91 files changed, 15649 insertions, 3641 deletions

diff --git a/src/lib/libc/net/Makefile.inc b/src/lib/libc/net/Makefile.inc
index 2d220067e4..530bc3f3f0 100644
--- a/src/lib/libc/net/Makefile.inc
+++ b/src/lib/libc/net/Makefile.inc
@@ -1,46 +1,101 @@
-#       $NetBSD: Makefile.inc,v 1.23 1995/03/02 09:09:07 chopps Exp $
-#       @(#)Makefile.inc        8.2 (Berkeley) 9/5/93
+#       $OpenBSD: Makefile.inc,v 1.48 2010/07/01 19:15:30 deraadt Exp $
 
 # net sources
-.PATH: ${.CURDIR}/arch/${MACHINE_ARCH}/net ${.CURDIR}/net
+.PATH: ${LIBCSRCDIR}/arch/${MACHINE_CPU}/net ${LIBCSRCDIR}/net
 
-SRCS+=  gethostnamadr.c getnetbyaddr.c getnetbyname.c getnetent.c \
-        getproto.c getprotoent.c getprotoname.c getservbyname.c \
-        getservbyport.c getservent.c herror.c inet_addr.c inet_lnaof.c \
-        inet_makeaddr.c inet_netof.c inet_network.c inet_ntoa.c \
-        iso_addr.c linkaddr.c ns_addr.c ns_ntoa.c rcmd.c recv.c res_comp.c \
-        res_debug.c res_init.c res_mkquery.c res_query.c res_send.c \
-        send.c sethostent.c ethers.c
+CFLAGS+=-DRESOLVSORT
+
+SRCS+=  base64.c freeaddrinfo.c gai_strerror.c getaddrinfo.c gethostnamadr.c \
+        getifaddrs.c getnameinfo.c getnetbyaddr.c getnetbyname.c getnetent.c \
+        getnetnamadr.c getpeereid.c getproto.c getprotoent.c getprotoname.c \
+        getservbyname.c getservbyport.c getservent.c getrrsetbyname.c \
+        herror.c if_indextoname.c if_nameindex.c if_nametoindex.c inet_addr.c \
+        inet_lnaof.c inet_makeaddr.c inet_neta.c inet_netof.c inet_network.c \
+        inet_net_ntop.c inet_net_pton.c inet_ntoa.c inet_ntop.c inet_pton.c \
+        linkaddr.c net_addrcmp.c nsap_addr.c \
+        rcmd.c ruserok.c rresvport.c recv.c res_comp.c res_data.c res_debug.c \
+        res_debug_syms.c \
+        res_init.c res_mkquery.c res_query.c res_random.c res_send.c send.c \
+        sethostent.c ethers.c rcmdsh.c
+
+# IPv6
+SRCS+=  ip6opt.c rthdr.c vars6.c
 
 # machine-dependent net sources
 # m-d Makefile.inc must include sources for:
 #       htonl() htons() ntohl() ntohs()
 
-.include "${.CURDIR}/arch/${MACHINE_ARCH}/net/Makefile.inc"
+.include "${LIBCSRCDIR}/arch/${MACHINE_CPU}/net/Makefile.inc"
 
-MAN+=   byteorder.3 gethostbyname.3 getnetent.3 getprotoent.3 getservent.3 \
-        inet.3 linkaddr.3 ns.3 rcmd.3 resolver.3 ethers.3
+MAN+=   byteorder.3 ethers.3 gai_strerror.3 getaddrinfo.3 gethostbyname.3 \
+        getifaddrs.3 getnameinfo.3 getnetent.3 getpeereid.3 getprotoent.3 \
+        getrrsetbyname.3 getservent.3 if_indextoname.3 inet.3 \
+        inet_net.3 inet6_option_space.3 inet6_rthdr_space.3 \
+        inet6_opt_init.3 inet6_rth_space.3 \
+        link_addr.3 net_addrcmp.3 \
+        rcmd.3 rcmdsh.3 resolver.3
 
 MLINKS+=byteorder.3 htonl.3 byteorder.3 htons.3 byteorder.3 ntohl.3 \
-        byteorder.3 ntohs.3
+        byteorder.3 ntohs.3 byteorder.3 htobe16.3 byteorder.3 htobe32.3 \
+        byteorder.3 htobe64.3 byteorder.3 betoh16.3 byteorder.3 betoh32.3 \
+        byteorder.3 betoh64.3 byteorder.3 htole16.3 byteorder.3 htole32.3 \
+        byteorder.3 htole64.3 byteorder.3 letoh16.3 byteorder.3 letoh32.3 \
+        byteorder.3 letoh64.3 byteorder.3 swap16.3 byteorder.3 swap32.3 \
+        byteorder.3 swap64.3
 MLINKS+=ethers.3 ether_aton.3 ethers.3 ether_hostton.3 ethers.3 ether_line.3 \
         ethers.3 ether_ntoa.3 ethers.3 ether_ntohost.3
+MLINKS+=getaddrinfo.3 freeaddrinfo.3
 MLINKS+=gethostbyname.3 endhostent.3 gethostbyname.3 gethostbyaddr.3 \
         gethostbyname.3 sethostent.3 gethostbyname.3 gethostent.3 \
-        gethostbyname.3 herror.3
+        gethostbyname.3 herror.3 gethostbyname.3 gethostbyname2.3 \
+        gethostbyname.3 hstrerror.3
+MLINKS+=getifaddrs.3 freeifaddrs.3
 MLINKS+=getnetent.3 endnetent.3 getnetent.3 getnetbyaddr.3 \
         getnetent.3 getnetbyname.3 getnetent.3 setnetent.3
 MLINKS+=getprotoent.3 endprotoent.3 getprotoent.3 getprotobyname.3 \
-        getprotoent.3 getprotobynumber.3 getprotoent.3 setprotoent.3
+        getprotoent.3 getprotobynumber.3 getprotoent.3 setprotoent.3 \
+        getprotoent.3 getprotoent_r.3 getprotoent.3 getprotobyname_r.3 \
+        getprotoent.3 getprotobynumber_r.3 getprotoent.3 setprotoent_r.3 \
+        getprotoent.3 endprotoent_r.3
 MLINKS+=getservent.3 endservent.3 getservent.3 getservbyname.3 \
-        getservent.3 getservbyport.3 getservent.3 setservent.3
+        getservent.3 getservbyport.3 getservent.3 setservent.3 \
+        getservent.3 getservent_r.3 getservent.3 getservbyname_r.3 \
+        getservent.3 getservbyport_r.3 getservent.3 setservent_r.3 \
+        getservent.3 endservent_r.3
+MLINKS+= if_indextoname.3 if_nametoindex.3 if_indextoname.3 if_nameindex.3 \
+        if_indextoname.3 if_freenameindex.3
 MLINKS+=inet.3 addr.3 inet.3 inet_addr.3 inet.3 inet_aton.3 \
         inet.3 inet_lnaof.3 inet.3 inet_makeaddr.3 inet.3 inet_netof.3 \
         inet.3 inet_network.3 inet.3 inet_ntoa.3 inet.3 network.3 \
-        inet.3 ntoa.3
-MLINKS+=linkaddr.3 linkntoa.3
-MLINKS+=ns.3 ns_addr.3 ns.3 ns_ntoa.3
-MLINKS+=rcmd.3 iruserok.3 rcmd.3 rresvport.3 rcmd.3 ruserok.3
+        inet.3 ntoa.3 inet.3 inet_ntop.3 inet.3 inet_pton.3
+MLINKS+=inet_net.3 inet_net_ntop.3 inet_net.3 inet_net_pton.3
+MLINKS+=link_addr.3 link_ntoa.3
+MLINKS+=rcmd.3 iruserok.3 rcmd.3 rresvport.3 rcmd.3 ruserok.3 \
+        rcmd.3 rresvport_af.3 rcmd.3 rcmd_af.3 rcmd.3 iruserok_sa.3
 MLINKS+=resolver.3 dn_comp.3 resolver.3 dn_expand.3 resolver.3 res_init.3 \
         resolver.3 res_mkquery.3 resolver.3 res_send.3 resolver.3 res_query.3 \
         resolver.3 res_search.3
+MLINKS+=getrrsetbyname.3 freerrset.3
+MLINKS+=inet6_option_space.3 inet6_option_init.3 \
+        inet6_option_space.3 inet6_option_append.3 \
+        inet6_option_space.3 inet6_option_alloc.3 \
+        inet6_option_space.3 inet6_option_next.3 \
+        inet6_option_space.3 inet6_option_find.3
+MLINKS+=inet6_rthdr_space.3 inet6_rthdr_init.3 \
+        inet6_rthdr_space.3 inet6_rthdr_add.3 \
+        inet6_rthdr_space.3 inet6_rthdr_lasthop.3 \
+        inet6_rthdr_space.3 inet6_rthdr_reverse.3 \
+        inet6_rthdr_space.3 inet6_rthdr_segments.3 \
+        inet6_rthdr_space.3 inet6_rthdr_getaddr.3 \
+        inet6_rthdr_space.3 inet6_rthdr_getflags.3
+MLINKS+=inet6_opt_init.3 inet6_opt_append.3 \
+        inet6_opt_init.3 inet6_opt_finish.3 \
+        inet6_opt_init.3 inet6_opt_set_val.3 \
+        inet6_opt_init.3 inet6_opt_next.3 \
+        inet6_opt_init.3 inet6_opt_find.3 \
+        inet6_opt_init.3 inet6_opt_get_val.3
+MLINKS+=inet6_rth_space.3 inet6_rth_init.3 \
+        inet6_rth_space.3 inet6_rth_add.3 \
+        inet6_rth_space.3 inet6_rth_reverse.3 \
+        inet6_rth_space.3 inet6_rth_segments.3 \
+        inet6_rth_space.3 inet6_rth_getaddr.3 \
diff --git a/src/lib/libc/net/base64.c b/src/lib/libc/net/base64.c
new file mode 100644
index 0000000000..d432c48d5c
--- /dev/null
+++ b/src/lib/libc/net/base64.c
@@ -0,0 +1,308 @@
+/*      $OpenBSD: base64.c,v 1.5 2006/10/21 09:55:03 otto Exp $ */
+
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+/*
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <resolv.h>
+#include <stdio.h>
+
+#include <stdlib.h>
+#include <string.h>
+
+static const char Base64[] =
+        "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";
+static const char Pad64 = '=';
+
+/* (From RFC1521 and draft-ietf-dnssec-secext-03.txt)
+   The following encoding technique is taken from RFC 1521 by Borenstein
+   and Freed.  It is reproduced here in a slightly edited form for
+   convenience.
+
+   A 65-character subset of US-ASCII is used, enabling 6 bits to be
+   represented per printable character. (The extra 65th character, "=",
+   is used to signify a special processing function.)
+
+   The encoding process represents 24-bit groups of input bits as output
+   strings of 4 encoded characters. Proceeding from left to right, a
+   24-bit input group is formed by concatenating 3 8-bit input groups.
+   These 24 bits are then treated as 4 concatenated 6-bit groups, each
+   of which is translated into a single digit in the base64 alphabet.
+
+   Each 6-bit group is used as an index into an array of 64 printable
+   characters. The character referenced by the index is placed in the
+   output string.
+
+                         Table 1: The Base64 Alphabet
+
+      Value Encoding  Value Encoding  Value Encoding  Value Encoding
+          0 A            17 R            34 i            51 z
+          1 B            18 S            35 j            52 0
+          2 C            19 T            36 k            53 1
+          3 D            20 U            37 l            54 2
+          4 E            21 V            38 m            55 3
+          5 F            22 W            39 n            56 4
+          6 G            23 X            40 o            57 5
+          7 H            24 Y            41 p            58 6
+          8 I            25 Z            42 q            59 7
+          9 J            26 a            43 r            60 8
+         10 K            27 b            44 s            61 9
+         11 L            28 c            45 t            62 +
+         12 M            29 d            46 u            63 /
+         13 N            30 e            47 v
+         14 O            31 f            48 w         (pad) =
+         15 P            32 g            49 x
+         16 Q            33 h            50 y
+
+   Special processing is performed if fewer than 24 bits are available
+   at the end of the data being encoded.  A full encoding quantum is
+   always completed at the end of a quantity.  When fewer than 24 input
+   bits are available in an input group, zero bits are added (on the
+   right) to form an integral number of 6-bit groups.  Padding at the
+   end of the data is performed using the '=' character.
+
+   Since all base64 input is an integral number of octets, only the
+         -------------------------------------------------                       
+   following cases can arise:
+   
+       (1) the final quantum of encoding input is an integral
+           multiple of 24 bits; here, the final unit of encoded
+           output will be an integral multiple of 4 characters
+           with no "=" padding,
+       (2) the final quantum of encoding input is exactly 8 bits;
+           here, the final unit of encoded output will be two
+           characters followed by two "=" padding characters, or
+       (3) the final quantum of encoding input is exactly 16 bits;
+           here, the final unit of encoded output will be three
+           characters followed by one "=" padding character.
+   */
+
+int
+b64_ntop(src, srclength, target, targsize)
+        u_char const *src;
+        size_t srclength;
+        char *target;
+        size_t targsize;
+{
+        size_t datalength = 0;
+        u_char input[3];
+        u_char output[4];
+        int i;
+
+        while (2 < srclength) {
+                input[0] = *src++;
+                input[1] = *src++;
+                input[2] = *src++;
+                srclength -= 3;
+
+                output[0] = input[0] >> 2;
+                output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
+                output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
+                output[3] = input[2] & 0x3f;
+
+                if (datalength + 4 > targsize)
+                        return (-1);
+                target[datalength++] = Base64[output[0]];
+                target[datalength++] = Base64[output[1]];
+                target[datalength++] = Base64[output[2]];
+                target[datalength++] = Base64[output[3]];
+        }
+    
+        /* Now we worry about padding. */
+        if (0 != srclength) {
+                /* Get what's left. */
+                input[0] = input[1] = input[2] = '\0';
+                for (i = 0; i < srclength; i++)
+                        input[i] = *src++;
+        
+                output[0] = input[0] >> 2;
+                output[1] = ((input[0] & 0x03) << 4) + (input[1] >> 4);
+                output[2] = ((input[1] & 0x0f) << 2) + (input[2] >> 6);
+
+                if (datalength + 4 > targsize)
+                        return (-1);
+                target[datalength++] = Base64[output[0]];
+                target[datalength++] = Base64[output[1]];
+                if (srclength == 1)
+                        target[datalength++] = Pad64;
+                else
+                        target[datalength++] = Base64[output[2]];
+                target[datalength++] = Pad64;
+        }
+        if (datalength >= targsize)
+                return (-1);
+        target[datalength] = '\0';      /* Returned value doesn't count \0. */
+        return (datalength);
+}
+
+/* skips all whitespace anywhere.
+   converts characters, four at a time, starting at (or after)
+   src from base - 64 numbers into three 8 bit bytes in the target area.
+   it returns the number of data bytes stored at the target, or -1 on error.
+ */
+
+int
+b64_pton(src, target, targsize)
+        char const *src;
+        u_char *target;
+        size_t targsize;
+{
+        int tarindex, state, ch;
+        char *pos;
+
+        state = 0;
+        tarindex = 0;
+
+        while ((ch = *src++) != '\0') {
+                if (isspace(ch))        /* Skip whitespace anywhere. */
+                        continue;
+
+                if (ch == Pad64)
+                        break;
+
+                pos = strchr(Base64, ch);
+                if (pos == 0)           /* A non-base64 character. */
+                        return (-1);
+
+                switch (state) {
+                case 0:
+                        if (target) {
+                                if (tarindex >= targsize)
+                                        return (-1);
+                                target[tarindex] = (pos - Base64) << 2;
+                        }
+                        state = 1;
+                        break;
+                case 1:
+                        if (target) {
+                                if (tarindex + 1 >= targsize)
+                                        return (-1);
+                                target[tarindex]   |=  (pos - Base64) >> 4;
+                                target[tarindex+1]  = ((pos - Base64) & 0x0f)
+                                                        << 4 ;
+                        }
+                        tarindex++;
+                        state = 2;
+                        break;
+                case 2:
+                        if (target) {
+                                if (tarindex + 1 >= targsize)
+                                        return (-1);
+                                target[tarindex]   |=  (pos - Base64) >> 2;
+                                target[tarindex+1]  = ((pos - Base64) & 0x03)
+                                                        << 6;
+                        }
+                        tarindex++;
+                        state = 3;
+                        break;
+                case 3:
+                        if (target) {
+                                if (tarindex >= targsize)
+                                        return (-1);
+                                target[tarindex] |= (pos - Base64);
+                        }
+                        tarindex++;
+                        state = 0;
+                        break;
+                }
+        }
+
+        /*
+         * We are done decoding Base-64 chars.  Let's see if we ended
+         * on a byte boundary, and/or with erroneous trailing characters.
+         */
+
+        if (ch == Pad64) {              /* We got a pad char. */
+                ch = *src++;            /* Skip it, get next. */
+                switch (state) {
+                case 0:         /* Invalid = in first position */
+                case 1:         /* Invalid = in second position */
+                        return (-1);
+
+                case 2:         /* Valid, means one byte of info */
+                        /* Skip any number of spaces. */
+                        for (; ch != '\0'; ch = *src++)
+                                if (!isspace(ch))
+                                        break;
+                        /* Make sure there is another trailing = sign. */
+                        if (ch != Pad64)
+                                return (-1);
+                        ch = *src++;            /* Skip the = */
+                        /* Fall through to "single trailing =" case. */
+                        /* FALLTHROUGH */
+
+                case 3:         /* Valid, means two bytes of info */
+                        /*
+                         * We know this char is an =.  Is there anything but
+                         * whitespace after it?
+                         */
+                        for (; ch != '\0'; ch = *src++)
+                                if (!isspace(ch))
+                                        return (-1);
+
+                        /*
+                         * Now make sure for cases 2 and 3 that the "extra"
+                         * bits that slopped past the last full byte were
+                         * zeros.  If we don't check them, they become a
+                         * subliminal channel.
+                         */
+                        if (target && target[tarindex] != 0)
+                                return (-1);
+                }
+        } else {
+                /*
+                 * We ended by seeing the end of the string.  Make sure we
+                 * have no partial bytes lying around.
+                 */
+                if (state != 0)
+                        return (-1);
+        }
+
+        return (tarindex);
+}
diff --git a/src/lib/libc/net/byteorder.3 b/src/lib/libc/net/byteorder.3
index 701a69f688..6625ea1442 100644
--- a/src/lib/libc/net/byteorder.3
+++ b/src/lib/libc/net/byteorder.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: byteorder.3,v 1.3 1995/02/25 06:20:27 cgd Exp $
+.\"     $OpenBSD: byteorder.3,v 1.16 2009/03/17 21:33:04 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,48 +27,180 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)byteorder.3 8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
+.Dd $Mdocdate: March 17 2009 $
 .Dt BYTEORDER 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm htonl ,
 .Nm htons ,
 .Nm ntohl ,
-.Nm ntohs
-.Nd convert values between host and network byte order
+.Nm ntohs ,
+.Nm htobe64 ,
+.Nm htobe32 ,
+.Nm htobe16 ,
+.Nm betoh64 ,
+.Nm betoh32 ,
+.Nm betoh16 ,
+.Nm htole64 ,
+.Nm htole32 ,
+.Nm htole16 ,
+.Nm letoh64 ,
+.Nm letoh32 ,
+.Nm letoh16 ,
+.Nm swap64 ,
+.Nm swap32 ,
+.Nm swap16
+.Nd convert values between different byte orderings
 .Sh SYNOPSIS
-.Fd #include <sys/param.h>
-.Ft u_long
-.Fn htonl "u_long hostlong"
-.Ft u_short
-.Fn htons "u_short hostshort"
-.Ft u_long
-.Fn ntohl "u_long netlong"
-.Ft u_short
-.Fn ntohs "u_short netshort"
+.Fd #include <sys/types.h>
+.Ft u_int32_t
+.Fn htonl "u_int32_t host32"
+.Ft u_int16_t
+.Fn htons "u_int16_t host16"
+.Ft u_int32_t
+.Fn ntohl "u_int32_t net32"
+.Ft u_int16_t
+.Fn ntohs "u_int16_t net16"
+.Ft u_int64_t
+.Fn htobe64 "u_int64_t host64"
+.Ft u_int32_t
+.Fn htobe32 "u_int32_t host32"
+.Ft u_int16_t
+.Fn htobe16 "u_int16_t host16"
+.Ft u_int64_t
+.Fn betoh64 "u_int64_t big64"
+.Ft u_int32_t
+.Fn betoh32 "u_int32_t big32"
+.Ft u_int16_t
+.Fn betoh16 "u_int16_t big16"
+.Ft u_int64_t
+.Fn htole64 "u_int64_t host64"
+.Ft u_int32_t
+.Fn htole32 "u_int32_t host32"
+.Ft u_int16_t
+.Fn htole16 "u_int16_t host16"
+.Ft u_int64_t
+.Fn letoh64 "u_int64_t little64"
+.Ft u_int32_t
+.Fn letoh32 "u_int32_t little32"
+.Ft u_int16_t
+.Fn letoh16 "u_int16_t little16"
+.Ft u_int64_t
+.Fn swap64 "u_int64_t val64"
+.Ft u_int32_t
+.Fn swap32 "u_int32_t val32"
+.Ft u_int16_t
+.Fn swap16 "u_int16_t val16"
 .Sh DESCRIPTION
-These routines convert 16 and 32 bit quantities between network
+These routines convert 16, 32 and 64-bit quantities between different
+byte orderings.
+The
+.Dq swap
+functions reverse the byte ordering of
+the given quantity; the others convert either from/to the native
+byte order used by the host to/from either little- or big-endian (a.k.a
+network) order.
+.Pp
+Apart from the swap functions, the names can be described by this form:
+{src-order}to{dst-order}{size}.
+Both {src-order} and {dst-order} can take the following forms:
+.Pp
+.Bl -tag -width "be " -offset indent -compact
+.It h
+Host order.
+.It n
+Network order (big-endian).
+.It be
+Big-endian (most significant byte first).
+.It le
+Little-endian (least significant byte first).
+.El
+.Pp
+One of the specified orderings must be
+.Sq h .
+{size} will take these forms:
+.Pp
+.Bl -tag -width "32 " -offset indent -compact
+.It l
+Long (32-bit, used in conjunction with forms involving
+.Sq n ) .
+.It s
+Short (16-bit, used in conjunction with forms involving
+.Sq n ) .
+.It 16
+16-bit.
+.It 32
+32-bit.
+.It 64
+64-bit.
+.El
+.Pp
+The swap functions are of the form: swap{size}.
+.Pp
+Names involving
+.Sq n
+convert quantities between network
 byte order and host byte order.
+The last letter
+.Pf ( Sq s
+or
+.Sq l )
+is a mnemonic
+for the traditional names for such quantities,
+.Li short
+and
+.Li long ,
+respectively.
+Today, the C concept of
+.Li short
+and
+.Li long
+integers need not coincide with this traditional misunderstanding.
 On machines which have a byte order which is the same as the network
 order, routines are defined as null macros.
 .Pp
-These routines are most often used in conjunction with Internet
-addresses and ports as returned by
+The functions involving either
+.Dq be ,
+.Dq le ,
+or
+.Dq swap
+use the numbers
+16, 32, or 64 for specifying the bitwidth of the quantities they operate on.
+Currently all supported architectures are either big- or little-endian
+so either the
+.Dq be
+or
+.Dq le
+variants are implemented as null macros.
+.Pp
+The routines mentioned above which have either {src-order} or {dst-order}
+set to
+.Sq n
+are most often used in
+conjunction with Internet addresses and ports as returned by
 .Xr gethostbyname 3
 and
 .Xr getservent 3 .
 .Sh SEE ALSO
 .Xr gethostbyname 3 ,
 .Xr getservent 3
+.Sh STANDARDS
+The
+.Fn htonl ,
+.Fn htons ,
+.Fn ntohl ,
+and
+.Fn ntohs
+functions conform to
+.St -p1003.1 .
+The other functions are extensions that should not be used when portability
+is required.
 .Sh HISTORY
 The
 .Nm byteorder
-functions appeared in 
+functions appeared in
 .Bx 4.2 .
 .Sh BUGS
-On the
-.Tn VAX
-bytes are handled backwards from most everyone else in
-the world.  This is not expected to be fixed in the near future.
+On the vax, alpha, i386, and some mips architectures,
+bytes are handled backwards from most everyone else in the world.
+This is not expected to be fixed in the near future.
diff --git a/src/lib/libc/net/ethers.3 b/src/lib/libc/net/ethers.3
index 81e6c65935..041ee981ec 100644
--- a/src/lib/libc/net/ethers.3
+++ b/src/lib/libc/net/ethers.3
@@ -1,65 +1,87 @@
+.\"     $OpenBSD: ethers.3,v 1.21 2011/04/19 22:38:26 matthew Exp $
 .\"
 .\" Written by roland@frob.com.  Public domain.
 .\"
-.Dd December 16, 1993
+.Dd $Mdocdate: April 19 2011 $
 .Dt ETHERS 3
-.Os NetBSD
+.Os
 .Sh NAME
+.Nm ether_aton ,
 .Nm ether_ntoa ,
-.Nm ether_addr ,
 .Nm ether_ntohost ,
 .Nm ether_hostton ,
-.Nm ether_line ,
+.Nm ether_line
 .Nd get ethers entry
 .Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <net/if.h>
+.Fd #include <netinet/in.h>
 .Fd #include <netinet/if_ether.h>
 .Ft char *
 .Fn ether_ntoa "struct ether_addr *e"
 .Ft struct ether_addr *
-.Fn ether_aton "char *s"
+.Fn ether_aton "const char *s"
+.Ft int
 .Fn ether_ntohost "char *hostname" "struct ether_addr *e"
-.Fn ether_hostton "char *hostname" "struct ether_addr *e"
-.Fn ether_line "char *l" "struct ether_addr *e" "char *hostname"
+.Ft int
+.Fn ether_hostton "const char *hostname" "struct ether_addr *e"
+.Ft int
+.Fn ether_line "const char *l" "struct ether_addr *e" "char *hostname"
 .Sh DESCRIPTION
-Ethernet addresses are represented by the 
+Ethernet addresses are represented by the
 following structure:
 .Bd -literal -offset indent
 struct ether_addr {
-        u_char  ether_addr_octet[6];
+        u_int8_t  ether_addr_octet[6];
 };
 .Ed
 .Pp
 The
 .Fn ether_ntoa
-function converts this structure into an ASCII string of the form
-``xx:xx:xx:xx:xx:xx'', consisting of 6 hexadecimal numbers separated
-by colons.  It returns a pointer to a static buffer that is reused for
-each call.
+function converts this structure into an
+.Tn ASCII
+string of the form
+.Dq xx:xx:xx:xx:xx:xx ,
+consisting of 6 hexadecimal numbers separated
+by colons.
+It returns a pointer to a static buffer that is reused for each call.
 The
 .Fn ether_aton
-converts an ASCII string of the same form and to a structure
-containing the 6 octets of the address.  It returns a pointer to a
-static structure that is reused for each call.
+converts an
+.Tn ASCII
+string of the same form and to a structure
+containing the 6 octets of the address.
+It returns a pointer to a static structure that is reused for each call.
+.Fn ether_aton
+will return NULL if the string does not represent a valid address.
 .Pp
 The
 .Fn ether_ntohost
 and
 .Fn ether_hostton
-functions interrogate the data base mapping host names to Ethernet
+functions interrogate the database mapping host names to Ethernet
 addresses,
 .Pa /etc/ethers .
 The
 .Fn ether_ntohost
 function looks up the given Ethernet address and writes the associated
 host name into the character buffer passed.
+This buffer should be
+.Dv MAXHOSTNAMELEN
+characters in size.
 The
 .Fn ether_hostton
 function looks up the given host name and writes the associated
-Ethernet address into the structure passed.  Both functions return
-zero if they find the requested host name or address, and -1 if not.
+Ethernet address into the structure passed.
+Both functions return
+zero if they find the requested host name or address, and \-1 if not.
+.Pp
 Each call reads
-.Pa /etc/ethers 
-from the beginning; if a + appears alone on a line in the file, then
+.Pa /etc/ethers
+from the beginning; if a
+.Ql +
+appears alone on a line in the file, then
 .Fn ether_hostton
 will consult the
 .Pa ethers.byname
@@ -73,9 +95,13 @@ The
 .Fn ether_line
 function parses a line from the
 .Pa /etc/ethers
-file and fills in the passed ``struct ether_addr'' and character
-buffer with the Ethernet address and host name on the line.  It
-returns zero if the line was successfully parsed and -1 if not.
+file and fills in the passed
+.Li struct ether_addr
+and character buffer with the Ethernet address and host name on the line.
+It returns zero if the line was successfully parsed and \-1 if not.
+The character buffer should be
+.Dv MAXHOSTNAMELEN
+characters in size.
 .Sh FILES
 .Bl -tag -width /etc/ethers -compact
 .It Pa /etc/ethers
@@ -91,12 +117,8 @@ The
 and
 .Fn ether_line
 functions were adopted from SunOS and appeared in
-NetBSD 0.9b.
+.Nx 0.9b .
 .Sh BUGS
 The data space used by these functions is static; if future use
 requires the data, it should be copied before any subsequent calls to
-these functions overwrite it.  There is no way to restrict how many
-character will be written into the host name buffer passed.  A very
-long line in
-.Pa /etc/ethers
-could overflow your buffer.
+these functions overwrite it.
diff --git a/src/lib/libc/net/ethers.c b/src/lib/libc/net/ethers.c
index 0f32b9b71b..d4243ff1da 100644
--- a/src/lib/libc/net/ethers.c
+++ b/src/lib/libc/net/ethers.c
@@ -1,10 +1,25 @@
-/*      $NetBSD: ethers.c,v 1.5 1995/02/25 06:20:28 cgd Exp $   */
+/*      $OpenBSD: ethers.c,v 1.20 2005/08/06 20:30:03 espie Exp $       */
 
-/* 
- * ethers(3N) a la Sun.
+/*
+ * Copyright (c) 1998 Todd C. Miller <Todd.Miller@courtesan.com>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
  *
- * Written by Roland McGrath <roland@frob.com> 10/14/93.
- * Public domain.
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+/* 
+ * ethers(3) a la Sun.
+ * Originally Written by Roland McGrath <roland@frob.com> 10/14/93.
+ * Substantially modified by Todd C. Miller <Todd.Miller@courtesan.com>
  */
 
 #include <sys/types.h>
@@ -18,57 +33,77 @@
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#include <ctype.h>
+#ifdef YP
+#include <rpcsvc/ypclnt.h>
+#endif
 
 #ifndef _PATH_ETHERS
-#define _PATH_ETHERS "/etc/ethers"
+#define _PATH_ETHERS    "/etc/ethers"
 #endif
 
+static char * _ether_aton(const char *, struct ether_addr *);
+
 char *
-ether_ntoa(e)
-        struct ether_addr *e;
+ether_ntoa(struct ether_addr *e)
 {
         static char a[] = "xx:xx:xx:xx:xx:xx";
 
-        sprintf(a, "%02x:%02x:%02x:%02x:%02x:%02x",
+        (void)snprintf(a, sizeof a, "%02x:%02x:%02x:%02x:%02x:%02x",
             e->ether_addr_octet[0], e->ether_addr_octet[1],
             e->ether_addr_octet[2], e->ether_addr_octet[3],
             e->ether_addr_octet[4], e->ether_addr_octet[5]);
-        return a;
+
+        return (a);
+}
+
+static char *
+_ether_aton(const char *s, struct ether_addr *e)
+{
+        int i;
+        long l;
+        char *pp;
+
+        while (isspace(*s))
+                s++;
+
+        /* expect 6 hex octets separated by ':' or space/NUL if last octet */
+        for (i = 0; i < 6; i++) {
+                l = strtol(s, &pp, 16);
+                if (pp == s || l > 0xFF || l < 0)
+                        return (NULL);
+                if (!(*pp == ':' || (i == 5 && (isspace(*pp) || *pp == '\0'))))
+                        return (NULL);
+                e->ether_addr_octet[i] = (u_char)l;
+                s = pp + 1;
+        }
+
+        /* return character after the octets ala strtol(3) */
+        return (pp);
 }
 
 struct ether_addr *
-ether_aton(s)
-        char *s;
+ether_aton(const char *s)
 {
         static struct ether_addr n;
-        u_int i[6];
-
-        if (sscanf(s, " %x:%x:%x:%x:%x:%x ", &i[0], &i[1],
-            &i[2], &i[3], &i[4], &i[5]) == 6) {
-                n.ether_addr_octet[0] = (u_char)i[0];
-                n.ether_addr_octet[1] = (u_char)i[1];
-                n.ether_addr_octet[2] = (u_char)i[2];
-                n.ether_addr_octet[3] = (u_char)i[3];
-                n.ether_addr_octet[4] = (u_char)i[4];
-                n.ether_addr_octet[5] = (u_char)i[5];
-                return &n;
-        }
-        return NULL;
+
+        return (_ether_aton(s, &n) ? &n : NULL);
 }
 
-ether_ntohost(hostname, e)
-        char *hostname;
-        struct ether_addr *e;
+int
+ether_ntohost(char *hostname, struct ether_addr *e)
 {
         FILE *f; 
-        char buf[BUFSIZ];
+        char buf[BUFSIZ+1], *p;
+        size_t len;
         struct ether_addr try;
-
 #ifdef YP
-        char trybuf[sizeof "xx:xx:xx:xx:xx:xx"];
+        char trybuf[sizeof("xx:xx:xx:xx:xx:xx")];
         int trylen;
+#endif
 
-        sprintf(trybuf, "%x:%x:%x:%x:%x:%x", 
+#ifdef YP
+        snprintf(trybuf, sizeof trybuf, "%x:%x:%x:%x:%x:%x", 
             e->ether_addr_octet[0], e->ether_addr_octet[1],
             e->ether_addr_octet[2], e->ether_addr_octet[3],
             e->ether_addr_octet[4], e->ether_addr_octet[5]);
@@ -76,12 +111,19 @@ ether_ntohost(hostname, e)
 #endif
 
         f = fopen(_PATH_ETHERS, "r");
-        if (f==NULL)
-                return -1;
-        while (fgets(buf, sizeof buf, f)) {
+        if (f == NULL)
+                return (-1);
+        while ((p = fgetln(f, &len)) != NULL) {
+                if (p[len-1] == '\n')
+                        len--;
+                if (len > sizeof(buf) - 2)
+                        continue;
+                (void)memcpy(buf, p, len);
+                buf[len] = '\n';        /* code assumes newlines later on */
+                buf[len+1] = '\0';
 #ifdef YP
                 /* A + in the file means try YP now.  */
-                if (!strncmp(buf, "+\n", sizeof buf)) {
+                if (!strncmp(buf, "+\n", sizeof(buf))) {
                         char *ypbuf, *ypdom;
                         int ypbuflen;
 
@@ -93,42 +135,49 @@ ether_ntohost(hostname, e)
                         if (ether_line(ypbuf, &try, hostname) == 0) {
                                 free(ypbuf);
                                 (void)fclose(f);
-                                return 0;
+                                return (0);
                         }
                         free(ypbuf);
                         continue;
                 }
 #endif
                 if (ether_line(buf, &try, hostname) == 0 &&
-                    bcmp((char *)&try, (char *)e, sizeof try) == 0) {
+                    memcmp((void *)&try, (void *)e, sizeof(try)) == 0) {
                         (void)fclose(f);
-                        return 0;
+                        return (0);
                 }     
         }
         (void)fclose(f);
         errno = ENOENT;
-        return -1;
+        return (-1);
 }
 
-ether_hostton(hostname, e)
-        char *hostname;
-        struct ether_addr *e;
+int
+ether_hostton(const char *hostname, struct ether_addr *e)
 {
         FILE *f;
-        char buf[BUFSIZ];
+        char buf[BUFSIZ+1], *p;
         char try[MAXHOSTNAMELEN];
+        size_t len;
 #ifdef YP
         int hostlen = strlen(hostname);
 #endif
 
         f = fopen(_PATH_ETHERS, "r");
         if (f==NULL)
-                return -1;
+                return (-1);
 
-        while (fgets(buf, sizeof buf, f)) {
+        while ((p = fgetln(f, &len)) != NULL) {
+                if (p[len-1] == '\n')
+                        len--;
+                if (len > sizeof(buf) - 2)
+                        continue;
+                memcpy(buf, p, len);
+                buf[len] = '\n';        /* code assumes newlines later on */
+                buf[len+1] = '\0';
 #ifdef YP
                 /* A + in the file means try YP now.  */
-                if (!strncmp(buf, "+\n", sizeof buf)) {
+                if (!strncmp(buf, "+\n", sizeof(buf))) {
                         char *ypbuf, *ypdom;
                         int ypbuflen;
 
@@ -140,7 +189,7 @@ ether_hostton(hostname, e)
                         if (ether_line(ypbuf, e, try) == 0) {
                                 free(ypbuf);
                                 (void)fclose(f);
-                                return 0;
+                                return (0);
                         }
                         free(ypbuf);
                         continue;
@@ -148,31 +197,36 @@ ether_hostton(hostname, e)
 #endif
                 if (ether_line(buf, e, try) == 0 && strcmp(hostname, try) == 0) {
                         (void)fclose(f);
-                        return 0;
+                        return (0);
                 }
         }
         (void)fclose(f);
         errno = ENOENT;
-        return -1;
+        return (-1);
 }
 
-ether_line(l, e, hostname)
-        char *l;
-        struct ether_addr *e;
-        char *hostname;
+int
+ether_line(const char *line, struct ether_addr *e, char *hostname)
 {
-        u_int i[6];
-
-        if (sscanf(l, " %x:%x:%x:%x:%x:%x %s\n", &i[0], &i[1],
-            &i[2], &i[3], &i[4], &i[5], hostname) == 7) {
-                e->ether_addr_octet[0] = (u_char)i[0];
-                e->ether_addr_octet[1] = (u_char)i[1];
-                e->ether_addr_octet[2] = (u_char)i[2];
-                e->ether_addr_octet[3] = (u_char)i[3];
-                e->ether_addr_octet[4] = (u_char)i[4];
-                e->ether_addr_octet[5] = (u_char)i[5];
-                return 0;
-        }
+        char *p;
+        size_t n;
+
+        /* Parse "xx:xx:xx:xx:xx:xx" */
+        if ((p = _ether_aton(line, e)) == NULL || (*p != ' ' && *p != '\t'))
+                goto bad;
+
+        /* Now get the hostname */
+        while (isspace(*p))
+                p++;
+        if (*p == '\0')
+                goto bad;
+        n = strcspn(p, " \t\n");
+        if (n >= MAXHOSTNAMELEN)
+                goto bad;
+        strlcpy(hostname, p, n + 1);
+        return (0);
+
+bad:
         errno = EINVAL;
-        return -1;
+        return (-1);
 }
diff --git a/src/lib/libc/net/freeaddrinfo.c b/src/lib/libc/net/freeaddrinfo.c
new file mode 100644
index 0000000000..58702d0b18
--- /dev/null
+++ b/src/lib/libc/net/freeaddrinfo.c
@@ -0,0 +1,50 @@
+/*      $OpenBSD: freeaddrinfo.c,v 1.6 2005/03/25 13:24:11 otto Exp $   */
+
+/*
+ * Copyright (c) 1996, 1997, 1998, 1999, Craig Metz, All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by Craig Metz and
+ *      by other contributors.
+ * 4. Neither the name of the author nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <stdlib.h>
+#include <netdb.h>
+
+void
+freeaddrinfo(struct addrinfo *ai)
+{
+        struct addrinfo *p;
+
+        do {
+                p = ai;
+                ai = ai->ai_next;
+                if (p->ai_canonname)
+                        free(p->ai_canonname);
+                free((void *)p);
+        } while (ai);
+}
diff --git a/src/lib/libc/net/gai_strerror.3 b/src/lib/libc/net/gai_strerror.3
new file mode 100644
index 0000000000..6ce94e30a1
--- /dev/null
+++ b/src/lib/libc/net/gai_strerror.3
@@ -0,0 +1,95 @@
+.\"     $OpenBSD: gai_strerror.3,v 1.7 2009/06/02 16:47:50 jasper Exp $
+.\"     $KAME: gai_strerror.3,v 1.1 2005/01/05 03:04:47 itojun Exp $
+.\"
+.\" Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+.\" AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+.\" PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: June 2 2009 $
+.Dt GAI_STRERROR 3
+.Os
+.Sh NAME
+.Nm gai_strerror
+.Nd get error message string from EAI_xxx error code
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <netdb.h>
+.Ft "const char *"
+.Fn gai_strerror "int ecode"
+.Sh DESCRIPTION
+The
+.Fn gai_strerror
+function returns an error message string corresponding to the error code
+returned by
+.Xr getaddrinfo 3
+or
+.Xr getnameinfo 3 .
+.Pp
+The following error codes and their meaning are defined in
+.Aq Pa netdb.h :
+.Pp
+.Bl -tag -width "EAI_ADDRFAMILYXX" -offset indent -compact
+.It Dv EAI_ADDRFAMILY
+address family for
+.Fa hostname
+not supported
+.It Dv EAI_AGAIN
+temporary failure in name resolution
+.It Dv EAI_BADFLAGS
+invalid value for
+.Fa ai_flags
+.It Dv EAI_BADHINTS
+invalid value for
+.Fa hints
+.It Dv EAI_FAIL
+non-recoverable failure in name resolution
+.It Dv EAI_FAMILY
+.Fa ai_family
+not supported.
+.It Dv EAI_MEMORY
+memory allocation failure
+.It Dv EAI_NODATA
+no address associated with
+.Fa hostname
+.It Dv EAI_NONAME
+.Fa hostname
+or
+.Fa servname
+not provided, or not known
+.It Dv EAI_OVERFLOW
+argument buffer overflow
+.It Dv EAI_PROTOCOL
+resolved protocol is unknown
+.It Dv EAI_SERVICE
+.Fa servname
+not supported for
+.Fa ai_socktype
+.It Dv EAI_SOCKTYPE
+.Fa ai_socktype
+not supported
+.It Dv EAI_SYSTEM
+system error returned in
+.Va errno
+.El
+.Sh RETURN VALUES
+.Fn gai_strerror
+returns a pointer to the error message string corresponding to
+.Fa ecode .
+If
+.Fa ecode
+is out of range, an implementation-specific error message string is returned.
+.Sh SEE ALSO
+.Xr getaddrinfo 3 ,
+.Xr getnameinfo 3
diff --git a/src/lib/libc/net/gai_strerror.c b/src/lib/libc/net/gai_strerror.c
new file mode 100644
index 0000000000..f4126413f8
--- /dev/null
+++ b/src/lib/libc/net/gai_strerror.c
@@ -0,0 +1,78 @@
+/*      $OpenBSD: gai_strerror.c,v 1.7 2009/06/02 16:47:50 jasper Exp $ */
+
+/*
+ * Copyright (c) 1997-1999, Craig Metz, All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. All advertising materials mentioning features or use of this software
+ *    must display the following acknowledgement:
+ *      This product includes software developed by Craig Metz and
+ *      by other contributors.
+ * 4. Neither the name of the author nor the names of contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/* gai_strerror() v1.38 */
+
+#include <sys/types.h>
+#include <netdb.h>
+#include <errno.h>
+
+const char *
+gai_strerror(int errnum)
+{
+        switch (errnum) {
+        case 0:
+                return "no error";
+        case EAI_BADFLAGS:
+                return "invalid value for ai_flags";
+        case EAI_NONAME:
+                return "name or service is not known";
+        case EAI_AGAIN:
+                return "temporary failure in name resolution";
+        case EAI_FAIL:
+                return "non-recoverable failure in name resolution";
+        case EAI_NODATA:
+                return "no address associated with name";
+        case EAI_FAMILY:
+                return "ai_family not supported";
+        case EAI_SOCKTYPE:
+                return "ai_socktype not supported";
+        case EAI_SERVICE:
+                return "service not supported for ai_socktype";
+        case EAI_ADDRFAMILY:
+                return "address family for name not supported";
+        case EAI_MEMORY:
+                return "memory allocation failure";
+        case EAI_SYSTEM:
+                return "system error";
+        case EAI_BADHINTS:
+                return "invalid value for hints";
+        case EAI_PROTOCOL:
+                return "resolved protocol is unknown";
+        case EAI_OVERFLOW:
+                return "argument buffer overflow";
+        default:
+                return "unknown/invalid error";
+        }
+}
diff --git a/src/lib/libc/net/getaddrinfo.3 b/src/lib/libc/net/getaddrinfo.3
new file mode 100644
index 0000000000..da6e64683f
--- /dev/null
+++ b/src/lib/libc/net/getaddrinfo.3
@@ -0,0 +1,470 @@
+.\"     $OpenBSD: getaddrinfo.3,v 1.48 2011/04/05 00:46:06 matthew Exp $
+.\"     $KAME: getaddrinfo.3,v 1.36 2005/01/05 03:23:05 itojun Exp $
+.\"
+.\" Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+.\" AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+.\" PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: April 5 2011 $
+.Dt GETADDRINFO 3
+.Os
+.Sh NAME
+.Nm getaddrinfo ,
+.Nm freeaddrinfo
+.Nd host and service name to socket address structure
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <netdb.h>
+.Ft int
+.Fn getaddrinfo "const char *hostname" "const char *servname" \
+    "const struct addrinfo *hints" "struct addrinfo **res"
+.Ft void
+.Fn freeaddrinfo "struct addrinfo *ai"
+.Sh DESCRIPTION
+The
+.Fn getaddrinfo
+function is used to get a list of
+.Tn IP
+addresses and port numbers for host
+.Fa hostname
+and service
+.Fa servname .
+It is a replacement for and provides more flexibility than the
+.Xr gethostbyname 3
+and
+.Xr getservbyname 3
+functions.
+.Pp
+The
+.Fa hostname
+and
+.Fa servname
+arguments are either pointers to NUL-terminated strings or the null pointer.
+An acceptable value for
+.Fa hostname
+is either a valid host name or a numeric host address string consisting
+of a dotted decimal IPv4 address or an IPv6 address.
+The
+.Fa servname
+is either a decimal port number or a service name listed in
+.Xr services 5 .
+At least one of
+.Fa hostname
+and
+.Fa servname
+must be non-null.
+.Pp
+.Fa hints
+is an optional pointer to a
+.Li struct addrinfo ,
+as defined by
+.Aq Pa netdb.h :
+.Bd -literal
+struct addrinfo {
+        int ai_flags;           /* input flags */
+        int ai_family;          /* protocol family for socket */
+        int ai_socktype;        /* socket type */
+        int ai_protocol;        /* protocol for socket */
+        socklen_t ai_addrlen;   /* length of socket-address */
+        struct sockaddr *ai_addr; /* socket-address for socket */
+        char *ai_canonname;     /* canonical name for service location */
+        struct addrinfo *ai_next; /* pointer to next in list */
+};
+.Ed
+.Pp
+This structure can be used to provide hints concerning the type of socket
+that the caller supports or wishes to use.
+The caller can supply the following structure elements in
+.Fa hints :
+.Bl -tag -width "ai_socktypeXX"
+.It Fa ai_family
+The protocol family that should be used.
+When
+.Fa ai_family
+is set to
+.Dv PF_UNSPEC ,
+it means the caller will accept any protocol family supported by the
+operating system.
+.It Fa ai_socktype
+Denotes the type of socket that is wanted:
+.Dv SOCK_STREAM ,
+.Dv SOCK_DGRAM ,
+or
+.Dv SOCK_RAW .
+When
+.Fa ai_socktype
+is zero the caller will accept any socket type.
+.It Fa ai_protocol
+Indicates which transport protocol is desired,
+.Dv IPPROTO_UDP
+or
+.Dv IPPROTO_TCP .
+If
+.Fa ai_protocol
+is zero the caller will accept any protocol.
+.It Fa ai_flags
+.Fa ai_flags
+is formed by
+.Tn OR Ns 'ing
+the following values:
+.Bl -tag -width "AI_CANONNAMEXX"
+.It Dv AI_CANONNAME
+If the
+.Dv AI_CANONNAME
+bit is set, a successful call to
+.Fn getaddrinfo
+will return a NUL-terminated string containing the canonical name
+of the specified host name in the
+.Fa ai_canonname
+element of the first
+.Li addrinfo
+structure returned.
+.It Dv AI_FQDN
+If the
+.Dv AI_FQDN
+bit is set, a successful call to
+.Fn getaddrinfo
+will return a NUL-terminated string containing the fully qualified domain name
+of the specified host name in the
+.Fa ai_canonname
+element of the first
+.Li addrinfo
+structure returned.
+.Pp
+This is different from the
+.Dv AI_CANONNAME
+bit flag that returns the canonical name registered in DNS,
+which may be different from the fully qualified domain name
+that the host name resolved to.
+Only one of the
+.Dv AI_FQDN
+and
+.Dv AI_CANONNAME
+bits can be set.
+.It Dv AI_NUMERICHOST
+If the
+.Dv AI_NUMERICHOST
+bit is set, it indicates that
+.Fa hostname
+should be treated as a numeric string defining an IPv4 or IPv6 address
+and no name resolution should be attempted.
+.It Dv AI_NUMERICSERV
+If the
+.Dv AI_NUMERICSERV
+bit is set, it indicates that
+.Fa servname
+should be treated as a numeric port string
+and no service name resolution should be attempted.
+.It Dv AI_PASSIVE
+If the
+.Dv AI_PASSIVE
+bit is set it indicates that the returned socket address structure
+is intended for use in a call to
+.Xr bind 2 .
+In this case, if the
+.Fa hostname
+argument is the null pointer, then the IP address portion of the
+socket address structure will be set to
+.Dv INADDR_ANY
+for an IPv4 address or
+.Dv IN6ADDR_ANY_INIT
+for an IPv6 address.
+.Pp
+If the
+.Dv AI_PASSIVE
+bit is not set, the returned socket address structure will be ready
+for use in a call to
+.Xr connect 2
+for a connection-oriented protocol or
+.Xr connect 2 ,
+.Xr sendto 2 ,
+or
+.Xr sendmsg 2
+if a connectionless protocol was chosen.
+The
+.Tn IP
+address portion of the socket address structure will be set to the
+loopback address if
+.Fa hostname
+is the null pointer and
+.Dv AI_PASSIVE
+is not set.
+.El
+.El
+.Pp
+All other elements of the
+.Li addrinfo
+structure passed via
+.Fa hints
+must be zero or the null pointer.
+.Pp
+If
+.Fa hints
+is the null pointer,
+.Fn getaddrinfo
+behaves as if the caller provided a
+.Li struct addrinfo
+with
+.Fa ai_family
+set to
+.Dv PF_UNSPEC
+and all other elements set to zero or
+.Dv NULL .
+.Pp
+After a successful call to
+.Fn getaddrinfo ,
+.Fa *res
+is a pointer to a linked list of one or more
+.Li addrinfo
+structures.
+The list can be traversed by following the
+.Fa ai_next
+pointer in each
+.Li addrinfo
+structure until a null pointer is encountered.
+The three members
+.Fa ai_family ,
+.Fa ai_socktype ,
+and
+.Fa ai_protocol
+in each returned
+.Li addrinfo
+structure are suitable for a call to
+.Xr socket 2 .
+For each
+.Li addrinfo
+structure in the list, the
+.Fa ai_addr
+member points to a filled-in socket address structure of length
+.Fa ai_addrlen .
+.Pp
+This implementation of
+.Fn getaddrinfo
+allows numeric IPv6 address notation with scope identifier,
+as documented in chapter 11 of draft-ietf-ipv6-scoping-arch-02.txt.
+By appending the percent character and scope identifier to addresses,
+one can fill the
+.Li sin6_scope_id
+field for addresses.
+This would make management of scoped addresses easier
+and allows cut-and-paste input of scoped addresses.
+.Pp
+At this moment the code supports only link-local addresses with the format.
+The scope identifier is hardcoded to the name of the hardware interface
+associated
+with the link
+.Po
+such as
+.Li ne0
+.Pc .
+An example is
+.Dq Li fe80::1%ne0 ,
+which means
+.Do
+.Li fe80::1
+on the link associated with the
+.Li ne0
+interface
+.Dc .
+.Pp
+The current implementation assumes a one-to-one relationship between
+the interface and link, which is not necessarily true from the specification.
+.Pp
+All of the information returned by
+.Fn getaddrinfo
+is dynamically allocated: the
+.Li addrinfo
+structures themselves as well as the socket address structures and
+the canonical host name strings included in the
+.Li addrinfo
+structures.
+.Pp
+Memory allocated for the dynamically allocated structures created by
+a successful call to
+.Fn getaddrinfo
+is released by the
+.Fn freeaddrinfo
+function.
+The
+.Fa ai
+pointer should be a
+.Li addrinfo
+structure created by a call to
+.Fn getaddrinfo .
+.Sh RETURN VALUES
+.Fn getaddrinfo
+returns zero on success or one of the error codes listed in
+.Xr gai_strerror 3
+if an error occurs.
+If an error occurs, no memory is allocated by
+.Fn getaddrinfo ,
+therefore it is not necessary to release the
+.Li addrinfo
+structure(s).
+.Sh EXAMPLES
+The following code tries to connect to
+.Dq Li www.kame.net
+service
+.Dq Li www
+via a stream socket.
+It loops through all the addresses available, regardless of address family.
+If the destination resolves to an IPv4 address, it will use an
+.Dv AF_INET
+socket.
+Similarly, if it resolves to IPv6, an
+.Dv AF_INET6
+socket is used.
+Observe that there is no hardcoded reference to a particular address family.
+The code works even if
+.Fn getaddrinfo
+returns addresses that are not IPv4/v6.
+.Bd -literal -offset indent
+struct addrinfo hints, *res, *res0;
+int error;
+int save_errno;
+int s;
+const char *cause = NULL;
+
+memset(&hints, 0, sizeof(hints));
+hints.ai_family = PF_UNSPEC;
+hints.ai_socktype = SOCK_STREAM;
+error = getaddrinfo("www.kame.net", "www", &hints, &res0);
+if (error)
+        errx(1, "%s", gai_strerror(error));
+s = -1;
+for (res = res0; res; res = res->ai_next) {
+        s = socket(res->ai_family, res->ai_socktype,
+            res->ai_protocol);
+        if (s == -1) {
+                cause = "socket";
+                continue;
+        }
+
+        if (connect(s, res->ai_addr, res->ai_addrlen) == -1) {
+                cause = "connect";
+                save_errno = errno;
+                close(s);
+                errno = save_errno;
+                s = -1;
+                continue;
+        }
+
+        break;  /* okay we got one */
+}
+if (s == -1)
+        err(1, "%s", cause);
+freeaddrinfo(res0);
+.Ed
+.Pp
+The following example tries to open a wildcard listening socket onto service
+.Dq Li www ,
+for all the address families available.
+.Bd -literal -offset indent
+struct addrinfo hints, *res, *res0;
+int error;
+int save_errno;
+int s[MAXSOCK];
+int nsock;
+const char *cause = NULL;
+
+memset(&hints, 0, sizeof(hints));
+hints.ai_family = PF_UNSPEC;
+hints.ai_socktype = SOCK_STREAM;
+hints.ai_flags = AI_PASSIVE;
+error = getaddrinfo(NULL, "www", &hints, &res0);
+if (error)
+        errx(1, "%s", gai_strerror(error));
+nsock = 0;
+for (res = res0; res && nsock < MAXSOCK; res = res->ai_next) {
+        s[nsock] = socket(res->ai_family, res->ai_socktype,
+            res->ai_protocol);
+        if (s[nsock] == -1) {
+                cause = "socket";
+                continue;
+        }
+
+        if (bind(s[nsock], res->ai_addr, res->ai_addrlen) == -1) {
+                cause = "bind";
+                save_errno = errno;
+                close(s[nsock]);
+                errno = save_errno;
+                continue;
+        }
+        (void) listen(s[nsock], 5);
+
+        nsock++;
+}
+if (nsock == 0)
+        err(1, "%s", cause);
+freeaddrinfo(res0);
+.Ed
+.Sh SEE ALSO
+.Xr bind 2 ,
+.Xr connect 2 ,
+.Xr send 2 ,
+.Xr socket 2 ,
+.Xr gai_strerror 3 ,
+.Xr gethostbyname 3 ,
+.Xr getnameinfo 3 ,
+.Xr getservbyname 3 ,
+.Xr resolver 3 ,
+.Xr hosts 5 ,
+.Xr resolv.conf 5 ,
+.Xr services 5 ,
+.Xr hostname 7 ,
+.Xr named 8
+.Rs
+.%A R. Gilligan
+.%A S. Thomson
+.%A J. Bound
+.%A J. McCann
+.%A W. Stevens
+.%T Basic Socket Interface Extensions for IPv6
+.%R RFC 3493
+.%D February 2003
+.Re
+.Rs
+.%A S. Deering
+.%A B. Haberman
+.%A T. Jinmei
+.%A E. Nordmark
+.%A B. Zill
+.%T "IPv6 Scoped Address Architecture"
+.%R internet draft
+.%N draft-ietf-ipv6-scoping-arch-02.txt
+.%O work in progress material
+.Re
+.Rs
+.%A Craig Metz
+.%T Protocol Independence Using the Sockets API
+.%B "Proceedings of the Freenix Track: 2000 USENIX Annual Technical Conference"
+.%D June 2000
+.Re
+.Sh STANDARDS
+The
+.Fn getaddrinfo
+function is defined by the
+.St -p1003.1g-2000
+draft specification and documented in
+.Dv "RFC 3493" ,
+.Dq Basic Socket Interface Extensions for IPv6 .
+.Pp
+The
+.Dv AI_FQDN
+flag bit first appeared in Windows 7.
+.Sh BUGS
+The implementation of
+.Fn getaddrinfo
+is not thread-safe.
diff --git a/src/lib/libc/net/getaddrinfo.c b/src/lib/libc/net/getaddrinfo.c
new file mode 100644
index 0000000000..29cc1f463e
--- /dev/null
+++ b/src/lib/libc/net/getaddrinfo.c
@@ -0,0 +1,1755 @@
+/*      $OpenBSD: getaddrinfo.c,v 1.72 2011/04/05 00:46:06 matthew Exp $        */
+/*      $KAME: getaddrinfo.c,v 1.31 2000/08/31 17:36:43 itojun Exp $    */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Issues to be discussed:
+ * - Thread safe-ness must be checked.
+ * - Return values.  There are nonstandard return values defined and used
+ *   in the source code.  This is because RFC2553 is silent about which error
+ *   code must be returned for which situation.
+ * - IPv4 classful (shortened) form.  RFC2553 is silent about it.  XNET 5.2
+ *   says to use inet_aton() to convert IPv4 numeric to binary (allows
+ *   classful form as a result).
+ *   current code - disallow classful form for IPv4 (due to use of inet_pton).
+ * - freeaddrinfo(NULL).  RFC2553 is silent about it.  XNET 5.2 says it is
+ *   invalid.
+ *   current code - SEGV on freeaddrinfo(NULL)
+ * Note:
+ * - We use getipnodebyname() just for thread-safeness.  There's no intent
+ *   to let it do PF_UNSPEC (actually we never pass PF_UNSPEC to
+ *   getipnodebyname().
+ * - The code filters out AFs that are not supported by the kernel,
+ *   when globbing NULL hostname (to loopback, or wildcard).  Is it the right
+ *   thing to do?  What is the relationship with post-RFC2553 AI_ADDRCONFIG
+ *   in ai_flags?
+ * - (post-2553) semantics of AI_ADDRCONFIG itself is too vague.
+ *   (1) what should we do against numeric hostname (2) what should we do
+ *   against NULL hostname (3) what is AI_ADDRCONFIG itself.  AF not ready?
+ *   non-loopback address configured?  global address configured?
+ * - To avoid search order issue, we have a big amount of code duplicate
+ *   from gethnamaddr.c and some other places.  The issues that there's no
+ *   lower layer function to lookup "IPv4 or IPv6" record.  Calling
+ *   gethostbyname2 from getaddrinfo will end up in wrong search order, as
+ *   follows:
+ *      - The code makes use of following calls when asked to resolver with
+ *        ai_family  = PF_UNSPEC:
+ *              getipnodebyname(host, AF_INET6);
+ *              getipnodebyname(host, AF_INET);
+ *        This will result in the following queries if the node is configure to
+ *        prefer /etc/hosts than DNS:
+ *              lookup /etc/hosts for IPv6 address
+ *              lookup DNS for IPv6 address
+ *              lookup /etc/hosts for IPv4 address
+ *              lookup DNS for IPv4 address
+ *        which may not meet people's requirement.
+ *        The right thing to happen is to have underlying layer which does
+ *        PF_UNSPEC lookup (lookup both) and return chain of addrinfos.
+ *        This would result in a bit of code duplicate with _dns_ghbyname() and
+ *        friends.
+ */
+
+#ifndef INET6
+#define INET6
+#endif
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <resolv.h>
+#include <string.h>
+#include <stdint.h>
+#include <stdlib.h>
+#include <stddef.h>
+#include <ctype.h>
+#include <unistd.h>
+#include <stdio.h>
+#include <errno.h>
+
+#include <syslog.h>
+#include <stdarg.h>
+
+#ifdef YP
+#include <rpc/rpc.h>
+#include <rpcsvc/yp.h>
+#include <rpcsvc/ypclnt.h>
+#include "ypinternal.h"
+#endif
+
+#include "thread_private.h"
+
+#define SUCCESS 0
+#define ANY 0
+#define YES 1
+#define NO  0
+
+static const char in_addrany[] = { 0, 0, 0, 0 };
+static const char in6_addrany[] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0
+};
+static const char in_loopback[] = { 127, 0, 0, 1 };
+static const char in6_loopback[] = {
+        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 1
+};
+
+static const struct afd {
+        int a_af;
+        int a_addrlen;
+        int a_socklen;
+        int a_off;
+        const char *a_addrany;
+        const char *a_loopback; 
+        int a_scoped;
+} afdl [] = {
+#ifdef INET6
+        {PF_INET6, sizeof(struct in6_addr),
+         sizeof(struct sockaddr_in6),
+         offsetof(struct sockaddr_in6, sin6_addr),
+         in6_addrany, in6_loopback, 1},
+#endif
+        {PF_INET, sizeof(struct in_addr),
+         sizeof(struct sockaddr_in),
+         offsetof(struct sockaddr_in, sin_addr),
+         in_addrany, in_loopback, 0},
+        {0, 0, 0, 0, NULL, NULL, 0},
+};
+
+struct explore {
+        int e_af;
+        int e_socktype;
+        int e_protocol;
+        const char *e_protostr;
+        int e_wild;
+#define WILD_AF(ex)             ((ex)->e_wild & 0x01)
+#define WILD_SOCKTYPE(ex)       ((ex)->e_wild & 0x02)
+#define WILD_PROTOCOL(ex)       ((ex)->e_wild & 0x04)
+};
+
+static const struct explore explore[] = {
+#if 0
+        { PF_LOCAL, 0, ANY, ANY, NULL, 0x01 },
+#endif
+#ifdef INET6
+        { PF_INET6, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07 },
+        { PF_INET6, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07 },
+        { PF_INET6, SOCK_RAW, ANY, NULL, 0x05 },
+#endif
+        { PF_INET, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07 },
+        { PF_INET, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07 },
+        { PF_INET, SOCK_RAW, ANY, NULL, 0x05 },
+        { PF_UNSPEC, SOCK_DGRAM, IPPROTO_UDP, "udp", 0x07 },
+        { PF_UNSPEC, SOCK_STREAM, IPPROTO_TCP, "tcp", 0x07 },
+        { PF_UNSPEC, SOCK_RAW, ANY, NULL, 0x05 },
+        { -1, 0, 0, NULL, 0 },
+};
+
+#ifdef INET6
+#define PTON_MAX        16
+#else
+#define PTON_MAX        4
+#endif
+
+#define MAXPACKET       (64*1024)
+
+typedef union {
+        HEADER hdr;
+        u_char buf[MAXPACKET];
+} querybuf;
+
+struct res_target {
+        struct res_target *next;
+        const char *name;       /* domain name */
+        int qclass, qtype;      /* class and type of query */
+        u_char *answer;         /* buffer to put answer */
+        int anslen;             /* size of answer buffer */
+        int n;                  /* result length */
+};
+
+static int explore_fqdn(const struct addrinfo *, const char *,
+        const char *, struct addrinfo **);
+static int explore_null(const struct addrinfo *,
+        const char *, struct addrinfo **);
+static int explore_numeric(const struct addrinfo *, const char *,
+        const char *, struct addrinfo **, const char *);
+static int explore_numeric_scope(const struct addrinfo *, const char *,
+        const char *, struct addrinfo **);
+static int get_canonname(const struct addrinfo *,
+        struct addrinfo *, const char *);
+static struct addrinfo *get_ai(const struct addrinfo *,
+        const struct afd *, const char *);
+static int get_portmatch(const struct addrinfo *, const char *);
+static int get_port(struct addrinfo *, const char *, int);
+static const struct afd *find_afd(int);
+#ifdef INET6
+static int ip6_str2scopeid(char *, struct sockaddr_in6 *, u_int32_t *);
+#endif
+
+static struct addrinfo * _gethtent(const char *, const struct addrinfo *,
+        FILE *);
+static struct addrinfo *_files_getaddrinfo(const char *,
+        const struct addrinfo *);
+
+#ifdef YP
+static struct addrinfo *_yphostent(char *, const struct addrinfo *);
+static struct addrinfo *_yp_getaddrinfo(const char *,
+        const struct addrinfo *);
+#endif
+
+static struct addrinfo *getanswer(const querybuf *, int, const char *, int,
+        const struct addrinfo *);
+static int res_queryN(const char *, struct res_target *);
+static int res_searchN(const char *, struct res_target *);
+static int res_querydomainN(const char *, const char *, struct res_target *);
+static struct addrinfo *_dns_getaddrinfo(const char *, const struct addrinfo *,
+        const struct __res_state *);
+
+
+/* XXX macros that make external reference is BAD. */
+
+#define GET_AI(ai, afd, addr)                                           \
+do {                                                                    \
+        /* external reference: pai, error, and label free */            \
+        (ai) = get_ai(pai, (afd), (addr));                              \
+        if ((ai) == NULL) {                                             \
+                error = EAI_MEMORY;                                     \
+                goto free;                                              \
+        }                                                               \
+} while (/*CONSTCOND*/0)
+
+#define GET_PORT(ai, serv)                                              \
+do {                                                                    \
+        /* external reference: error and label free */                  \
+        error = get_port((ai), (serv), 0);                              \
+        if (error != 0)                                                 \
+                goto free;                                              \
+} while (/*CONSTCOND*/0)
+
+#define GET_CANONNAME(ai, str)                                          \
+do {                                                                    \
+        /* external reference: pai, error and label free */             \
+        error = get_canonname(pai, (ai), (str));                        \
+        if (error != 0)                                                 \
+                goto free;                                              \
+} while (/*CONSTCOND*/0)
+
+#define ERR(err)                                                        \
+do {                                                                    \
+        /* external reference: error, and label bad */                  \
+        error = (err);                                                  \
+        goto bad;                                                       \
+        /*NOTREACHED*/                                                  \
+} while (/*CONSTCOND*/0)
+
+#define MATCH_FAMILY(x, y, w) \
+        ((x) == (y) || (/*CONSTCOND*/(w) && ((x) == PF_UNSPEC || (y) == PF_UNSPEC)))
+#define MATCH(x, y, w) \
+        ((x) == (y) || (/*CONSTCOND*/(w) && ((x) == ANY || (y) == ANY)))
+
+int
+getaddrinfo(const char *hostname, const char *servname,
+    const struct addrinfo *hints, struct addrinfo **res)
+{
+        struct addrinfo sentinel;
+        struct addrinfo *cur;
+        int error = 0;
+        struct addrinfo ai;
+        struct addrinfo ai0;
+        struct addrinfo *pai;
+        const struct explore *ex;
+
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+        pai = &ai;
+        pai->ai_flags = 0;
+        pai->ai_family = PF_UNSPEC;
+        pai->ai_socktype = ANY;
+        pai->ai_protocol = ANY;
+        pai->ai_addrlen = 0;
+        pai->ai_canonname = NULL;
+        pai->ai_addr = NULL;
+        pai->ai_next = NULL;
+        
+        if (hostname == NULL && servname == NULL)
+                return EAI_NONAME;
+        if (hints) {
+                /* error check for hints */
+                if (hints->ai_addrlen || hints->ai_canonname ||
+                    hints->ai_addr || hints->ai_next)
+                        ERR(EAI_BADHINTS); /* xxx */
+                if ((hints->ai_flags & ~AI_MASK) != 0 ||
+                    (hints->ai_flags & (AI_CANONNAME | AI_FQDN)) ==
+                    (AI_CANONNAME | AI_FQDN))
+                        ERR(EAI_BADFLAGS);
+                switch (hints->ai_family) {
+                case PF_UNSPEC:
+                case PF_INET:
+#ifdef INET6
+                case PF_INET6:
+#endif
+                        break;
+                default:
+                        ERR(EAI_FAMILY);
+                }
+                memcpy(pai, hints, sizeof(*pai));
+
+                /*
+                 * if both socktype/protocol are specified, check if they
+                 * are meaningful combination.
+                 */
+                if (pai->ai_socktype != ANY && pai->ai_protocol != ANY) {
+                        for (ex = explore; ex->e_af >= 0; ex++) {
+                                if (pai->ai_family != ex->e_af)
+                                        continue;
+                                if (ex->e_socktype == ANY)
+                                        continue;
+                                if (ex->e_protocol == ANY)
+                                        continue;
+                                if (pai->ai_socktype == ex->e_socktype
+                                 && pai->ai_protocol != ex->e_protocol) {
+                                        ERR(EAI_BADHINTS);
+                                }
+                        }
+                }
+        }
+
+        /*
+         * check for special cases.  (1) numeric servname is disallowed if
+         * socktype/protocol are left unspecified. (2) servname is disallowed
+         * for raw and other inet{,6} sockets.
+         */
+        if (MATCH_FAMILY(pai->ai_family, PF_INET, 1)
+#ifdef PF_INET6
+         || MATCH_FAMILY(pai->ai_family, PF_INET6, 1)
+#endif
+            ) {
+                ai0 = *pai;     /* backup *pai */
+
+                if (pai->ai_family == PF_UNSPEC) {
+#ifdef PF_INET6
+                        pai->ai_family = PF_INET6;
+#else
+                        pai->ai_family = PF_INET;
+#endif
+                }
+                error = get_portmatch(pai, servname);
+                if (error)
+                        ERR(error);
+
+                *pai = ai0;
+        }
+
+        ai0 = *pai;
+
+        /* NULL hostname, or numeric hostname */
+        for (ex = explore; ex->e_af >= 0; ex++) {
+                *pai = ai0;
+
+                /* PF_UNSPEC entries are prepared for DNS queries only */
+                if (ex->e_af == PF_UNSPEC)
+                        continue;
+
+                if (!MATCH_FAMILY(pai->ai_family, ex->e_af, WILD_AF(ex)))
+                        continue;
+                if (!MATCH(pai->ai_socktype, ex->e_socktype, WILD_SOCKTYPE(ex)))
+                        continue;
+                if (!MATCH(pai->ai_protocol, ex->e_protocol, WILD_PROTOCOL(ex)))
+                        continue;
+
+                if (pai->ai_family == PF_UNSPEC)
+                        pai->ai_family = ex->e_af;
+                if (pai->ai_socktype == ANY && ex->e_socktype != ANY)
+                        pai->ai_socktype = ex->e_socktype;
+                if (pai->ai_protocol == ANY && ex->e_protocol != ANY)
+                        pai->ai_protocol = ex->e_protocol;
+
+                if (hostname == NULL)
+                        error = explore_null(pai, servname, &cur->ai_next);
+                else
+                        error = explore_numeric_scope(pai, hostname, servname,
+                            &cur->ai_next);
+
+                if (error)
+                        goto free;
+
+                while (cur && cur->ai_next)
+                        cur = cur->ai_next;
+        }
+
+        /*
+         * XXX
+         * If numeric representation of AF1 can be interpreted as FQDN
+         * representation of AF2, we need to think again about the code below.
+         */
+        if (sentinel.ai_next)
+                goto good;
+
+        if (hostname == NULL)
+                ERR(EAI_NODATA);
+        if (pai->ai_flags & AI_NUMERICHOST)
+                ERR(EAI_NONAME);
+
+        /*
+         * hostname as alphabetical name.
+         * we would like to prefer AF_INET6 than AF_INET, so we'll make an
+         * outer loop by AFs.
+         */
+        for (ex = explore; ex->e_af >= 0; ex++) {
+                *pai = ai0;
+
+                /* require exact match for family field */
+                if (pai->ai_family != ex->e_af)
+                        continue;
+
+                if (!MATCH(pai->ai_socktype, ex->e_socktype,
+                                WILD_SOCKTYPE(ex))) {
+                        continue;
+                }
+                if (!MATCH(pai->ai_protocol, ex->e_protocol,
+                                WILD_PROTOCOL(ex))) {
+                        continue;
+                }
+
+                if (pai->ai_socktype == ANY && ex->e_socktype != ANY)
+                        pai->ai_socktype = ex->e_socktype;
+                if (pai->ai_protocol == ANY && ex->e_protocol != ANY)
+                        pai->ai_protocol = ex->e_protocol;
+
+                error = explore_fqdn(pai, hostname, servname,
+                        &cur->ai_next);
+
+                while (cur && cur->ai_next)
+                        cur = cur->ai_next;
+        }
+
+        /* XXX */
+        if (sentinel.ai_next)
+                error = 0;
+
+        if (error == 0) {
+                if (sentinel.ai_next) {
+ good:
+                        *res = sentinel.ai_next;
+                        return SUCCESS;
+                } else
+                        error = EAI_FAIL;
+        }
+ free:
+ bad:
+        if (sentinel.ai_next)
+                freeaddrinfo(sentinel.ai_next);
+        *res = NULL;
+        return error;
+}
+
+/*
+ * FQDN hostname, DNS lookup
+ */
+
+static int
+explore_fqdn(const struct addrinfo *pai, const char *hostname,
+    const char *servname, struct addrinfo **res)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        struct addrinfo *result;
+        struct addrinfo *cur;
+        int error = 0;
+        char lookups[MAXDNSLUS];
+        int i;
+        _THREAD_PRIVATE_MUTEX(_explore_mutex);
+
+        result = NULL;
+
+        /*
+         * if the servname does not match socktype/protocol, ignore it.
+         */
+        if (get_portmatch(pai, servname) != 0) {
+                return 0;
+        }
+
+        if (_res_init(0) == -1)
+                strlcpy(lookups, "f", sizeof lookups);
+        else {
+                bcopy(_resp->lookups, lookups, sizeof lookups);
+                if (lookups[0] == '\0')
+                        strlcpy(lookups, "bf", sizeof lookups);
+        }
+
+        /*
+         * The yp/dns/files getaddrinfo functions are not thread safe.
+         * Protect them with a mutex.
+         */
+        _THREAD_PRIVATE_MUTEX_LOCK(_explore_mutex);
+        for (i = 0; i < MAXDNSLUS && result == NULL && lookups[i]; i++) {
+                switch (lookups[i]) {
+#ifdef YP
+                case 'y':
+                        result = _yp_getaddrinfo(hostname, pai);
+                        break;
+#endif
+                case 'b':
+                        result = _dns_getaddrinfo(hostname, pai, _resp);
+                        break;
+                case 'f':
+                        result = _files_getaddrinfo(hostname, pai);
+                        break;
+                }
+        }
+        _THREAD_PRIVATE_MUTEX_UNLOCK(_explore_mutex);
+        if (result) {
+                for (cur = result; cur; cur = cur->ai_next) {
+                        GET_PORT(cur, servname);
+                        /* canonname should be filled already */
+                }
+                *res = result;
+                return 0;
+        } else {
+                /* translate error code */
+                switch (h_errno) {
+                case NETDB_SUCCESS:
+                        error = EAI_FAIL;       /*XXX strange */
+                        break;
+                case HOST_NOT_FOUND:
+                        error = EAI_NODATA;
+                        break;
+                case TRY_AGAIN:
+                        error = EAI_AGAIN;
+                        break;
+                case NO_RECOVERY:
+                        error = EAI_FAIL;
+                        break;
+                case NO_DATA:
+#if NO_ADDRESS != NO_DATA
+                case NO_ADDRESS:
+#endif
+                        error = EAI_NODATA;
+                        break;
+                default:                        /* unknown ones */
+                        error = EAI_FAIL;
+                        break;
+                }
+        }
+
+free:
+        if (result)
+                freeaddrinfo(result);
+        return error;
+}
+
+/*
+ * hostname == NULL.
+ * passive socket -> anyaddr (0.0.0.0 or ::)
+ * non-passive socket -> localhost (127.0.0.1 or ::1)
+ */
+static int
+explore_null(const struct addrinfo *pai, const char *servname,
+    struct addrinfo **res)
+{
+        int s;
+        const struct afd *afd;
+        struct addrinfo *cur;
+        struct addrinfo sentinel;
+        int error;
+
+        *res = NULL;
+        sentinel.ai_next = NULL;
+        cur = &sentinel;
+
+        /*
+         * filter out AFs that are not supported by the kernel
+         * XXX errno?
+         */
+        s = socket(pai->ai_family, SOCK_DGRAM, 0);
+        if (s < 0) {
+                if (errno != EMFILE)
+                        return 0;
+        } else
+                close(s);
+
+        /*
+         * if the servname does not match socktype/protocol, ignore it.
+         */
+        if (get_portmatch(pai, servname) != 0)
+                return 0;
+
+        afd = find_afd(pai->ai_family);
+        if (afd == NULL)
+                return 0;
+
+        if (pai->ai_flags & AI_PASSIVE) {
+                GET_AI(cur->ai_next, afd, afd->a_addrany);
+                /* xxx meaningless?
+                 * GET_CANONNAME(cur->ai_next, "anyaddr");
+                 */
+        } else {
+                GET_AI(cur->ai_next, afd, afd->a_loopback);
+                /* xxx meaningless?
+                 * GET_CANONNAME(cur->ai_next, "localhost");
+                 */
+        }
+        GET_PORT(cur->ai_next, servname);
+        cur = cur->ai_next;
+
+        *res = sentinel.ai_next;
+        return 0;
+
+free:
+        if (sentinel.ai_next)
+                freeaddrinfo(sentinel.ai_next);
+        return error;
+}
+
+/*
+ * numeric hostname
+ */
+static int
+explore_numeric(const struct addrinfo *pai, const char *hostname,
+    const char *servname, struct addrinfo **res, const char *canonname)
+{
+        const struct afd *afd;
+        struct addrinfo *cur;
+        struct addrinfo sentinel;
+        int error;
+        char pton[PTON_MAX];
+
+        *res = NULL;
+        sentinel.ai_next = NULL;
+        cur = &sentinel;
+
+        /*
+         * if the servname does not match socktype/protocol, ignore it.
+         */
+        if (get_portmatch(pai, servname) != 0)
+                return 0;
+
+        afd = find_afd(pai->ai_family);
+        if (afd == NULL)
+                return 0;
+
+        switch (afd->a_af) {
+#if 0 /*X/Open spec*/
+        case AF_INET:
+                error = inet_aton(hostname, (struct in_addr *)pton);
+                break;
+#endif
+        default:
+                error = inet_pton(afd->a_af, hostname, pton);
+                break;
+        }
+        if (error == 1) {
+                if (pai->ai_family == afd->a_af ||
+                    pai->ai_family == PF_UNSPEC /*?*/) {
+                        GET_AI(cur->ai_next, afd, pton);
+                        GET_PORT(cur->ai_next, servname);
+                        /*
+                         * Set the numeric address itself as
+                         * the canonical name, based on a
+                         * clarification in rfc2553bis-03.
+                         */
+                        GET_CANONNAME(cur->ai_next, canonname);
+
+                        while (cur && cur->ai_next)
+                                cur = cur->ai_next;
+                } else
+                        ERR(EAI_FAMILY);        /*xxx*/
+        }
+
+        *res = sentinel.ai_next;
+        return 0;
+
+free:
+bad:
+        if (sentinel.ai_next)
+                freeaddrinfo(sentinel.ai_next);
+        return error;
+}
+
+/*
+ * numeric hostname with scope
+ */
+static int
+explore_numeric_scope(const struct addrinfo *pai, const char *hostname,
+    const char *servname, struct addrinfo **res)
+{
+#if !defined(SCOPE_DELIMITER) || !defined(INET6)
+        return explore_numeric(pai, hostname, servname, res, hostname);
+#else
+        const struct afd *afd;
+        struct addrinfo *cur;
+        int error;
+        char *cp, *hostname2 = NULL, *scope, *addr;
+        struct sockaddr_in6 *sin6;
+
+        /*
+         * if the servname does not match socktype/protocol, ignore it.
+         */
+        if (get_portmatch(pai, servname) != 0)
+                return 0;
+
+        afd = find_afd(pai->ai_family);
+        if (afd == NULL)
+                return 0;
+
+        if (!afd->a_scoped)
+                return explore_numeric(pai, hostname, servname, res, hostname);
+
+        cp = strchr(hostname, SCOPE_DELIMITER);
+        if (cp == NULL)
+                return explore_numeric(pai, hostname, servname, res, hostname);
+
+        /*
+         * Handle special case of <scoped_address><delimiter><scope id>
+         */
+        hostname2 = strdup(hostname);
+        if (hostname2 == NULL)
+                return EAI_MEMORY;
+        /* terminate at the delimiter */
+        hostname2[cp - hostname] = '\0';
+        addr = hostname2;
+        scope = cp + 1;
+
+        error = explore_numeric(pai, addr, servname, res, hostname);
+        if (error == 0) {
+                u_int32_t scopeid;
+
+                for (cur = *res; cur; cur = cur->ai_next) {
+                        if (cur->ai_family != AF_INET6)
+                                continue;
+                        sin6 = (struct sockaddr_in6 *)(void *)cur->ai_addr;
+                        if (ip6_str2scopeid(scope, sin6, &scopeid) == -1) {
+                                free(hostname2);
+                                return(EAI_NODATA); /* XXX: is return OK? */
+                        }
+                        sin6->sin6_scope_id = scopeid;
+                }
+        }
+
+        free(hostname2);
+
+        return error;
+#endif
+}
+
+static int
+get_canonname(const struct addrinfo *pai, struct addrinfo *ai, const char *str)
+{
+        if ((pai->ai_flags & (AI_CANONNAME | AI_FQDN)) != 0) {
+                ai->ai_canonname = strdup(str);
+                if (ai->ai_canonname == NULL)
+                        return EAI_MEMORY;
+        }
+        return 0;
+}
+
+static struct addrinfo *
+get_ai(const struct addrinfo *pai, const struct afd *afd, const char *addr)
+{
+        char *p;
+        struct addrinfo *ai;
+
+        ai = (struct addrinfo *)malloc(sizeof(struct addrinfo)
+                + (afd->a_socklen));
+        if (ai == NULL)
+                return NULL;
+
+        memcpy(ai, pai, sizeof(struct addrinfo));
+        ai->ai_addr = (struct sockaddr *)(void *)(ai + 1);
+        memset(ai->ai_addr, 0, (size_t)afd->a_socklen);
+        ai->ai_addr->sa_len = afd->a_socklen;
+        ai->ai_addrlen = afd->a_socklen;
+        ai->ai_addr->sa_family = ai->ai_family = afd->a_af;
+        p = (char *)(void *)(ai->ai_addr);
+        memcpy(p + afd->a_off, addr, (size_t)afd->a_addrlen);
+        return ai;
+}
+
+static int
+get_portmatch(const struct addrinfo *ai, const char *servname)
+{
+
+        /* get_port does not touch first argument. when matchonly == 1. */
+        /* LINTED const cast */
+        return get_port((struct addrinfo *)ai, servname, 1);
+}
+
+static int
+get_port(struct addrinfo *ai, const char *servname, int matchonly)
+{
+        const char *errstr, *proto;
+        int port;
+        int allownumeric;
+
+        if (servname == NULL)
+                return 0;
+        switch (ai->ai_family) {
+        case AF_INET:
+#ifdef AF_INET6
+        case AF_INET6:
+#endif
+                break;
+        default:
+                return 0;
+        }
+
+        switch (ai->ai_socktype) {
+        case SOCK_RAW:
+                return EAI_SERVICE;
+        case SOCK_DGRAM:
+        case SOCK_STREAM:
+        case ANY:
+                allownumeric = 1;
+                break;
+        default:
+                return EAI_SOCKTYPE;
+        }
+
+        port = (int)strtonum(servname, 0, USHRT_MAX, &errstr);
+        if (!errstr) {
+                if (!allownumeric)
+                        return EAI_SERVICE;
+                port = htons(port);
+        } else {
+                struct servent sp;
+                struct servent_data sd;
+
+                if (errno == ERANGE)
+                        return EAI_SERVICE;
+                if (ai->ai_flags & AI_NUMERICSERV)
+                        return EAI_NONAME;
+
+                switch (ai->ai_socktype) {
+                case SOCK_DGRAM:
+                        proto = "udp";
+                        break;
+                case SOCK_STREAM:
+                        proto = "tcp";
+                        break;
+                default:
+                        proto = NULL;
+                        break;
+                }
+
+                (void)memset(&sd, 0, sizeof(sd));
+                if (getservbyname_r(servname, proto, &sp, &sd) == -1)
+                        return EAI_SERVICE;
+                port = sp.s_port;
+                endservent_r(&sd);
+        }
+
+        if (!matchonly) {
+                switch (ai->ai_family) {
+                case AF_INET:
+                        ((struct sockaddr_in *)(void *)
+                            ai->ai_addr)->sin_port = port;
+                        break;
+#ifdef INET6
+                case AF_INET6:
+                        ((struct sockaddr_in6 *)(void *)
+                            ai->ai_addr)->sin6_port = port;
+                        break;
+#endif
+                }
+        }
+
+        return 0;
+}
+
+static const struct afd *
+find_afd(int af)
+{
+        const struct afd *afd;
+
+        if (af == PF_UNSPEC)
+                return NULL;
+        for (afd = afdl; afd->a_af; afd++) {
+                if (afd->a_af == af)
+                        return afd;
+        }
+        return NULL;
+}
+
+#ifdef INET6
+/* convert a string to a scope identifier. XXX: IPv6 specific */
+static int
+ip6_str2scopeid(char *scope, struct sockaddr_in6 *sin6, u_int32_t *scopeid)
+{
+        struct in6_addr *a6 = &sin6->sin6_addr;
+        const char *errstr;
+
+        /* empty scopeid portion is invalid */
+        if (*scope == '\0')
+                return -1;
+
+        if (IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6) ||
+            IN6_IS_ADDR_MC_INTFACELOCAL(a6)) {
+                /*
+                 * We currently assume a one-to-one mapping between links
+                 * and interfaces, so we simply use interface indices for
+                 * like-local scopes.
+                 */
+                *scopeid = if_nametoindex(scope);
+                if (*scopeid == 0)
+                        goto trynumeric;
+                return 0;
+        }
+
+        /* still unclear about literal, allow numeric only - placeholder */
+        if (IN6_IS_ADDR_SITELOCAL(a6) || IN6_IS_ADDR_MC_SITELOCAL(a6))
+                goto trynumeric;
+        if (IN6_IS_ADDR_MC_ORGLOCAL(a6))
+                goto trynumeric;
+        else
+                goto trynumeric;        /* global */
+
+        /* try to convert to a numeric id as a last resort */
+  trynumeric:
+        *scopeid = (u_int32_t)strtonum(scope, 0, UINT32_MAX, &errstr);
+        if (errstr)
+                return (-1);
+        return (0);
+}
+#endif
+
+/* code duplicate with gethnamaddr.c */
+
+static const char AskedForGot[] =
+        "gethostby*.getanswer: asked for \"%s\", got \"%s\"";
+
+static struct addrinfo *
+getanswer(const querybuf *answer, int anslen, const char *qname, int qtype,
+    const struct addrinfo *pai)
+{
+        struct addrinfo sentinel, *cur;
+        struct addrinfo ai;
+        const struct afd *afd;
+        char *canonname;
+        const HEADER *hp;
+        const u_char *cp;
+        int n;
+        const u_char *eom;
+        char *bp, *ep;
+        int type, class, ancount, qdcount;
+        int haveanswer, had_error;
+        char tbuf[MAXDNAME];
+        int (*name_ok)(const char *);
+        char hostbuf[8*1024];
+
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+
+        canonname = NULL;
+        eom = answer->buf + anslen;
+        switch (qtype) {
+        case T_A:
+        case T_AAAA:
+        case T_ANY:     /*use T_ANY only for T_A/T_AAAA lookup*/
+                name_ok = res_hnok;
+                break;
+        default:
+                return (NULL);  /* XXX should be abort() -- but that is illegal */
+        }
+        /*
+         * find first satisfactory answer
+         */
+        hp = &answer->hdr;
+        ancount = ntohs(hp->ancount);
+        qdcount = ntohs(hp->qdcount);
+        bp = hostbuf;
+        ep = hostbuf + sizeof hostbuf;
+        cp = answer->buf + HFIXEDSZ;
+        if (qdcount != 1) {
+                h_errno = NO_RECOVERY;
+                return (NULL);
+        }
+        n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+        if ((n < 0) || !(*name_ok)(bp)) {
+                h_errno = NO_RECOVERY;
+                return (NULL);
+        }
+        cp += n + QFIXEDSZ;
+        if (qtype == T_A || qtype == T_AAAA || qtype == T_ANY) {
+                size_t len;
+
+                /* res_send() has already verified that the query name is the
+                 * same as the one we sent; this just gets the expanded name
+                 * (i.e., with the succeeding search-domain tacked on).
+                 */
+                len = strlen(bp) + 1;           /* for the \0 */
+                if (len >= MAXHOSTNAMELEN) {
+                        h_errno = NO_RECOVERY;
+                        return (NULL);
+                }
+                canonname = bp;
+                bp += len;
+                /* The qname can be abbreviated, but h_name is now absolute. */
+                qname = canonname;
+        }
+        haveanswer = 0;
+        had_error = 0;
+        while (ancount-- > 0 && cp < eom && !had_error) {
+                n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+                if ((n < 0) || !(*name_ok)(bp)) {
+                        had_error++;
+                        continue;
+                }
+                cp += n;                        /* name */
+                type = _getshort(cp);
+                cp += INT16SZ;                  /* type */
+                class = _getshort(cp);
+                cp += INT16SZ + INT32SZ;        /* class, TTL */
+                n = _getshort(cp);
+                cp += INT16SZ;                  /* len */
+                if (class != C_IN) {
+                        /* XXX - debug? syslog? */
+                        cp += n;
+                        continue;               /* XXX - had_error++ ? */
+                }
+                if ((qtype == T_A || qtype == T_AAAA || qtype == T_ANY) &&
+                    type == T_CNAME) {
+                        size_t len;
+
+                        n = dn_expand(answer->buf, eom, cp, tbuf, sizeof tbuf);
+                        if ((n < 0) || !(*name_ok)(tbuf)) {
+                                had_error++;
+                                continue;
+                        }
+                        cp += n;
+                        /* Get canonical name. */
+                        len = strlen(tbuf) + 1; /* for the \0 */
+                        if (len > ep - bp || len >= MAXHOSTNAMELEN) {
+                                had_error++;
+                                continue;
+                        }
+                        strlcpy(bp, tbuf, ep - bp);
+                        canonname = bp;
+                        bp += len;
+                        continue;
+                }
+                if (qtype == T_ANY) {
+                        if (!(type == T_A || type == T_AAAA)) {
+                                cp += n;
+                                continue;
+                        }
+                } else if (type != qtype) {
+#ifndef NO_LOG_BAD_DNS_RESPONSES
+                        if (type != T_KEY && type != T_SIG) {
+                                struct syslog_data sdata = SYSLOG_DATA_INIT;
+
+                                syslog_r(LOG_NOTICE|LOG_AUTH, &sdata,
+               "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
+                                       qname, p_class(C_IN), p_type(qtype),
+                                       p_type(type));
+                        }
+#endif /* NO_LOG_BAD_DNS_RESPONSES */
+                        cp += n;
+                        continue;               /* XXX - had_error++ ? */
+                }
+                switch (type) {
+                case T_A:
+                case T_AAAA:
+                        if (strcasecmp(canonname, bp) != 0) {
+                                struct syslog_data sdata = SYSLOG_DATA_INIT;
+
+                                syslog_r(LOG_NOTICE|LOG_AUTH, &sdata,
+                                       AskedForGot, canonname, bp);
+                                cp += n;
+                                continue;       /* XXX - had_error++ ? */
+                        }
+                        if (type == T_A && n != INADDRSZ) {
+                                cp += n;
+                                continue;
+                        }
+                        if (type == T_AAAA && n != IN6ADDRSZ) {
+                                cp += n;
+                                continue;
+                        }
+                        if (type == T_AAAA) {
+                                struct in6_addr in6;
+                                memcpy(&in6, cp, IN6ADDRSZ);
+                                if (IN6_IS_ADDR_V4MAPPED(&in6)) {
+                                        cp += n;
+                                        continue;
+                                }
+                        }
+                        if (!haveanswer) {
+                                canonname = bp;
+                                bp += strlen(bp) + 1;   /* for the \0 */
+                        }
+
+                        /* don't overwrite pai */
+                        ai = *pai;
+                        ai.ai_family = (type == T_A) ? AF_INET : AF_INET6;
+                        afd = find_afd(ai.ai_family);
+                        if (afd == NULL) {
+                                cp += n;
+                                continue;
+                        }
+                        cur->ai_next = get_ai(&ai, afd, (const char *)cp);
+                        if (cur->ai_next == NULL)
+                                had_error++;
+                        while (cur && cur->ai_next)
+                                cur = cur->ai_next;
+                        cp += n;
+                        break;
+                default:
+                        abort();        /* XXX abort illegal in library */
+                }
+                if (!had_error)
+                        haveanswer++;
+        }
+        if (haveanswer) {
+                if (!canonname || (pai->ai_flags & AI_FQDN) != 0)
+                        (void)get_canonname(pai, sentinel.ai_next, qname);
+                else
+                        (void)get_canonname(pai, sentinel.ai_next, canonname);
+                h_errno = NETDB_SUCCESS;
+                return sentinel.ai_next;
+        }
+
+        h_errno = NO_RECOVERY;
+        return NULL;
+}
+
+/*ARGSUSED*/
+static struct addrinfo *
+_dns_getaddrinfo(const char *name, const struct addrinfo *pai,
+        const struct __res_state *_resp)
+{
+        struct addrinfo *ai;
+        querybuf *buf, *buf2;
+        struct addrinfo sentinel, *cur;
+        struct res_target q, q2;
+
+        memset(&q, 0, sizeof(q));
+        memset(&q2, 0, sizeof(q2));
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+
+        buf = malloc(sizeof(*buf));
+        if (buf == NULL) {
+                h_errno = NETDB_INTERNAL;
+                return NULL;
+        }
+        buf2 = malloc(sizeof(*buf2));
+        if (buf2 == NULL) {
+                free(buf);
+                h_errno = NETDB_INTERNAL;
+                return NULL;
+        }
+
+        switch (pai->ai_family) {
+        case AF_UNSPEC:
+                /* respect user supplied order */
+                q.qclass = C_IN;
+                q.qtype = (_resp->family[0] == AF_INET6) ? T_AAAA : T_A;
+                q.answer = buf->buf;
+                q.anslen = sizeof(buf->buf);
+                q.next = &q2;
+
+                if (_resp->family[1] == -1) {
+                        /* stop here if only one family was given */
+                        q.next = NULL;
+                        break;
+                }
+
+                q2.qclass = C_IN;
+                q2.qtype = (_resp->family[1] == AF_INET6) ? T_AAAA : T_A;
+                q2.answer = buf2->buf;
+                q2.anslen = sizeof(buf2->buf);
+                break;
+        case AF_INET:
+                q.qclass = C_IN;
+                q.qtype = T_A;
+                q.answer = buf->buf;
+                q.anslen = sizeof(buf->buf);
+                break;
+        case AF_INET6:
+                q.qclass = C_IN;
+                q.qtype = T_AAAA;
+                q.answer = buf->buf;
+                q.anslen = sizeof(buf->buf);
+                break;
+        default:
+                free(buf);
+                free(buf2);
+                return NULL;
+        }
+        if (res_searchN(name, &q) < 0) {
+                free(buf);
+                free(buf2);
+                return NULL;
+        }
+        ai = getanswer(buf, q.n, q.name, q.qtype, pai);
+        if (ai) {
+                cur->ai_next = ai;
+                while (cur && cur->ai_next)
+                        cur = cur->ai_next;
+        }
+        if (q.next) {
+                ai = getanswer(buf2, q2.n, q2.name, q2.qtype, pai);
+                if (ai)
+                        cur->ai_next = ai;
+        }
+        free(buf);
+        free(buf2);
+        return sentinel.ai_next;
+}
+
+static struct addrinfo *
+_gethtent(const char *name, const struct addrinfo *pai, FILE *hostf)
+{
+        char *p;
+        char *cp, *tname, *cname;
+        struct addrinfo hints, *res0, *res;
+        int error;
+        const char *addr;
+        char hostbuf[8*1024];
+
+ again:
+        if (!(p = fgets(hostbuf, sizeof hostbuf, hostf)))
+                return (NULL);
+        if (*p == '#')
+                goto again;
+        if (!(cp = strpbrk(p, "#\n")))
+                goto again;
+        *cp = '\0';
+        if (!(cp = strpbrk(p, " \t")))
+                goto again;
+        *cp++ = '\0';
+        addr = p;
+        /* if this is not something we're looking for, skip it. */
+        cname = NULL;
+        while (cp && *cp) {
+                if (*cp == ' ' || *cp == '\t') {
+                        cp++;
+                        continue;
+                }
+                if (!cname)
+                        cname = cp;
+                tname = cp;
+                if ((cp = strpbrk(cp, " \t")) != NULL)
+                        *cp++ = '\0';
+                if (strcasecmp(name, tname) == 0)
+                        goto found;
+        }
+        goto again;
+
+found:
+        hints = *pai;
+        hints.ai_flags = AI_NUMERICHOST;
+        error = getaddrinfo(addr, NULL, &hints, &res0);
+        if (error)
+                goto again;
+        for (res = res0; res; res = res->ai_next) {
+                /* cover it up */
+                res->ai_flags = pai->ai_flags;
+
+                if (get_canonname(pai, res, cname) != 0) {
+                        freeaddrinfo(res0);
+                        goto again;
+                }
+        }
+        return res0;
+}
+
+/*ARGSUSED*/
+static struct addrinfo *
+_files_getaddrinfo(const char *name, const struct addrinfo *pai)
+{
+        struct addrinfo sentinel, *cur;
+        struct addrinfo *p;
+        FILE *hostf;
+
+        hostf = fopen(_PATH_HOSTS, "r");
+        if (hostf == NULL)
+                return NULL;
+
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+
+        while ((p = _gethtent(name, pai, hostf)) != NULL) {
+                cur->ai_next = p;
+                while (cur && cur->ai_next)
+                        cur = cur->ai_next;
+        }
+        fclose(hostf);
+
+        return sentinel.ai_next;
+}
+
+#ifdef YP
+static char *__ypdomain;
+
+/*ARGSUSED*/
+static struct addrinfo *
+_yphostent(char *line, const struct addrinfo *pai)
+{
+        struct addrinfo sentinel, *cur;
+        struct addrinfo hints, *res, *res0;
+        int error;
+        char *p = line;
+        const char *addr, *canonname;
+        char *nextline;
+        char *cp;
+
+        addr = canonname = NULL;
+
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+
+nextline:
+        /* terminate line */
+        cp = strchr(p, '\n');
+        if (cp) {
+                *cp++ = '\0';
+                nextline = cp;
+        } else
+                nextline = NULL;
+
+        cp = strpbrk(p, " \t");
+        if (cp == NULL) {
+                if (canonname == NULL)
+                        return (NULL);
+                else
+                        goto done;
+        }
+        *cp++ = '\0';
+
+        addr = p;
+
+        while (cp && *cp) {
+                if (*cp == ' ' || *cp == '\t') {
+                        cp++;
+                        continue;
+                }
+                if (!canonname)
+                        canonname = cp;
+                if ((cp = strpbrk(cp, " \t")) != NULL)
+                        *cp++ = '\0';
+        }
+
+        hints = *pai;
+        hints.ai_flags = AI_NUMERICHOST;
+        error = getaddrinfo(addr, NULL, &hints, &res0);
+        if (error == 0) {
+                for (res = res0; res; res = res->ai_next) {
+                        /* cover it up */
+                        res->ai_flags = pai->ai_flags;
+
+                        (void)get_canonname(pai, res, canonname);
+                }
+        } else
+                res0 = NULL;
+        if (res0) {
+                cur->ai_next = res0;
+                while (cur && cur->ai_next)
+                        cur = cur->ai_next;
+        }
+
+        if (nextline) {
+                p = nextline;
+                goto nextline;
+        }
+
+done:
+        return sentinel.ai_next;
+}
+
+/*ARGSUSED*/
+static struct addrinfo *
+_yp_getaddrinfo(const char *name, const struct addrinfo *pai)
+{
+        struct addrinfo sentinel, *cur;
+        struct addrinfo *ai = NULL;
+        static char *__ypcurrent;
+        int __ypcurrentlen, r;
+
+        memset(&sentinel, 0, sizeof(sentinel));
+        cur = &sentinel;
+
+        if (!__ypdomain) {
+                if (_yp_check(&__ypdomain) == 0)
+                        return NULL;
+        }
+        if (__ypcurrent)
+                free(__ypcurrent);
+        __ypcurrent = NULL;
+
+        /* hosts.byname is only for IPv4 (Solaris8) */
+        if (pai->ai_family == PF_UNSPEC || pai->ai_family == PF_INET) {
+                r = yp_match(__ypdomain, "hosts.byname", name,
+                        (int)strlen(name), &__ypcurrent, &__ypcurrentlen);
+                if (r == 0) {
+                        struct addrinfo ai4;
+
+                        ai4 = *pai;
+                        ai4.ai_family = AF_INET;
+                        ai = _yphostent(__ypcurrent, &ai4);
+                        if (ai) {
+                                cur->ai_next = ai;
+                                while (cur && cur->ai_next)
+                                        cur = cur->ai_next;
+                        }
+                }
+        }
+
+        /* ipnodes.byname can hold both IPv4/v6 */
+        r = yp_match(__ypdomain, "ipnodes.byname", name,
+                (int)strlen(name), &__ypcurrent, &__ypcurrentlen);
+        if (r == 0) {
+                ai = _yphostent(__ypcurrent, pai);
+                if (ai) {
+                        cur->ai_next = ai;
+                        while (cur && cur->ai_next)
+                                cur = cur->ai_next;
+                }
+        }
+
+        return sentinel.ai_next;
+}
+#endif
+
+
+/* resolver logic */
+
+extern const char *__hostalias(const char *);
+extern int h_errno;
+extern int res_opt(int, u_char *, int, int);
+
+/*
+ * Formulate a normal query, send, and await answer.
+ * Returned answer is placed in supplied buffer "answer".
+ * Perform preliminary check of answer, returning success only
+ * if no error is indicated and the answer count is nonzero.
+ * Return the size of the response on success, -1 on error.
+ * Error number is left in h_errno.
+ *
+ * Caller must parse answer and determine whether it answers the question.
+ */
+static int
+res_queryN(const char *name, struct res_target *target)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        u_char *buf;
+        HEADER *hp;
+        int n;
+        struct res_target *t;
+        int rcode;
+        int ancount;
+
+        buf = malloc(MAXPACKET);
+        if (buf == NULL) {
+                h_errno = NETDB_INTERNAL;
+                return (-1);
+        }
+
+        rcode = NOERROR;
+        ancount = 0;
+
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                free(buf);
+                return (-1);
+        }
+
+        for (t = target; t; t = t->next) {
+                int class, type;
+                u_char *answer;
+                int anslen;
+
+                hp = (HEADER *)(void *)t->answer;
+                hp->rcode = NOERROR;    /* default */
+
+                /* make it easier... */
+                class = t->qclass;
+                type = t->qtype;
+                answer = t->answer;
+                anslen = t->anslen;
+#ifdef DEBUG
+                if (_resp->options & RES_DEBUG)
+                        printf(";; res_query(%s, %d, %d)\n", name, class, type);
+#endif
+
+                n = res_mkquery(QUERY, name, class, type, NULL, 0, NULL,
+                    buf, MAXPACKET);
+                if (n > 0 && (_resp->options & RES_USE_EDNS0) != 0)
+                        n = res_opt(n, buf, MAXPACKET, anslen);
+                if (n <= 0) {
+#ifdef DEBUG
+                        if (_resp->options & RES_DEBUG)
+                                printf(";; res_query: mkquery failed\n");
+#endif
+                        h_errno = NO_RECOVERY;
+                        free(buf);
+                        return (n);
+                }
+                n = res_send(buf, n, answer, anslen);
+#if 0
+                if (n < 0) {
+#ifdef DEBUG
+                        if (_resp->options & RES_DEBUG)
+                                printf(";; res_query: send error\n");
+#endif
+                        h_errno = TRY_AGAIN;
+                        free(buf);
+                        return (n);
+                }
+#endif
+
+                if (n < 0 || hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
+                        rcode = hp->rcode;      /* record most recent error */
+#ifdef DEBUG
+                        if (_resp->options & RES_DEBUG)
+                                printf(";; rcode = %u, ancount=%u\n", hp->rcode,
+                                    ntohs(hp->ancount));
+#endif
+                        continue;
+                }
+
+                ancount += ntohs(hp->ancount);
+
+                t->n = n;
+        }
+
+        if (ancount == 0) {
+                switch (rcode) {
+                case NXDOMAIN:
+                        h_errno = HOST_NOT_FOUND;
+                        break;
+                case SERVFAIL:
+                        h_errno = TRY_AGAIN;
+                        break;
+                case NOERROR:
+                        h_errno = NO_DATA;
+                        break;
+                case FORMERR:
+                case NOTIMP:
+                case REFUSED:
+                default:
+                        h_errno = NO_RECOVERY;
+                        break;
+                }
+                free(buf);
+                return (-1);
+        }
+        free(buf);
+        return (ancount);
+}
+
+/*
+ * Formulate a normal query, send, and retrieve answer in supplied buffer.
+ * Return the size of the response on success, -1 on error.
+ * If enabled, implement search rules until answer or unrecoverable failure
+ * is detected.  Error code, if any, is left in h_errno.
+ */
+static int
+res_searchN(const char *name, struct res_target *target)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        const char *cp, * const *domain;
+        HEADER *hp = (HEADER *)(void *)target->answer;  /*XXX*/
+        u_int dots;
+        int trailing_dot, ret, saved_herrno;
+        int got_nodata = 0, got_servfail = 0, tried_as_is = 0;
+
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                return (-1);
+        }
+
+        errno = 0;
+        h_errno = HOST_NOT_FOUND;       /* default, if we never query */
+        dots = 0;
+        for (cp = name; *cp; cp++)
+                dots += (*cp == '.');
+        trailing_dot = 0;
+        if (cp > name && *--cp == '.')
+                trailing_dot++;
+
+        /*
+         * if there aren't any dots, it could be a user-level alias
+         */
+        if (!dots && (cp = __hostalias(name)) != NULL)
+                return (res_queryN(cp, target));
+
+        /*
+         * If there are dots in the name already, let's just give it a try
+         * 'as is'.  The threshold can be set with the "ndots" option.
+         */
+        saved_herrno = -1;
+        if (dots >= _resp->ndots) {
+                ret = res_querydomainN(name, NULL, target);
+                if (ret > 0)
+                        return (ret);
+                saved_herrno = h_errno;
+                tried_as_is++;
+        }
+
+        /*
+         * We do at least one level of search if
+         *      - there is no dot and RES_DEFNAME is set, or
+         *      - there is at least one dot, there is no trailing dot,
+         *        and RES_DNSRCH is set.
+         */
+        if ((!dots && (_resp->options & RES_DEFNAMES)) ||
+            (dots && !trailing_dot && (_resp->options & RES_DNSRCH))) {
+                int done = 0;
+
+                for (domain = (const char * const *)_resp->dnsrch;
+                   *domain && !done;
+                   domain++) {
+
+                        ret = res_querydomainN(name, *domain, target);
+                        if (ret > 0)
+                                return (ret);
+
+                        /*
+                         * If no server present, give up.
+                         * If name isn't found in this domain,
+                         * keep trying higher domains in the search list
+                         * (if that's enabled).
+                         * On a NO_DATA error, keep trying, otherwise
+                         * a wildcard entry of another type could keep us
+                         * from finding this entry higher in the domain.
+                         * If we get some other error (negative answer or
+                         * server failure), then stop searching up,
+                         * but try the input name below in case it's
+                         * fully-qualified.
+                         */
+                        if (errno == ECONNREFUSED) {
+                                h_errno = TRY_AGAIN;
+                                return (-1);
+                        }
+
+                        switch (h_errno) {
+                        case NO_DATA:
+                                got_nodata++;
+                                /* FALLTHROUGH */
+                        case HOST_NOT_FOUND:
+                                /* keep trying */
+                                break;
+                        case TRY_AGAIN:
+                                if (hp->rcode == SERVFAIL) {
+                                        /* try next search element, if any */
+                                        got_servfail++;
+                                        break;
+                                }
+                                /* FALLTHROUGH */
+                        default:
+                                /* anything else implies that we're done */
+                                done++;
+                        }
+                        /*
+                         * if we got here for some reason other than DNSRCH,
+                         * we only wanted one iteration of the loop, so stop.
+                         */
+                        if (!(_resp->options & RES_DNSRCH))
+                                done++;
+                }
+        }
+
+        /*
+         * if we have not already tried the name "as is", do that now.
+         * note that we do this regardless of how many dots were in the
+         * name or whether it ends with a dot.
+         */
+        if (!tried_as_is) {
+                ret = res_querydomainN(name, NULL, target);
+                if (ret > 0)
+                        return (ret);
+        }
+
+        /*
+         * if we got here, we didn't satisfy the search.
+         * if we did an initial full query, return that query's h_errno
+         * (note that we wouldn't be here if that query had succeeded).
+         * else if we ever got a nodata, send that back as the reason.
+         * else send back meaningless h_errno, that being the one from
+         * the last DNSRCH we did.
+         */
+        if (saved_herrno != -1)
+                h_errno = saved_herrno;
+        else if (got_nodata)
+                h_errno = NO_DATA;
+        else if (got_servfail)
+                h_errno = TRY_AGAIN;
+        return (-1);
+}
+
+/*
+ * Perform a call on res_query on the concatenation of name and domain,
+ * removing a trailing dot from name if domain is NULL.
+ */
+static int
+res_querydomainN(const char *name, const char *domain,
+    struct res_target *target)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        char nbuf[MAXDNAME];
+        const char *longname = nbuf;
+        size_t len;
+
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                return (-1);
+        }
+#ifdef DEBUG
+        if (_resp->options & RES_DEBUG)
+                printf(";; res_querydomain(%s, %s)\n",
+                        name, domain?domain:"<Nil>");
+#endif
+        if (domain == NULL) {
+                /*
+                 * Check for trailing '.';
+                 * copy without '.' if present.
+                 */
+                len = strlcpy(nbuf, name, sizeof(nbuf));
+                if (len >= sizeof(nbuf)) {
+                        h_errno = NO_RECOVERY;
+                        return (-1);
+                }
+                if (len > 0 && nbuf[len - 1] == '.')
+                        nbuf[len - 1] = '\0';
+        } else {
+                int i;
+
+                i = snprintf(nbuf, sizeof(nbuf), "%s.%s", name, domain);
+                if (i < 0 || i >= sizeof(nbuf)) {
+                        h_errno = NO_RECOVERY;
+                        return (-1);
+                }
+        }
+        return (res_queryN(longname, target));
+}
diff --git a/src/lib/libc/net/gethostbyname.3 b/src/lib/libc/net/gethostbyname.3
index bac0368296..1a05460da4 100644
--- a/src/lib/libc/net/gethostbyname.3
+++ b/src/lib/libc/net/gethostbyname.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: gethostbyname.3,v 1.6 1995/02/25 06:20:28 cgd Exp $
+.\"     $OpenBSD: gethostbyname.3,v 1.25 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1987, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,58 +27,66 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)gethostbyname.3     8.2 (Berkeley) 4/19/94
-.\"
-.Dd April 19, 1994
+.Dd $Mdocdate: May 31 2007 $
 .Dt GETHOSTBYNAME 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm gethostbyname ,
+.Nm gethostbyname2 ,
 .Nm gethostbyaddr ,
 .Nm gethostent ,
 .Nm sethostent ,
 .Nm endhostent ,
+.Nm hstrerror ,
 .Nm herror
 .Nd get network host entry
 .Sh SYNOPSIS
 .Fd #include <netdb.h>
-.Fd extern int h_errno;
+.Vt extern int h_errno ;
 .Ft struct hostent *
 .Fn gethostbyname "const char *name"
 .Ft struct hostent *
-.Fn gethostbyaddr "const char *addr" "int len" "int type"
+.Fn gethostbyname2 "const char *name" "int af"
+.Ft struct hostent *
+.Fn gethostbyaddr "const void *addr" "socklen_t len" "int af"
 .Ft struct hostent *
 .Fn gethostent void
+.Ft void
 .Fn sethostent "int stayopen"
+.Ft void
 .Fn endhostent void
-.Fn herror "char *string"
+.Ft void
+.Fn herror "const char *string"
+.Ft const char *
+.Fn hstrerror "int err"
 .Sh DESCRIPTION
 The
-.Fn gethostbyname
+.Fn gethostbyname ,
+.Fn gethostbyname2 ,
 and
 .Fn gethostbyaddr
-functions
-each return a pointer to an object with the
-following structure describing an internet host
-referenced by name or by address, respectively.
-This structure contains either the information obtained from the name server,
-.Xr named 8 ,
-broken-out fields from a line in 
+functions each return a pointer to an object with the following structure
+describing an Internet host referenced by name or by address, respectively.
+This structure contains either information obtained from the name server (i.e.,
+.Xr resolver 3
+and
+.Xr named 8 ) ,
+broken-out fields from a line in
 .Pa /etc/hosts ,
 or database entries supplied by the
 .Xr yp 8
-system .
-If the local name server is not running these routines do a lookup in
-.Pa /etc/hosts .
-.Bd -literal
+system.
+.Xr resolv.conf 5
+describes how the particular database is chosen.
+.Bd -literal -offset indent
 struct  hostent {
         char    *h_name;        /* official name of host */
         char    **h_aliases;    /* alias list */
         int     h_addrtype;     /* host address type */
         int     h_length;       /* length of address */
-        char    **h_addr_list;  /* list of addresses from name server */
+        char    **h_addr_list;  /* list of returned addresses */
 };
-#define h_addr  h_addr_list[0]  /* address, for backward compatibility */
+#define h_addr  h_addr_list[0]  /* address, for backward compat */
 .Ed
 .Pp
 The members of this structure are:
@@ -90,36 +94,50 @@ The members of this structure are:
 .It Fa h_name
 Official name of the host.
 .It Fa h_aliases
-A zero terminated array of alternate names for the host.
+A null-terminated array of alternate names for the host.
 .It Fa h_addrtype
-The type of address being returned; currently always
-.Dv AF_INET .
+The type of address being returned.
 .It Fa h_length
 The length, in bytes, of the address.
 .It Fa h_addr_list
-A zero terminated array of network addresses for the host.
+A null-terminated array of network addresses for the host.
 Host addresses are returned in network byte order.
 .It Fa h_addr
 The first address in
 .Fa h_addr_list ;
 this is for backward compatibility.
+.El
 .Pp
-When using the nameserver,
+The function
 .Fn gethostbyname
 will search for the named host in the current domain and its parents
-unless the name ends in a dot.
-If the name contains no dot, and if the environment variable
-.Dq Ev HOSTALIASES
-contains the name of an alias file, the alias file will first be searched
-for an alias matching the input name.
-See
-.Xr hostname 7
-for the domain search procedure and the alias file format.
+using the search lookup semantics detailed in
+.Xr resolv.conf 5
+and
+.Xr hostname 7 .
+.Pp
+.Fn gethostbyname2
+is an advanced form of
+.Fn gethostbyname
+which allows lookups in address families other than
+.Dv AF_INET .
+Currently, the only supported address family besides
+.Dv AF_INET
+is
+.Dv AF_INET6 .
+.Pp
+The
+.Fn gethostbyaddr
+function will search for the specified address of length
+.Fa len
+in the address family
+.Fa af .
+The only address family currently supported is
+.Dv AF_INET .
 .Pp
 The
 .Fn sethostent
-function
-may be used to request the use of a connected
+function may be used to request the use of a connected
 .Tn TCP
 socket for queries.
 If the
@@ -127,7 +145,7 @@ If the
 flag is non-zero,
 this sets the option to send all queries to the name server using
 .Tn TCP
-and to retain the connection after each call to 
+and to retain the connection after each call to
 .Fn gethostbyname
 or
 .Fn gethostbyaddr .
@@ -137,17 +155,46 @@ datagrams.
 .Pp
 The
 .Fn endhostent
-function
-closes the
+function closes the
 .Tn TCP
 connection.
+.Pp
+The
+.Fn herror
+function prints an error message describing the failure.
+If its argument
+.Fa string
+is non-null,
+it is prepended to the message string and separated from it by a colon
+.Pq Ql \&:
+and a space.
+The error message is printed with a trailing newline.
+The contents of the error message is the same as that returned by
+.Fn hstrerror
+with argument
+.Fa h_errno .
+.Sh ENVIRONMENT
+.Bl -tag -width HOSTALIASES
+.It HOSTALIASES
+A file containing local host aliases.
+See
+.Xr hostname 7
+for more information.
+.It RES_OPTIONS
+A list of options to override the resolver's internal defaults.
+See
+.Xr resolver 3
+for more information.
+.El
 .Sh FILES
-.Bl -tag -width /etc/hosts -compact
+.Bl -tag -width /etc/resolv.conf -compact
 .It Pa /etc/hosts
+.It Pa /etc/resolv.conf
 .El
 .Sh DIAGNOSTICS
-Error return status from 
-.Fn gethostbyname
+Error return status from
+.Fn gethostbyname ,
+.Fn gethostbyname2 ,
 and
 .Fn gethostbyaddr
 is indicated by return of a null pointer.
@@ -155,15 +202,6 @@ The external integer
 .Va h_errno
 may then be checked to see whether this is a temporary failure
 or an invalid or unknown host.
-The routine
-.Fn herror
-can be used to print an error message describing the failure.
-If its argument
-.Fa string
-is
-.Pf non Dv -NULL ,
-it is printed, followed by a colon and a space.
-The error message is printed with a trailing newline.
 .Pp
 The variable
 .Va h_errno
@@ -180,75 +218,80 @@ A retry at some later time may succeed.
 Some unexpected server failure was encountered.
 This is a non-recoverable error.
 .It Dv NO_DATA
-The requested name is valid but does not have an IP address; 
-this is not a temporary error.  
+The requested name is valid but does not have an IP address;
+this is not a temporary error.
 This means that the name is known to the name server but there is no address
 associated with this name.
 Another type of request to the name server using this domain name
 will result in an answer;
 for example, a mail-forwarder may be registered for this domain.
+.It Dv NETDB_INTERNAL
+An internal error occurred.
+This may occur when an address family other than
+.Dv AF_INET
+or
+.Dv AF_INET6
+is specified or when a resource is unable to be allocated.
+.It Dv NETDB_SUCCESS
+The function completed successfully.
 .El
 .Sh SEE ALSO
+.Xr getaddrinfo 3 ,
+.Xr getnameinfo 3 ,
 .Xr resolver 3 ,
 .Xr hosts 5 ,
+.Xr resolv.conf 5 ,
 .Xr hostname 7 ,
 .Xr named 8
-.Sh CAVEAT
+.Sh HISTORY
 The
-.Fn gethostent
-function
-is defined, and
-.Fn sethostent
+.Fn herror
+function appeared in
+.Bx 4.3 .
+The
+.Fn endhostent ,
+.Fn gethostbyaddr ,
+.Fn gethostbyname ,
+.Fn gethostent ,
 and
-.Fn endhostent
-are redefined,
-when
-.Xr libc 3
-is built to use only the routines to lookup in
+.Fn sethostent
+functions appeared in
+.Bx 4.2 .
+.Sh CAVEATS
+If the search routines in
+.Xr resolv.conf 5
+decide to read the
 .Pa /etc/hosts
-and not the name server.
-.Pp
-The
+file,
 .Fn gethostent
-function
-reads the next line of
-.Pa /etc/hosts ,
-opening the file if necessary.
+and other functions will
+read the next line of the file,
+re-opening the file if necessary.
 .Pp
 The
 .Fn sethostent
-function
-opens and/or rewinds the file
+function opens and/or rewinds the file
 .Pa /etc/hosts .
 If the
 .Fa stayopen
-argument is non-zero,
-the file will not be closed after each call to
-.Fn gethostbyname
+argument is non-zero, the file will not be closed after each call to
+.Fn gethostbyname ,
+.Fn gethostbyname2 ,
 or
 .Fn gethostbyaddr .
 .Pp
 The
 .Fn endhostent
-function
-closes the file.
-.Sh HISTORY
-The
-.Fn herror
-function appeared in 
-.Bx 4.3 .
-The
-.Fn endhostent ,
-.Fn gethostbyaddr ,
-.Fn gethostbyname ,
-.Fn gethostent ,
-and
-.Fn sethostent
-functions appeared in
-.Bx 4.2 .
+function closes the file.
 .Sh BUGS
 These functions use static data storage;
 if the data is needed for future use, it should be
 copied before any subsequent calls overwrite it.
+.Pp
 Only the Internet
-address format is currently understood.
+address formats are currently understood.
+.Pp
+YP does not support any address families other than
+.Dv AF_INET
+and uses
+the traditional database format.
diff --git a/src/lib/libc/net/gethostnamadr.c b/src/lib/libc/net/gethostnamadr.c
index ec3f14a900..f4e655eeaf 100644
--- a/src/lib/libc/net/gethostnamadr.c
+++ b/src/lib/libc/net/gethostnamadr.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: gethostnamadr.c,v 1.13 1995/05/21 16:21:14 mycroft Exp $       */
-
+/*      $OpenBSD: gethostnamadr.c,v 1.73 2009/11/18 07:43:22 guenther Exp $ */
 /*-
  * Copyright (c) 1985, 1988, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -53,15 +48,6 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)gethostnamadr.c     8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: gethnamaddr.c,v 4.9.1.1 1993/05/02 22:43:03 vixie Rel ";
-#else
-static char rcsid[] = "$NetBSD: gethostnamadr.c,v 1.13 1995/05/21 16:21:14 mycroft Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
@@ -73,11 +59,17 @@ static char rcsid[] = "$NetBSD: gethostnamadr.c,v 1.13 1995/05/21 16:21:14 mycro
 #include <ctype.h>
 #include <errno.h>
 #include <string.h>
+#include <syslog.h>
+#include <stdlib.h>
 #ifdef YP
 #include <rpc/rpc.h>
-#include <rpcsvc/yp_prot.h>
+#include <rpcsvc/yp.h>
 #include <rpcsvc/ypclnt.h>
+#include "ypinternal.h"
 #endif
+#include "thread_private.h"
+
+#define MULTI_PTRS_ARE_ALIASES 1        /* XXX - experimental */
 
 #define MAXALIASES      35
 #define MAXADDRS        35
@@ -91,47 +83,101 @@ static char *__ypdomain;
 static struct hostent host;
 static char *host_aliases[MAXALIASES];
 static char hostbuf[BUFSIZ+1];
-static struct in_addr host_addr;
+static union {
+        struct in_addr _host_in_addr;
+        u_char _host_addr[16];          /* IPv4 or IPv6 */
+} _host_addr_u;
+#define host_addr _host_addr_u._host_addr
 static FILE *hostf = NULL;
 static int stayopen = 0;
 
-#if PACKETSZ > 1024
-#define MAXPACKET       PACKETSZ
-#else
-#define MAXPACKET       1024
+static void map_v4v6_address(const char *src, char *dst);
+static void map_v4v6_hostent(struct hostent *hp, char **bp, char *);
+
+#ifdef RESOLVSORT
+static void addrsort(char **, int);
 #endif
 
+int _hokchar(const char *);
+
+static const char AskedForGot[] =
+                          "gethostby*.getanswer: asked for \"%s\", got \"%s\"";
+
+#define MAXPACKET       (64*1024)
+
 typedef union {
         HEADER hdr;
         u_char buf[MAXPACKET];
 } querybuf;
 
 typedef union {
-    int32_t al;
-    char ac;
+        int32_t al;
+        char ac;
 } align;
 
-static int qcomp __P((struct in_addr **, struct in_addr **));
-static struct hostent *getanswer __P((querybuf *, int, int));
+static struct hostent *getanswer(const querybuf *, int, const char *, int);
 
 extern int h_errno;
 
+int
+_hokchar(const char *p)
+{
+        char c;
+
+        /*
+         * Many people do not obey RFC 822 and 1035.  The valid
+         * characters are a-z, A-Z, 0-9, '-' and . But the others
+         * tested for below can happen, and we must be more permissive
+         * than the resolver until those idiots clean up their act.
+         * We let '/' through, but not '..'
+         */
+        while ((c = *p++)) {
+                if (('a' <= c && c <= 'z') ||
+                    ('A' <= c && c <= 'Z') ||
+                    ('0' <= c && c <= '9'))
+                        continue;
+                if (strchr("-_/", c))
+                        continue;
+                if (c == '.' && *p != '.')
+                        continue;
+                return 0;
+        }
+        return 1;
+}
+
 static struct hostent *
-getanswer(answer, anslen, iquery)
-        querybuf *answer;
-        int anslen;
-        int iquery;
+getanswer(const querybuf *answer, int anslen, const char *qname, int qtype)
 {
-        register HEADER *hp;
-        register u_char *cp;
-        register int n;
-        u_char *eom;
-        char *bp, **ap;
-        int type, class, buflen, ancount, qdcount;
-        int haveanswer, getclass = C_ANY;
-        char **hap;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        const HEADER *hp;
+        const u_char *cp, *eom;
+        char tbuf[MAXDNAME];
+        char *bp, **ap, **hap, *ep;
+        int type, class, ancount, qdcount, n;
+        int haveanswer, had_error, toobig = 0;
+        const char *tname;
+        int (*name_ok)(const char *);
 
+        tname = qname;
+        host.h_name = NULL;
         eom = answer->buf + anslen;
+        switch (qtype) {
+        case T_A:
+        case T_AAAA:
+#ifdef USE_RESOLV_NAME_OK
+                name_ok = res_hnok;
+                break;
+#endif
+        case T_PTR:
+#ifdef USE_RESOLV_NAME_OK
+                name_ok = res_dnok;
+#else
+                name_ok = _hokchar;
+#endif
+                break;
+        default:
+                return (NULL);
+        }
         /*
          * find first satisfactory answer
          */
@@ -139,31 +185,27 @@ getanswer(answer, anslen, iquery)
         ancount = ntohs(hp->ancount);
         qdcount = ntohs(hp->qdcount);
         bp = hostbuf;
-        buflen = sizeof(hostbuf);
-        cp = answer->buf + sizeof(HEADER);
-        if (qdcount) {
-                if (iquery) {
-                        if ((n = dn_expand((u_char *)answer->buf,
-                            (u_char *)eom, (u_char *)cp, (u_char *)bp,
-                            buflen)) < 0) {
-                                h_errno = NO_RECOVERY;
-                                return ((struct hostent *) NULL);
-                        }
-                        cp += n + QFIXEDSZ;
-                        host.h_name = bp;
-                        n = strlen(bp) + 1;
-                        bp += n;
-                        buflen -= n;
-                } else
-                        cp += __dn_skipname(cp, eom) + QFIXEDSZ;
-                while (--qdcount > 0)
-                        cp += __dn_skipname(cp, eom) + QFIXEDSZ;
-        } else if (iquery) {
-                if (hp->aa)
-                        h_errno = HOST_NOT_FOUND;
-                else
-                        h_errno = TRY_AGAIN;
-                return ((struct hostent *) NULL);
+        ep = hostbuf + sizeof hostbuf;
+        cp = answer->buf + HFIXEDSZ;
+        if (qdcount != 1) {
+                h_errno = NO_RECOVERY;
+                return (NULL);
+        }
+        n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+        if ((n < 0) || !(*name_ok)(bp)) {
+                h_errno = NO_RECOVERY;
+                return (NULL);
+        }
+        cp += n + QFIXEDSZ;
+        if (qtype == T_A || qtype == T_AAAA) {
+                /* res_send() has already verified that the query name is the
+                 * same as the one we sent; this just gets the expanded name
+                 * (i.e., with the succeeding search-domain tacked on).
+                 */
+                host.h_name = bp;
+                bp += strlen(bp) + 1;           /* for the \0 */
+                /* The qname can be abbreviated, but h_name is now absolute. */
+                qname = host.h_name;
         }
         ap = host_aliases;
         *ap = NULL;
@@ -172,103 +214,325 @@ getanswer(answer, anslen, iquery)
         *hap = NULL;
         host.h_addr_list = h_addr_ptrs;
         haveanswer = 0;
-        while (--ancount >= 0 && cp < eom) {
-                if ((n = dn_expand((u_char *)answer->buf, (u_char *)eom,
-                    (u_char *)cp, (u_char *)bp, buflen)) < 0)
+        had_error = 0;
+        while (ancount-- > 0 && cp < eom && !had_error) {
+                size_t len;
+
+                n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+                if ((n < 0) || !(*name_ok)(bp)) {
+                        had_error++;
+                        continue;
+                }
+                cp += n;                        /* name */
+                if (cp >= eom)
                         break;
-                cp += n;
                 type = _getshort(cp);
-                cp += sizeof(u_int16_t);
+                cp += INT16SZ;                  /* type */
+                if (cp >= eom)
+                        break;
                 class = _getshort(cp);
-                cp += sizeof(u_int16_t) + sizeof(u_int32_t);
+                cp += INT16SZ + INT32SZ;        /* class, TTL */
+                if (cp >= eom)
+                        break;
                 n = _getshort(cp);
-                cp += sizeof(u_int16_t);
-                if (type == T_CNAME) {
+                cp += INT16SZ;                  /* len */
+                if (cp >= eom)
+                        break;
+                if (type == T_SIG || type == T_RRSIG) {
+                        /* XXX - ignore signatures as we don't use them yet */
                         cp += n;
-                        if (ap >= &host_aliases[MAXALIASES-1])
-                                continue;
-                        *ap++ = bp;
-                        n = strlen(bp) + 1;
-                        bp += n;
-                        buflen -= n;
                         continue;
                 }
-                if (iquery && type == T_PTR) {
-                        if ((n = dn_expand((u_char *)answer->buf,
-                            (u_char *)eom, (u_char *)cp, (u_char *)bp,
-                            buflen)) < 0)
-                                break;
+                if (class != C_IN) {
+                        /* XXX - debug? syslog? */
                         cp += n;
+                        continue;               /* XXX - had_error++ ? */
+                }
+                if ((qtype == T_A || qtype == T_AAAA) && type == T_CNAME) {
+                        if (ap >= &host_aliases[MAXALIASES-1])
+                                continue;
+                        n = dn_expand(answer->buf, eom, cp, tbuf, sizeof tbuf);
+                        if ((n < 0) || !(*name_ok)(tbuf)) {
+                                had_error++;
+                                continue;
+                        }
+                        cp += n;
+                        /* Store alias. */
+                        *ap++ = bp;
+                        bp += strlen(bp) + 1;   /* for the \0 */
+                        /* Get canonical name. */
+                        len = strlen(tbuf) + 1; /* for the \0 */
+                        if (len > ep - bp) {
+                                had_error++;
+                                continue;
+                        }
+                        strlcpy(bp, tbuf, ep - bp);
                         host.h_name = bp;
-                        return(&host);
+                        bp += len;
+                        continue;
                 }
-                if (iquery || type != T_A)  {
-#ifdef DEBUG
-                        if (_res.options & RES_DEBUG)
-                                printf("unexpected answer type %d, size %d\n",
-                                        type, n);
+                if (qtype == T_PTR && type == T_CNAME) {
+                        n = dn_expand(answer->buf, eom, cp, tbuf, sizeof tbuf);
+#ifdef USE_RESOLV_NAME_OK
+                        if ((n < 0) || !res_hnok(tbuf)) {
+#else
+                        if ((n < 0) || !_hokchar(tbuf)) {
 #endif
+                                had_error++;
+                                continue;
+                        }
                         cp += n;
+                        /* Get canonical name. */
+                        len = strlen(tbuf) + 1; /* for the \0 */
+                        if (len > ep - bp) {
+                                had_error++;
+                                continue;
+                        }
+                        strlcpy(bp, tbuf, ep - bp);
+                        tname = bp;
+                        bp += len;
                         continue;
                 }
-                if (haveanswer) {
-                        if (n != host.h_length) {
+                if (type != qtype) {
+#ifndef NO_LOG_BAD_DNS_RESPONSES
+                        syslog(LOG_NOTICE|LOG_AUTH,
+               "gethostby*.getanswer: asked for \"%s %s %s\", got type \"%s\"",
+                               qname, p_class(C_IN), p_type(qtype),
+                               p_type(type));
+#endif /* NO_LOG_BAD_DNS_RESPONSES */
+                        cp += n;
+                        continue;               /* XXX - had_error++ ? */
+                }
+                switch (type) {
+                case T_PTR:
+                        if (strcasecmp(tname, bp) != 0) {
+                                syslog(LOG_NOTICE|LOG_AUTH,
+                                       AskedForGot, qname, bp);
                                 cp += n;
-                                continue;
+                                continue;       /* XXX - had_error++ ? */
+                        }
+                        n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+#ifdef USE_RESOLV_NAME_OK
+                        if ((n < 0) || !res_hnok(bp)) {
+#else
+                        if ((n < 0) || !_hokchar(bp)) {
+#endif
+                                had_error++;
+                                break;
+                        }
+#if MULTI_PTRS_ARE_ALIASES
+                        cp += n;
+                        if (!haveanswer)
+                                host.h_name = bp;
+                        else if (ap < &host_aliases[MAXALIASES-1])
+                                *ap++ = bp;
+                        else
+                                n = -1;
+                        if (n != -1) {
+                                n = strlen(bp) + 1;     /* for the \0 */
+                                bp += n;
+                        }
+                        break;
+#else
+                        host.h_name = bp;
+                        if (_resp->options & RES_USE_INET6) {
+                                n = strlen(bp) + 1;     /* for the \0 */
+                                bp += n;
+                                map_v4v6_hostent(&host, &bp, ep);
+                        }
+                        h_errno = NETDB_SUCCESS;
+                        return (&host);
+#endif
+                case T_A:
+                case T_AAAA:
+                        if (strcasecmp(host.h_name, bp) != 0) {
+                                syslog(LOG_NOTICE|LOG_AUTH,
+                                       AskedForGot, host.h_name, bp);
+                                cp += n;
+                                continue;       /* XXX - had_error++ ? */
                         }
-                        if (class != getclass) {
+                        if (n != host.h_length) {
                                 cp += n;
                                 continue;
                         }
-                } else {
-                        host.h_length = n;
-                        getclass = class;
-                        host.h_addrtype = (class == C_IN) ? AF_INET : AF_UNSPEC;
-                        if (!iquery) {
+                        if (type == T_AAAA) {
+                                struct in6_addr in6;
+                                memcpy(&in6, cp, IN6ADDRSZ);
+                                if (IN6_IS_ADDR_V4MAPPED(&in6)) {
+                                        cp += n;
+                                        continue;
+                                }
+                        }
+                        if (!haveanswer) {
                                 host.h_name = bp;
-                                bp += strlen(bp) + 1;
+                                bp += strlen(bp) + 1;   /* for the \0 */
                         }
-                }
 
-                bp += sizeof(align) - ((u_long)bp % sizeof(align));
+                        bp += sizeof(align) - ((u_long)bp % sizeof(align));
 
-                if (bp + n >= &hostbuf[sizeof(hostbuf)]) {
+                        if (bp + n >= &hostbuf[sizeof hostbuf]) {
 #ifdef DEBUG
-                        if (_res.options & RES_DEBUG)
-                                printf("size (%d) too big\n", n);
+                                if (_resp->options & RES_DEBUG)
+                                        printf("size (%d) too big\n", n);
 #endif
+                                had_error++;
+                                continue;
+                        }
+                        if (hap >= &h_addr_ptrs[MAXADDRS-1]) {
+                                if (!toobig++)
+#ifdef DEBUG
+                                        if (_resp->options & RES_DEBUG)
+                                                printf("Too many addresses (%d)\n", MAXADDRS);
+#endif
+                                cp += n;
+                                continue;
+                        }
+                        bcopy(cp, *hap++ = bp, n);
+                        bp += n;
+                        cp += n;
                         break;
                 }
-                bcopy(cp, *hap++ = bp, n);
-                bp +=n;
-                cp += n;
-                haveanswer++;
+                if (!had_error)
+                        haveanswer++;
         }
         if (haveanswer) {
                 *ap = NULL;
                 *hap = NULL;
-                if (_res.nsort) {
-                        qsort(host.h_addr_list, haveanswer,
-                            sizeof(struct in_addr),
-                            (int (*)__P((const void *, const void *)))qcomp);
+# if defined(RESOLVSORT)
+                /*
+                 * Note: we sort even if host can take only one address
+                 * in its return structures - should give it the "best"
+                 * address in that case, not some random one
+                 */
+                if (_resp->nsort && haveanswer > 1 && qtype == T_A)
+                        addrsort(h_addr_ptrs, haveanswer);
+# endif /*RESOLVSORT*/
+                if (!host.h_name) {
+                        size_t len;
+
+                        len = strlen(qname) + 1;
+                        if (len > ep - bp)      /* for the \0 */
+                                goto try_again;
+                        strlcpy(bp, qname, ep - bp);
+                        host.h_name = bp;
+                        bp += len;
                 }
+                if (_resp->options & RES_USE_INET6)
+                        map_v4v6_hostent(&host, &bp, ep);
+                h_errno = NETDB_SUCCESS;
                 return (&host);
-        } else {
-                h_errno = TRY_AGAIN;
-                return ((struct hostent *) NULL);
         }
+ try_again:
+        h_errno = TRY_AGAIN;
+        return (NULL);
 }
 
+#ifdef notyet
+/*
+ * XXX This is an extremely bogus implementation.
+ *
+ * FreeBSD has this interface:
+ *    int gethostbyaddr_r(const char *addr, int len, int type,
+ *             struct hostent *result, struct hostent_data *buffer)
+ */
+
+struct hostent *
+gethostbyname_r(const char *name, struct hostent *hp, char *buf, int buflen,
+    int *errorp)
+{
+        struct hostent *res;
+
+        res = gethostbyname(name);
+        *errorp = h_errno;
+        if (res == NULL)
+                return NULL;
+        memcpy(hp, res, sizeof *hp); /* XXX not sufficient */
+        return hp;
+}
+
+/*
+ * XXX This is an extremely bogus implementation.
+ */
 struct hostent *
-gethostbyname(name)
-        const char *name;
+gethostbyaddr_r(const char *addr, int len, int af, struct hostent *he,
+    char *buf, int buflen, int *errorp)
 {
-        querybuf buf;
-        register const char *cp;
-        int n, i;
-        extern struct hostent *_gethtbyname(), *_yp_gethtbyname();
-        register struct hostent *hp;
+        struct hostent * res;
+
+        res = gethostbyaddr(addr, len, af);
+        *errorp = h_errno;
+        if (res == NULL)
+                return NULL;
+        memcpy(he, res, sizeof *he); /* XXX not sufficient */
+        return he;
+}
+
+/* XXX RFC2133 expects a gethostbyname2_r() -- unimplemented */
+#endif
+
+struct hostent *
+gethostbyname(const char *name)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        struct hostent *hp;
+        extern struct hostent *_gethtbyname2(const char *, int);
+
+        if (_res_init(0) == -1)
+                hp = _gethtbyname2(name, AF_INET);
+
+        else if (_resp->options & RES_USE_INET6) {
+                hp = gethostbyname2(name, AF_INET6);
+                if (hp == NULL)
+                        hp = gethostbyname2(name, AF_INET);
+        }
+        else
+                hp = gethostbyname2(name, AF_INET);
+        return hp;
+}
+
+struct hostent *
+gethostbyname2(const char *name, int af)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        querybuf *buf;
+        const char *cp;
+        char *bp, *ep;
+        int n, size, type, i;
+        struct hostent *hp;
         char lookups[MAXDNSLUS];
+        extern struct hostent *_gethtbyname2(const char *, int);
+#ifdef YP
+        extern struct hostent *_yp_gethtbyname(const char *);
+#endif
+
+        if (_res_init(0) == -1)
+                return (_gethtbyname2(name, af));
+
+        switch (af) {
+        case AF_INET:
+                size = INADDRSZ;
+                type = T_A;
+                break;
+        case AF_INET6:
+                size = IN6ADDRSZ;
+                type = T_AAAA;
+                break;
+        default:
+                h_errno = NETDB_INTERNAL;
+                errno = EAFNOSUPPORT;
+                return (NULL);
+        }
+
+        host.h_addrtype = af;
+        host.h_length = size;
+
+        /*
+         * if there aren't any dots, it could be a user-level alias.
+         * this is also done in res_query() since we are not the only
+         * function that looks up host names.
+         */
+        if (!strchr(name, '.') && (cp = __hostalias(name)))
+                name = cp;
 
         /*
          * disallow names consisting only of digits/dots, unless
@@ -284,122 +548,229 @@ gethostbyname(name)
                                  * Fake up a hostent as if we'd actually
                                  * done a lookup.
                                  */
-                                if (!inet_aton(name, &host_addr)) {
+                                if (inet_pton(af, name, host_addr) <= 0) {
                                         h_errno = HOST_NOT_FOUND;
-                                        return((struct hostent *) NULL);
+                                        return (NULL);
                                 }
-                                host.h_name = (char *)name;
+                                strlcpy(hostbuf, name, MAXHOSTNAMELEN);
+                                bp = hostbuf + MAXHOSTNAMELEN;
+                                ep = hostbuf + sizeof(hostbuf);
+                                host.h_name = hostbuf;
                                 host.h_aliases = host_aliases;
                                 host_aliases[0] = NULL;
-                                host.h_addrtype = AF_INET;
-                                host.h_length = sizeof(u_int32_t);
-                                h_addr_ptrs[0] = (char *)&host_addr;
+                                h_addr_ptrs[0] = (char *)host_addr;
                                 h_addr_ptrs[1] = NULL;
                                 host.h_addr_list = h_addr_ptrs;
+                                if (_resp->options & RES_USE_INET6)
+                                        map_v4v6_hostent(&host, &bp, ep);
+                                h_errno = NETDB_SUCCESS;
                                 return (&host);
                         }
                         if (!isdigit(*cp) && *cp != '.') 
                                 break;
                 }
+        if ((isxdigit(name[0]) && strchr(name, ':') != NULL) ||
+            name[0] == ':')
+                for (cp = name;; ++cp) {
+                        if (!*cp) {
+                                if (*--cp == '.')
+                                        break;
+                                /*
+                                 * All-IPv6-legal, no dot at the end.
+                                 * Fake up a hostent as if we'd actually
+                                 * done a lookup.
+                                 */
+                                if (inet_pton(af, name, host_addr) <= 0) {
+                                        h_errno = HOST_NOT_FOUND;
+                                        return (NULL);
+                                }
+                                strlcpy(hostbuf, name, MAXHOSTNAMELEN);
+                                bp = hostbuf + MAXHOSTNAMELEN;
+                                ep = hostbuf + sizeof(hostbuf);
+                                host.h_name = hostbuf;
+                                host.h_aliases = host_aliases;
+                                host_aliases[0] = NULL;
+                                h_addr_ptrs[0] = (char *)host_addr;
+                                h_addr_ptrs[1] = NULL;
+                                host.h_addr_list = h_addr_ptrs;
+                                h_errno = NETDB_SUCCESS;
+                                return (&host);
+                        }
+                        if (!isxdigit(*cp) && *cp != ':' && *cp != '.') 
+                                break;
+                }
 
-        if ((_res.options & RES_INIT) == 0 && res_init() == -1)
-                return (_gethtbyname(name));
-
-        bcopy(_res.lookups, lookups, sizeof lookups);
+        bcopy(_resp->lookups, lookups, sizeof lookups);
         if (lookups[0] == '\0')
-                strncpy(lookups, "bf", sizeof lookups);
+                strlcpy(lookups, "bf", sizeof lookups);
 
         hp = (struct hostent *)NULL;
         for (i = 0; i < MAXDNSLUS && hp == NULL && lookups[i]; i++) {
                 switch (lookups[i]) {
 #ifdef YP
                 case 'y':
-                        hp = _yp_gethtbyname(name);
+                        /* YP only supports AF_INET. */
+                        if (af == AF_INET)
+                                hp = _yp_gethtbyname(name);
                         break;
 #endif
                 case 'b':
-                        if ((n = res_search(name, C_IN, T_A, buf.buf,
-                            sizeof(buf))) < 0) {
+                        buf = malloc(sizeof(*buf));
+                        if (buf == NULL)
+                                break;
+                        if ((n = res_search(name, C_IN, type, buf->buf,
+                            sizeof(buf->buf))) < 0) {
+                                free(buf);
 #ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
+                                if (_resp->options & RES_DEBUG)
                                         printf("res_search failed\n");
 #endif
                                 break;
                         }
-                        hp = getanswer(&buf, n, 0);
+                        hp = getanswer(buf, n, name, type);
+                        free(buf);
                         break;
                 case 'f':
-                        hp = _gethtbyname(name);
+                        hp = _gethtbyname2(name, af);
                         break;
                 }
         }
+        /* XXX h_errno not correct in all cases... */
         return (hp);
 }
 
 struct hostent *
-gethostbyaddr(addr, len, type)
-        const char *addr;
-        int len, type;
+gethostbyaddr(const void *addr, socklen_t len, int af)
 {
-        int n, i;
-        querybuf buf;
-        register struct hostent *hp;
-        char qbuf[MAXDNAME];
-        extern struct hostent *_gethtbyaddr(), *_yp_gethtbyaddr();
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        const u_char *uaddr = (const u_char *)addr;
+        int n, size, i;
+        querybuf *buf;
+        struct hostent *hp;
+        char qbuf[MAXDNAME+1], *qp, *ep;
         char lookups[MAXDNSLUS];
+        struct hostent *res;
+        extern struct hostent *_gethtbyaddr(const void *, socklen_t, int);
+#ifdef YP
+        extern struct hostent *_yp_gethtbyaddr(const void *);
+#endif
         
-        if (type != AF_INET)
-                return ((struct hostent *) NULL);
-        (void)sprintf(qbuf, "%u.%u.%u.%u.in-addr.arpa",
-                ((unsigned)addr[3] & 0xff),
-                ((unsigned)addr[2] & 0xff),
-                ((unsigned)addr[1] & 0xff),
-                ((unsigned)addr[0] & 0xff));
-
-        if ((_res.options & RES_INIT) == 0 && res_init() == -1)
-                return (_gethtbyaddr(addr, len, type));
-
-        bcopy(_res.lookups, lookups, sizeof lookups);
+        if (_res_init(0) == -1) {
+                res = _gethtbyaddr(addr, len, af);
+                return (res);
+        }
+
+        if (af == AF_INET6 && len == IN6ADDRSZ &&
+            (IN6_IS_ADDR_LINKLOCAL((struct in6_addr *)uaddr) ||
+             IN6_IS_ADDR_SITELOCAL((struct in6_addr *)uaddr))) {
+                h_errno = HOST_NOT_FOUND;
+                return (NULL);
+        }
+        if (af == AF_INET6 && len == IN6ADDRSZ &&
+            (IN6_IS_ADDR_V4MAPPED((struct in6_addr *)uaddr) ||
+             IN6_IS_ADDR_V4COMPAT((struct in6_addr *)uaddr))) {
+                /* Unmap. */
+                uaddr += IN6ADDRSZ - INADDRSZ;
+                af = AF_INET;
+                len = INADDRSZ;
+        }
+        switch (af) {
+        case AF_INET:
+                size = INADDRSZ;
+                break;
+        case AF_INET6:
+                size = IN6ADDRSZ;
+                break;
+        default:
+                errno = EAFNOSUPPORT;
+                h_errno = NETDB_INTERNAL;
+                return (NULL);
+        }
+        if (size != len) {
+                errno = EINVAL;
+                h_errno = NETDB_INTERNAL;
+                return (NULL);
+        }
+        ep = qbuf + sizeof(qbuf);
+        switch (af) {
+        case AF_INET:
+                (void) snprintf(qbuf, sizeof qbuf, "%u.%u.%u.%u.in-addr.arpa",
+                    (uaddr[3] & 0xff), (uaddr[2] & 0xff),
+                    (uaddr[1] & 0xff), (uaddr[0] & 0xff));
+                break;
+        case AF_INET6:
+                qp = qbuf;
+                for (n = IN6ADDRSZ - 1; n >= 0; n--) {
+                        i = snprintf(qp, ep - qp, "%x.%x.",
+                            uaddr[n] & 0xf, (uaddr[n] >> 4) & 0xf);
+                        if (i <= 0 || i >= ep - qp) {
+                                errno = EINVAL;
+                                h_errno = NETDB_INTERNAL;
+                                return (NULL);
+                        }
+                        qp += i;
+                }
+                strlcpy(qp, "ip6.arpa", ep - qp);
+                break;
+        }
+
+        bcopy(_resp->lookups, lookups, sizeof lookups);
         if (lookups[0] == '\0')
-                strncpy(lookups, "bf", sizeof lookups);
+                strlcpy(lookups, "bf", sizeof lookups);
 
         hp = (struct hostent *)NULL;
         for (i = 0; i < MAXDNSLUS && hp == NULL && lookups[i]; i++) {
                 switch (lookups[i]) {
 #ifdef YP
                 case 'y':
-                        hp = _yp_gethtbyaddr(addr, len, type);
+                        /* YP only supports AF_INET. */
+                        if (af == AF_INET)
+                                hp = _yp_gethtbyaddr(uaddr);
                         break;
 #endif
                 case 'b':
-                        n = res_query(qbuf, C_IN, T_PTR, (char *)&buf, sizeof(buf));
+                        buf = malloc(sizeof(*buf));
+                        if (!buf)
+                                break;
+                        n = res_query(qbuf, C_IN, T_PTR, buf->buf,
+                            sizeof(buf->buf));
                         if (n < 0) {
+                                free(buf);
 #ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
+                                if (_resp->options & RES_DEBUG)
                                         printf("res_query failed\n");
 #endif
                                 break;
                         }
-                        hp = getanswer(&buf, n, 1);
-                        if (hp == NULL)
+                        if (!(hp = getanswer(buf, n, qbuf, T_PTR))) {
+                                free(buf);
                                 break;
-                        hp->h_addrtype = type;
+                        }
+                        free(buf);
+                        hp->h_addrtype = af;
                         hp->h_length = len;
-                        h_addr_ptrs[0] = (char *)&host_addr;
-                        h_addr_ptrs[1] = (char *)0;
-                        host_addr = *(struct in_addr *)addr;
+                        bcopy(uaddr, host_addr, len);
+                        h_addr_ptrs[0] = (char *)host_addr;
+                        h_addr_ptrs[1] = NULL;
+                        if (af == AF_INET && (_resp->options & RES_USE_INET6)) {
+                                map_v4v6_address((char*)host_addr,
+                                    (char*)host_addr);
+                                hp->h_addrtype = AF_INET6;
+                                hp->h_length = IN6ADDRSZ;
+                        }
+                        h_errno = NETDB_SUCCESS;
                         break;
                 case 'f':
-                        hp = _gethtbyaddr(addr, len, type);
+                        hp = _gethtbyaddr(uaddr, len, af);
                         break;
                 }
         }
+        /* XXX h_errno not correct in all cases... */
         return (hp);
 }
 
 void
-_sethtent(f)
-        int f;
+_sethtent(int f)
 {
         if (hostf == NULL)
                 hostf = fopen(_PATH_HOSTS, "r" );
@@ -409,7 +780,7 @@ _sethtent(f)
 }
 
 void
-_endhtent()
+_endhtent(void)
 {
         if (hostf && !stayopen) {
                 (void) fclose(hostf);
@@ -417,40 +788,66 @@ _endhtent()
         }
 }
 
-struct hostent *
-_gethtent()
+static struct hostent *
+_gethtent(void)
 {
-        char *p;
-        register char *cp, **q;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        char *p, *cp, **q;
+        int af;
+        size_t len;
 
-        if (hostf == NULL && (hostf = fopen(_PATH_HOSTS, "r" )) == NULL)
+        if (!hostf && !(hostf = fopen(_PATH_HOSTS, "r" ))) {
+                h_errno = NETDB_INTERNAL;
                 return (NULL);
-again:
-        if ((p = fgets(hostbuf, BUFSIZ, hostf)) == NULL)
+        }
+ again:
+        if ((p = fgetln(hostf, &len)) == NULL) {
+                h_errno = HOST_NOT_FOUND;
                 return (NULL);
-        if (*p == '#')
+        }
+        if (p[len-1] == '\n')
+                len--;
+        if (len >= sizeof(hostbuf) || len == 0)
                 goto again;
-        cp = strpbrk(p, "#\n");
-        if (cp == NULL)
+        p = memcpy(hostbuf, p, len);
+        hostbuf[len] = '\0';
+        if (*p == '#')
                 goto again;
-        *cp = '\0';
-        cp = strpbrk(p, " \t");
-        if (cp == NULL)
+        if ((cp = strchr(p, '#')))
+                *cp = '\0';
+        if (!(cp = strpbrk(p, " \t")))
                 goto again;
         *cp++ = '\0';
-        /* THIS STUFF IS INTERNET SPECIFIC */
-        h_addr_ptrs[0] = (char *)&host_addr;
+        if (inet_pton(AF_INET6, p, host_addr) > 0) {
+                af = AF_INET6;
+                len = IN6ADDRSZ;
+        } else if (inet_pton(AF_INET, p, host_addr) > 0) {
+                if (_resp->options & RES_USE_INET6) {
+                        map_v4v6_address((char*)host_addr, (char*)host_addr);
+                        af = AF_INET6;
+                        len = IN6ADDRSZ;
+                } else {
+                        af = AF_INET;
+                        len = INADDRSZ;
+                }
+        } else {
+                goto again;
+        }
+        /* if this is not something we're looking for, skip it. */
+        if (host.h_addrtype != AF_UNSPEC && host.h_addrtype != af)
+                goto again;
+        if (host.h_length != 0 && host.h_length != len)
+                goto again;
+        h_addr_ptrs[0] = (char *)host_addr;
         h_addr_ptrs[1] = NULL;
-        (void) inet_aton(p, &host_addr);
         host.h_addr_list = h_addr_ptrs;
-        host.h_length = sizeof(u_int32_t);
-        host.h_addrtype = AF_INET;
+        host.h_length = len;
+        host.h_addrtype = af;
         while (*cp == ' ' || *cp == '\t')
                 cp++;
         host.h_name = cp;
         q = host.h_aliases = host_aliases;
-        cp = strpbrk(cp, " \t");
-        if (cp != NULL) 
+        if ((cp = strpbrk(cp, " \t")))
                 *cp++ = '\0';
         while (cp && *cp) {
                 if (*cp == ' ' || *cp == '\t') {
@@ -459,74 +856,61 @@ again:
                 }
                 if (q < &host_aliases[MAXALIASES - 1])
                         *q++ = cp;
-                cp = strpbrk(cp, " \t");
-                if (cp != NULL)
+                if ((cp = strpbrk(cp, " \t")))
                         *cp++ = '\0';
         }
         *q = NULL;
+        if (_resp->options & RES_USE_INET6) {
+                char *bp = hostbuf;
+                char *ep = hostbuf + sizeof hostbuf;
+
+                map_v4v6_hostent(&host, &bp, ep);
+        }
+        h_errno = NETDB_SUCCESS;
         return (&host);
 }
 
 struct hostent *
-_gethtbyname(name)
-        char *name;
+_gethtbyname2(const char *name, int af)
 {
-        register struct hostent *p;
-        register char **cp;
+        struct hostent *p;
+        char **cp;
         
         _sethtent(0);
-        while (p = _gethtent()) {
+        while ((p = _gethtent())) {
+                if (p->h_addrtype != af)
+                        continue;
                 if (strcasecmp(p->h_name, name) == 0)
                         break;
                 for (cp = p->h_aliases; *cp != 0; cp++)
                         if (strcasecmp(*cp, name) == 0)
                                 goto found;
         }
-found:
+ found:
         _endhtent();
-        if (p==NULL)
-                h_errno = HOST_NOT_FOUND;
         return (p);
 }
 
 struct hostent *
-_gethtbyaddr(addr, len, type)
-        const char *addr;
-        int len, type;
+_gethtbyaddr(const void *addr, socklen_t len, int af)
 {
-        register struct hostent *p;
+        struct hostent *p;
+
+        host.h_length = len;
+        host.h_addrtype = af;
 
         _sethtent(0);
-        while (p = _gethtent())
-                if (p->h_addrtype == type && !bcmp(p->h_addr, addr, len))
+        while ((p = _gethtent()))
+                if (p->h_addrtype == af && p->h_length == len &&
+                    !bcmp(p->h_addr, addr, len))
                         break;
         _endhtent();
-        if (p==NULL)
-                h_errno = HOST_NOT_FOUND;
         return (p);
 }
 
-static int
-qcomp(a1, a2)
-        struct in_addr **a1, **a2;
-{
-        int pos1, pos2;
-
-        for (pos1 = 0; pos1 < _res.nsort; pos1++)
-                if (_res.sort_list[pos1].addr.s_addr ==
-                    ((*a1)->s_addr & _res.sort_list[pos1].mask))
-                        break;
-        for (pos2 = 0; pos2 < _res.nsort; pos2++)
-                if (_res.sort_list[pos2].addr.s_addr ==
-                    ((*a2)->s_addr & _res.sort_list[pos2].mask))
-                        break;
-        return pos1 - pos2;
-}
-
 #ifdef YP
 struct hostent *
-_yphostent(line)
-        char *line;
+_yphostent(char *line)
 {
         static struct in_addr host_addrs[MAXADDRS];
         char *p = line;
@@ -537,21 +921,21 @@ _yphostent(line)
 
         host.h_name = NULL;
         host.h_addr_list = h_addr_ptrs;
-        host.h_length = sizeof(u_int32_t);
+        host.h_length = INADDRSZ;
         host.h_addrtype = AF_INET;
         hap = h_addr_ptrs;
         buf = host_addrs;
         q = host.h_aliases = host_aliases;
 
 nextline:
+        /* check for host_addrs overflow */
+        if (buf >= &host_addrs[sizeof(host_addrs) / sizeof(host_addrs[0])])
+                goto done;
+
         more = 0;
         cp = strpbrk(p, " \t");
-        if (cp == NULL) {
-                if (host.h_name == NULL)
-                        return (NULL);
-                else
-                        goto done;
-        }
+        if (cp == NULL)
+                goto done;
         *cp++ = '\0';
 
         *hap++ = (char *)buf;
@@ -592,30 +976,28 @@ nextline:
                         *cp++ = '\0';
         }
 done:
+        if (host.h_name == NULL)
+                return (NULL);
         *q = NULL;
         *hap = NULL;
         return (&host);
 }
 
 struct hostent *
-_yp_gethtbyaddr(addr, len, type)
-        const char *addr;
-        int len, type;
+_yp_gethtbyaddr(const void *addr)
 {
-        struct hostent *hp = (struct hostent *)NULL;
+        struct hostent *hp = NULL;
+        const u_char *uaddr = (const u_char *)addr;
         static char *__ypcurrent;
         int __ypcurrentlen, r;
-        char name[sizeof("xxx.xxx.xxx.xxx") + 1];
+        char name[sizeof("xxx.xxx.xxx.xxx")];
         
         if (!__ypdomain) {
                 if (_yp_check(&__ypdomain) == 0)
                         return (hp);
         }
-        sprintf(name, "%u.%u.%u.%u",
-                ((unsigned)addr[0] & 0xff),
-                ((unsigned)addr[1] & 0xff),
-                ((unsigned)addr[2] & 0xff),
-                ((unsigned)addr[3] & 0xff));
+        snprintf(name, sizeof name, "%u.%u.%u.%u", (uaddr[0] & 0xff),
+            (uaddr[1] & 0xff), (uaddr[2] & 0xff), (uaddr[3] & 0xff));
         if (__ypcurrent)
                 free(__ypcurrent);
         __ypcurrent = NULL;
@@ -629,13 +1011,14 @@ _yp_gethtbyaddr(addr, len, type)
 }
 
 struct hostent *
-_yp_gethtbyname(name)
-        const char *name;
+_yp_gethtbyname(const char *name)
 {
         struct hostent *hp = (struct hostent *)NULL;
         static char *__ypcurrent;
         int __ypcurrentlen, r;
 
+        if (strlen(name) >= MAXHOSTNAMELEN)
+                return (NULL);
         if (!__ypdomain) {
                 if (_yp_check(&__ypdomain) == 0)
                         return (hp);
@@ -645,10 +1028,104 @@ _yp_gethtbyname(name)
         __ypcurrent = NULL;
         r = yp_match(__ypdomain, "hosts.byname", name,
                 strlen(name), &__ypcurrent, &__ypcurrentlen);
-        if (r==0)
+        if (r == 0)
                 hp = _yphostent(__ypcurrent);
-        if (hp==NULL)
+        if (hp == NULL)
                 h_errno = HOST_NOT_FOUND;
         return (hp);
 }
 #endif
+
+static void
+map_v4v6_address(const char *src, char *dst)
+{
+        u_char *p = (u_char *)dst;
+        char tmp[INADDRSZ];
+        int i;
+
+        /* Stash a temporary copy so our caller can update in place. */
+        bcopy(src, tmp, INADDRSZ);
+        /* Mark this ipv6 addr as a mapped ipv4. */
+        for (i = 0; i < 10; i++)
+                *p++ = 0x00;
+        *p++ = 0xff;
+        *p++ = 0xff;
+        /* Retrieve the saved copy and we're done. */
+        bcopy(tmp, (void*)p, INADDRSZ);
+}
+
+static void
+map_v4v6_hostent(struct hostent *hp, char **bpp, char *ep)
+{
+        char **ap;
+
+        if (hp->h_addrtype != AF_INET || hp->h_length != INADDRSZ)
+                return;
+        hp->h_addrtype = AF_INET6;
+        hp->h_length = IN6ADDRSZ;
+        for (ap = hp->h_addr_list; *ap; ap++) {
+                int i = sizeof(align) - ((u_long)*bpp % sizeof(align));
+
+                if (ep - *bpp < (i + IN6ADDRSZ)) {
+                        /* Out of memory.  Truncate address list here.  XXX */
+                        *ap = NULL;
+                        return;
+                }
+                *bpp += i;
+                map_v4v6_address(*ap, *bpp);
+                *ap = *bpp;
+                *bpp += IN6ADDRSZ;
+        }
+}
+
+struct hostent *
+gethostent(void)
+{
+        host.h_addrtype = AF_UNSPEC;
+        host.h_length = 0;
+        return (_gethtent());
+}
+
+#ifdef RESOLVSORT
+static void
+addrsort(char **ap, int num)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        int i, j;
+        char **p;
+        short aval[MAXADDRS];
+        int needsort = 0;
+
+        p = ap;
+        for (i = 0; i < num; i++, p++) {
+                for (j = 0 ; (unsigned)j < _resp->nsort; j++)
+                        if (_resp->sort_list[j].addr.s_addr == 
+                            (((struct in_addr *)(*p))->s_addr & 
+                            _resp->sort_list[j].mask))
+                                break;
+                aval[i] = j;
+                if (needsort == 0 && i > 0 && j < aval[i-1])
+                        needsort = i;
+        }
+        if (!needsort)
+                return;
+
+        while (needsort < num) {
+                for (j = needsort - 1; j >= 0; j--) {
+                        if (aval[j] > aval[j+1]) {
+                                char *hp;
+
+                                i = aval[j];
+                                aval[j] = aval[j+1];
+                                aval[j+1] = i;
+
+                                hp = ap[j];
+                                ap[j] = ap[j+1];
+                                ap[j+1] = hp;
+                        } else
+                                break;
+                }
+                needsort++;
+        }
+}
+#endif
diff --git a/src/lib/libc/net/getifaddrs.3 b/src/lib/libc/net/getifaddrs.3
new file mode 100644
index 0000000000..f282e26960
--- /dev/null
+++ b/src/lib/libc/net/getifaddrs.3
@@ -0,0 +1,157 @@
+.\"     $OpenBSD: getifaddrs.3,v 1.14 2007/05/31 19:19:30 jmc Exp $
+.\"     BSDI    getifaddrs.3,v 2.5 2000/02/23 14:51:59 dab Exp
+.\"
+.\" Copyright (c) 1995, 1999
+.\"     Berkeley Software Design, Inc.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY Berkeley Software Design, Inc. ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL Berkeley Software Design, Inc. BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.Dd $Mdocdate: May 31 2007 $
+.Dt GETIFADDRS 3
+.Os
+.Sh NAME
+.Nm getifaddrs
+.Nd get interface addresses
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <ifaddrs.h>
+.Ft int
+.Fn getifaddrs "struct ifaddrs **ifap"
+.Ft void
+.Fn freeifaddrs "struct ifaddrs *ifap"
+.Sh DESCRIPTION
+The
+.Fn getifaddrs
+function stores a reference to a linked list of the network interfaces
+on the local machine in the memory referenced by
+.Fa ifap .
+The list consists of
+.Nm ifaddrs
+structures, as defined in the include file
+.Aq Pa ifaddrs.h .
+The
+.Nm ifaddrs
+structure contains at least the following entries:
+.Bd -literal
+    struct ifaddrs   *ifa_next;         /* Pointer to next struct */
+    char             *ifa_name;         /* Interface name */
+    u_int             ifa_flags;        /* Interface flags */
+    struct sockaddr  *ifa_addr;         /* Interface address */
+    struct sockaddr  *ifa_netmask;      /* Interface netmask */
+    struct sockaddr  *ifa_broadaddr;    /* Interface broadcast address */
+    struct sockaddr  *ifa_dstaddr;      /* P2P interface destination */
+    void             *ifa_data;         /* Address specific data */
+.Ed
+.Bl -tag -width ifa_broadaddr
+.It Fa ifa_next
+Contains a pointer to the next structure on the list.
+This field is set to
+.Dv NULL
+in the last structure on the list.
+.It Fa ifa_name
+Contains the interface name.
+.It Fa ifa_flags
+Contains the interface flags, as set by
+.Xr ifconfig 8 .
+.It Fa ifa_addr
+References either the address of the interface or the link level
+address of the interface, if one exists, otherwise it is
+.Dv NULL .
+(The
+.Fa sa_family
+field of the
+.Fa ifa_addr
+field should be consulted to determine the format of the
+.Fa ifa_addr
+address.)
+.It Fa ifa_netmask
+References the netmask associated with
+.Fa ifa_addr ,
+if one is set, otherwise it is
+.Dv NULL .
+.It Fa ifa_broadaddr
+This field, which should only be referenced for non-P2P interfaces,
+references the broadcast address associated with
+.Fa ifa_addr ,
+if one exists, otherwise it is
+.Dv NULL .
+.It Fa ifa_dstaddr
+References the destination address on a P2P interface,
+if one exists, otherwise it is
+.Dv NULL .
+.It Fa ifa_data
+References address family specific data.
+For
+.Dv AF_LINK
+addresses it contains a pointer to the
+.Li struct if_data
+(as defined in include file
+.Aq Pa net/if.h )
+which contains various interface attributes and statistics.
+For all other address families,
+.Fa ifa_data
+is
+.Dv NULL .
+.El
+.Pp
+The data returned by
+.Fn getifaddrs
+is dynamically allocated and should be freed using
+.Fn freeifaddrs
+when no longer needed.
+.Sh RETURN VALUES
+Upon successful completion, a value of 0 is returned.
+Otherwise, a value of \-1 is returned and
+.Va errno
+is set to indicate the error.
+.Sh ERRORS
+The
+.Fn getifaddrs
+may fail and set
+.Va errno
+for any of the errors specified for the library routines
+.Xr ioctl 2 ,
+.Xr socket 2 ,
+.Xr malloc 3 ,
+or
+.Xr sysctl 3 .
+.Sh SEE ALSO
+.Xr ioctl 2 ,
+.Xr socket 2 ,
+.Xr sysctl 3 ,
+.Xr networking 4 ,
+.Xr ifconfig 8
+.Sh HISTORY
+The
+.Fn getifaddrs
+function first appeared in BSDI BSD/OS.
+The function has been available on
+.Ox
+since
+.Ox 2.7 .
+.Sh BUGS
+If both
+.Aq Pa net/if.h
+and
+.Aq Pa ifaddrs.h
+are being included,
+.Aq Pa net/if.h
+.Em must
+be included before
+.Aq Pa ifaddrs.h .
diff --git a/src/lib/libc/net/getifaddrs.c b/src/lib/libc/net/getifaddrs.c
new file mode 100644
index 0000000000..6f7ea15721
--- /dev/null
+++ b/src/lib/libc/net/getifaddrs.c
@@ -0,0 +1,284 @@
+/*      $OpenBSD: getifaddrs.c,v 1.10 2008/11/24 20:08:49 claudio Exp $ */
+
+/*
+ * Copyright (c) 1995, 1999
+ *      Berkeley Software Design, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Berkeley Software Design, Inc. ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Berkeley Software Design, Inc. BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      BSDI getifaddrs.c,v 2.12 2000/02/23 14:51:59 dab Exp
+ */
+
+#include <sys/types.h>
+#include <sys/ioctl.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <sys/param.h>
+#include <net/route.h>
+#include <sys/sysctl.h>
+#include <net/if_dl.h>
+
+#include <errno.h>
+#include <ifaddrs.h>
+#include <stddef.h>
+#include <stdlib.h>
+#include <string.h>
+#include <unistd.h>
+
+#define SALIGN  (sizeof(long) - 1)
+#define SA_RLEN(sa)     ((sa)->sa_len ? (((sa)->sa_len + SALIGN) & ~SALIGN) : (SALIGN + 1))
+
+int
+getifaddrs(struct ifaddrs **pif)
+{
+        int icnt = 1;
+        int dcnt = 0;
+        int ncnt = 0;
+        int mib[6];
+        size_t needed;
+        char *buf;
+        char *next;
+        struct ifaddrs *cif = 0;
+        char *p, *p0;
+        struct rt_msghdr *rtm;
+        struct if_msghdr *ifm;
+        struct ifa_msghdr *ifam;
+        struct sockaddr_dl *dl;
+        struct sockaddr *sa;
+        u_short index = 0;
+        size_t len, alen, dlen;
+        struct ifaddrs *ifa, *ift;
+        int i;
+        char *data;
+        char *names;
+
+        mib[0] = CTL_NET;
+        mib[1] = PF_ROUTE;
+        mib[2] = 0;             /* protocol */
+        mib[3] = 0;             /* wildcard address family */
+        mib[4] = NET_RT_IFLIST;
+        mib[5] = 0;             /* no flags */
+        if (sysctl(mib, 6, NULL, &needed, NULL, 0) < 0)
+                return (-1);
+        if ((buf = malloc(needed)) == NULL)
+                return (-1);
+        if (sysctl(mib, 6, buf, &needed, NULL, 0) < 0) {
+                free(buf);
+                return (-1);
+        }
+
+        for (next = buf; next < buf + needed; next += rtm->rtm_msglen) {
+                rtm = (struct rt_msghdr *)next;
+                if (rtm->rtm_version != RTM_VERSION)
+                        continue;
+                switch (rtm->rtm_type) {
+                case RTM_IFINFO:
+                        ifm = (struct if_msghdr *)rtm;
+                        if (ifm->ifm_addrs & RTA_IFP) {
+                                index = ifm->ifm_index;
+                                ++icnt;
+                                dl = (struct sockaddr_dl *)(next +
+                                    rtm->rtm_hdrlen);
+                                dcnt += SA_RLEN((struct sockaddr *)dl) +
+                                        ALIGNBYTES;
+                                dcnt += sizeof(ifm->ifm_data);
+                                ncnt += dl->sdl_nlen + 1;
+                        } else
+                                index = 0;
+                        break;
+
+                case RTM_NEWADDR:
+                        ifam = (struct ifa_msghdr *)rtm;
+                        if (index && ifam->ifam_index != index)
+                                abort();        /* XXX abort illegal in library */
+
+#define RTA_MASKS       (RTA_NETMASK | RTA_IFA | RTA_BRD)
+                        if (index == 0 || (ifam->ifam_addrs & RTA_MASKS) == 0)
+                                break;
+                        p = next + rtm->rtm_hdrlen;
+                        ++icnt;
+                        /* Scan to look for length of address */
+                        alen = 0;
+                        for (p0 = p, i = 0; i < RTAX_MAX; i++) {
+                                if ((RTA_MASKS & ifam->ifam_addrs & (1 << i))
+                                    == 0)
+                                        continue;
+                                sa = (struct sockaddr *)p;
+                                len = SA_RLEN(sa);
+                                if (i == RTAX_IFA) {
+                                        alen = len;
+                                        break;
+                                }
+                                p += len;
+                        }
+                        for (p = p0, i = 0; i < RTAX_MAX; i++) {
+                                if ((RTA_MASKS & ifam->ifam_addrs & (1 << i))
+                                    == 0)
+                                        continue;
+                                sa = (struct sockaddr *)p;
+                                len = SA_RLEN(sa);
+                                if (i == RTAX_NETMASK && sa->sa_len == 0)
+                                        dcnt += alen;
+                                else
+                                        dcnt += len;
+                                p += len;
+                        }
+                        break;
+                }
+        }
+
+        if (icnt + dcnt + ncnt == 1) {
+                *pif = NULL;
+                free(buf);
+                return (0);
+        }
+        data = malloc(sizeof(struct ifaddrs) * icnt + dcnt + ncnt);
+        if (data == NULL) {
+                free(buf);
+                return(-1);
+        }
+
+        ifa = (struct ifaddrs *)data;
+        data += sizeof(struct ifaddrs) * icnt;
+        names = data + dcnt;
+
+        memset(ifa, 0, sizeof(struct ifaddrs) * icnt);
+        ift = ifa;
+
+        index = 0;
+        for (next = buf; next < buf + needed; next += rtm->rtm_msglen) {
+                rtm = (struct rt_msghdr *)next;
+                if (rtm->rtm_version != RTM_VERSION)
+                        continue;
+                switch (rtm->rtm_type) {
+                case RTM_IFINFO:
+                        ifm = (struct if_msghdr *)rtm;
+                        if (ifm->ifm_addrs & RTA_IFP) {
+                                index = ifm->ifm_index;
+                                dl = (struct sockaddr_dl *)(next +
+                                    rtm->rtm_hdrlen);
+
+                                cif = ift;
+                                ift->ifa_name = names;
+                                ift->ifa_flags = (int)ifm->ifm_flags;
+                                memcpy(names, dl->sdl_data, dl->sdl_nlen);
+                                names[dl->sdl_nlen] = 0;
+                                names += dl->sdl_nlen + 1;
+
+                                ift->ifa_addr = (struct sockaddr *)data;
+                                memcpy(data, dl,
+                                    ((struct sockaddr *)dl)->sa_len);
+                                data += SA_RLEN((struct sockaddr *)dl);
+
+                                /* ifm_data needs to be aligned */
+                                ift->ifa_data = data = (void *)ALIGN(data);
+                                dlen = rtm->rtm_hdrlen -
+                                    offsetof(struct if_msghdr, ifm_data);
+                                if (dlen > sizeof(ifm->ifm_data))
+                                        dlen = sizeof(ifm->ifm_data);
+                                memcpy(data, &ifm->ifm_data, dlen);
+                                data += sizeof(ifm->ifm_data);
+
+                                ift = (ift->ifa_next = ift + 1);
+                        } else
+                                index = 0;
+                        break;
+
+                case RTM_NEWADDR:
+                        ifam = (struct ifa_msghdr *)rtm;
+                        if (index && ifam->ifam_index != index)
+                                abort();        /* XXX abort illegal in library */
+
+                        if (index == 0 || (ifam->ifam_addrs & RTA_MASKS) == 0)
+                                break;
+                        ift->ifa_name = cif->ifa_name;
+                        ift->ifa_flags = cif->ifa_flags;
+                        ift->ifa_data = NULL;
+                        p = next + rtm->rtm_hdrlen;
+                        /* Scan to look for length of address */
+                        alen = 0;
+                        for (p0 = p, i = 0; i < RTAX_MAX; i++) {
+                                if ((RTA_MASKS & ifam->ifam_addrs & (1 << i))
+                                    == 0)
+                                        continue;
+                                sa = (struct sockaddr *)p;
+                                len = SA_RLEN(sa);
+                                if (i == RTAX_IFA) {
+                                        alen = len;
+                                        break;
+                                }
+                                p += len;
+                        }
+                        for (p = p0, i = 0; i < RTAX_MAX; i++) {
+                                if ((RTA_MASKS & ifam->ifam_addrs & (1 << i))
+                                    == 0)
+                                        continue;
+                                sa = (struct sockaddr *)p;
+                                len = SA_RLEN(sa);
+                                switch (i) {
+                                case RTAX_IFA:
+                                        ift->ifa_addr = (struct sockaddr *)data;
+                                        memcpy(data, p, len);
+                                        data += len;
+                                        break;
+
+                                case RTAX_NETMASK:
+                                        ift->ifa_netmask =
+                                            (struct sockaddr *)data;
+                                        if (sa->sa_len == 0) {
+                                                memset(data, 0, alen);
+                                                data += alen;
+                                                break;
+                                        }
+                                        memcpy(data, p, len);
+                                        data += len;
+                                        break;
+
+                                case RTAX_BRD:
+                                        ift->ifa_broadaddr =
+                                            (struct sockaddr *)data;
+                                        memcpy(data, p, len);
+                                        data += len;
+                                        break;
+                                }
+                                p += len;
+                        }
+
+
+                        ift = (ift->ifa_next = ift + 1);
+                        break;
+                }
+        }
+
+        free(buf);
+        if (--ift >= ifa) {
+                ift->ifa_next = NULL;
+                *pif = ifa;
+        } else {
+                *pif = NULL;
+                free(ifa);
+        }
+        return (0);
+}
+
+void
+freeifaddrs(struct ifaddrs *ifp)
+{
+        free(ifp);
+}
diff --git a/src/lib/libc/net/getnameinfo.3 b/src/lib/libc/net/getnameinfo.3
new file mode 100644
index 0000000000..a91e8896b6
--- /dev/null
+++ b/src/lib/libc/net/getnameinfo.3
@@ -0,0 +1,265 @@
+.\"     $OpenBSD: getnameinfo.3,v 1.41 2008/12/22 12:18:56 jacekm Exp $
+.\"     $KAME: getnameinfo.3,v 1.37 2005/01/05 03:23:05 itojun Exp $
+.\"
+.\" Copyright (C) 2004  Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND ISC DISCLAIMS ALL WARRANTIES WITH
+.\" REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+.\" AND FITNESS.  IN NO EVENT SHALL ISC BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+.\" LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE
+.\" OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+.\" PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: December 22 2008 $
+.Dt GETNAMEINFO 3
+.Os
+.Sh NAME
+.Nm getnameinfo
+.Nd socket address structure to hostname and service name
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <netdb.h>
+.Ft int
+.Fn getnameinfo "const struct sockaddr *sa" "socklen_t salen" "char *host" \
+    "size_t hostlen" "char *serv" "size_t servlen" "int flags"
+.Sh DESCRIPTION
+The
+.Fn getnameinfo
+function is used to convert a
+.Li sockaddr
+structure to a pair of host name and service strings.
+It is a replacement for and provides more flexibility than the
+.Xr gethostbyaddr 3
+and
+.Xr getservbyport 3
+functions and is the converse of the
+.Xr getaddrinfo 3
+function.
+.Pp
+The
+.Li sockaddr
+structure
+.Fa sa
+should point to either a
+.Li sockaddr_in
+or
+.Li sockaddr_in6
+structure (for IPv4 or IPv6 respectively) that is
+.Fa salen
+bytes long.
+.Pp
+The host and service names associated with
+.Fa sa
+are stored in
+.Fa host
+and
+.Fa serv
+which have length parameters
+.Fa hostlen
+and
+.Fa servlen .
+The maximum value for
+.Fa hostlen
+is
+.Dv NI_MAXHOST
+and
+the maximum value for
+.Fa servlen
+is
+.Dv NI_MAXSERV ,
+as defined by
+.Aq Pa netdb.h .
+If a length parameter is zero, no string will be stored.
+Otherwise, enough space must be provided to store the
+host name or service string plus a byte for the NUL terminator.
+.Pp
+The
+.Fa flags
+argument is formed by
+.Tn OR Ns 'ing
+the following values:
+.Bl -tag -width "NI_NUMERICHOSTXX"
+.It Dv NI_NOFQDN
+A fully qualified domain name is not required for local hosts.
+The local part of the fully qualified domain name is returned instead.
+.It Dv NI_NUMERICHOST
+Return the address in numeric form, as if calling
+.Xr inet_ntop 3 ,
+instead of a host name.
+.It Dv NI_NAMEREQD
+A name is required.
+If the host name cannot be found in DNS and this flag is set,
+a non-zero error code is returned.
+If the host name is not found and the flag is not set, the
+address is returned in numeric form.
+.It NI_NUMERICSERV
+The service name is returned as a digit string representing the port number.
+.It NI_DGRAM
+Specifies that the service being looked up is a datagram
+service, and causes
+.Xr getservbyport 3
+to be called with a second argument of
+.Dq udp
+instead of its default of
+.Dq tcp .
+This is required for the few ports (512\-514) that have different services
+for
+.Tn UDP
+and
+.Tn TCP .
+.El
+.Pp
+This implementation allows numeric IPv6 address notation with scope identifier,
+as documented in chapter 11 of draft-ietf-ipv6-scoping-arch-02.txt.
+IPv6 link-local address will appear as a string like
+.Dq Li fe80::1%ne0 .
+Refer to
+.Xr getaddrinfo 3
+for more information.
+.Sh RETURN VALUES
+.Fn getnameinfo
+returns zero on success or one of the error codes listed in
+.Xr gai_strerror 3
+if an error occurs.
+.Sh EXAMPLES
+The following code tries to get a numeric host name, and service name,
+for a given socket address.
+Observe that there is no hardcoded reference to a particular address family.
+.Bd -literal -offset indent
+struct sockaddr *sa;    /* input */
+char hbuf[NI_MAXHOST], sbuf[NI_MAXSERV];
+
+if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), sbuf,
+    sizeof(sbuf), NI_NUMERICHOST | NI_NUMERICSERV))
+        errx(1, "could not get numeric hostname");
+printf("host=%s, serv=%s\en", hbuf, sbuf);
+.Ed
+.Pp
+The following version checks if the socket address has a reverse address mapping:
+.Bd -literal -offset indent
+struct sockaddr *sa;    /* input */
+char hbuf[NI_MAXHOST];
+
+if (getnameinfo(sa, sa->sa_len, hbuf, sizeof(hbuf), NULL, 0,
+    NI_NAMEREQD))
+        errx(1, "could not resolve hostname");
+printf("host=%s\en", hbuf);
+.Ed
+.Sh SEE ALSO
+.Xr gai_strerror 3 ,
+.Xr getaddrinfo 3 ,
+.Xr gethostbyaddr 3 ,
+.Xr getservbyport 3 ,
+.Xr inet_ntop 3 ,
+.Xr resolver 3 ,
+.Xr hosts 5 ,
+.Xr resolv.conf 5 ,
+.Xr services 5 ,
+.Xr hostname 7 ,
+.Xr named 8
+.Rs
+.%A R. Gilligan
+.%A S. Thomson
+.%A J. Bound
+.%A W. Stevens
+.%T Basic Socket Interface Extensions for IPv6
+.%R RFC 2553
+.%D March 1999
+.Re
+.Rs
+.%A S. Deering
+.%A B. Haberman
+.%A T. Jinmei
+.%A E. Nordmark
+.%A B. Zill
+.%T "IPv6 Scoped Address Architecture"
+.%R internet draft
+.%N draft-ietf-ipv6-scoping-arch-02.txt
+.%O work in progress material
+.Re
+.Rs
+.%A Craig Metz
+.%T Protocol Independence Using the Sockets API
+.%B "Proceedings of the Freenix Track: 2000 USENIX Annual Technical Conference"
+.%D June 2000
+.Re
+.Sh STANDARDS
+The
+.Fn getnameinfo
+function is defined by the
+.St -p1003.1g-2000
+draft specification and documented in
+.Tn "RFC 2553" ,
+.Dq Basic Socket Interface Extensions for IPv6 .
+.Sh CAVEATS
+.Fn getnameinfo
+can return both numeric and FQDN forms of the address specified in
+.Fa sa .
+There is no return value that indicates whether the string returned in
+.Fa host
+is a result of binary to numeric-text translation (like
+.Xr inet_ntop 3 ) ,
+or is the result of a DNS reverse lookup.
+Because of this, malicious parties could set up a PTR record as follows:
+.Bd -literal -offset indent
+1.0.0.127.in-addr.arpa. IN PTR  10.1.1.1
+.Ed
+.Pp
+and trick the caller of
+.Fn getnameinfo
+into believing that
+.Fa sa
+is
+.Li 10.1.1.1
+when it is actually
+.Li 127.0.0.1 .
+.Pp
+To prevent such attacks, the use of
+.Dv NI_NAMEREQD
+is recommended when the result of
+.Fn getnameinfo
+is used
+for access control purposes:
+.Bd -literal -offset indent
+struct sockaddr *sa;
+char addr[NI_MAXHOST];
+struct addrinfo hints, *res;
+int error;
+
+error = getnameinfo(sa, sa->sa_len, addr, sizeof(addr),
+    NULL, 0, NI_NAMEREQD);
+if (error == 0) {
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
+        hints.ai_flags = AI_NUMERICHOST;
+        if (getaddrinfo(addr, "0", &hints, &res) == 0) {
+                /* malicious PTR record */
+                freeaddrinfo(res);
+                printf("bogus PTR record\en");
+                return -1;
+        }
+        /* addr is FQDN as a result of PTR lookup */
+} else {
+        /* addr is numeric string */
+        error = getnameinfo(sa, sa->sa_len, addr, sizeof(addr),
+            NULL, 0, NI_NUMERICHOST);
+}
+.Ed
+.Sh BUGS
+The implementation of
+.Fn getnameinfo
+is not thread-safe.
+.Pp
+.Ox
+intentionally uses a different
+.Dv NI_MAXHOST
+value from what
+.Tn "RFC 2553"
+suggests, to avoid buffer length handling mistakes.
diff --git a/src/lib/libc/net/getnameinfo.c b/src/lib/libc/net/getnameinfo.c
new file mode 100644
index 0000000000..7041a4ee48
--- /dev/null
+++ b/src/lib/libc/net/getnameinfo.c
@@ -0,0 +1,351 @@
+/*      $OpenBSD: getnameinfo.c,v 1.33 2007/02/15 04:25:35 ray Exp $    */
+/*      $KAME: getnameinfo.c,v 1.45 2000/09/25 22:43:56 itojun Exp $    */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Issues to be discussed:
+ * - Thread safe-ness must be checked
+ * - RFC2553 says that we should raise error on short buffer.  X/Open says
+ *   we need to truncate the result.  We obey RFC2553 (and X/Open should be
+ *   modified).  ipngwg rough consensus seems to follow RFC2553.
+ * - What is "local" in NI_FQDN?
+ * - NI_NAMEREQD and NI_NUMERICHOST conflict with each other.
+ * - (KAME extension) always attach textual scopeid (fe80::1%lo0), if
+ *   sin6_scope_id is filled - standardization status?
+ *   XXX breaks backward compat for code that expects no scopeid.
+ *   beware on merge.
+ */
+
+#ifndef INET6
+#define INET6
+#endif
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <resolv.h>
+#include <string.h>
+#include <stddef.h>
+
+#include "thread_private.h"
+
+static const struct afd {
+        int a_af;
+        int a_addrlen;
+        int a_socklen;
+        int a_off;
+} afdl [] = {
+#ifdef INET6
+        {PF_INET6, sizeof(struct in6_addr), sizeof(struct sockaddr_in6),
+                offsetof(struct sockaddr_in6, sin6_addr)},
+#endif
+        {PF_INET, sizeof(struct in_addr), sizeof(struct sockaddr_in),
+                offsetof(struct sockaddr_in, sin_addr)},
+        {0, 0, 0},
+};
+
+struct sockinet {
+        u_char  si_len;
+        u_char  si_family;
+        u_short si_port;
+};
+
+#ifdef INET6
+static int ip6_parsenumeric(const struct sockaddr *, const char *, char *,
+    size_t, int);
+static int ip6_sa2str(const struct sockaddr_in6 *, char *, size_t, int);
+#endif
+
+void *__THREAD_NAME(serv_mutex);
+
+int
+getnameinfo(const struct sockaddr *sa, socklen_t salen, char *host,
+    size_t hostlen, char *serv, size_t servlen, int flags)
+{
+        const struct afd *afd;
+        struct hostent *hp;
+        u_short port;
+        int family, i;
+        const char *addr;
+        u_int32_t v4a;
+        char numserv[512];
+        char numaddr[512];
+
+        if (sa == NULL)
+                return EAI_FAIL;
+
+        family = sa->sa_family;
+        for (i = 0; afdl[i].a_af; i++)
+                if (afdl[i].a_af == family) {
+                        afd = &afdl[i];
+                        goto found;
+                }
+        return EAI_FAMILY;
+
+ found:
+        if (salen != afd->a_socklen)
+                return EAI_FAIL;
+
+        /* network byte order */
+        port = ((const struct sockinet *)sa)->si_port;
+        addr = (const char *)sa + afd->a_off;
+
+        if (serv == NULL || servlen == 0) {
+                /*
+                 * do nothing in this case.
+                 * in case you are wondering if "&&" is more correct than
+                 * "||" here: rfc2553bis-03 says that serv == NULL OR
+                 * servlen == 0 means that the caller does not want the result.
+                 */
+        } else if (!(flags & NI_NUMERICSERV)) {
+                struct servent sp;
+                struct servent_data sd;
+
+                (void)memset(&sd, 0, sizeof(sd));
+                if (getservbyport_r(port,
+                    (flags & NI_DGRAM) ? "udp" : "tcp", &sp, &sd) == -1)
+                        goto numeric;
+
+                if (strlen(sp.s_name) + 1 > servlen) {
+                        endservent_r(&sd);
+                        return EAI_MEMORY;
+                }
+                strlcpy(serv, sp.s_name, servlen);
+                endservent_r(&sd);
+        } else {
+ numeric:
+                i = snprintf(numserv, sizeof(numserv), "%u", ntohs(port));
+                if (i < 0 || i >= servlen || i >= sizeof(numserv))
+                        return EAI_MEMORY;
+                strlcpy(serv, numserv, servlen);
+        }
+
+        switch (sa->sa_family) {
+        case AF_INET:
+                v4a = (u_int32_t)
+                    ntohl(((const struct sockaddr_in *)sa)->sin_addr.s_addr);
+                if (IN_MULTICAST(v4a) || IN_EXPERIMENTAL(v4a))
+                        flags |= NI_NUMERICHOST;
+                v4a >>= IN_CLASSA_NSHIFT;
+                if (v4a == 0)
+                        flags |= NI_NUMERICHOST;                        
+                break;
+#ifdef INET6
+        case AF_INET6:
+            {
+                const struct sockaddr_in6 *sin6;
+                sin6 = (const struct sockaddr_in6 *)sa;
+                switch (sin6->sin6_addr.s6_addr[0]) {
+                case 0x00:
+                        if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
+                                ;
+                        else if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))
+                                ;
+                        else
+                                flags |= NI_NUMERICHOST;
+                        break;
+                default:
+                        if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
+                                flags |= NI_NUMERICHOST;
+                        }
+                        else if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr))
+                                flags |= NI_NUMERICHOST;
+                        break;
+                }
+            }
+                break;
+#endif
+        }
+        if (host == NULL || hostlen == 0) {
+                /*
+                 * do nothing in this case.
+                 * in case you are wondering if "&&" is more correct than
+                 * "||" here: rfc2553bis-03 says that host == NULL or
+                 * hostlen == 0 means that the caller does not want the result.
+                 */
+        } else if (flags & NI_NUMERICHOST) {
+                int numaddrlen;
+
+                /* NUMERICHOST and NAMEREQD conflicts with each other */
+                if (flags & NI_NAMEREQD)
+                        return EAI_NONAME;
+
+                switch(afd->a_af) {
+#ifdef INET6
+                case AF_INET6:
+                {
+                        int error;
+
+                        if ((error = ip6_parsenumeric(sa, addr, host,
+                                                      hostlen, flags)) != 0)
+                                return(error);
+                        break;
+                }
+#endif
+                default:
+                        if (inet_ntop(afd->a_af, addr, numaddr, sizeof(numaddr))
+                            == NULL)
+                                return EAI_SYSTEM;
+                        numaddrlen = strlen(numaddr);
+                        if (numaddrlen + 1 > hostlen) /* don't forget terminator */
+                                return EAI_MEMORY;
+                        strlcpy(host, numaddr, hostlen);
+                        break;
+                }
+        } else {
+                _THREAD_PRIVATE_MUTEX_LOCK(serv_mutex);
+                hp = gethostbyaddr(addr, afd->a_addrlen, afd->a_af);
+                _THREAD_PRIVATE_MUTEX_UNLOCK(serv_mutex);
+
+                if (hp) {
+#if 0
+                        /*
+                         * commented out, since "for local host" is not
+                         * implemented here - see RFC2553 p30
+                         */
+                        if (flags & NI_NOFQDN) {
+                                char *p;
+                                p = strchr(hp->h_name, '.');
+                                if (p)
+                                        *p = '\0';
+                        }
+#endif
+                        if (strlen(hp->h_name) + 1 > hostlen) {
+                                return EAI_MEMORY;
+                        }
+                        strlcpy(host, hp->h_name, hostlen);
+                } else {
+                        if (flags & NI_NAMEREQD)
+                                return EAI_NONAME;
+                        switch(afd->a_af) {
+#ifdef INET6
+                        case AF_INET6:
+                        {
+                                int error;
+
+                                if ((error = ip6_parsenumeric(sa, addr, host,
+                                                              hostlen,
+                                                              flags)) != 0)
+                                        return(error);
+                                break;
+                        }
+#endif
+                        default:
+                                if (inet_ntop(afd->a_af, addr, host,
+                                    hostlen) == NULL)
+                                        return EAI_SYSTEM;
+                                break;
+                        }
+                }
+        }
+        return(0);
+}
+
+#ifdef INET6
+static int
+ip6_parsenumeric(const struct sockaddr *sa, const char *addr, char *host,
+    size_t hostlen, int flags)
+{
+        int numaddrlen;
+        char numaddr[512];
+
+        if (inet_ntop(AF_INET6, addr, numaddr, sizeof(numaddr)) == NULL)
+                return EAI_SYSTEM;
+
+        numaddrlen = strlen(numaddr);
+        if (numaddrlen + 1 > hostlen) /* don't forget terminator */
+                return EAI_MEMORY;
+        strlcpy(host, numaddr, hostlen);
+
+        if (((const struct sockaddr_in6 *)sa)->sin6_scope_id) {
+                char zonebuf[MAXHOSTNAMELEN];
+                int zonelen;
+
+                zonelen = ip6_sa2str(
+                    (const struct sockaddr_in6 *)(const void *)sa,
+                    zonebuf, sizeof(zonebuf), flags);
+                if (zonelen < 0)
+                        return EAI_MEMORY;
+                if (zonelen + 1 + numaddrlen + 1 > hostlen)
+                        return EAI_MEMORY;
+
+                /* construct <numeric-addr><delim><zoneid> */
+                memcpy(host + numaddrlen + 1, zonebuf,
+                    (size_t)zonelen);
+                host[numaddrlen] = SCOPE_DELIMITER;
+                host[numaddrlen + 1 + zonelen] = '\0';
+        }
+
+        return 0;
+}
+
+/* ARGSUSED */
+static int
+ip6_sa2str(const struct sockaddr_in6 *sa6, char *buf, size_t bufsiz, int flags)
+{
+        unsigned int ifindex;
+        const struct in6_addr *a6;
+        int n;
+
+        ifindex = (unsigned int)sa6->sin6_scope_id;
+        a6 = &sa6->sin6_addr;
+
+#ifdef notdef
+        if ((flags & NI_NUMERICSCOPE) != 0) {
+                n = snprintf(buf, bufsiz, "%u", sa6->sin6_scope_id);
+                if (n < 0 || n >= bufsiz)
+                        return -1;
+                else
+                        return n;
+        }
+#endif
+
+        /* if_indextoname() does not take buffer size.  not a good api... */
+        if ((IN6_IS_ADDR_LINKLOCAL(a6) || IN6_IS_ADDR_MC_LINKLOCAL(a6) ||
+            IN6_IS_ADDR_MC_INTFACELOCAL(a6)) && bufsiz >= IF_NAMESIZE) {
+                char *p = if_indextoname(ifindex, buf);
+                if (p) {
+                        return(strlen(p));
+                }
+        }
+
+        /* last resort */
+        n = snprintf(buf, bufsiz, "%u", sa6->sin6_scope_id);
+        if (n < 0 || n >= bufsiz)
+                return -1;
+        else
+                return n;
+}
+#endif /* INET6 */
diff --git a/src/lib/libc/net/getnetbyaddr.c b/src/lib/libc/net/getnetbyaddr.c
index c193860e36..a85106630c 100644
--- a/src/lib/libc/net/getnetbyaddr.c
+++ b/src/lib/libc/net/getnetbyaddr.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getnetbyaddr.c,v 1.4 1995/02/25 06:20:30 cgd Exp $     */
-
+/*      $OpenBSD: getnetbyaddr.c,v 1.8 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,27 +28,17 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getnetbyaddr.c      8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getnetbyaddr.c,v 1.4 1995/02/25 06:20:30 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
 
 extern int _net_stayopen;
 
 struct netent *
-getnetbyaddr(net, type)
-        register long net;
-        register int type;
+_getnetbyaddr(in_addr_t net, int type)
 {
-        register struct netent *p;
+        struct netent *p;
 
         setnetent(_net_stayopen);
-        while (p = getnetent())
+        while ((p = getnetent()))
                 if (p->n_addrtype == type && p->n_net == net)
                         break;
         if (!_net_stayopen)
diff --git a/src/lib/libc/net/getnetbyname.c b/src/lib/libc/net/getnetbyname.c
index 93a2e1256c..e6540cf12c 100644
--- a/src/lib/libc/net/getnetbyname.c
+++ b/src/lib/libc/net/getnetbyname.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getnetbyname.c,v 1.4 1995/02/25 06:20:31 cgd Exp $     */
-
+/*      $OpenBSD: getnetbyname.c,v 1.8 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,32 +28,23 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getnetbyname.c      8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getnetbyname.c,v 1.4 1995/02/25 06:20:31 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
 #include <string.h>
 
 extern int _net_stayopen;
 
 struct netent *
-getnetbyname(name)
-        register const char *name;
+_getnetbyname(const char *name)
 {
-        register struct netent *p;
-        register char **cp;
+        struct netent *p;
+        char **cp;
 
         setnetent(_net_stayopen);
-        while (p = getnetent()) {
-                if (strcmp(p->n_name, name) == 0)
+        while ((p = getnetent())) {
+                if (strcasecmp(p->n_name, name) == 0)
                         break;
                 for (cp = p->n_aliases; *cp != 0; cp++)
-                        if (strcmp(*cp, name) == 0)
+                        if (strcasecmp(*cp, name) == 0)
                                 goto found;
         }
 found:
diff --git a/src/lib/libc/net/getnetent.3 b/src/lib/libc/net/getnetent.3
index d4f0bedbf9..00fd543ec4 100644
--- a/src/lib/libc/net/getnetent.3
+++ b/src/lib/libc/net/getnetent.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: getnetent.3,v 1.3 1995/02/25 06:20:32 cgd Exp $
+.\"     $OpenBSD: getnetent.3,v 1.15 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,11 +27,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)getnetent.3 8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
+.Dd $Mdocdate: May 31 2007 $
 .Dt GETNETENT 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm getnetent ,
 .Nm getnetbyaddr ,
@@ -46,31 +40,30 @@
 .Sh SYNOPSIS
 .Fd #include <netdb.h>
 .Ft struct netent *
-.Fn getnetent 
+.Fn getnetent "void"
 .Ft struct netent *
-.Fn getnetbyname "char *name"
+.Fn getnetbyname "const char *name"
 .Ft struct netent *
-.Fn getnetbyaddr "long net" "int type"
+.Fn getnetbyaddr "in_addr_t net" "int type"
+.Ft void
 .Fn setnetent "int stayopen"
-.Fn endnetent 
+.Ft void
+.Fn endnetent "void"
 .Sh DESCRIPTION
 The
 .Fn getnetent ,
 .Fn getnetbyname ,
 and
 .Fn getnetbyaddr
-functions
-each return a pointer to an object with the
-following structure
-containing the broken-out
-fields of a line in the network data base,
+functions each return a pointer to an object with the following structure
+containing the broken-out fields of a line in the network database,
 .Pa /etc/networks .
 .Bd -literal -offset indent
 struct  netent {
         char            *n_name;        /* official name of net */
         char            **n_aliases;    /* alias list */
         int             n_addrtype;     /* net number type */
-        unsigned long   n_net;          /* net number */
+        in_addr_t       n_net;          /* net number */
 };
 .Ed
 .Pp
@@ -79,45 +72,42 @@ The members of this structure are:
 .It Fa n_name
 The official name of the network.
 .It Fa n_aliases
-A zero terminated list of alternate names for the network.
+A null-terminated list of alternate names for the network.
 .It Fa n_addrtype
-The type of the network number returned; currently only AF_INET.
+The type of the network number returned; currently only
+.Dv AF_INET .
 .It Fa n_net
-The network number.  Network numbers are returned in machine byte
-order.
+The network number.
+Network numbers are returned in machine byte order.
 .El
 .Pp
 The
 .Fn getnetent
-function
-reads the next line of the file, opening the file if necessary.
+function reads the next line of the file, opening the file if necessary.
 .Pp
 The
 .Fn setnetent
-function
-opens and rewinds the file.  If the
+function opens and rewinds the file.
+If the
 .Fa stayopen
 flag is non-zero,
-the net data base will not be closed after each call to 
+the net database will not be closed after each call to
 .Fn getnetbyname
 or
 .Fn getnetbyaddr .
 .Pp
 The
 .Fn endnetent
-function
-closes the file.
+function closes the file.
 .Pp
 The
 .Fn getnetbyname
-function
 and
 .Fn getnetbyaddr
-sequentially search from the beginning
-of the file until a matching
-net name or
-net address and type is found,
-or until
+functions search the domain name server if the system is configured to use one.
+If the search fails, or no name server is configured, they sequentially
+search from the beginning of the file until a matching net name or
+net address and type is found, or until
 .Dv EOF
 is encountered.
 Network numbers are supplied in host order.
@@ -126,11 +116,11 @@ Network numbers are supplied in host order.
 .It Pa /etc/networks
 .El
 .Sh DIAGNOSTICS
-Null pointer
-(0) returned on
+Null pointer (0) returned on
 .Dv EOF
 or error.
 .Sh SEE ALSO
+.Xr resolver 3 ,
 .Xr networks 5
 .Sh HISTORY
 The
@@ -140,14 +130,11 @@ The
 .Fn setnetent ,
 and
 .Fn endnetent
-functions appeared in 
+functions appeared in
 .Bx 4.2 .
 .Sh BUGS
-The data space used by
-these functions is static; if future use requires the data, it should be
-copied before any subsequent calls to these functions overwrite it.
-Only Internet network
-numbers are currently understood.
-Expecting network numbers to fit
-in no more than 32 bits is probably
-naive.
+The data space used by these functions is static; if future use
+requires the data, it should be copied before any subsequent calls
+to these functions overwrite it.
+Only Internet network numbers are currently understood.
+Expecting network numbers to fit in no more than 32 bits is naive.
diff --git a/src/lib/libc/net/getnetent.c b/src/lib/libc/net/getnetent.c
index b4e16b8f5d..1bec6fb98c 100644
--- a/src/lib/libc/net/getnetent.c
+++ b/src/lib/libc/net/getnetent.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getnetent.c,v 1.4 1995/02/25 06:20:33 cgd Exp $        */
-
+/*      $OpenBSD: getnetent.c,v 1.12 2006/01/17 15:37:58 millert Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,15 +28,7 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getnetent.c 8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getnetent.c,v 1.4 1995/02/25 06:20:33 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
+#include <sys/param.h>
 #include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -58,8 +45,7 @@ static char *net_aliases[MAXALIASES];
 int _net_stayopen;
 
 void
-setnetent(f)
-        int f;
+setnetent(int f)
 {
         if (netf == NULL)
                 netf = fopen(_PATH_NETWORKS, "r" );
@@ -69,7 +55,7 @@ setnetent(f)
 }
 
 void
-endnetent()
+endnetent(void)
 {
         if (netf) {
                 fclose(netf);
@@ -79,24 +65,29 @@ endnetent()
 }
 
 struct netent *
-getnetent()
+getnetent(void)
 {
-        char *p;
-        register char *cp, **q;
+        char *p, *cp, **q;
+        size_t len;
 
         if (netf == NULL && (netf = fopen(_PATH_NETWORKS, "r" )) == NULL)
                 return (NULL);
 again:
-        p = fgets(line, BUFSIZ, netf);
-        if (p == NULL)
+        if ((p = fgetln(netf, &len)) == NULL)
                 return (NULL);
-        if (*p == '#')
+        if (p[len-1] == '\n')
+                len--;
+        if (len >= sizeof(line) || len == 0)
                 goto again;
-        cp = strpbrk(p, "#\n");
-        if (cp == NULL)
+        p = memcpy(line, p, len);
+        line[len] = '\0';
+        if (*p == '#')
                 goto again;
-        *cp = '\0';
+        if ((cp = strchr(p, '#')) != NULL)
+                *cp = '\0';
         net.n_name = p;
+        if (strlen(net.n_name) >= MAXHOSTNAMELEN-1)
+                net.n_name[MAXHOSTNAMELEN-1] = '\0';
         cp = strpbrk(p, " \t");
         if (cp == NULL)
                 goto again;
@@ -116,8 +107,11 @@ again:
                         cp++;
                         continue;
                 }
-                if (q < &net_aliases[MAXALIASES - 1])
+                if (q < &net_aliases[MAXALIASES - 1]) {
                         *q++ = cp;
+                        if (strlen(cp) >= MAXHOSTNAMELEN-1)
+                                cp[MAXHOSTNAMELEN-1] = '\0';
+                }
                 cp = strpbrk(cp, " \t");
                 if (cp != NULL)
                         *cp++ = '\0';
diff --git a/src/lib/libc/net/getnetnamadr.c b/src/lib/libc/net/getnetnamadr.c
new file mode 100644
index 0000000000..7b770f1ce7
--- /dev/null
+++ b/src/lib/libc/net/getnetnamadr.c
@@ -0,0 +1,384 @@
+/*      $OpenBSD: getnetnamadr.c,v 1.26 2005/08/06 20:30:03 espie Exp $ */
+
+/*
+ * Copyright (c) 1997, Jason Downs.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR(S) ``AS IS'' AND ANY EXPRESS
+ * OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR(S) BE LIABLE FOR ANY DIRECT,
+ * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+/* Copyright (c) 1993 Carlos Leandro and Rui Salgueiro
+ *      Dep. Matematica Universidade de Coimbra, Portugal, Europe
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ */
+/*
+ * Copyright (c) 1983, 1993
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <stdio.h>
+#include <netdb.h>
+#include <resolv.h>
+#include <ctype.h>
+#include <errno.h>
+#include <string.h>
+#include <stdlib.h>
+
+#include "thread_private.h"
+
+extern int h_errno;
+
+struct netent *_getnetbyaddr(in_addr_t net, int type);
+struct netent *_getnetbyname(const char *name);
+
+int _hokchar(const char *);
+
+#define BYADDR 0
+#define BYNAME 1
+#define MAXALIASES      35
+
+#define MAXPACKET       (64*1024)
+
+typedef union {
+        HEADER  hdr;
+        u_char  buf[MAXPACKET];
+} querybuf;
+
+typedef union {
+        long    al;
+        char    ac;
+} align;
+
+static struct netent *
+getnetanswer(querybuf *answer, int anslen, int net_i)
+{
+
+        HEADER *hp;
+        u_char *cp;
+        int n;
+        u_char *eom;
+        int type, class, ancount, qdcount, haveanswer, i, nchar;
+        char aux1[MAXHOSTNAMELEN], aux2[MAXHOSTNAMELEN], ans[MAXHOSTNAMELEN];
+        char *in, *st, *pauxt, *bp, **ap, *ep;
+        char *paux1 = &aux1[0], *paux2 = &aux2[0];
+        static  struct netent net_entry;
+        static  char *net_aliases[MAXALIASES], netbuf[BUFSIZ+1];
+
+        /*
+         * find first satisfactory answer
+         *
+         *      answer --> +------------+  ( MESSAGE )
+         *                 |   Header   |
+         *                 +------------+
+         *                 |  Question  | the question for the name server
+         *                 +------------+
+         *                 |   Answer   | RRs answering the question
+         *                 +------------+
+         *                 | Authority  | RRs pointing toward an authority
+         *                 | Additional | RRs holding additional information
+         *                 +------------+
+         */
+        eom = answer->buf + anslen;
+        hp = &answer->hdr;
+        ancount = ntohs(hp->ancount); /* #/records in the answer section */
+        qdcount = ntohs(hp->qdcount); /* #/entries in the question section */
+        bp = netbuf;
+        ep = netbuf + sizeof(netbuf);
+        cp = answer->buf + HFIXEDSZ;
+        if (!qdcount) {
+                if (hp->aa)
+                        h_errno = HOST_NOT_FOUND;
+                else
+                        h_errno = TRY_AGAIN;
+                return (NULL);
+        }
+        while (qdcount-- > 0) {
+                n = __dn_skipname(cp, eom);
+                if (n < 0 || (cp + n + QFIXEDSZ) > eom) {
+                        h_errno = NO_RECOVERY;
+                        return(NULL);
+                }
+                cp += n + QFIXEDSZ;
+        }
+        ap = net_aliases;
+        *ap = NULL;
+        net_entry.n_aliases = net_aliases;
+        haveanswer = 0;
+        while (--ancount >= 0 && cp < eom) {
+                n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+#ifdef USE_RESOLV_NAME_OK
+                if ((n < 0) || !res_dnok(bp))
+#else
+                if ((n < 0) || !_hokchar(bp))
+#endif
+                        break;
+                cp += n;
+                ans[0] = '\0';
+                strlcpy(&ans[0], bp, sizeof ans);
+                GETSHORT(type, cp);
+                GETSHORT(class, cp);
+                cp += INT32SZ;          /* TTL */
+                GETSHORT(n, cp);
+                if (class == C_IN && type == T_PTR) {
+                        n = dn_expand(answer->buf, eom, cp, bp, ep - bp);
+#ifdef USE_RESOLV_NAME_OK
+                        if ((n < 0) || !res_hnok(bp))
+#else
+                        if ((n < 0) || !_hokchar(bp))
+#endif
+                        {
+                                cp += n;
+                                return (NULL);
+                        }
+                        cp += n; 
+                        if ((ap + 2) < &net_aliases[MAXALIASES]) {
+                                *ap++ = bp;
+                                bp += strlen(bp) + 1;
+                                net_entry.n_addrtype =
+                                        (class == C_IN) ? AF_INET : AF_UNSPEC;
+                                haveanswer++;
+                        }
+                }
+        }
+        if (haveanswer) {
+                *ap = NULL;
+                switch (net_i) {
+                case BYADDR:
+                        net_entry.n_name = *net_entry.n_aliases;
+                        net_entry.n_net = 0L;
+                        break;
+                case BYNAME:
+                        ap = net_entry.n_aliases;
+                next_alias:
+                        in = *ap++;
+                        if (in == NULL) {
+                                h_errno = HOST_NOT_FOUND;
+                                return (NULL);
+                        }
+                        net_entry.n_name = ans;
+                        aux2[0] = '\0';
+                        for (i = 0; i < 4; i++) {
+                                for (st = in, nchar = 0;
+                                     isdigit((unsigned char)*st);
+                                     st++, nchar++)
+                                        ;
+                                if (*st != '.' || nchar == 0 || nchar > 3)
+                                        goto next_alias;
+                                if (i != 0)
+                                        nchar++;
+                                strlcpy(paux1, in, nchar+1);
+                                strlcat(paux1, paux2, MAXHOSTNAMELEN);
+                                pauxt = paux2;
+                                paux2 = paux1;
+                                paux1 = pauxt;
+                                in = ++st;
+                        }                 
+                        if (strcasecmp(in, "IN-ADDR.ARPA") != 0)
+                                goto next_alias;
+                        net_entry.n_net = inet_network(paux2);
+                        break;
+                }
+                net_entry.n_aliases++;
+                return (&net_entry);
+        }
+        h_errno = TRY_AGAIN;
+        return (NULL);
+}
+
+struct netent *
+getnetbyaddr(in_addr_t net, int net_type)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        unsigned int netbr[4];
+        int nn, anslen;
+        querybuf *buf;
+        char qbuf[MAXDNAME];
+        in_addr_t net2;
+        struct netent *net_entry = NULL;
+        char lookups[MAXDNSLUS];
+        int i;
+
+        if (_res_init(0) == -1)
+                return(_getnetbyaddr(net, net_type));
+
+        bcopy(_resp->lookups, lookups, sizeof lookups);
+        if (lookups[0] == '\0')
+                strlcpy(lookups, "bf", sizeof lookups);
+
+        for (i = 0; i < MAXDNSLUS && lookups[i]; i++) {
+                switch (lookups[i]) {
+#ifdef YP
+                case 'y':
+                        /* There is no YP support. */
+                        break;
+#endif  /* YP */
+                case 'b':
+                        if (net_type != AF_INET)
+                                break;  /* DNS only supports AF_INET? */
+
+                        for (nn = 4, net2 = net; net2; net2 >>= 8)
+                                netbr[--nn] = net2 & 0xff;
+                        switch (nn) {
+                        case 3:         /* Class A */
+                                snprintf(qbuf, sizeof(qbuf),
+                                    "0.0.0.%u.in-addr.arpa", netbr[3]);
+                                break;
+                        case 2:         /* Class B */
+                                snprintf(qbuf, sizeof(qbuf),
+                                    "0.0.%u.%u.in-addr.arpa",
+                                    netbr[3], netbr[2]);
+                                break;
+                        case 1:         /* Class C */
+                                snprintf(qbuf, sizeof(qbuf),
+                                    "0.%u.%u.%u.in-addr.arpa",
+                                    netbr[3], netbr[2], netbr[1]);
+                                break;
+                        case 0:         /* Class D - E */
+                                snprintf(qbuf, sizeof(qbuf),
+                                    "%u.%u.%u.%u.in-addr.arpa",
+                                    netbr[3], netbr[2], netbr[1], netbr[0]);
+                                break;
+                        }
+                        buf = malloc(sizeof(*buf));
+                        if (buf == NULL)
+                                break;
+                        anslen = res_query(qbuf, C_IN, T_PTR, buf->buf,
+                            sizeof(buf->buf));
+                        if (anslen < 0) {
+                                free(buf);
+#ifdef DEBUG
+                                if (_resp->options & RES_DEBUG)
+                                        printf("res_query failed\n");
+#endif
+                                break;
+                        }
+                        net_entry = getnetanswer(buf, anslen, BYADDR);
+                        free(buf);
+                        if (net_entry != NULL) {
+                                unsigned u_net = net;   /* maybe net should be unsigned ? */
+
+                                /* Strip trailing zeros */
+                                while ((u_net & 0xff) == 0 && u_net != 0)
+                                        u_net >>= 8;
+                                net_entry->n_net = u_net;
+                                return (net_entry);
+                        }
+                        break;
+                case 'f':
+                        net_entry = _getnetbyaddr(net, net_type);
+                        if (net_entry != NULL)
+                                return (net_entry);
+                }
+        }
+
+        /* Nothing matched. */
+        return (NULL);
+}
+
+struct netent *
+getnetbyname(const char *net)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        int anslen;
+        querybuf *buf;
+        char qbuf[MAXDNAME];
+        struct netent *net_entry = NULL;
+        char lookups[MAXDNSLUS];
+        int i;
+
+        if (_res_init(0) == -1)
+                return (_getnetbyname(net));
+
+        bcopy(_resp->lookups, lookups, sizeof lookups);
+        if (lookups[0] == '\0')
+                strlcpy(lookups, "bf", sizeof lookups);
+
+        for (i = 0; i < MAXDNSLUS && lookups[i]; i++) {
+                switch (lookups[i]) {
+#ifdef YP
+                case 'y':
+                        /* There is no YP support. */
+                        break;
+#endif  /* YP */
+                case 'b':
+                        strlcpy(qbuf, net, sizeof qbuf);
+                        buf = malloc(sizeof(*buf));
+                        if (buf == NULL)
+                                break;
+                        anslen = res_search(qbuf, C_IN, T_PTR, buf->buf,
+                            sizeof(buf->buf));
+                        if (anslen < 0) {
+                                free(buf);
+#ifdef DEBUG
+                                if (_resp->options & RES_DEBUG)
+                                        printf("res_query failed\n");
+#endif
+                                break;
+                        }
+                        net_entry = getnetanswer(buf, anslen, BYNAME);
+                        free(buf);
+                        if (net_entry != NULL)
+                                return (net_entry);
+                        break;
+                case 'f':
+                        net_entry = _getnetbyname(net);
+                        if (net_entry != NULL)
+                                return (net_entry);
+                        break;
+                }
+        }
+
+        /* Nothing matched. */
+        return (NULL);
+}
diff --git a/src/lib/libc/net/getpeereid.3 b/src/lib/libc/net/getpeereid.3
new file mode 100644
index 0000000000..c1671a7516
--- /dev/null
+++ b/src/lib/libc/net/getpeereid.3
@@ -0,0 +1,119 @@
+.\"     $OpenBSD: getpeereid.3,v 1.1 2010/07/01 19:15:30 deraadt Exp $
+.\"
+.\" Copyright (c) 1983, 1991, 1993
+.\"     The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the University nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.Dd $Mdocdate: July 1 2010 $
+.Dt GETPEEREID 3
+.Os
+.Sh NAME
+.Nm getpeereid
+.Nd get effective user and group identification of locally-connected peer
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Ft int
+.Fn getpeereid "int s" "uid_t *euid" "gid_t *egid"
+.Sh DESCRIPTION
+.Fn getpeereid
+returns the effective user ID and group ID of the peer connected to
+a
+.Ux Ns -domain
+socket (see
+.Xr unix 4 ) .
+The argument
+.Fa s
+must be of type
+.Dv SOCK_STREAM .
+.Pp
+One common use is for
+.Ux Ns -domain
+servers to determine the credentials of clients that have connected to it.
+.Pp
+.Fn getpeereid
+takes three parameters:
+.Bl -bullet
+.It
+.Fa s
+contains the file descriptor of the socket whose peer credentials
+should be looked up.
+.It
+.Fa euid
+points to a
+.Li uid_t
+variable into which the effective user ID for the connected peer will
+be stored.
+.It
+.Fa egid
+points to a
+.Li gid_t
+variable into which the effective group ID for the connected peer will
+be stored.
+.El
+.Sh RETURN VALUES
+If the call succeeds, a 0 is returned and
+.Fa euid
+and
+.Fa egid
+are set to the effective user ID and group ID of the connected peer.
+Otherwise,
+.Va errno
+is set and a value of \-1 is returned.
+.Sh ERRORS
+On failure,
+.Va errno
+is set to one of the following:
+.Bl -tag -width Er
+.It Bq Er EBADF
+The argument
+.Fa s
+is not a valid descriptor.
+.It Bq Er ENOTSOCK
+The argument
+.Fa s
+is a file, not a socket.
+.It Bq Er EOPNOTSUPP
+The socket is not in the
+.Ux Ns -domain .
+.It Bq Er ENOTCONN
+The socket is not connected.
+.It Bq Er ENOBUFS
+Insufficient resources were available in the system
+to perform the operation.
+.El
+.Sh SEE ALSO
+.Xr accept 2 ,
+.Xr bind 2 ,
+.Xr getpeername 2 ,
+.Xr getsockname 2 ,
+.Xr getsockopt 2 ,
+.Xr socket 2 ,
+.Xr unix 4
+.Sh HISTORY
+The
+.Fn getpeereid
+function call appeared in
+.Ox 3.0 .
diff --git a/src/lib/libc/net/getpeereid.c b/src/lib/libc/net/getpeereid.c
new file mode 100644
index 0000000000..208e541f17
--- /dev/null
+++ b/src/lib/libc/net/getpeereid.c
@@ -0,0 +1,36 @@
+/*      $OpenBSD: getpeereid.c,v 1.1 2010/07/01 19:15:30 deraadt Exp $  */
+
+/*
+ * Copyright (c) 2010 Theo de Raadt <deraadt@openbsd.org>
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
+ * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
+ * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
+ * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
+ * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
+ * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
+ * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+
+int
+getpeereid(int s, uid_t *euid, gid_t *egid)
+{
+        struct sockpeercred creds;
+        socklen_t credslen = sizeof(creds);
+        int error;
+
+        error = getsockopt(s, SOL_SOCKET, SO_PEERCRED,
+            &creds, &credslen);
+        if (error)
+                return (error);
+        *euid = creds.uid;
+        *egid = creds.gid;
+        return (0);
+}
diff --git a/src/lib/libc/net/getproto.c b/src/lib/libc/net/getproto.c
index 49c09b0806..07fa33288d 100644
--- a/src/lib/libc/net/getproto.c
+++ b/src/lib/libc/net/getproto.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getproto.c,v 1.4 1995/02/25 06:20:33 cgd Exp $ */
-
+/*      $OpenBSD: getproto.c,v 1.7 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,29 +28,32 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getproto.c  8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getproto.c,v 1.4 1995/02/25 06:20:33 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
+#include <stdio.h>
 
-extern int _proto_stayopen;
+int
+getprotobynumber_r(int num, struct protoent *pe, struct protoent_data *pd)
+{
+        int error;
+
+        setprotoent_r(pd->stayopen, pd);
+        while ((error = getprotoent_r(pe, pd)) == 0)
+                if (pe->p_proto == num)
+                        break;
+        if (!pd->stayopen && pd->fp != NULL) {
+                (void)fclose(pd->fp);
+                pd->fp = NULL;
+        }
+        return (error);
+}
 
 struct protoent *
-getprotobynumber(proto)
-        register int proto;
+getprotobynumber(int num)
 {
-        register struct protoent *p;
+        extern struct protoent_data _protoent_data;
+        static struct protoent proto;
 
-        setprotoent(_proto_stayopen);
-        while (p = getprotoent())
-                if (p->p_proto == proto)
-                        break;
-        if (!_proto_stayopen)
-                endprotoent();
-        return (p);
+        if (getprotobynumber_r(num, &proto, &_protoent_data) != 0)
+                return (NULL);
+        return (&proto);
 }
diff --git a/src/lib/libc/net/getprotoent.3 b/src/lib/libc/net/getprotoent.3
index 8d607199ef..df4cd0c323 100644
--- a/src/lib/libc/net/getprotoent.3
+++ b/src/lib/libc/net/getprotoent.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: getprotoent.3,v 1.3 1995/02/25 06:20:34 cgd Exp $
+.\"     $OpenBSD: getprotoent.3,v 1.17 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,39 +27,51 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)getprotoent.3       8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
+.Dd $Mdocdate: May 31 2007 $
 .Dt GETPROTOENT 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm getprotoent ,
+.Nm getprotoent_r ,
 .Nm getprotobynumber ,
+.Nm getprotobynumber_r ,
 .Nm getprotobyname ,
+.Nm getprotobyname_r ,
 .Nm setprotoent ,
-.Nm endprotoent
+.Nm setprotoent_r ,
+.Nm endprotoent ,
+.Nm endprotoent_r
 .Nd get protocol entry
 .Sh SYNOPSIS
 .Fd #include <netdb.h>
 .Ft struct protoent *
-.Fn getprotoent 
+.Fn getprotoent "void"
+.Ft int
+.Fn getprotoent_r "struct protoent *protoent" "struct protoent_data *protoent_data"
 .Ft struct protoent *
-.Fn getprotobyname "char *name"
+.Fn getprotobyname "const char *name"
+.Ft int
+.Fn getprotobyname_r "const char *name" "struct protoent *protoent" "struct protoent_data *protoent_data"
 .Ft struct protoent *
 .Fn getprotobynumber "int proto"
+.Ft int
+.Fn getprotobynumber_r "int proto" "struct protoent *protoent" "struct protoent_data *protoent_data"
+.Ft void
 .Fn setprotoent "int stayopen"
-.Fn endprotoent 
+.Ft void
+.Fn setprotoent_r "int stayopen" "struct protoent_data *protoent_data"
+.Ft void
+.Fn endprotoent "void"
+.Ft void
+.Fn endprotoent_r "struct protoent_data *protoent_data"
 .Sh DESCRIPTION
 The
 .Fn getprotoent ,
 .Fn getprotobyname ,
 and
 .Fn getprotobynumber
-functions
-each return a pointer to an object with the
-following structure
-containing the broken-out
-fields of a line in the network protocol data base,
+functions each return a pointer to an object with the following structure
+containing the broken-out fields of a line in the network protocol database,
 .Pa /etc/protocols .
 .Bd -literal -offset indent
 .Pp
@@ -79,55 +87,106 @@ The members of this structure are:
 .It Fa p_name
 The official name of the protocol.
 .It Fa p_aliases
-A zero terminated list of alternate names for the protocol.
+A null-terminated list of alternate names for the protocol.
 .It Fa p_proto
 The protocol number.
 .El
 .Pp
 The
 .Fn getprotoent
-function
-reads the next line of the file, opening the file if necessary.
+function reads the next line of the file, opening the file if necessary.
 .Pp
 The
 .Fn setprotoent
-function
-opens and rewinds the file.  If the
+function opens and rewinds the file.
+If the
 .Fa stayopen
 flag is non-zero,
-the net data base will not be closed after each call to 
+the protocol database will not be closed after each call to
 .Fn getprotobyname
 or
 .Fn getprotobynumber .
 .Pp
 The
 .Fn endprotoent
-function
-closes the file.
+function closes the file.
 .Pp
 The
 .Fn getprotobyname
-function
 and
 .Fn getprotobynumber
-sequentially search from the beginning
-of the file until a matching
-protocol name or
-protocol number is found,
-or until
+functions sequentially search from the beginning of the file until a
+matching protocol name or protocol number is found, or until
 .Dv EOF
 is encountered.
+.Pp
+The
+.Fn getprotoent_r ,
+.Fn getprotobyport_r ,
+.Fn getprotobyname_r ,
+.Fn setprotoent_r ,
+and
+.Fn endprotoent_r
+functions are reentrant versions of the above functions that take a
+pointer to a
+.Vt protoent_data
+structure which is used to store state information.
+The structure must be zero-filled before it is used
+and should be considered opaque for the sake of portability.
+.Pp
+The
+.Fn getprotoent_r ,
+.Fn getprotobyport_r ,
+and
+.Fn getprotobyname_r
+functions
+also take a pointer to a
+.Vt protoent
+structure which is used to store the results of the database lookup.
 .Sh RETURN VALUES
-Null pointer
-(0) returned on
-.Dv EOF
-or error.
+The
+.Fn getprotoent ,
+.Fn getprotobyport ,
+and
+.Fn getprotobyname
+functions return a pointer to a
+.Vt protoent
+structure on success or a null pointer if end-of-file
+is reached or an error occurs.
+.Pp
+The
+.Fn getprotoent_r ,
+.Fn getprotobyport_r ,
+and
+.Fn getprotobyname_r
+functions return 0 on success or \-1 if end-of-file
+is reached or an error occurs.
 .Sh FILES
 .Bl -tag -width /etc/protocols -compact
 .It Pa /etc/protocols
 .El
 .Sh SEE ALSO
 .Xr protocols 5
+.Sh STANDARDS
+The
+.Fn getprotoent ,
+.Fn getprotobynumber ,
+.Fn getprotobyname ,
+.Fn setprotoent ,
+and
+.Fn endprotoent
+functions conform to
+.St -p1003.1-2004 .
+.Pp
+The
+.Fn getprotoent_r ,
+.Fn getprotobyport_r ,
+.Fn getprotobyname_r ,
+.Fn setprotoent_r ,
+and
+.Fn endprotoent_r
+functions are not currently standardized.
+This implementation follows the API used by HP, IBM, and Digital.
 .Sh HISTORY
 The
 .Fn getprotoent ,
@@ -136,11 +195,19 @@ The
 .Fn setprotoent ,
 and
 .Fn endprotoent
-functions appeared in 
+functions appeared in
 .Bx 4.2 .
+.Pp
+The
+.Fn getprotoent_r ,
+.Fn getprotobyport_r ,
+.Fn getprotobyname_r ,
+.Fn setprotoent_r ,
+and
+.Fn endprotoent_r
+functions appeared in
+.Ox 3.7 .
 .Sh BUGS
-These functions use a static data space;
-if the data is needed for future use, it should be
-copied before any subsequent calls overwrite it.
-Only the Internet
-protocols are currently understood.
+The non-reentrant functions use a static data space; if the data is needed
+for future use, it should be copied before any subsequent calls overwrite it.
+Only the Internet protocols are currently understood.
diff --git a/src/lib/libc/net/getprotoent.c b/src/lib/libc/net/getprotoent.c
index 1179b9029b..f0705e0765 100644
--- a/src/lib/libc/net/getprotoent.c
+++ b/src/lib/libc/net/getprotoent.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getprotoent.c,v 1.4 1995/02/25 06:20:35 cgd Exp $      */
-
+/*      $OpenBSD: getprotoent.c,v 1.10 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,69 +28,66 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getprotoent.c       8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getprotoent.c,v 1.4 1995/02/25 06:20:35 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <sys/socket.h>
+
+#include <errno.h>
+#include <limits.h>
 #include <netdb.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-#define MAXALIASES      35
-
-static FILE *protof = NULL;
-static char line[BUFSIZ+1];
-static struct protoent proto;
-static char *proto_aliases[MAXALIASES];
-int _proto_stayopen;
-
 void
-setprotoent(f)
-        int f;
+setprotoent_r(int f, struct protoent_data *pd)
 {
-        if (protof == NULL)
-                protof = fopen(_PATH_PROTOCOLS, "r" );
+        if (pd->fp == NULL)
+                pd->fp = fopen(_PATH_PROTOCOLS, "r" );
         else
-                rewind(protof);
-        _proto_stayopen |= f;
+                rewind(pd->fp);
+        pd->stayopen |= f;
 }
 
 void
-endprotoent()
+endprotoent_r(struct protoent_data *pd)
 {
-        if (protof) {
-                fclose(protof);
-                protof = NULL;
+        if (pd->fp) {
+                fclose(pd->fp);
+                pd->fp = NULL;
         }
-        _proto_stayopen = 0;
+        free(pd->aliases);
+        pd->aliases = NULL;
+        pd->maxaliases = 0;
+        free(pd->line);
+        pd->line = NULL;
+        pd->stayopen = 0;
 }
 
-struct protoent *
-getprotoent()
+int
+getprotoent_r(struct protoent *pe, struct protoent_data *pd)
 {
-        char *p;
-        register char *cp, **q;
+        char *p, *cp, **q, *endp;
+        size_t len;
+        long l;
+        int serrno;
 
-        if (protof == NULL && (protof = fopen(_PATH_PROTOCOLS, "r" )) == NULL)
-                return (NULL);
+        if (pd->fp == NULL && (pd->fp = fopen(_PATH_PROTOCOLS, "r" )) == NULL)
+                return (-1);
 again:
-        if ((p = fgets(line, BUFSIZ, protof)) == NULL)
-                return (NULL);
-        if (*p == '#')
+        if ((p = fgetln(pd->fp, &len)) == NULL)
+                return (-1);
+        if (len == 0 || *p == '#' || *p == '\n')
                 goto again;
-        cp = strpbrk(p, "#\n");
+        if (p[len-1] == '\n')
+                len--;
+        if ((cp = memchr(p, '#', len)) != NULL)
+                len = cp - p;
+        cp = realloc(pd->line, len + 1);
         if (cp == NULL)
-                goto again;
-        *cp = '\0';
-        proto.p_name = p;
-        cp = strpbrk(p, " \t");
+                return (-1);
+        pd->line = pe->p_name = memcpy(cp, p, len);
+        cp[len] = '\0';
+        cp = strpbrk(cp, " \t");
         if (cp == NULL)
                 goto again;
         *cp++ = '\0';
@@ -104,8 +96,21 @@ again:
         p = strpbrk(cp, " \t");
         if (p != NULL)
                 *p++ = '\0';
-        proto.p_proto = atoi(cp);
-        q = proto.p_aliases = proto_aliases;
+        l = strtol(cp, &endp, 10);
+        if (endp == cp || *endp != '\0' || l < 0 || l >= INT_MAX)
+                goto again;
+        pe->p_proto = l;
+        if (pd->aliases == NULL) {
+                pd->maxaliases = 5;
+                pd->aliases = calloc(pd->maxaliases, sizeof(char *));
+                if (pd->aliases == NULL) {
+                        serrno = errno;
+                        endprotoent_r(pd);
+                        errno = serrno;
+                        return (-1);
+                }
+        }
+        q = pe->p_aliases = pd->aliases;
         if (p != NULL) {
                 cp = p;
                 while (cp && *cp) {
@@ -113,13 +118,49 @@ again:
                                 cp++;
                                 continue;
                         }
-                        if (q < &proto_aliases[MAXALIASES - 1])
-                                *q++ = cp;
+                        if (q == &pe->p_aliases[pd->maxaliases - 1]) {
+                                p = realloc(pe->p_aliases,
+                                    2 * pd->maxaliases * sizeof(char *));
+                                if (p == NULL) {
+                                        serrno = errno;
+                                        endprotoent_r(pd);
+                                        errno = serrno;
+                                        return (-1);
+                                }
+                                pd->maxaliases *= 2;
+                                q = (char **)p + (q - pe->p_aliases);
+                                pe->p_aliases = pd->aliases = (char **)p;
+                        }
+                        *q++ = cp;
                         cp = strpbrk(cp, " \t");
                         if (cp != NULL)
                                 *cp++ = '\0';
                 }
         }
         *q = NULL;
+        return (0);
+}
+
+struct protoent_data _protoent_data;    /* shared with getproto{,name}.c */
+
+void
+setprotoent(int f)
+{
+        setprotoent_r(f, &_protoent_data);
+}
+
+void
+endprotoent(void)
+{
+        endprotoent_r(&_protoent_data);
+}
+
+struct protoent *
+getprotoent(void)
+{
+        static struct protoent proto;
+
+        if (getprotoent_r(&proto, &_protoent_data) != 0)
+                return (NULL);
         return (&proto);
 }
diff --git a/src/lib/libc/net/getprotoname.c b/src/lib/libc/net/getprotoname.c
index 4f8cf21c3f..749b6b3f13 100644
--- a/src/lib/libc/net/getprotoname.c
+++ b/src/lib/libc/net/getprotoname.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getprotoname.c,v 1.4 1995/02/25 06:20:36 cgd Exp $     */
-
+/*      $OpenBSD: getprotoname.c,v 1.7 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,36 +28,40 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getprotoname.c      8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getprotoname.c,v 1.4 1995/02/25 06:20:36 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
+#include <stdio.h>
 #include <string.h>
 
-extern int _proto_stayopen;
-
-struct protoent *
-getprotobyname(name)
-        register const char *name;
+int
+getprotobyname_r(const char *name, struct protoent *pe,
+    struct protoent_data *pd)
 {
-        register struct protoent *p;
-        register char **cp;
+        char **cp;
+        int error;
 
-        setprotoent(_proto_stayopen);
-        while (p = getprotoent()) {
-                if (strcmp(p->p_name, name) == 0)
+        setprotoent_r(pd->stayopen, pd);
+        while ((error = getprotoent_r(pe, pd)) == 0) {
+                if (strcmp(pe->p_name, name) == 0)
                         break;
-                for (cp = p->p_aliases; *cp != 0; cp++)
+                for (cp = pe->p_aliases; *cp != 0; cp++)
                         if (strcmp(*cp, name) == 0)
                                 goto found;
         }
 found:
-        if (!_proto_stayopen)
-                endprotoent();
-        return (p);
+        if (!pd->stayopen && pd->fp != NULL) {
+                fclose(pd->fp);
+                pd->fp = NULL;
+        }
+        return (error);
+}
+
+struct protoent *
+getprotobyname(const char *name)
+{
+        extern struct protoent_data _protoent_data;
+        static struct protoent proto;
+
+        if (getprotobyname_r(name, &proto, &_protoent_data) != 0)
+                return (NULL);
+        return (&proto);
 }
diff --git a/src/lib/libc/net/getrrsetbyname.3 b/src/lib/libc/net/getrrsetbyname.3
new file mode 100644
index 0000000000..121cb67fcc
--- /dev/null
+++ b/src/lib/libc/net/getrrsetbyname.3
@@ -0,0 +1,166 @@
+.\" $OpenBSD: getrrsetbyname.3,v 1.15 2007/05/31 19:19:30 jmc Exp $
+.\"
+.\" Copyright (C) 2000, 2001  Internet Software Consortium.
+.\"
+.\" Permission to use, copy, modify, and distribute this software for any
+.\" purpose with or without fee is hereby granted, provided that the above
+.\" copyright notice and this permission notice appear in all copies.
+.\"
+.\" THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+.\" DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+.\" INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+.\" INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+.\" FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+.\" NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+.\" WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt GETRRSETBYNAME 3
+.Os
+.Sh NAME
+.Nm freerrset ,
+.Nm getrrsetbyname
+.Nd retrieve DNS records
+.Sh SYNOPSIS
+.Fd #include <netdb.h>
+.Ft int
+.Fn getrrsetbyname "const char *hostname" "unsigned int rdclass" \
+"unsigned int rdtype" "unsigned int flags" "struct rrsetinfo **res"
+.Ft void
+.Fn freerrset "struct rrsetinfo *rrset"
+.Sh DESCRIPTION
+.Fn getrrsetbyname
+gets a set of resource records associated with a
+.Fa hostname ,
+.Fa rdclass ,
+and
+.Fa rdtype .
+.Fa hostname
+is a pointer to a NUL-terminated string.
+The
+.Fa flags
+field is currently unused and must be zero.
+.Pp
+After a successful call to
+.Fn getrrsetbyname ,
+.Fa *res
+is a pointer to an
+.Li rrsetinfo
+structure, containing a list of one or more
+.Li rdatainfo
+structures containing resource records and potentially another list of
+.Li rdatainfo
+structures containing SIG resource records associated with those records.
+The members
+.Li rri_rdclass
+and
+.Li rri_rdtype
+are copied from the parameters.
+.Li rri_ttl
+and
+.Li rri_name
+are properties of the obtained rrset.
+The resource records contained in
+.Li rri_rdatas
+and
+.Li rri_sigs
+are in uncompressed DNS wire format.
+Properties of the rdataset are represented in the
+.Li rri_flags
+bitfield.
+If the
+.Dv RRSET_VALIDATED
+bit is set, the data has been DNSSEC
+validated and the signatures verified.
+.Pp
+The following structures are used:
+.Bd -literal -offset indent
+struct  rdatainfo {
+        unsigned int    rdi_length;     /* length of data */
+        unsigned char   *rdi_data;      /* record data */
+};
+
+struct  rrsetinfo {
+        unsigned int     rri_flags;     /* RRSET_VALIDATED ... */
+        unsigned int     rri_rdclass;   /* class number */
+        unsigned int     rri_rdtype;    /* RR type number */
+        unsigned int     rri_ttl;       /* time to live */
+        unsigned int     rri_nrdatas;   /* size of rdatas array */
+        unsigned int     rri_nsigs;     /* size of sigs array */
+        char             *rri_name;     /* canonical name */
+        struct rdatainfo *rri_rdatas;   /* individual records */
+        struct rdatainfo *rri_sigs;     /* individual signatures */
+};
+.Ed
+.Pp
+All of the information returned by
+.Fn getrrsetbyname
+is dynamically allocated: the
+.Li rrsetinfo
+and
+.Li rdatainfo
+structures,
+and the canonical host name strings pointed to by the
+.Li rrsetinfo
+structure.
+Memory allocated for the dynamically allocated structures created by
+a successful call to
+.Fn getrrsetbyname
+is released by
+.Fn freerrset .
+.Li rrset
+is a pointer to a
+.Li struct rrsetinfo
+created by a call to
+.Fn getrrsetbyname .
+.Pp
+If the EDNS0 option is activated in
+.Xr resolv.conf 5 ,
+.Fn getrrsetbyname
+will request DNSSEC authentication using the EDNS0 DNSSEC OK (DO) bit.
+.Sh RETURN VALUES
+.Fn getrrsetbyname
+returns zero on success, and one of the following error
+codes if an error occurred:
+.Pp
+.Bl -tag -width ERRSET_NOMEMORY
+.It Bq Er ERRSET_NONAME
+The name does not exist.
+.It Bq Er ERRSET_NODATA
+The name exists, but does not have data of the desired type.
+.It Bq Er ERRSET_NOMEMORY
+Memory could not be allocated.
+.It Bq Er ERRSET_INVAL
+A parameter is invalid.
+.It Bq Er ERRSET_FAIL
+Other failure.
+.El
+.Sh SEE ALSO
+.Xr resolver 3 ,
+.Xr resolv.conf 5 ,
+.Xr named 8
+.Sh HISTORY
+.Fn getrrsetbyname
+first appeared in
+.Ox 3.0 .
+The API first appeared in ISC BIND version 9.
+.Sh AUTHORS
+.An Jakob Schlyter Aq jakob@openbsd.org
+.Sh CAVEATS
+The
+.Dv RRSET_VALIDATED
+flag in
+.Li rri_flags
+is set if the AD (authenticated data) bit in the DNS answer is
+set.
+This flag
+.Em should not
+be trusted unless the transport between the nameserver and the resolver
+is secure (e.g. IPsec, trusted network, loopback communication).
+.Sh BUGS
+The data in
+.Li *rdi_data
+should be returned in uncompressed wire format.
+Currently, the data is in compressed format and the caller can't
+uncompress since it doesn't have the full message.
diff --git a/src/lib/libc/net/getrrsetbyname.c b/src/lib/libc/net/getrrsetbyname.c
new file mode 100644
index 0000000000..2bbb6ccf83
--- /dev/null
+++ b/src/lib/libc/net/getrrsetbyname.c
@@ -0,0 +1,517 @@
+/* $OpenBSD: getrrsetbyname.c,v 1.12 2010/06/29 09:22:06 deraadt Exp $ */
+
+/*
+ * Copyright (c) 2001 Jakob Schlyter. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * Portions Copyright (c) 1999-2001 Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM
+ * DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL
+ * INTERNET SOFTWARE CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT,
+ * INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING
+ * FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT,
+ * NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION
+ * WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <netdb.h>
+#include <resolv.h>
+#include <stdlib.h>
+#include <string.h>
+
+#include "thread_private.h"
+
+#define MAXPACKET 1024*64
+
+struct dns_query {
+        char                    *name;
+        u_int16_t               type;
+        u_int16_t               class;
+        struct dns_query        *next;
+};
+
+struct dns_rr {
+        char                    *name;
+        u_int16_t               type;
+        u_int16_t               class;
+        u_int16_t               ttl;
+        u_int16_t               size;
+        void                    *rdata;
+        struct dns_rr           *next;
+};
+
+struct dns_response {
+        HEADER                  header;
+        struct dns_query        *query;
+        struct dns_rr           *answer;
+        struct dns_rr           *authority;
+        struct dns_rr           *additional;
+};
+
+static struct dns_response *parse_dns_response(const u_char *, int);
+static struct dns_query *parse_dns_qsection(const u_char *, int,
+    const u_char **, int);
+static struct dns_rr *parse_dns_rrsection(const u_char *, int, const u_char **,
+    int);
+
+static void free_dns_query(struct dns_query *);
+static void free_dns_rr(struct dns_rr *);
+static void free_dns_response(struct dns_response *);
+
+static int count_dns_rr(struct dns_rr *, u_int16_t, u_int16_t);
+
+int
+getrrsetbyname(const char *hostname, unsigned int rdclass,
+    unsigned int rdtype, unsigned int flags,
+    struct rrsetinfo **res)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        int result;
+        struct rrsetinfo *rrset = NULL;
+        struct dns_response *response = NULL;
+        struct dns_rr *rr;
+        struct rdatainfo *rdata;
+        int length;
+        unsigned int index_ans, index_sig;
+        union {
+                HEADER hdr;
+                u_char buf[MAXPACKET];
+        } answer;
+
+        /* check for invalid class and type */
+        if (rdclass > 0xffff || rdtype > 0xffff) {
+                result = ERRSET_INVAL;
+                goto fail;
+        }
+
+        /* don't allow queries of class or type ANY */
+        if (rdclass == 0xff || rdtype == 0xff) {
+                result = ERRSET_INVAL;
+                goto fail;
+        }
+
+        /* don't allow flags yet, unimplemented */
+        if (flags) {
+                result = ERRSET_INVAL;
+                goto fail;
+        }
+
+        /* initialize resolver */
+        if (_res_init(0) == -1) {
+                result = ERRSET_FAIL;
+                goto fail;
+        }
+
+#ifdef DEBUG
+        _resp->options |= RES_DEBUG;
+#endif /* DEBUG */
+
+#ifdef RES_USE_DNSSEC
+        /* turn on DNSSEC if EDNS0 is configured */
+        if (_resp->options & RES_USE_EDNS0)
+                _resp->options |= RES_USE_DNSSEC;
+#endif /* RES_USE_DNSEC */
+
+        /* make query */
+        length = res_query(hostname, (signed int) rdclass, (signed int) rdtype,
+            answer.buf, sizeof(answer.buf));
+        if (length < 0) {
+                switch(h_errno) {
+                case HOST_NOT_FOUND:
+                        result = ERRSET_NONAME;
+                        goto fail;
+                case NO_DATA:
+                        result = ERRSET_NODATA;
+                        goto fail;
+                default:
+                        result = ERRSET_FAIL;
+                        goto fail;
+                }
+        }
+
+        /* parse result */
+        response = parse_dns_response(answer.buf, length);
+        if (response == NULL) {
+                result = ERRSET_FAIL;
+                goto fail;
+        }
+
+        if (response->header.qdcount != 1) {
+                result = ERRSET_FAIL;
+                goto fail;
+        }
+
+        /* initialize rrset */
+        rrset = calloc(1, sizeof(struct rrsetinfo));
+        if (rrset == NULL) {
+                result = ERRSET_NOMEMORY;
+                goto fail;
+        }
+        rrset->rri_rdclass = response->query->class;
+        rrset->rri_rdtype = response->query->type;
+        rrset->rri_ttl = response->answer->ttl;
+        rrset->rri_nrdatas = response->header.ancount;
+
+        /* check for authenticated data */
+        if (response->header.ad == 1)
+                rrset->rri_flags |= RRSET_VALIDATED;
+
+        /* copy name from answer section */
+        rrset->rri_name = strdup(response->answer->name);
+        if (rrset->rri_name == NULL) {
+                result = ERRSET_NOMEMORY;
+                goto fail;
+        }
+
+        /* count answers */
+        rrset->rri_nrdatas = count_dns_rr(response->answer, rrset->rri_rdclass,
+            rrset->rri_rdtype);
+        rrset->rri_nsigs = count_dns_rr(response->answer, rrset->rri_rdclass,
+            T_RRSIG);
+
+        /* allocate memory for answers */
+        rrset->rri_rdatas = calloc(rrset->rri_nrdatas,
+            sizeof(struct rdatainfo));
+        if (rrset->rri_rdatas == NULL) {
+                result = ERRSET_NOMEMORY;
+                goto fail;
+        }
+
+        /* allocate memory for signatures */
+        rrset->rri_sigs = calloc(rrset->rri_nsigs, sizeof(struct rdatainfo));
+        if (rrset->rri_sigs == NULL) {
+                result = ERRSET_NOMEMORY;
+                goto fail;
+        }
+
+        /* copy answers & signatures */
+        for (rr = response->answer, index_ans = 0, index_sig = 0;
+            rr; rr = rr->next) {
+
+                rdata = NULL;
+
+                if (rr->class == rrset->rri_rdclass &&
+                    rr->type  == rrset->rri_rdtype)
+                        rdata = &rrset->rri_rdatas[index_ans++];
+
+                if (rr->class == rrset->rri_rdclass &&
+                    rr->type  == T_RRSIG)
+                        rdata = &rrset->rri_sigs[index_sig++];
+
+                if (rdata) {
+                        rdata->rdi_length = rr->size;
+                        rdata->rdi_data   = malloc(rr->size);
+
+                        if (rdata->rdi_data == NULL) {
+                                result = ERRSET_NOMEMORY;
+                                goto fail;
+                        }
+                        memcpy(rdata->rdi_data, rr->rdata, rr->size);
+                }
+        }
+        free_dns_response(response);
+
+        *res = rrset;
+        return (ERRSET_SUCCESS);
+
+fail:
+        if (rrset != NULL)
+                freerrset(rrset);
+        if (response != NULL)
+                free_dns_response(response);
+        return (result);
+}
+
+void
+freerrset(struct rrsetinfo *rrset)
+{
+        u_int16_t i;
+
+        if (rrset == NULL)
+                return;
+
+        if (rrset->rri_rdatas) {
+                for (i = 0; i < rrset->rri_nrdatas; i++) {
+                        if (rrset->rri_rdatas[i].rdi_data == NULL)
+                                break;
+                        free(rrset->rri_rdatas[i].rdi_data);
+                }
+                free(rrset->rri_rdatas);
+        }
+
+        if (rrset->rri_sigs) {
+                for (i = 0; i < rrset->rri_nsigs; i++) {
+                        if (rrset->rri_sigs[i].rdi_data == NULL)
+                                break;
+                        free(rrset->rri_sigs[i].rdi_data);
+                }
+                free(rrset->rri_sigs);
+        }
+
+        if (rrset->rri_name)
+                free(rrset->rri_name);
+        free(rrset);
+}
+
+/*
+ * DNS response parsing routines
+ */
+static struct dns_response *
+parse_dns_response(const u_char *answer, int size)
+{
+        struct dns_response *resp;
+        const u_char *cp;
+
+        /* allocate memory for the response */
+        resp = calloc(1, sizeof(*resp));
+        if (resp == NULL)
+                return (NULL);
+
+        /* initialize current pointer */
+        cp = answer;
+
+        /* copy header */
+        memcpy(&resp->header, cp, HFIXEDSZ);
+        cp += HFIXEDSZ;
+
+        /* fix header byte order */
+        resp->header.qdcount = ntohs(resp->header.qdcount);
+        resp->header.ancount = ntohs(resp->header.ancount);
+        resp->header.nscount = ntohs(resp->header.nscount);
+        resp->header.arcount = ntohs(resp->header.arcount);
+
+        /* there must be at least one query */
+        if (resp->header.qdcount < 1) {
+                free_dns_response(resp);
+                return (NULL);
+        }
+
+        /* parse query section */
+        resp->query = parse_dns_qsection(answer, size, &cp,
+            resp->header.qdcount);
+        if (resp->header.qdcount && resp->query == NULL) {
+                free_dns_response(resp);
+                return (NULL);
+        }
+
+        /* parse answer section */
+        resp->answer = parse_dns_rrsection(answer, size, &cp,
+            resp->header.ancount);
+        if (resp->header.ancount && resp->answer == NULL) {
+                free_dns_response(resp);
+                return (NULL);
+        }
+
+        /* parse authority section */
+        resp->authority = parse_dns_rrsection(answer, size, &cp,
+            resp->header.nscount);
+        if (resp->header.nscount && resp->authority == NULL) {
+                free_dns_response(resp);
+                return (NULL);
+        }
+
+        /* parse additional section */
+        resp->additional = parse_dns_rrsection(answer, size, &cp,
+            resp->header.arcount);
+        if (resp->header.arcount && resp->additional == NULL) {
+                free_dns_response(resp);
+                return (NULL);
+        }
+
+        return (resp);
+}
+
+static struct dns_query *
+parse_dns_qsection(const u_char *answer, int size, const u_char **cp, int count)
+{
+        struct dns_query *head, *curr, *prev;
+        int i, length;
+        char name[MAXDNAME];
+
+        for (i = 1, head = NULL, prev = NULL; i <= count; i++, prev = curr) {
+
+                /* allocate and initialize struct */
+                curr = calloc(1, sizeof(struct dns_query));
+                if (curr == NULL) {
+                        free_dns_query(head);
+                        return (NULL);
+                }
+                if (head == NULL)
+                        head = curr;
+                if (prev != NULL)
+                        prev->next = curr;
+
+                /* name */
+                length = dn_expand(answer, answer + size, *cp, name,
+                    sizeof(name));
+                if (length < 0) {
+                        free_dns_query(head);
+                        return (NULL);
+                }
+                curr->name = strdup(name);
+                if (curr->name == NULL) {
+                        free_dns_query(head);
+                        return (NULL);
+                }
+                *cp += length;
+
+                /* type */
+                curr->type = _getshort(*cp);
+                *cp += INT16SZ;
+
+                /* class */
+                curr->class = _getshort(*cp);
+                *cp += INT16SZ;
+        }
+
+        return (head);
+}
+
+static struct dns_rr *
+parse_dns_rrsection(const u_char *answer, int size, const u_char **cp,
+    int count)
+{
+        struct dns_rr *head, *curr, *prev;
+        int i, length;
+        char name[MAXDNAME];
+
+        for (i = 1, head = NULL, prev = NULL; i <= count; i++, prev = curr) {
+
+                /* allocate and initialize struct */
+                curr = calloc(1, sizeof(struct dns_rr));
+                if (curr == NULL) {
+                        free_dns_rr(head);
+                        return (NULL);
+                }
+                if (head == NULL)
+                        head = curr;
+                if (prev != NULL)
+                        prev->next = curr;
+
+                /* name */
+                length = dn_expand(answer, answer + size, *cp, name,
+                    sizeof(name));
+                if (length < 0) {
+                        free_dns_rr(head);
+                        return (NULL);
+                }
+                curr->name = strdup(name);
+                if (curr->name == NULL) {
+                        free_dns_rr(head);
+                        return (NULL);
+                }
+                *cp += length;
+
+                /* type */
+                curr->type = _getshort(*cp);
+                *cp += INT16SZ;
+
+                /* class */
+                curr->class = _getshort(*cp);
+                *cp += INT16SZ;
+
+                /* ttl */
+                curr->ttl = _getlong(*cp);
+                *cp += INT32SZ;
+
+                /* rdata size */
+                curr->size = _getshort(*cp);
+                *cp += INT16SZ;
+
+                /* rdata itself */
+                curr->rdata = malloc(curr->size);
+                if (curr->rdata == NULL) {
+                        free_dns_rr(head);
+                        return (NULL);
+                }
+                memcpy(curr->rdata, *cp, curr->size);
+                *cp += curr->size;
+        }
+
+        return (head);
+}
+
+static void
+free_dns_query(struct dns_query *p)
+{
+        if (p == NULL)
+                return;
+
+        if (p->name)
+                free(p->name);
+        free_dns_query(p->next);
+        free(p);
+}
+
+static void
+free_dns_rr(struct dns_rr *p)
+{
+        if (p == NULL)
+                return;
+
+        if (p->name)
+                free(p->name);
+        if (p->rdata)
+                free(p->rdata);
+        free_dns_rr(p->next);
+        free(p);
+}
+
+static void
+free_dns_response(struct dns_response *p)
+{
+        if (p == NULL)
+                return;
+
+        free_dns_query(p->query);
+        free_dns_rr(p->answer);
+        free_dns_rr(p->authority);
+        free_dns_rr(p->additional);
+        free(p);
+}
+
+static int
+count_dns_rr(struct dns_rr *p, u_int16_t class, u_int16_t type)
+{
+        int n = 0;
+
+        while(p) {
+                if (p->class == class && p->type == type)
+                        n++;
+                p = p->next;
+        }
+
+        return (n);
+}
diff --git a/src/lib/libc/net/getservbyname.c b/src/lib/libc/net/getservbyname.c
index b4a6311966..beb8943af6 100644
--- a/src/lib/libc/net/getservbyname.c
+++ b/src/lib/libc/net/getservbyname.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getservbyname.c,v 1.4 1995/02/25 06:20:36 cgd Exp $    */
-
+/*      $OpenBSD: getservbyname.c,v 1.10 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,39 +28,43 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getservbyname.c     8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getservbyname.c,v 1.4 1995/02/25 06:20:36 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
+#include <stdio.h>
 #include <string.h>
 
-extern int _serv_stayopen;
-
-struct servent *
-getservbyname(name, proto)
-        const char *name, *proto;
+int
+getservbyname_r(const char *name, const char *proto, struct servent *se,
+    struct servent_data *sd)
 {
-        register struct servent *p;
-        register char **cp;
+        char **cp;
+        int error;
 
-        setservent(_serv_stayopen);
-        while (p = getservent()) {
-                if (strcmp(name, p->s_name) == 0)
+        setservent_r(sd->stayopen, sd);
+        while ((error = getservent_r(se, sd)) == 0) {
+                if (strcmp(name, se->s_name) == 0)
                         goto gotname;
-                for (cp = p->s_aliases; *cp; cp++)
+                for (cp = se->s_aliases; *cp; cp++)
                         if (strcmp(name, *cp) == 0)
                                 goto gotname;
                 continue;
 gotname:
-                if (proto == 0 || strcmp(p->s_proto, proto) == 0)
+                if (proto == 0 || strcmp(se->s_proto, proto) == 0)
                         break;
         }
-        if (!_serv_stayopen)
-                endservent();
-        return (p);
+        if (!sd->stayopen && sd->fp != NULL) {
+                fclose(sd->fp);
+                sd->fp = NULL;
+        }
+        return (error);
+}
+
+struct servent *
+getservbyname(const char *name, const char *proto)
+{
+        extern struct servent_data _servent_data;
+        static struct servent serv;
+
+        if (getservbyname_r(name, proto, &serv, &_servent_data) != 0)
+                return (NULL);
+        return (&serv);
 }
diff --git a/src/lib/libc/net/getservbyport.c b/src/lib/libc/net/getservbyport.c
index c34790737b..46679ba366 100644
--- a/src/lib/libc/net/getservbyport.c
+++ b/src/lib/libc/net/getservbyport.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getservbyport.c,v 1.4 1995/02/25 06:20:37 cgd Exp $    */
-
+/*      $OpenBSD: getservbyport.c,v 1.7 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,34 +28,37 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getservbyport.c     8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getservbyport.c,v 1.4 1995/02/25 06:20:37 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <netdb.h>
+#include <stdio.h>
 #include <string.h>
 
-extern int _serv_stayopen;
-
-struct servent *
-getservbyport(port, proto)
-        int port;
-        const char *proto;
+int
+getservbyport_r(int port, const char *proto, struct servent *se,
+    struct servent_data *sd)
 {
-        register struct servent *p;
+        int error;
 
-        setservent(_serv_stayopen);
-        while (p = getservent()) {
-                if (p->s_port != port)
+        setservent_r(sd->stayopen, sd);
+        while ((error = getservent_r(se, sd)) == 0) {
+                if (se->s_port != port)
                         continue;
-                if (proto == 0 || strcmp(p->s_proto, proto) == 0)
+                if (proto == 0 || strcmp(se->s_proto, proto) == 0)
                         break;
         }
-        if (!_serv_stayopen)
-                endservent();
-        return (p);
+        if (!sd->stayopen && sd->fp != NULL) {
+                fclose(sd->fp);
+                sd->fp = NULL;
+        }
+        return (error);
+}
+
+struct servent *
+getservbyport(int port, const char *proto)
+{
+        extern struct servent_data _servent_data;
+        static struct servent serv;
+
+        if (getservbyport_r(port, proto, &serv, &_servent_data) != 0)
+                return (NULL);
+        return (&serv);
 }
diff --git a/src/lib/libc/net/getservent.3 b/src/lib/libc/net/getservent.3
index 9e0656be00..7888b5f1b8 100644
--- a/src/lib/libc/net/getservent.3
+++ b/src/lib/libc/net/getservent.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: getservent.3,v 1.3 1995/02/25 06:20:38 cgd Exp $
+.\"     $OpenBSD: getservent.3,v 1.20 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,41 +27,51 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)getservent.3        8.3 (Berkeley) 1/12/94
-.\"
-.Dd January 12, 1994
+.Dd $Mdocdate: May 31 2007 $
 .Dt GETSERVENT 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm getservent ,
+.Nm getservent_r ,
 .Nm getservbyport ,
+.Nm getservbyport_r ,
 .Nm getservbyname ,
+.Nm getservbyname_r ,
 .Nm setservent ,
-.Nm endservent
+.Nm setservent_r ,
+.Nm endservent ,
+.Nm endservent_r
 .Nd get service entry
 .Sh SYNOPSIS
 .Fd #include <netdb.h>
 .Ft struct servent *
-.Fn getservent 
+.Fn getservent "void"
+.Ft int
+.Fn getservent_r "struct servent *servent" "struct servent_data *servent_data"
 .Ft struct servent *
-.Fn getservbyname "char *name" "char *proto"
+.Fn getservbyname "const char *name" "const char *proto"
+.Ft int
+.Fn getservbyname_r "const char *name" "const char *proto" "struct servent *servent" "struct servent_data *servent_data"
 .Ft struct servent *
-.Fn getservbyport "int port" proto
+.Fn getservbyport "int port" "const char *proto"
+.Ft int
+.Fn getservbyport_r "int port" "const char *proto" "struct servent *servent" "struct servent_data *servent_data"
 .Ft void
 .Fn setservent "int stayopen"
 .Ft void
-.Fn endservent void
+.Fn setservent_r "int stayopen" "struct servent_data *servent_data"
+.Ft void
+.Fn endservent "void"
+.Ft void
+.Fn endservent_r "struct servent_data *servent_data"
 .Sh DESCRIPTION
 The
 .Fn getservent ,
 .Fn getservbyname ,
 and
 .Fn getservbyport
-functions
-each return a pointer to an object with the
-following structure
-containing the broken-out
-fields of a line in the network services data base,
+functions each return a pointer to an object with the following structure
+containing the broken-out fields of a line in the network services database,
 .Pa /etc/services .
 .Bd -literal -offset indent
 struct  servent {
@@ -81,64 +87,113 @@ The members of this structure are:
 .It Fa s_name
 The official name of the service.
 .It Fa s_aliases
-A zero terminated list of alternate names for the service.
+A null-terminated list of alternate names for the service.
 .It Fa s_port
 The port number at which the service resides.
 Port numbers are returned in network byte order.
 .It Fa s_proto
-The name of the protocol to use when contacting the
-service.
+The name of the protocol to use when contacting the service.
 .El
 .Pp
 The
 .Fn getservent
-function
-reads the next line of the file, opening the file if necessary.
+function reads the next line of the file, opening the file if necessary.
 .Pp
 The
 .Fn setservent
-function
-opens and rewinds the file.  If the
+function opens and rewinds the file.
+If the
 .Fa stayopen
 flag is non-zero,
-the net data base will not be closed after each call to 
+the services database will not be closed after each call to
 .Fn getservbyname
 or
 .Fn getservbyport .
 .Pp
 The
 .Fn endservent
-function
-closes the file.
+function closes the file.
 .Pp
 The
 .Fn getservbyname
 and
 .Fn getservbyport
-functions
-sequentially search from the beginning
-of the file until a matching
-protocol name or
-port number is found,
-or until
+functions sequentially search from the beginning of the file until a
+matching protocol name or port number (specified in network byte order)
+is found, or until
 .Dv EOF
 is encountered.
-If a protocol name is also supplied (non-
-.Dv NULL ) , 
+If a protocol name is also supplied (non-null),
 searches must also match the protocol.
-.ne 1i
+.Pp
+The
+.Fn getservent_r ,
+.Fn getservbyport_r ,
+.Fn getservbyname_r ,
+.Fn setservent_r ,
+and
+.Fn endservent_r
+functions are reentrant versions of the above functions that take a
+pointer to a
+.Fa servent_data
+structure which is used to store state information.
+The structure must be zero-filled before it is used
+and should be considered opaque for the sake of portability.
+.Pp
+The
+.Fn getservent_r ,
+.Fn getservbyport_r ,
+and
+.Fn getservbyname_r
+functions
+also take a pointer to a
+.Fa servent
+structure which is used to store the results of the database lookup.
+.Sh RETURN VALUES
+The
+.Fn getservent ,
+.Fn getservbyport ,
+and
+.Fn getservbyname
+functions return a pointer to a
+.Fa servent
+structure on success or a null pointer if end-of-file
+is reached or an error occurs.
+.Pp
+The
+.Fn getservent_r ,
+.Fn getservbyport_r ,
+and
+.Fn getservbyname_r
+functions return 0 on success or \-1 if end-of-file
+is reached or an error occurs.
 .Sh FILES
 .Bl -tag -width /etc/services -compact
 .It Pa /etc/services
 .El
-.Sh DIAGNOSTICS
-Null pointer
-(0) returned on
-.Dv EOF
-or error.
 .Sh SEE ALSO
 .Xr getprotoent 3 ,
 .Xr services 5
+.Sh STANDARDS
+The
+.Fn getservent ,
+.Fn getservbynumber ,
+.Fn getservbyname ,
+.Fn setservent ,
+and
+.Fn endservent
+functions conform to
+.St -p1003.1-2004 .
+.Pp
+The
+.Fn getservent_r ,
+.Fn getservbyport_r ,
+.Fn getservbyname_r ,
+.Fn setservent_r ,
+and
+.Fn endservent_r
+functions are not currently standardized.
+This implementation follows the API used by HP, IBM, and Digital.
 .Sh HISTORY
 The
 .Fn getservent ,
@@ -147,11 +202,19 @@ The
 .Fn setservent ,
 and
 .Fn endservent
-functions appeared in 
+functions appeared in
 .Bx 4.2 .
+.Pp
+The
+.Fn getservent_r ,
+.Fn getservbyport_r ,
+.Fn getservbyname_r ,
+.Fn setservent_r ,
+and
+.Fn endservent_r
+functions appeared in
+.Ox 3.7 .
 .Sh BUGS
-These functions use static data storage;
-if the data is needed for future use, it should be
-copied before any subsequent calls overwrite it.
-Expecting port numbers to fit in a 32 bit
-quantity is probably naive.
+The non-reentrant functions use static data storage; if the data is needed
+for future use, it should be copied before any subsequent calls overwrite it.
+Expecting port numbers to fit in a 32-bit quantity is probably naive.
diff --git a/src/lib/libc/net/getservent.c b/src/lib/libc/net/getservent.c
index 316891450e..c81a4cf3e2 100644
--- a/src/lib/libc/net/getservent.c
+++ b/src/lib/libc/net/getservent.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: getservent.c,v 1.4 1995/02/25 06:20:38 cgd Exp $       */
-
+/*      $OpenBSD: getservent.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,69 +28,66 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)getservent.c        8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: getservent.c,v 1.4 1995/02/25 06:20:38 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <sys/socket.h>
+
+#include <errno.h>
+#include <limits.h>
 #include <netdb.h>
 #include <stdio.h>
 #include <string.h>
 #include <stdlib.h>
 
-#define MAXALIASES      35
-
-static FILE *servf = NULL;
-static char line[BUFSIZ+1];
-static struct servent serv;
-static char *serv_aliases[MAXALIASES];
-int _serv_stayopen;
-
 void
-setservent(f)
-        int f;
+setservent_r(int f, struct servent_data *sd)
 {
-        if (servf == NULL)
-                servf = fopen(_PATH_SERVICES, "r" );
+        if (sd->fp == NULL)
+                sd->fp = fopen(_PATH_SERVICES, "r" );
         else
-                rewind(servf);
-        _serv_stayopen |= f;
+                rewind(sd->fp);
+        sd->stayopen |= f;
 }
 
 void
-endservent()
+endservent_r(struct servent_data *sd)
 {
-        if (servf) {
-                fclose(servf);
-                servf = NULL;
+        if (sd->fp) {
+                fclose(sd->fp);
+                sd->fp = NULL;
         }
-        _serv_stayopen = 0;
+        free(sd->aliases);
+        sd->aliases = NULL;
+        sd->maxaliases = 0;
+        free(sd->line);
+        sd->line = NULL;
+        sd->stayopen = 0;
 }
 
-struct servent *
-getservent()
+int
+getservent_r(struct servent *se, struct servent_data *sd)
 {
-        char *p;
-        register char *cp, **q;
+        char *p, *cp, **q, *endp;
+        size_t len;
+        long l;
+        int serrno;
 
-        if (servf == NULL && (servf = fopen(_PATH_SERVICES, "r" )) == NULL)
-                return (NULL);
+        if (sd->fp == NULL && (sd->fp = fopen(_PATH_SERVICES, "r" )) == NULL)
+                return (-1);
 again:
-        if ((p = fgets(line, BUFSIZ, servf)) == NULL)
-                return (NULL);
-        if (*p == '#')
+        if ((p = fgetln(sd->fp, &len)) == NULL)
+                return (-1);
+        if (len == 0 || *p == '#' || *p == '\n')
                 goto again;
-        cp = strpbrk(p, "#\n");
+        if (p[len-1] == '\n')
+                len--;
+        if ((cp = memchr(p, '#', len)) != NULL)
+                len = cp - p;
+        cp = realloc(sd->line, len + 1);
         if (cp == NULL)
-                goto again;
-        *cp = '\0';
-        serv.s_name = p;
-        p = strpbrk(p, " \t");
+                return (-1);
+        sd->line = se->s_name = memcpy(cp, p, len);
+        cp[len] = '\0';
+        p = strpbrk(cp, " \t");
         if (p == NULL)
                 goto again;
         *p++ = '\0';
@@ -105,9 +97,22 @@ again:
         if (cp == NULL)
                 goto again;
         *cp++ = '\0';
-        serv.s_port = htons((u_short)atoi(p));
-        serv.s_proto = cp;
-        q = serv.s_aliases = serv_aliases;
+        l = strtol(p, &endp, 10);
+        if (endp == p || *endp != '\0' || l < 0 || l > USHRT_MAX)
+                goto again;
+        se->s_port = htons((in_port_t)l);
+        se->s_proto = cp;
+        if (sd->aliases == NULL) {
+                sd->maxaliases = 10;
+                sd->aliases = calloc(sd->maxaliases, sizeof(char *));
+                if (sd->aliases == NULL) {
+                        serrno = errno;
+                        endservent_r(sd);
+                        errno = serrno;
+                        return (-1);
+                }
+        }
+        q = se->s_aliases = sd->aliases;
         cp = strpbrk(cp, " \t");
         if (cp != NULL)
                 *cp++ = '\0';
@@ -116,12 +121,48 @@ again:
                         cp++;
                         continue;
                 }
-                if (q < &serv_aliases[MAXALIASES - 1])
-                        *q++ = cp;
+                if (q == &se->s_aliases[sd->maxaliases - 1]) {
+                        p = realloc(se->s_aliases,
+                            2 * sd->maxaliases * sizeof(char *));
+                        if (p == NULL) {
+                                serrno = errno;
+                                endservent_r(sd);
+                                errno = serrno;
+                                return (-1);
+                        }
+                        sd->maxaliases *= 2;
+                        q = (char **)p + (q - se->s_aliases);
+                        se->s_aliases = sd->aliases = (char **)p;
+                }
+                *q++ = cp;
                 cp = strpbrk(cp, " \t");
                 if (cp != NULL)
                         *cp++ = '\0';
         }
         *q = NULL;
+        return (0);
+}
+
+struct servent_data _servent_data;      /* shared with getservby{name,port}.c */
+
+void
+setservent(int f)
+{
+        setservent_r(f, &_servent_data);
+}
+
+void
+endservent(void)
+{
+        endservent_r(&_servent_data);
+}
+
+struct servent *
+getservent(void)
+{
+        static struct servent serv;
+
+        if (getservent_r(&serv, &_servent_data) != 0)
+                return (NULL);
         return (&serv);
 }
diff --git a/src/lib/libc/net/herror.c b/src/lib/libc/net/herror.c
index 41adbf1055..7787115a9d 100644
--- a/src/lib/libc/net/herror.c
+++ b/src/lib/libc/net/herror.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: herror.c,v 1.5 1995/02/25 06:20:39 cgd Exp $   */
+/*      $OpenBSD: herror.c,v 1.8 2005/08/06 20:30:03 espie Exp $        */
 
-/*-
+/*
+ * ++Copyright++ 1987, 1993
+ * -
  * Copyright (c) 1987, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,29 +51,21 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)herror.c    8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: herror.c,v 4.9.1.1 1993/05/02 23:14:35 vixie Rel ";
-#else
-static char rcsid[] = "$NetBSD: herror.c,v 1.5 1995/02/25 06:20:39 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
+#include <sys/param.h>
 #include <sys/uio.h>
 #include <netdb.h>
 #include <unistd.h>
 #include <string.h>
 
-char    *h_errlist[] = {
-        "Error 0",
+const char * const h_errlist[] = {
+        "Resolver Error 0 (no error)",
         "Unknown host",                         /* 1 HOST_NOT_FOUND */
         "Host name lookup failure",             /* 2 TRY_AGAIN */
         "Unknown server error",                 /* 3 NO_RECOVERY */
         "No address associated with name",      /* 4 NO_ADDRESS */
 };
-int     h_nerr = { sizeof(h_errlist)/sizeof(h_errlist[0]) };
+const int       h_nerr = { sizeof h_errlist / sizeof h_errlist[0] };
 
 extern int      h_errno;
 
@@ -84,11 +74,10 @@ extern int	h_errno;
  *      print the error indicated by the h_errno value.
  */
 void
-herror(s)
-        const char *s;
+herror(const char *s)
 {
         struct iovec iov[4];
-        register struct iovec *v = iov;
+        struct iovec *v = iov;
 
         if (s && *s) {
                 v->iov_base = (char *)s;
@@ -98,8 +87,7 @@ herror(s)
                 v->iov_len = 2;
                 v++;
         }
-        v->iov_base = (u_int)h_errno < h_nerr ?
-            h_errlist[h_errno] : "Unknown error";
+        v->iov_base = (char *)hstrerror(h_errno);
         v->iov_len = strlen(v->iov_base);
         v++;
         v->iov_base = "\n";
@@ -107,9 +95,12 @@ herror(s)
         writev(STDERR_FILENO, iov, (v - iov) + 1);
 }
 
-char *
-hstrerror(err)
-        int err;
+const char *
+hstrerror(int err)
 {
-        return (u_int)err < h_nerr ? h_errlist[err] : "Unknown resolver error";
+        if (err < 0)
+                return ("Resolver internal error");
+        else if (err < h_nerr)
+                return (h_errlist[err]);
+        return ("Unknown resolver error");
 }
diff --git a/src/lib/libc/net/htonl.c b/src/lib/libc/net/htonl.c
index ac85cb0fd7..5ab4189597 100644
--- a/src/lib/libc/net/htonl.c
+++ b/src/lib/libc/net/htonl.c
@@ -1,29 +1,21 @@
-/*      $NetBSD: htonl.c,v 1.5 1995/04/28 23:25:14 jtc Exp $    */
-
+/*      $OpenBSD: htonl.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Written by J.T. Conklin <jtc@netbsd.org>.
  * Public domain.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$NetBSD: htonl.c,v 1.5 1995/04/28 23:25:14 jtc Exp $";
-#endif
-
 #include <sys/types.h>
 #include <machine/endian.h>
 
 #undef htonl
 
-unsigned long
-htonl(x)
-        unsigned long x;
+u_int32_t
+htonl(u_int32_t x)
 {
-        u_int32_t y = x;
-
 #if BYTE_ORDER == LITTLE_ENDIAN
-        u_char *s = (u_char *)&y;
-        return s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3];
+        u_char *s = (u_char *)&x;
+        return (u_int32_t)(s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]);
 #else
-        return y;
+        return x;
 #endif
 }
diff --git a/src/lib/libc/net/htons.c b/src/lib/libc/net/htons.c
index b2500a51d1..c8b73fdbb7 100644
--- a/src/lib/libc/net/htons.c
+++ b/src/lib/libc/net/htons.c
@@ -1,26 +1,20 @@
-/*      $NetBSD: htons.c,v 1.5 1995/04/28 23:25:19 jtc Exp $    */
-
+/*      $OpenBSD: htons.c,v 1.8 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Written by J.T. Conklin <jtc@netbsd.org>.
  * Public domain.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$NetBSD: htons.c,v 1.5 1995/04/28 23:25:19 jtc Exp $";
-#endif
-
 #include <sys/types.h>
 #include <machine/endian.h>
 
 #undef htons
 
-unsigned short
-htons(x)
-        unsigned short x;
+u_int16_t
+htons(u_int16_t x)
 {
 #if BYTE_ORDER == LITTLE_ENDIAN
         u_char *s = (u_char *) &x;
-        return s[0] << 8 | s[1];
+        return (u_int16_t)(s[0] << 8 | s[1]);
 #else
         return x;
 #endif
diff --git a/src/lib/libc/net/if_indextoname.3 b/src/lib/libc/net/if_indextoname.3
new file mode 100644
index 0000000000..8ffc35a5fa
--- /dev/null
+++ b/src/lib/libc/net/if_indextoname.3
@@ -0,0 +1,144 @@
+.\"     $OpenBSD: if_indextoname.3,v 1.11 2007/05/31 19:19:30 jmc Exp $
+.\" Copyright (c) 1983, 1991, 1993
+.\"     The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the University nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.\"     From: @(#)rcmd.3        8.1 (Berkeley) 6/4/93
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt IF_NAMETOINDEX 3
+.Os
+.Sh NAME
+.Nm if_nametoindex ,
+.Nm if_indextoname ,
+.Nm if_nameindex ,
+.Nm if_freenameindex
+.Nd convert interface index to name, and vice versa
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <net/if.h>
+.Ft "unsigned int"
+.Fn if_nametoindex "const char *ifname"
+.Ft "char *"
+.Fn if_indextoname "unsigned int ifindex" "char *ifname"
+.Ft "struct if_nameindex *"
+.Fn if_nameindex "void"
+.Ft "void"
+.Fn if_freenameindex "struct if_nameindex *ptr"
+.Sh DESCRIPTION
+These functions map interface indexes to interface names (such as
+.Dq lo0 ) ,
+and vice versa.
+.Pp
+The
+.Fn if_nametoindex
+function converts an interface name specified by the
+.Fa ifname
+argument to an interface index (positive integer value).
+If the specified interface does not exist, 0 will be returned.
+.Pp
+.Fn if_indextoname
+converts an interface index specified by the
+.Fa ifindex
+argument to an interface name.
+The
+.Fa ifname
+argument must point to a buffer of at least
+.Dv IF_NAMESIZE
+bytes into which the interface name corresponding to the specified index is
+returned.
+.Pf ( Dv IF_NAMESIZE
+is also defined in
+.Aq Pa net/if.h
+and its value includes a terminating NUL byte at the end of the
+interface name.)
+This pointer is also the return value of the function.
+If there is no interface corresponding to the specified index,
+.Dv NULL
+is returned.
+.Pp
+.Fn if_nameindex
+returns an array of
+.Vt if_nameindex
+structures.
+.Vt if_nameindex
+is also defined in
+.Aq Pa net/if.h ,
+and is as follows:
+.Bd -literal -offset indent
+struct if_nameindex {
+        unsigned int      if_index;     /* 1, 2, ... */
+        char             *if_name;      /* NUL-terminated name */
+};
+.Ed
+.Pp
+The end of the array of structures is indicated by a structure with
+an
+.Fa if_index
+of 0 and an
+.Fa if_name
+of
+.Dv NULL .
+The function returns a null pointer on error.
+The memory used for this array of structures along with the interface
+names pointed to by the
+.Fa if_name
+members is obtained dynamically.
+This memory is freed by the
+.Fn if_freenameindex
+function.
+.Pp
+.Fn if_freenameindex
+takes a pointer that was returned by
+.Fn if_nameindex
+as argument
+.Pq Fa ptr ,
+and it reclaims the region allocated.
+.Sh DIAGNOSTICS
+.Fn if_nametoindex
+returns 0 on error, positive integer on success.
+.Fn if_indextoname
+and
+.Fn if_nameindex
+return
+.Dv NULL
+on errors.
+.Sh SEE ALSO
+.Xr getifaddrs 3 ,
+.Xr networking 4
+.Rs
+.%A R. Gilligan
+.%A S. Thomson
+.%A J. Bound
+.%A W. Stevens
+.%T Basic Socket Interface Extensions for IPv6
+.%R RFC 2553
+.%D March 1999
+.Re
+.Sh STANDARDS
+These functions are defined in ``Basic Socket Interface Extensions for IPv6''
+.Pq RFC 2533 .
diff --git a/src/lib/libc/net/if_indextoname.c b/src/lib/libc/net/if_indextoname.c
new file mode 100644
index 0000000000..f99e52e387
--- /dev/null
+++ b/src/lib/libc/net/if_indextoname.c
@@ -0,0 +1,86 @@
+/*      $OpenBSD: if_indextoname.c,v 1.9 2002/03/07 22:40:23 millert Exp $      */
+/*      $KAME: if_indextoname.c,v 1.6 2000/11/07 22:33:25 jinmei Exp $  */
+
+/*-
+ * Copyright (c) 1997, 2000
+ *      Berkeley Software Design, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Berkeley Software Design, Inc. ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Berkeley Software Design, Inc. BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      BSDI Id: if_indextoname.c,v 2.3 2000/04/17 22:38:05 dab Exp
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if_dl.h>
+#include <net/if.h>
+#include <ifaddrs.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+/*
+ * From RFC 2533:
+ *
+ * The second function maps an interface index into its corresponding
+ * name.
+ *
+ *    #include <net/if.h>
+ *
+ *    char  *if_indextoname(unsigned int ifindex, char *ifname);
+ *
+ * The ifname argument must point to a buffer of at least IF_NAMESIZE
+ * bytes into which the interface name corresponding to the specified
+ * index is returned.  (IF_NAMESIZE is also defined in <net/if.h> and
+ * its value includes a terminating null byte at the end of the
+ * interface name.) This pointer is also the return value of the
+ * function.  If there is no interface corresponding to the specified
+ * index, NULL is returned, and errno is set to ENXIO, if there was a
+ * system error (such as running out of memory), if_indextoname returns
+ * NULL and errno would be set to the proper value (e.g., ENOMEM).
+ */
+
+char *
+if_indextoname(unsigned int ifindex, char *ifname)
+{
+        struct ifaddrs *ifaddrs, *ifa;
+        int error = 0;
+
+        if (getifaddrs(&ifaddrs) < 0)
+                return(NULL);   /* getifaddrs properly set errno */
+
+        for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
+                if (ifa->ifa_addr &&
+                    ifa->ifa_addr->sa_family == AF_LINK &&
+                    ifindex == ((struct sockaddr_dl*)ifa->ifa_addr)->sdl_index)
+                        break;
+        }
+
+        if (ifa == NULL) {
+                error = ENXIO;
+                ifname = NULL;
+        }
+        else
+                strlcpy(ifname, ifa->ifa_name, IFNAMSIZ);
+
+        freeifaddrs(ifaddrs);
+
+        errno = error;
+        return(ifname);
+}
diff --git a/src/lib/libc/net/if_nameindex.c b/src/lib/libc/net/if_nameindex.c
new file mode 100644
index 0000000000..c5a771869b
--- /dev/null
+++ b/src/lib/libc/net/if_nameindex.c
@@ -0,0 +1,146 @@
+/*      $OpenBSD: if_nameindex.c,v 1.10 2010/09/24 13:29:29 claudio Exp $       */
+/*      $KAME: if_nameindex.c,v 1.7 2000/11/24 08:17:20 itojun Exp $    */
+
+/*-
+ * Copyright (c) 1997, 2000
+ *      Berkeley Software Design, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Berkeley Software Design, Inc. ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Berkeley Software Design, Inc. BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      BSDI Id: if_nameindex.c,v 2.3 2000/04/17 22:38:05 dab Exp
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if_dl.h>
+#include <net/if.h>
+#include <ifaddrs.h>
+#include <stdlib.h>
+#include <string.h>
+
+/*
+ * From RFC 2553:
+ *
+ * 4.3 Return All Interface Names and Indexes
+ *
+ *    The if_nameindex structure holds the information about a single
+ *    interface and is defined as a result of including the <net/if.h>
+ *    header.
+ *
+ *       struct if_nameindex {
+ *         unsigned int   if_index;
+ *         char          *if_name;
+ *       };
+ *
+ *    The final function returns an array of if_nameindex structures, one
+ *    structure per interface.
+ *
+ *       struct if_nameindex  *if_nameindex(void);
+ *
+ *    The end of the array of structures is indicated by a structure with
+ *    an if_index of 0 and an if_name of NULL.  The function returns a NULL
+ *    pointer upon an error, and would set errno to the appropriate value.
+ *
+ *    The memory used for this array of structures along with the interface
+ *    names pointed to by the if_name members is obtained dynamically.
+ *    This memory is freed by the next function.
+ *
+ * 4.4.  Free Memory
+ *
+ *    The following function frees the dynamic memory that was allocated by
+ *    if_nameindex().
+ *
+ *        #include <net/if.h>
+ *
+ *        void  if_freenameindex(struct if_nameindex *ptr);
+ *
+ *    The argument to this function must be a pointer that was returned by
+ *    if_nameindex().
+ */
+
+struct if_nameindex *
+if_nameindex(void)
+{
+        struct ifaddrs *ifaddrs, *ifa;
+        unsigned int ni;
+        size_t nbytes;
+        struct if_nameindex *ifni, *ifni2;
+        char *cp;
+
+        if (getifaddrs(&ifaddrs) < 0)
+                return(NULL);
+
+        /*
+         * First, find out how many interfaces there are, and how
+         * much space we need for the string names.
+         */
+        ni = 0;
+        nbytes = 0;
+        for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
+                if (ifa->ifa_addr &&
+                    ifa->ifa_addr->sa_family == AF_LINK) {
+                        nbytes += strlen(ifa->ifa_name) + 1;
+                        ni++;
+                }
+        }
+
+        /*
+         * Next, allocate a chunk of memory, use the first part
+         * for the array of structures, and the last part for
+         * the strings.
+         */
+        cp = malloc((ni + 1) * sizeof(struct if_nameindex) + nbytes);
+        ifni = (struct if_nameindex *)cp;
+        if (ifni == NULL)
+                goto out;
+        cp += (ni + 1) * sizeof(struct if_nameindex);
+
+        /*
+         * Now just loop through the list of interfaces again,
+         * filling in the if_nameindex array and making copies
+         * of all the strings.
+         */
+        ifni2 = ifni;
+        for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
+                if (ifa->ifa_addr &&
+                    ifa->ifa_addr->sa_family == AF_LINK) {
+                        ifni2->if_index =
+                            ((struct sockaddr_dl*)ifa->ifa_addr)->sdl_index;
+                        ifni2->if_name = cp;
+                        nbytes = strlen(ifa->ifa_name) + 1;
+                        memcpy(cp, ifa->ifa_name, nbytes);
+                        ifni2++;
+                        cp += nbytes;
+                }
+        }
+        /*
+         * Finally, don't forget to terminate the array.
+         */
+        ifni2->if_index = 0;
+        ifni2->if_name = NULL;
+out:
+        freeifaddrs(ifaddrs);
+        return(ifni);
+}
+
+void
+if_freenameindex(struct if_nameindex *ptr)
+{
+        free(ptr);
+}
diff --git a/src/lib/libc/net/if_nametoindex.c b/src/lib/libc/net/if_nametoindex.c
new file mode 100644
index 0000000000..8bd792b949
--- /dev/null
+++ b/src/lib/libc/net/if_nametoindex.c
@@ -0,0 +1,81 @@
+/*      $OpenBSD: if_nametoindex.c,v 1.8 2002/03/07 22:40:23 millert Exp $      */
+/*      $KAME: if_nametoindex.c,v 1.5 2000/11/24 08:04:40 itojun Exp $  */
+
+/*-
+ * Copyright (c) 1997, 2000
+ *      Berkeley Software Design, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ *
+ * THIS SOFTWARE IS PROVIDED BY Berkeley Software Design, Inc. ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL Berkeley Software Design, Inc. BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ *      BSDI Id: if_nametoindex.c,v 2.3 2000/04/17 22:38:05 dab Exp
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <net/if.h>
+#include <net/if_dl.h>
+#include <ifaddrs.h>
+#include <stdlib.h>
+#include <string.h>
+#include <errno.h>
+
+/*
+ * From RFC 2553:
+ *
+ * 4.1 Name-to-Index
+ *
+ *
+ *    The first function maps an interface name into its corresponding
+ *    index.
+ *
+ *       #include <net/if.h>
+ *
+ *       unsigned int  if_nametoindex(const char *ifname);
+ *
+ *    If the specified interface name does not exist, the return value is
+ *    0, and errno is set to ENXIO.  If there was a system error (such as
+ *    running out of memory), the return value is 0 and errno is set to the
+ *    proper value (e.g., ENOMEM).
+ */
+
+unsigned int
+if_nametoindex(const char *ifname)
+{
+        struct ifaddrs *ifaddrs, *ifa;
+        unsigned int ni;
+
+        if (getifaddrs(&ifaddrs) < 0)
+                return(0);
+
+        ni = 0;
+
+        for (ifa = ifaddrs; ifa != NULL; ifa = ifa->ifa_next) {
+                if (ifa->ifa_addr &&
+                    ifa->ifa_addr->sa_family == AF_LINK &&
+                    strcmp(ifa->ifa_name, ifname) == 0) {
+                        ni = ((struct sockaddr_dl*)ifa->ifa_addr)->sdl_index;
+                        break;
+                }
+        }
+
+        freeifaddrs(ifaddrs);
+        if (!ni)
+                errno = ENXIO;
+        return(ni);
+}
diff --git a/src/lib/libc/net/inet.3 b/src/lib/libc/net/inet.3
index 49bac97e96..3f198ae8e0 100644
--- a/src/lib/libc/net/inet.3
+++ b/src/lib/libc/net/inet.3
@@ -1,4 +1,5 @@
-.\"     $NetBSD: inet.3,v 1.4 1995/02/27 09:45:26 chopps Exp $
+.\"     $OpenBSD: inet.3,v 1.22 2008/12/09 19:38:38 otto Exp $
+.\"     $NetBSD: inet.3,v 1.7 1997/06/18 02:25:24 lukem Exp $
 .\"
 .\" Copyright (c) 1983, 1990, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +12,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -33,52 +30,74 @@
 .\"
 .\"     @(#)inet.3      8.1 (Berkeley) 6/4/93
 .\"
-.Dd June 4, 1993
+.Dd $Mdocdate: December 9 2008 $
 .Dt INET 3
-.Os BSD 4.2
+.Os
 .Sh NAME
-.Nm inet_aton ,
 .Nm inet_addr ,
+.Nm inet_aton ,
+.Nm inet_lnaof ,
+.Nm inet_makeaddr ,
+.Nm inet_netof ,
 .Nm inet_network ,
 .Nm inet_ntoa ,
-.Nm inet_makeaddr ,
-.Nm inet_lnaof ,
-.Nm inet_netof
+.Nm inet_ntop ,
+.Nm inet_pton
 .Nd Internet address manipulation routines
 .Sh SYNOPSIS
+.Fd #include <sys/types.h>
 .Fd #include <sys/socket.h>
 .Fd #include <netinet/in.h>
 .Fd #include <arpa/inet.h>
-.Ft int 
-.Fn inet_aton "const char *cp" "struct in_addr *pin"
-.Ft unsigned long 
+.Ft in_addr_t
 .Fn inet_addr "const char *cp"
-.Ft unsigned long 
+.Ft int
+.Fn inet_aton "const char *cp" "struct in_addr *addr"
+.Ft in_addr_t
+.Fn inet_lnaof "struct in_addr in"
+.Ft struct in_addr
+.Fn inet_makeaddr "in_addr_t net" "in_addr_t lna"
+.Ft in_addr_t
+.Fn inet_netof "struct in_addr in"
+.Ft in_addr_t
 .Fn inet_network "const char *cp"
 .Ft char *
 .Fn inet_ntoa "struct in_addr in"
-.Ft struct in_addr 
-.Fn inet_makeaddr "int net" "int lna"
-.Ft unsigned long 
-.Fn inet_lnaof "struct in_addr in"
-.Ft unsigned long 
-.Fn inet_netof "struct in_addr in"
+.Ft const char *
+.Fn inet_ntop "int af" "const void *src" "char *dst" "socklen_t size"
+.Ft int
+.Fn inet_pton "int af" "const char *src" "void *dst"
 .Sh DESCRIPTION
 The routines
 .Fn inet_aton ,
-.Fn inet_addr
+.Fn inet_addr ,
 and
 .Fn inet_network
 interpret character strings representing
 numbers expressed in the Internet standard
-.Ql \&.
+.Dq dot
 notation.
 The
+.Fn inet_pton
+function converts a presentation format address (that is, printable form
+as held in a character string) to network format (usually a
+.Li struct in_addr
+or some other internal binary representation, in network byte order).
+It returns 1 if the address was valid for the specified address family;
+0 if the address wasn't parseable in the specified address family; or \-1
+if some system error occurred (in which case
+.Va errno
+will have been set).
+This function is presently valid for
+.Dv AF_INET
+and
+.Dv AF_INET6 .
+The
 .Fn inet_aton
 routine interprets the specified character string as an Internet address,
 placing the address into the structure provided.
 It returns 1 if the string was successfully interpreted,
-or 0 if the string is invalid.
+or 0 if the string was invalid.
 The
 .Fn inet_addr
 and
@@ -86,17 +105,29 @@ and
 functions return numbers suitable for use
 as Internet addresses and Internet network
 numbers, respectively.
+.Pp
+The function
+.Fn inet_ntop
+converts an address from network format (usually a
+.Li struct in_addr
+or some other binary form, in network byte order) to presentation format
+(suitable for external display purposes).
+It returns
+.Dv NULL
+if a system
+error occurs (in which case,
+.Va errno
+will have been set), or it returns a pointer to the destination string.
 The routine
 .Fn inet_ntoa
 takes an Internet address and returns an
-.Tn ASCII
-string representing the address in
-.Ql \&.
-notation.  The routine
+ASCII string representing the address in dot notation.
+The routine
 .Fn inet_makeaddr
 takes an Internet network number and a local
 network address and constructs an Internet address
-from it.  The routines
+from it.
+The routines
 .Fn inet_netof
 and
 .Fn inet_lnaof
@@ -108,11 +139,8 @@ All Internet addresses are returned in network
 order (bytes ordered from left to right).
 All network numbers and local address parts are
 returned as machine format integer values.
-.Sh INTERNET ADDRESSES
-Values specified using the
-.Ql \&.
-notation take one
-of the following forms:
+.Sh INTERNET ADDRESSES (IP VERSION 4)
+Values specified using dot notation take one of the following forms:
 .Bd -literal -offset indent
 a.b.c.d
 a.b.c
@@ -122,28 +150,25 @@ a
 .Pp
 When four parts are specified, each is interpreted
 as a byte of data and assigned, from left to right,
-to the four bytes of an Internet address.  Note
-that when an Internet address is viewed as a 32-bit
-integer quantity on the
-.Tn VAX
-the bytes referred to
-above appear as
+to the four bytes of an Internet address.
+Note that when an Internet address is viewed as a 32-bit
+integer quantity on a system that uses little-endian
+byte order
+(such as the Intel 386, 486 and Pentium processors)
+the bytes referred to above appear as
 .Dq Li d.c.b.a .
-That is,
-.Tn VAX
-bytes are
-ordered from right to left.
+That is, little-endian bytes are ordered from right to left.
 .Pp
 When a three part address is specified, the last
 part is interpreted as a 16-bit quantity and placed
-in the right-most two bytes of the network address.
+in the rightmost two bytes of the network address.
 This makes the three part address format convenient
 for specifying Class B network addresses as
 .Dq Li 128.net.host .
 .Pp
 When a two part address is supplied, the last part
 is interpreted as a 24-bit quantity and placed in
-the right most three bytes of the network address.
+the rightmost three bytes of the network address.
 This makes the two part address format convenient
 for specifying Class A network addresses as
 .Dq Li net.host .
@@ -154,13 +179,88 @@ rearrangement.
 .Pp
 All numbers supplied as
 .Dq parts
-in a
-.Ql  \&.
-notation
+in a dot notation
 may be decimal, octal, or hexadecimal, as specified
 in the C language (i.e., a leading 0x or 0X implies
-hexadecimal; otherwise, a leading 0 implies octal;
+hexadecimal; a leading 0 implies octal;
 otherwise, the number is interpreted as decimal).
+.Sh INTERNET ADDRESSES (IP VERSION 6)
+In order to support scoped IPv6 addresses,
+.Xr getaddrinfo 3
+and
+.Xr getnameinfo 3
+are recommended rather than the functions presented here.
+.Pp
+The presentation format of an IPv6 address is given in RFC 2373:
+.Pp
+There are three conventional forms for representing IPv6 addresses as
+text strings:
+.Bl -enum
+.It
+The preferred form is x:x:x:x:x:x:x:x, where the 'x's are the
+hexadecimal values of the eight 16-bit pieces of the address.
+Examples:
+.Bd -literal -offset indent
+FEDC:BA98:7654:3210:FEDC:BA98:7654:3210
+1080:0:0:0:8:800:200C:417A
+.Ed
+.Pp
+Note that it is not necessary to write the leading zeros in an
+individual field, but there must be at least one numeral in
+every field (except for the case described in 2.).
+.It
+Due to the method of allocating certain styles of IPv6
+addresses, it will be common for addresses to contain long
+strings of zero bits.
+In order to make writing addresses
+containing zero bits easier, a special syntax is available to
+compress the zeros.
+The use of
+.Dq \&:\&:
+indicates multiple groups
+of 16 bits of zeros.
+The
+.Dq \&:\&:
+can only appear once in an
+address.
+The
+.Dq \&:\&:
+can also be used to compress the leading and/or trailing zeros in an address.
+.Pp
+For example the following addresses:
+.Bd -literal -offset indent
+1080:0:0:0:8:800:200C:417A  a unicast address
+FF01:0:0:0:0:0:0:43         a multicast address
+0:0:0:0:0:0:0:1             the loopback address
+0:0:0:0:0:0:0:0             the unspecified addresses
+.Ed
+.Pp
+may be represented as:
+.Bd -literal -offset indent
+1080::8:800:200C:417A       a unicast address
+FF01::43                    a multicast address
+::1                         the loopback address
+::                          the unspecified addresses
+.Ed
+.It
+An alternative form that is sometimes more convenient when
+dealing with a mixed environment of IPv4 and IPv6 nodes is
+x:x:x:x:x:x:d.d.d.d, where the 'x's are the hexadecimal values
+of the six high-order 16-bit pieces of the address, and the 'd's
+are the decimal values of the four low-order 8-bit pieces of the
+address (standard IPv4 representation).
+Examples:
+.Bd -literal -offset indent
+0:0:0:0:0:0:13.1.68.3
+0:0:0:0:0:FFFF:129.144.52.38
+.Ed
+.Pp
+or in compressed form:
+.Bd -literal -offset indent
+::13.1.68.3
+::FFFF:129.144.52.38
+.Ed
+.El
 .Sh DIAGNOSTICS
 The constant
 .Dv INADDR_NONE
@@ -170,28 +270,76 @@ and
 .Fn inet_network
 for malformed requests.
 .Sh SEE ALSO
+.Xr byteorder 3 ,
 .Xr gethostbyname 3 ,
 .Xr getnetent 3 ,
+.Xr inet_net 3 ,
 .Xr hosts 5 ,
-.Xr networks 5 ,
+.Xr networks 5
+.Rs
+.%R RFC 2373
+.%D July 1998
+.%T "IP Version 6 Addressing Architecture"
+.Re
+.Rs
+.%R RFC 3493
+.%D February 2003
+.%T "Basic Socket Interface Extensions for IPv6"
+.Re
+.Sh STANDARDS
+The
+.Nm inet_ntop
+and
+.Nm inet_pton
+functions conform to the IETF IPv6 BSD API and address formatting
+specifications.
+Note that
+.Nm inet_pton
+does not accept 1-, 2-, or 3-part dotted addresses; all four parts
+must be specified.
+This is a narrower input set than that accepted by
+.Nm inet_aton .
 .Sh HISTORY
-These
-functions appeared in 
+The
+.Nm inet_addr ,
+.Nm inet_network ,
+.Nm inet_makeaddr ,
+.Nm inet_lnaof ,
+and
+.Nm inet_netof
+functions appeared in
 .Bx 4.2 .
+The
+.Nm inet_aton
+and
+.Nm inet_ntoa
+functions appeared in
+.Bx 4.3 .
+The
+.Nm inet_pton
+and
+.Nm inet_ntop
+functions appeared in BIND 4.9.4.
 .Sh BUGS
 The value
 .Dv INADDR_NONE
 (0xffffffff) is a valid broadcast address, but
 .Fn inet_addr
 cannot return that value without indicating failure.
+Also,
+.Fn inet_addr
+should have been designed to return a
+.Li struct in_addr .
 The newer
 .Fn inet_aton
-function does not share this problem.
+function does not share these problems, and almost all existing code
+should be modified to use
+.Fn inet_aton
+instead.
+.Pp
 The problem of host byte ordering versus network byte ordering is
 confusing.
+.Pp
 The string returned by
 .Fn inet_ntoa
 resides in a static memory area.
-.Pp
-Inet_addr should return a
-.Fa struct in_addr .
diff --git a/src/lib/libc/net/inet6_opt_init.3 b/src/lib/libc/net/inet6_opt_init.3
new file mode 100644
index 0000000000..21880a6382
--- /dev/null
+++ b/src/lib/libc/net/inet6_opt_init.3
@@ -0,0 +1,338 @@
+.\"     $OpenBSD: inet6_opt_init.3,v 1.3 2007/05/31 19:19:30 jmc Exp $
+.\"     $KAME: inet6_opt_init.3,v 1.7 2004/12/27 05:08:23 itojun Exp $
+.\"
+.\" Copyright (C) 2004 WIDE Project.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the project nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt INET6_OPT_INIT 3
+.Os
+.\"
+.Sh NAME
+.Nm inet6_opt_init ,
+.Nm inet6_opt_append ,
+.Nm inet6_opt_finish ,
+.Nm inet6_opt_set_val ,
+.Nm inet6_opt_next ,
+.Nm inet6_opt_find ,
+.Nm inet6_opt_get_val
+.Nd IPv6 Hop-by-Hop and Destination Options manipulation
+.\"
+.Sh SYNOPSIS
+.In netinet/in.h
+.Ft "int"
+.Fn inet6_opt_init "void *extbuf" "socklen_t extlen"
+.Ft "int"
+.Fn inet6_opt_append "void *extbuf" "socklen_t extlen" "int offset" "u_int8_t type" "socklen_t len" "u_int8_t align" "void **databufp"
+.Ft "int"
+.Fn inet6_opt_finish "void *extbuf" "socklen_t extlen" "int offset"
+.Ft "int"
+.Fn inet6_opt_set_val "void *databuf" "int offset" "void *val" "socklen_t vallen"
+.Ft "int"
+.Fn inet6_opt_next "void *extbuf" "socklen_t extlen" "int offset" "u_int8_t *typep" "socklen_t *lenp" "void **databufp"
+.Ft "int"
+.Fn inet6_opt_find "void *extbuf" "socklen_t extlen" "int offset" "u_int8_t type" "socklen_t *lenp" "void **databufp"
+.Ft "int"
+.Fn inet6_opt_get_val "void *databuf" "socklen_t offset" "void *val" "socklen_t vallen"
+.\"
+.Sh DESCRIPTION
+Building and parsing the Hop-by-Hop and Destination options is
+complicated.
+The advanced sockets API defines a set of functions to
+help applications create and manipulate Hop-by-Hop and Destination
+options.
+.\"This man page describes the functions specified in
+.\"IETF Draft RFC 3542 while the
+.\".Xr inet6_options_space 3
+.\"man page documents the functions defined in RFC 2292.
+.\"It is expected
+.\"that this set of functions will supersede those in RFC 2292 but for
+.\"the time being both APIs are retained.
+These functions use the
+formatting rules specified in Appendix B in RFC 2460, i.e. that the
+largest field is placed last in the option.
+The function prototypes
+for these functions are all contained in the header file
+.Aq Pa netinet/in.h .
+.\"
+.Ss inet6_opt_init
+The
+.Fn inet6_opt_init
+function
+returns the number of bytes needed for an empty
+extension header, one without any options.
+If the
+.Va extbuf
+argument points to a valid section of memory
+then the
+.Fn inet6_opt_init
+function also initializes the extension header's length field.
+When attempting to initialize an extension buffer passed in the
+.Va extbuf
+argument,
+.Fa extlen
+must be a positive multiple of 8 or else the function fails and
+returns \-1 to the caller.
+.\"
+.Ss inet6_opt_append
+The
+.Fn inet6_opt_append
+function can perform different jobs.
+When a valid
+.Fa extbuf
+argument is supplied it appends an option to the extension buffer and
+returns the updated total length as well as a pointer to the newly
+created option in
+.Fa databufp .
+If the value
+of
+.Fa extbuf
+is
+.Dv NULL
+then the
+.Fn inet6_opt_append
+function only reports what the total length would
+be if the option were actually appended.
+The
+.Fa len
+and
+.Fa align
+arguments specify the length of the option and the required data
+alignment which must be used when appending the option.
+The
+.Fa offset
+argument should be the length returned by the
+.Fn inet6_opt_init
+function or a previous call to
+.Fn inet6_opt_append .
+.Pp
+The
+.Fa type
+argument is the 8-bit option type.
+.Pp
+After
+.Fn inet6_opt_append
+has been called, the application can use the buffer pointed to by
+.Fa databufp
+directly, or use
+.Fn inet6_opt_set_val
+to specify the data to be contained in the option.
+.Pp
+Option types of
+.Li 0
+and
+.Li 1
+are reserved for the
+.Li Pad1
+and
+.Li PadN
+options.
+All other values from 2 through 255 may be used by applications.
+.Pp
+The length of the option data is contained in an 8-bit value and so
+may contain any value from 0 through 255.
+.Pp
+The
+.Fa align
+parameter must have a value of 1, 2, 4, or 8 and cannot exceed the
+value of
+.Fa len .
+The alignment values represent no alignment, 16-bit, 32-bit and 64-bit
+alignments respectively.
+.\"
+.Ss inet6_opt_finish
+The
+.Fn inet6_opt_finish
+calculates the final padding necessary to make the extension header a
+multiple of 8 bytes, as required by the IPv6 extension header
+specification, and returns the extension header's updated total
+length.
+The
+.Fa offset
+argument should be the length returned by
+.Fn inet6_opt_init
+or
+.Fn inet6_opt_append .
+When
+.Fa extbuf
+is not
+.Dv NULL
+the function also sets up the appropriate padding bytes by inserting a
+Pad1 or PadN option of the proper length.
+.Pp
+If the extension header is too small to contain the proper padding
+then an error of \-1 is returned to the caller.
+.\"
+.Ss inet6_opt_set_val
+The
+.Fn inet6_opt_set_val
+function inserts data items of various sizes into the data portion of
+the option.
+The
+.Fa databuf
+argument is a pointer to memory that was returned by the
+.Fn inet6_opt_append
+call and the
+.Fa offset
+argument specifies where the option should be placed in the
+data buffer.
+The
+.Fa val
+argument points to an area of memory containing the data to be
+inserted into the extension header, and the
+.Fa vallen
+argument indicates how much data to copy.
+.Pp
+The caller should ensure that each field is aligned on its natural
+boundaries as described in Appendix B of RFC 2460.
+.Pp
+The function returns the offset for the next field which is calculated as
+.Fa offset
++
+.Fa vallen
+and is used when composing options with multiple fields.
+.\"
+.Ss inet6_opt_next
+The
+.Fn inet6_opt_next
+function parses received extension headers.
+The
+.Fa extbuf
+and
+.Fa extlen
+arguments specify the location and length of the extension header
+being parsed.
+The
+.Fa offset
+argument should either be zero, for the first option, or the length value
+returned by a previous call to
+.Fn inet6_opt_next
+or
+.Fn inet6_opt_find .
+The return value specifies the position where to continue scanning the
+extension buffer.
+The option is returned in the arguments
+.Fa typep , lenp ,
+and
+.Fa databufp .
+.Fa typep , lenp ,
+and
+.Fa databufp
+point to the 8-bit option type, the 8-bit option length and the option
+data respectively.
+This function does not return any PAD1 or PADN options.
+When an error occurs or there are no more options the return
+value is \-1.
+.\"
+.Ss inet6_opt_find
+The
+.Fn inet6_opt_find
+function searches the extension buffer for a particular option type,
+passed in through the
+.Fa type
+argument.
+If the option is found then the
+.Fa lenp
+and
+.Fa databufp
+arguments are updated to point to the option's length and data
+respectively.
+.Fa extbuf
+and
+.Fa extlen
+must point to a valid extension buffer and give its length.
+The
+.Fa offset
+argument can be used to search from a location anywhere in the
+extension header.
+.Ss inet6_opt_get_val
+The
+.Fn inet6_opt_get_val
+function extracts data items of various sizes in the data portion of
+the option.
+The
+.Fa databuf
+is a pointer returned by the
+.Fn inet6_opt_next
+or
+.Fn inet6_opt_find
+functions.
+The
+.Fa val
+argument points to where the data will be extracted.
+The
+.Fa offset
+argument specifies from where in the data portion of the option the
+value should be extracted; the first byte of option data is specified
+by an offset of zero.
+.Pp
+It is expected that each field is aligned on its natural boundaries as
+described in Appendix B of RFC 2460.
+.Pp
+The function returns the offset for the next field
+by calculating
+.Fa offset
++
+.Fa vallen
+which can be used when extracting option content with multiple fields.
+Robust receivers must verify alignment before calling this function.
+.\"
+.Sh EXAMPLES
+RFC 3542 gives comprehensive examples in Section 23.
+KAME also provides examples in the
+.Pa advapitest
+directory of its kit.
+.\"
+.Sh DIAGNOSTICS
+All the functions return
+\-1
+on an error.
+.\"
+.Sh SEE ALSO
+.Rs
+.%A W. Stevens
+.%A M. Thomas
+.%A E. Nordmark
+.%A T. Jinmei
+.%T "Advanced Sockets API for IPv6"
+.%N RFC 3542
+.%D October 2002
+.Re
+.Rs
+.%A S. Deering
+.%A R. Hinden
+.%T "Internet Protocol, Version 6 (IPv6) Specification"
+.%N RFC 2460
+.%D December 1998
+.Re
+.Sh STANDARDS
+The functions are documented in
+.Dq Advanced Sockets API for IPv6
+.Pq RFC 3542 .
+.Sh HISTORY
+The implementation first appeared in KAME advanced networking kit.
+.\"
diff --git a/src/lib/libc/net/inet6_option_space.3 b/src/lib/libc/net/inet6_option_space.3
new file mode 100644
index 0000000000..8aa79a6d0b
--- /dev/null
+++ b/src/lib/libc/net/inet6_option_space.3
@@ -0,0 +1,444 @@
+.\"     $OpenBSD: inet6_option_space.3,v 1.21 2007/05/31 19:19:30 jmc Exp $
+.\"     $KAME: inet6_option_space.3,v 1.11 2005/01/05 03:00:44 itojun Exp $
+.\"
+.\" Copyright (C) 2004 WIDE Project.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the project nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt INET6_OPTION_SPACE 3
+.Os
+.\"
+.Sh NAME
+.Nm inet6_option_space ,
+.Nm inet6_option_init ,
+.Nm inet6_option_append ,
+.Nm inet6_option_alloc ,
+.Nm inet6_option_next ,
+.Nm inet6_option_find
+.Nd IPv6 Hop-by-Hop and Destination Option Manipulation
+.\"
+.Sh SYNOPSIS
+.In sys/types.h
+.In netinet/in.h
+.Ft "int"
+.Fn inet6_option_space "int nbytes"
+.Ft "int"
+.Fn inet6_option_init "void *bp" "struct cmsghdr **cmsgp" "int type"
+.Ft "int"
+.Fn inet6_option_append "struct cmsghdr *cmsg" "const u_int8_t *typep" "int multx" "int plusy"
+.Ft "u_int8_t *"
+.Fn inet6_option_alloc "struct cmsghdr *cmsg" "int datalen" "int multx" "int plusy"
+.Ft "int"
+.Fn inet6_option_next "const struct cmsghdr *cmsg" "u_int8_t **tptrp"
+.Ft "int"
+.Fn inet6_option_find "const struct cmsghdr *cmsg" "u_int8_t **tptrp" "int type"
+.\"
+.Sh DESCRIPTION
+.\"
+Note:
+RFC 2292 has been superseded by RFC 3542.
+The use of functions described in this page is deprecated.
+See
+.Xr inet6_opt_init 3 .
+.Pp
+Manipulating and parsing IPv6's Hop-by-Hop and Destination options is
+complicated by the need to properly align and pad data as well as the
+need to manipulate ancillary information that is not part of the data
+stream.
+RFC 2292 defines a set of functions, which are implemented as
+part of the Kame libraries, to help developers create, change,
+and parse Hop-by-Hop and Destination options.
+All of the prototypes
+for the option functions are defined in the
+.Aq Pa netinet/in.h
+header file.
+.\"
+.Ss inet6_option_space
+In order to determine the amount of space necessary to hold any option
+the
+.Fn inet6_option_space
+function is called.
+It returns the number of bytes required to hold
+an option when it is stored as ancillary data, including the
+.Li cmsghdr
+structure at the beginning, and any necessary padding at the end.
+The
+.Fa nbytes
+argument indicates the size of the structure defining the option,
+and must include any pad bytes at the beginning (the value
+.Li y
+in the alignment term
+.Dq Li "xn + y" ) ,
+the type byte, the length byte, and the option data.
+.Pp
+Note: If multiple options are stored in a single ancillary data
+object, which is the recommended technique, the
+.Fn inet6_option_space
+function overestimates the amount of space required by the size of
+.Li N-1
+.Li cmsghdr
+structures, where
+.Li N
+is the number of options to be stored in the object.
+Usually this has
+no impact because it is assumed that most Hop-by-Hop and Destination
+option headers carry only one option as indicated in appendix B of RFC 2460.
+.\"
+.Ss inet6_option_init
+The
+.Fn inet6_option_init
+function is called to initialize any ancillary data object that will contain
+a Hop-by-Hop or Destination option.
+It returns
+.Li 0
+on success and
+.Li \-1
+when an error occurs.
+.Pp
+The
+.Fa bp
+argument points to a previously allocated area of memory which must be
+large enough to contain all the arguments that the application intends
+to add later via the
+.Fn inet6_option_append
+and
+.Fn inet6_option_alloc
+routines.
+.Pp
+The
+.Fa cmsgp
+argument is a pointer to a pointer to a
+.Li cmsghdr
+structure.
+The
+.Fa *cmsgp
+argument
+points to a
+.Li cmsghdr
+structure which is constructed by this function and stored in the
+area of memory pointed to by
+.Fa bp .
+.Pp
+The
+.Fa type
+is either
+.Dv IPV6_HOPOPTS
+or
+.Dv IPV6_DSTOPTS
+and is stored in the
+.Li cmsg_type
+member of the
+.Li cmsghdr
+structure mentioned above.
+.\"
+.Ss inet6_option_append
+This function appends a Hop-by-Hop option or a Destination option into
+an ancillary data object previously initialized by a call to
+.Fn inet6_option_init .
+The
+.Fn inet6_option_append
+function returns
+.Li 0
+if it succeeds or
+.Li \-1
+when an error occurs.
+.Pp
+The
+.Fa cmsg
+argument is a pointer to the
+.Li cmsghdr
+structure that was initialized by a call to
+.Fn inet6_option_init .
+.Pp
+The
+.Fa typep
+argument is a pointer to the 8-bit option type.
+All options are
+encoded as type-length-value tuples and it is assumed that
+the
+.Fa typep
+field is immediately followed by the 8-bit option data length field,
+which is then followed by the option data.
+.Pp
+The option types of
+.Li 0
+and
+.Li 1
+are reserved for the
+.Li Pad1
+and
+.Li PadN
+options respectively.
+All other values from
+.Li 2
+through
+.Li 255
+are available for applications to use.
+.Pp
+The option data length, since it is stored in 8 bites, must have a
+value between
+.Li 0
+and
+.Li 255 ,
+inclusive.
+.Pp
+The
+.Fa multx
+argument
+is the value
+.Li x
+in the alignment term
+.Dq Li xn + y
+and indicates the byte alignment necessary for the data.
+Alignments may be specified as
+.Li 1 ,
+.Li 2 ,
+.Li 4 ,
+or
+.Li 8
+bytes, which is no alignment, 16-bit, 32-bit and 64-bit alignments
+respectively.
+.Pp
+The
+.Fa plusy
+argument
+is the value
+.Li y
+in the alignment term
+.Dq Li xn + y
+and must have a value between
+.Li 0
+and
+.Li 7 ,
+inclusive, indicating the amount of padding that is necessary for an
+option.
+.\"
+.Ss inet6_option_alloc
+The
+.Fn inet6_option_alloc
+function appends a Hop-by-Hop option or a Destination option into an
+ancillary data object that has previously been initialized by a call to
+.Fn inet6_option_init .
+A successful call to the
+.Fn inet6_option_alloc
+function returns a pointer to the 8-bit option type field,
+which is at the beginning of the allocated region.
+.Fn inet6_option_alloc
+returns
+.Dv NULL
+when an error has occurred.
+.Pp
+The difference between the
+.Fn inet6_option_alloc
+and
+.Fn inet6_option_append
+functions is that the latter copies the contents of a previously built
+option into the ancillary data object while the former returns a
+pointer to the place in the data object where the option's TLV must
+then be built by the application.
+.Pp
+The
+.Fa cmsg
+argument is a pointer to a
+.Li cmsghdr
+structure that was initialized by
+.Fn inet6_option_init .
+.Pp
+The
+.Fa datalen
+argument is the value of the option data length byte for this option.
+This value is required as an argument to allow the function to
+determine if padding must be appended at the end of the option.
+(The
+.Fn inet6_option_append
+function does not need a data length argument
+since the option data length must already be stored by the caller.)
+.Pp
+The
+.Fa multx
+and
+.Fa plusy
+arguments
+are identical to the arguments of the same name described in the
+.Fn inet6_option_init
+function above.
+.\"
+.Ss inet6_option_next
+The
+.Fn inet6_option_next
+function is used to process Hop-by-Hop and Destination options that
+are present in an ancillary data object.
+When an option remains to
+be processed, the return value of the
+.Fn inet6_option_next
+function is
+.Li 0
+and the
+.Fa *tptrp
+argument points to the 8-bit option type field, which is followed by
+the 8-bit option data length, and then the option data.
+When no more
+options remain to be processed, the return value is
+.Li \-1
+and
+.Fa *tptrp
+is
+.Dv NULL .
+When an error occurs, the return value is
+.Li \-1 ,
+but the
+.Fa *tptrp
+argument is not
+.Dv NULL .
+This set of return values allows a program to easily loop through all
+the options in an ancillary data object, checking for the error and
+end of stream conditions along the way.
+.Pp
+When a valid option is returned, the
+.Fa cmsg
+argument points to a
+.Li cmsghdr
+where the
+.Li cmsg_level
+element equals
+.Dv IPPROTO_IPV6
+and the
+.Li cmsg_type
+element is either
+.Dv IPV6_HOPOPTS
+or
+.Dv IPV6_DSTOPTS .
+.Pp
+The
+.Fa tptrp
+argument is a pointer to a pointer to an 8-bit byte and
+.Fa *tptrp
+is used by the function to remember its place in the ancillary data
+object each time the function is called.
+When the
+.Fn inet6_option_next
+function is called for the first time on a given ancillary data object,
+.Fa *tptrp
+must be set to
+.Dv NULL .
+.Pp
+Each time the function returns success,
+the
+.Fa *tptrp
+argument points to the 8-bit option type field for the next option to
+be processed.
+.\"
+.Ss inet6_option_find
+The
+.Fn inet6_option_find
+function allows an application to search for a particular option type
+in an ancillary data object.
+The
+.Fa cmsg
+argument is a pointer to a
+.Li cmsghdr
+structure in which the
+.Li cmsg_level
+element equals
+.Dv IPPROTO_IPV6
+and the
+.Li cmsg_type
+element is either
+.Dv IPV6_HOPOPTS
+or
+.Dv IPV6_DSTOPTS .
+.Pp
+The
+.Fa tptrp
+argument is handled exactly as in the
+.Fn inet6_option_next
+function described above.
+.Pp
+The
+.Fn inet6_option_find
+function starts searching for an option of the specified type
+beginning after the value of
+.Fa *tptrp .
+.\"
+.Sh EXAMPLES
+RFC 2292 gives comprehensive examples in chapter 6.
+.\"
+.Sh DIAGNOSTICS
+The
+.Fn inet6_option_init
+and
+.Fn inet6_option_append
+functions return
+.Li 0
+on success or
+.Li \-1
+on an error.
+.Pp
+The
+.Fn inet6_option_alloc
+function returns
+.Dv NULL
+on an error.
+.Pp
+When
+.Fn inet6_option_next
+or
+.Fn inet6_option_find
+detect an error they return
+.Li \-1 ,
+setting
+.Fa *tptrp
+to a non
+.Dv NULL
+value.
+.\"
+.Sh SEE ALSO
+.Xr inet6 4 ,
+.Xr ip6 4
+.Rs
+.%A W. Stevens
+.%A M. Thomas
+.%T "Advanced Sockets API for IPv6"
+.%N RFC 2292
+.%D February 1998
+.Re
+.Rs
+.%A S. Deering
+.%A R. Hinden
+.%T "Internet Protocol, Version 6 (IPv6) Specification"
+.%N RFC 2460
+.%D December 1998
+.Re
+.\"
+.Sh STANDARDS
+The functions are documented in
+.Dq Advanced Sockets API for IPv6
+(RFC 2292).
+.\"
+.Sh HISTORY
+This implementation first appeared in the KAME advanced networking kit.
+.\"
diff --git a/src/lib/libc/net/inet6_rth_space.3 b/src/lib/libc/net/inet6_rth_space.3
new file mode 100644
index 0000000000..326521def7
--- /dev/null
+++ b/src/lib/libc/net/inet6_rth_space.3
@@ -0,0 +1,219 @@
+.\"     $OpenBSD: inet6_rth_space.3,v 1.3 2007/05/31 19:19:30 jmc Exp $
+.\"     $KAME: inet6_rth_space.3,v 1.7 2005/01/05 03:00:44 itojun Exp $
+.\"
+.\" Copyright (C) 2004 WIDE Project.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the project nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt INET6_RTH_SPACE 3
+.Os
+.\"
+.Sh NAME
+.Nm inet6_rth_space ,
+.Nm inet6_rth_init ,
+.Nm inet6_rth_add ,
+.Nm inet6_rth_reverse ,
+.Nm inet6_rth_segments ,
+.Nm inet6_rth_getaddr
+.Nd IPv6 Routing Header Options manipulation
+.\"
+.Sh SYNOPSIS
+.In netinet/in.h
+.Ft socklen_t
+.Fn inet6_rth_space "int" "int"
+.Ft "void *"
+.Fn inet6_rth_init "void *" "socklen_t" "int" "int"
+.Ft int
+.Fn inet6_rth_add "void *" "const struct in6_addr *"
+.Ft int
+.Fn inet6_rth_reverse "const void *" "void *"
+.Ft int
+.Fn inet6_rth_segments "const void *"
+.Ft "struct in6_addr *"
+.Fn inet6_rth_getaddr "const void *" "int"
+.\"
+.Sh DESCRIPTION
+The IPv6 Advanced API, RFC 3542, defines the functions that an
+application calls to build and examine IPv6 Routing headers.
+Routing headers are used to perform source routing in IPv6 networks.
+The RFC uses the word
+.Dq segments
+to describe addresses and that is the term used here as well.
+All of the functions are defined in the header file
+.Aq Pa netinet/in.h .
+The functions described in this manual page all operate
+on routing header structures which are defined in
+.Aq Pa netinet/ip6.h
+but which should not need to be modified outside the use of this API.
+The size and shape of the route header structures may change, so using
+the APIs is a more portable, long term, solution.
+.Pp
+The functions in the API are split into two groups, those that build a
+routing header and those that parse a received routing header.
+The builder functions are described first, followed by the parser functions.
+.Ss inet6_rth_space
+The
+.Fn inet6_rth_space
+function returns the number of bytes required to hold a Routing Header
+of the type, specified in the
+.Fa type
+argument and containing the number of addresses specified in the
+.Fa segments
+argument.
+When the type is
+.Dv IPV6_RTHDR_TYPE_0
+the number of segments must be from 0 through 127.
+The return value from this function is the number of bytes required to
+store the routing header.
+If the value 0 is returned then either the
+route header type was not recognized or another error occurred.
+.Ss inet6_rth_init
+The
+.Fn inet6_rth_init
+function initializes the pre-allocated buffer pointed to by
+.Fa bp
+to contain a routing header of the specified type.
+The
+.Fa bp_len
+argument is used to verify that the buffer is large enough.
+The caller must allocate the buffer pointed to by bp.
+The necessary buffer size should be determined by calling
+.Fn inet6_rth_space
+described in the previous sections.
+.Pp
+The
+.Fn inet6_rth_init
+function returns a pointer to
+.Fa bp
+on success and
+.Dv NULL
+when there is an error.
+.Ss inet6_rth_add
+The
+.Fn inet6_rth_add
+function adds the IPv6 address pointed to by
+.Fa addr
+to the end of the routing header being constructed.
+.Pp
+A successful addition results in the function returning 0, otherwise
+\-1 is returned.
+.Ss inet6_rth_reverse
+The
+.Fn inet6_rth_reverse
+function takes a routing header, pointed to by the
+argument
+.Fa in ,
+and writes a new routing header into the argument pointed to by
+.Fa out .
+The routing header at that sends datagrams along the reverse of that
+route.
+Both arguments are allowed to point to the same buffer meaning
+that the reversal can occur in place.
+.Pp
+The return value of the function is 0 on success, or \-1 when
+there is an error.
+.\"
+.Pp
+The next set of functions operate on a routing header that the
+application wants to parse.
+In the usual case such a routing header
+is received from the network, although these functions can also be
+used with routing headers that the application itself created.
+.Ss inet6_rth_segments
+The
+.Fn inet6_rth_segments
+function returns the number of segments contained in the
+routing header pointed to by
+.Fa bp .
+The return value is the number of segments contained in the routing
+header, or \-1 if an error occurred.
+It is not an error for 0 to be
+returned as a routing header may contain 0 segments.
+.\"
+.Ss inet6_rth_getaddr
+The
+.Fn inet6_rth_getaddr
+function is used to retrieve a single address from a routing header.
+The
+.Fa index
+is the location in the routing header from which the application wants
+to retrieve an address.
+The
+.Fa index
+parameter must have a value between 0 and one less than the number of
+segments present in the routing header.
+The
+.Fn inet6_rth_segments
+function, described in the last section, should be used to determine
+the total number of segments in the routing header.
+The
+.Fn inet6_rth_getaddr
+function returns a pointer to an IPv6 address on success or
+.Dv NULL
+when an error has occurred.
+.\"
+.Sh EXAMPLES
+RFC 3542 gives extensive examples in Section 21, Appendix B.
+KAME also provides examples in the advapitest directory of its kit.
+.\"
+.Sh DIAGNOSTICS
+The
+.Fn inet6_rth_space
+and
+.Fn inet6_rth_getaddr
+functions return 0 on errors.
+.Pp
+The
+.Fn inet6_rthdr_init
+function returns
+.Dv NULL
+on error.
+The
+.Fn inet6_rth_add
+and
+.Fn inet6_rth_reverse
+functions return 0 on success, or \-1 upon an error.
+.\"
+.Sh SEE ALSO
+.Rs
+.%A W. Stevens
+.%A M. Thomas
+.%A E. Nordmark
+.%A T. Jinmei
+.%T "Advanced Sockets API for IPv6"
+.%N RFC 3542
+.%D May 2003
+.Re
+.Rs
+.%A S. Deering
+.%A R. Hinden
+.%T "Internet Protocol, Version 6 (IPv6) Specification"
+.%N RFC 2460
+.%D December 1998
+.Re
+.Sh HISTORY
+The implementation first appeared in KAME advanced networking kit.
diff --git a/src/lib/libc/net/inet6_rthdr_space.3 b/src/lib/libc/net/inet6_rthdr_space.3
new file mode 100644
index 0000000000..3287bfe009
--- /dev/null
+++ b/src/lib/libc/net/inet6_rthdr_space.3
@@ -0,0 +1,314 @@
+.\"     $OpenBSD: inet6_rthdr_space.3,v 1.20 2007/05/31 19:19:30 jmc Exp $
+.\"     $KAME: inet6_rthdr_space.3,v 1.11 2005/01/05 03:00:44 itojun Exp $
+.\"
+.\" Copyright (C) 2004 WIDE Project.
+.\" All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the project nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt INET6_RTHDR_SPACE 3
+.Os
+.\"
+.Sh NAME
+.Nm inet6_rthdr_space ,
+.Nm inet6_rthdr_init ,
+.Nm inet6_rthdr_add ,
+.Nm inet6_rthdr_lasthop ,
+.Nm inet6_rthdr_reverse ,
+.Nm inet6_rthdr_segments ,
+.Nm inet6_rthdr_getaddr ,
+.Nm inet6_rthdr_getflags
+.Nd IPv6 Routing Header Options Manipulation
+.\"
+.Sh SYNOPSIS
+.In sys/types.h
+.In netinet/in.h
+.Ft size_t
+.Fn inet6_rthdr_space "int type" "int segments"
+.Ft "struct cmsghdr *"
+.Fn inet6_rthdr_init "void *bp" "int type"
+.Ft int
+.Fn inet6_rthdr_add "struct cmsghdr *cmsg" "const struct in6_addr *addr" "unsigned int flags"
+.Ft int
+.Fn inet6_rthdr_lasthop "struct cmsghdr *cmsg" "unsigned int flags"
+.Ft int
+.Fn inet6_rthdr_reverse "const struct cmsghdr *in" "struct cmsghdr *out"
+.Ft int
+.Fn inet6_rthdr_segments "const struct cmsghdr *cmsg"
+.Ft "struct in6_addr *"
+.Fn inet6_rthdr_getaddr "struct cmsghdr *cmsg" "int index"
+.Ft int
+.Fn inet6_rthdr_getflags "const struct cmsghdr *cmsg" "int index"
+.\"
+.Sh DESCRIPTION
+.\"The RFC 2292 IPv6 Advanced API has been deprecated in favor of the
+.\"newer, RFC 3542 APIs.
+.\"On platforms that support it, currently only
+.\"FreeBSD, please use the newer API to manipulate routing header
+.\"options.
+.\".Pp
+Note:
+RFC 2292 has been superseded by RFC 3542.
+The use of functions described in this page is deprecated.
+See
+.Xr inet6_rth_space 3 .
+.Pp
+The RFC 2292 IPv6 Advanced API defined eight functions for
+applications to use for building and parsing routing headers.
+The
+eight functions are split into two groups, the first of which builds
+the header and the second of which can parse it.
+The function prototypes for these functions are all in the
+.Aq Pa netinet/in.h
+header.
+Although direct manipulation of a routing header is possible,
+this set of APIs make it unnecessary and such direct manipulation
+should be avoided so that changes to the underlying structures do not
+break applications.
+.Pp
+Please note that RFC 2292 uses the term
+.Dq segments
+instead of the term
+.Dq addresses
+but they are considered equivalent for this manual page.
+.\"
+.Ss inet6_rthdr_space
+The
+.Fn inet6_rthdr_space
+function returns the number of bytes required to hold a routing header
+of the specified
+.Fa type
+and containing the specified number of
+.Fa segments .
+Only one
+.Fa type
+is supported,
+.Dv IPV6_RTHDR_TYPE_0 ,
+and it can hold from 1 to 23 segments.
+The return value includes the
+size of the
+.Vt cmsghdr
+structure that precedes the routing header and
+any required padding.
+.Pp
+A return value of 0 indicates an error.
+Either the type was specified
+incorrectly, or the number of segments was less than one or greater
+than 23.
+.Pp
+Note: The
+.Fn inet6_rthdr_space
+function only returns the size required by the routing header and does
+not allocate memory for the caller.
+.\"
+.Ss inet6_rthdr_init
+The
+.Fn inet6_rthdr_init
+function initializes a buffer, pointed to by
+.Fa bp
+with an appropriate
+.Li cmsghdr
+structure followed by a routing header of the specified
+.Fa type .
+.Pp
+The caller must use the
+.Fn inet6_rthdr_space
+function to determine the size of the buffer, and then allocate that
+buffer before calling
+.Fn inet6_rthdr_init .
+.Pp
+The return value is a pointer to a
+.Li cmsghdr
+structure, which is used as the first argument to the
+.Fn inet6_rthdr_add
+and
+.Fn inet6_rthdr_lasthop
+functions in order to construct the routing header.
+When an error occurs the return value is
+.Dv NULL .
+.\"
+.Ss inet6_rthdr_add
+The
+.Fn inet6_rthdr_add
+function adds the IPv6 address pointed to by
+.Fa addr
+to the end of the
+routing header being constructed and sets the type of this address to the
+value of
+.Fa flags .
+The
+.Fa flags
+must be either
+.Dv IPV6_RTHDR_LOOSE
+or
+.Dv IPV6_RTHDR_STRICT
+indicating whether loose or strict source routing is required.
+.Pp
+When the function succeeds it returns 0, otherwise \-1 is returned.
+.\"
+.Ss inet6_rthdr_lasthop
+The
+.Fn inet6_rthdr_lasthop
+function specifies the strict or loose flag for the final hop of a
+routing header.
+The
+.Fa flags
+argument must be either
+.Dv IPV6_RTHDR_LOOSE
+or
+.Dv IPV6_RTHDR_STRICT .
+.Pp
+The return value of the function is 0 upon success, and \-1 when an
+error has occurred.
+.Pp
+Please note that a routing header specifying
+.Li N
+intermediate nodes requires
+.Li N+1
+strict or loose flags meaning that
+.Fn inet6_rthdr_add
+must be called
+.Li N
+times and then
+.Fn inet6_rthdr_lasthop
+must be called once.
+.\"
+.Ss inet6_rthdr_reverse
+This function was never implemented.
+.Pp
+The following three functions provide an API for parsing a received
+routing header:
+.\"
+.Ss inet6_rthdr_segments
+The
+.Fn inet6_rthdr_segments
+function returns the number of segments contained in the routing
+header pointed to by the
+.Fa cmsg
+argument.
+On success the return value is from 1 to 23.
+When an error occurs, \-1 is returned.
+.\"
+.Ss inet6_rthdr_getaddr
+The
+.Fn inet6_rthdr_getaddr
+function returns a pointer to the IPv6 address specified by the
+.Fa index
+argument from the routing header pointed to by
+.Fa cmsg .
+The index must be between 1 and the number returned by
+.Fn inet6_rthdr_segments ,
+described above.
+An application must call
+.Fn inet6_rthdr_segments
+to obtain the number of segments in the routing header.
+.Pp
+If an error occurs,
+.Dv NULL
+is returned.
+.\"
+.Ss inet6_rthdr_getflags
+The
+.Fn inet6_rthdr_getflags
+function returns the flags value of the segment specified by
+.Fa index
+of the routing header pointed to by
+.Fa cmsg .
+The
+.Fa index
+argument must be between 0 and the value returned by
+.Fn inet6_rthdr_segments .
+The return value will be either
+.Dv IPV6_RTHDR_LOOSE
+or
+.Dv IPV6_RTHDR_STRICT
+indicating whether loose or strict source routing was requested for
+that segment.
+.Pp
+When an error occurs, \-1 is returned.
+.Pp
+Note: Flags begin at index 0 while segments begin at index 1, to
+maintain consistency with the terminology and figures in RFC 2460.
+.\"
+.Sh EXAMPLES
+RFC 2292 gives comprehensive examples in chapter 8.
+.\"
+.Sh DIAGNOSTICS
+The
+.Fn inet6_rthdr_space
+function returns 0 when an error occurs.
+.Pp
+The
+.Fn inet6_rthdr_add
+and
+.Fn inet6_rthdr_lasthop
+functions return 0 on success, and \-1 on error.
+.Pp
+The
+.Fn inet6_rthdr_init
+and
+.Fn inet6_rthdr_getaddr
+functions
+return
+.Dv NULL
+on error.
+.Pp
+The
+.Fn inet6_rthdr_segments
+and
+.Fn inet6_rthdr_getflags
+functions return \-1 on error.
+.\"
+.Sh SEE ALSO
+.Xr inet6 4 ,
+.Xr ip6 4
+.Rs
+.%A W. Stevens
+.%A M. Thomas
+.%T "Advanced Sockets API for IPv6"
+.%N RFC 2292
+.%D February 1998
+.Re
+.Rs
+.%A S. Deering
+.%A R. Hinden
+.%T "Internet Protocol, Version 6 (IPv6) Specification"
+.%N RFC 2460
+.%D December 1998
+.Re
+.\"
+.Sh HISTORY
+This implementation first appeared in the KAME advanced networking kit.
+.\"
+.Sh BUGS
+The
+.Fn inet6_rthdr_reverse
+function was never implemented.
+.\".Pp
+.\"This API is deprecated in favor of
+.\".Xr inet6_rth_space 3
+.\".Sh SEE ALSO
+.\".Xr inet6_rth_space 3
diff --git a/src/lib/libc/net/inet_addr.c b/src/lib/libc/net/inet_addr.c
index b5b9d8302f..c962a03382 100644
--- a/src/lib/libc/net/inet_addr.c
+++ b/src/lib/libc/net/inet_addr.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: inet_addr.c,v 1.5 1995/02/25 06:20:41 cgd Exp $        */
+/*      $OpenBSD: inet_addr.c,v 1.9 2005/08/06 20:30:03 espie Exp $     */
 
 /*
+ * ++Copyright++ 1983, 1990, 1993
+ * -
  * Copyright (c) 1983, 1990, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -31,16 +29,29 @@
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
+ * -
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * -
+ * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_addr.c 8.1 (Berkeley) 6/17/93";
-#else
-static char rcsid[] = "$NetBSD: inet_addr.c,v 1.5 1995/02/25 06:20:41 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
+#include <sys/types.h>
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -50,9 +61,8 @@ static char rcsid[] = "$NetBSD: inet_addr.c,v 1.5 1995/02/25 06:20:41 cgd Exp $"
  * Ascii internet address interpretation routine.
  * The value returned is in network order.
  */
-u_long
-inet_addr(cp)
-        register const char *cp;
+in_addr_t
+inet_addr(const char *cp)
 {
         struct in_addr val;
 
@@ -69,60 +79,60 @@ inet_addr(cp)
  * cannot distinguish between failure and a local broadcast address.
  */
 int
-inet_aton(cp, addr)
-        register const char *cp;
-        struct in_addr *addr;
+inet_aton(const char *cp, struct in_addr *addr)
 {
-        register u_long val;
-        register int base, n;
-        register char c;
+        in_addr_t val;
+        int base, n;
+        char c;
         u_int parts[4];
-        register u_int *pp = parts;
+        u_int *pp = parts;
 
+        c = *cp;
         for (;;) {
                 /*
                  * Collect number up to ``.''.
                  * Values are specified as for C:
-                 * 0x=hex, 0=octal, other=decimal.
+                 * 0x=hex, 0=octal, isdigit=decimal.
                  */
+                if (!isdigit(c))
+                        return (0);
                 val = 0; base = 10;
-                if (*cp == '0') {
-                        if (*++cp == 'x' || *cp == 'X')
-                                base = 16, cp++;
+                if (c == '0') {
+                        c = *++cp;
+                        if (c == 'x' || c == 'X')
+                                base = 16, c = *++cp;
                         else
                                 base = 8;
                 }
-                while ((c = *cp) != '\0') {
+                for (;;) {
                         if (isascii(c) && isdigit(c)) {
                                 val = (val * base) + (c - '0');
-                                cp++;
-                                continue;
-                        }
-                        if (base == 16 && isascii(c) && isxdigit(c)) {
-                                val = (val << 4) + 
+                                c = *++cp;
+                        } else if (base == 16 && isascii(c) && isxdigit(c)) {
+                                val = (val << 4) |
                                         (c + 10 - (islower(c) ? 'a' : 'A'));
-                                cp++;
-                                continue;
-                        }
-                        break;
+                                c = *++cp;
+                        } else
+                                break;
                 }
-                if (*cp == '.') {
+                if (c == '.') {
                         /*
                          * Internet format:
                          *      a.b.c.d
-                         *      a.b.c   (with c treated as 16-bits)
+                         *      a.b.c   (with c treated as 16 bits)
                          *      a.b     (with b treated as 24 bits)
                          */
-                        if (pp >= parts + 3 || val > 0xff)
+                        if (pp >= parts + 3)
                                 return (0);
-                        *pp++ = val, cp++;
+                        *pp++ = val;
+                        c = *++cp;
                 } else
                         break;
         }
         /*
          * Check for trailing characters.
          */
-        if (*cp && (!isascii(*cp) || !isspace(*cp)))
+        if (c != '\0' && (!isascii(c) || !isspace(c)))
                 return (0);
         /*
          * Concoct the address according to
@@ -131,23 +141,26 @@ inet_aton(cp, addr)
         n = pp - parts + 1;
         switch (n) {
 
+        case 0:
+                return (0);             /* initial nondigit */
+
         case 1:                         /* a -- 32 bits */
                 break;
 
         case 2:                         /* a.b -- 8.24 bits */
-                if (val > 0xffffff)
+                if ((val > 0xffffff) || (parts[0] > 0xff))
                         return (0);
                 val |= parts[0] << 24;
                 break;
 
         case 3:                         /* a.b.c -- 8.8.16 bits */
-                if (val > 0xffff)
+                if ((val > 0xffff) || (parts[0] > 0xff) || (parts[1] > 0xff))
                         return (0);
                 val |= (parts[0] << 24) | (parts[1] << 16);
                 break;
 
         case 4:                         /* a.b.c.d -- 8.8.8.8 bits */
-                if (val > 0xff)
+                if ((val > 0xff) || (parts[0] > 0xff) || (parts[1] > 0xff) || (parts[2] > 0xff))
                         return (0);
                 val |= (parts[0] << 24) | (parts[1] << 16) | (parts[2] << 8);
                 break;
diff --git a/src/lib/libc/net/inet_lnaof.c b/src/lib/libc/net/inet_lnaof.c
index ce1257bf68..b1a58cd2c1 100644
--- a/src/lib/libc/net/inet_lnaof.c
+++ b/src/lib/libc/net/inet_lnaof.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: inet_lnaof.c,v 1.4 1995/02/25 06:20:42 cgd Exp $       */
-
+/*      $OpenBSD: inet_lnaof.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_lnaof.c        8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: inet_lnaof.c,v 1.4 1995/02/25 06:20:42 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -50,11 +37,10 @@ static char rcsid[] = "$NetBSD: inet_lnaof.c,v 1.4 1995/02/25 06:20:42 cgd Exp $
  * internet address; handles class a/b/c network
  * number formats.
  */
-u_long
-inet_lnaof(in)
-        struct in_addr in;
+in_addr_t
+inet_lnaof(struct in_addr in)
 {
-        register u_long i = ntohl(in.s_addr);
+        in_addr_t i = ntohl(in.s_addr);
 
         if (IN_CLASSA(i))
                 return ((i)&IN_CLASSA_HOST);
diff --git a/src/lib/libc/net/inet_makeaddr.c b/src/lib/libc/net/inet_makeaddr.c
index 84d366e03a..87d9325231 100644
--- a/src/lib/libc/net/inet_makeaddr.c
+++ b/src/lib/libc/net/inet_makeaddr.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: inet_makeaddr.c,v 1.4 1995/02/25 06:20:42 cgd Exp $    */
-
+/*      $OpenBSD: inet_makeaddr.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_makeaddr.c     8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: inet_makeaddr.c,v 1.4 1995/02/25 06:20:42 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -50,10 +37,9 @@ static char rcsid[] = "$NetBSD: inet_makeaddr.c,v 1.4 1995/02/25 06:20:42 cgd Ex
  * building addresses stored in the ifnet structure.
  */
 struct in_addr
-inet_makeaddr(net, host)
-        u_long net, host;
+inet_makeaddr(in_addr_t net, in_addr_t host)
 {
-        u_long addr;
+        in_addr_t addr;
 
         if (net < 128)
                 addr = (net << IN_CLASSA_NSHIFT) | (host & IN_CLASSA_HOST);
diff --git a/src/lib/libc/net/inet_net.3 b/src/lib/libc/net/inet_net.3
new file mode 100644
index 0000000000..648d82c780
--- /dev/null
+++ b/src/lib/libc/net/inet_net.3
@@ -0,0 +1,176 @@
+.\"     $OpenBSD: inet_net.3,v 1.14 2008/06/26 05:42:05 ray Exp $
+.\"     $NetBSD: inet_net.3,v 1.1 1997/06/18 02:25:27 lukem Exp $
+.\"
+.\" Copyright (c) 1997 The NetBSD Foundation, Inc.
+.\" All rights reserved.
+.\"
+.\" This code is derived from software contributed to The NetBSD Foundation
+.\" by Luke Mewburn.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
+.\" ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
+.\" TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+.\" PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE
+.\" LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+.\" CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+.\" SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+.\" INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+.\" CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+.\" ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
+.\" POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: June 26 2008 $
+.Dt INET_NET 3
+.Os
+.Sh NAME
+.Nm inet_net_ntop ,
+.Nm inet_net_pton
+.Nd Internet network number manipulation routines
+.Sh SYNOPSIS
+.Fd #include <sys/types.h>
+.Fd #include <sys/socket.h>
+.Fd #include <netinet/in.h>
+.Fd #include <arpa/inet.h>
+.Ft char *
+.Fn inet_net_ntop "int af" "const void *src" "int bits" "char *dst" "size_t size"
+.Ft int
+.Fn inet_net_pton "int af" "const char *src" "void *dst" "size_t size"
+.Sh DESCRIPTION
+The
+.Fn inet_net_ntop
+function converts an Internet network number from network format (usually a
+.Li struct in_addr
+or some other binary form, in network byte order) to CIDR presentation format
+(suitable for external display purposes).
+.Fa bits
+is the number of bits in
+.Fa src
+that are the network number.
+It returns
+.Dv NULL
+if a system error occurs (in which case,
+.Va errno
+will have been set), or it returns a pointer to the destination string.
+.Pp
+The
+.Fn inet_net_pton
+function converts a presentation format Internet network number (that is,
+printable form as held in a character string) to network format (usually a
+.Li struct in_addr
+or some other internal binary representation, in network byte order).
+It returns the number of bits (either computed based on the class, or
+specified with /CIDR), or \-1 if a failure occurred
+(in which case
+.Va errno
+will have been set.
+It will be set to
+.Er ENOENT
+if the Internet network number was not valid).
+.Pp
+Caution:
+The
+.Fa dst
+field should be zeroed before calling
+.Fn inet_net_pton
+as the function will only fill the number of bytes necessary to
+encode the network number in network byte order.
+.Pp
+The only value for
+.Fa af
+currently supported is
+.Dv AF_INET .
+.Fa size
+is the size of the result buffer
+.Fa dst .
+.Sh NETWORK NUMBERS (IP VERSION 4)
+The external representation of Internet network numbers may be specified in
+one of the following forms:
+.Bd -literal -offset indent
+a
+a.b
+a.b.c
+a.b.c.d
+.Ed
+.Pp
+Any of the above four forms may have
+.Dq Li /bits
+appended where
+.Dq Li bits
+is in the range
+.Li 0-32
+and is used to explicitly specify the number of bits in the network address.
+When
+.Dq Li /bits
+is not specified the number of bits in the network address is calculated
+as the larger of the number of bits in the class to which the address
+belongs and the number of bits provided rounded up modulo 8.
+Examples:
+.Pp
+.Bl -tag -width 10.1.2.3/24 -offset indent -compact
+.It Li 10
+an 8-bit network number (class A), value
+.Li 10.0.0.0 .
+.It Li 192
+a 24-bit network number (class C), value
+.Li 192.0.0.0 .
+.It Li 10.10
+a 16-bit network number, value
+.Li 10.10.0.0 .
+.It Li 10.1.2
+a 24-bit network number, value
+.Li 10.1.2.0 .
+.It Li 10.1.2.3
+a 32-bit network number, value
+.Li 10.1.2.3 .
+.It Li 10.1.2.3/24
+a 24-bit network number (explicit), value
+.Li 10.1.2.3 .
+.El
+.Pp
+Note that when the number of bits is specified using
+.Dq Li /bits
+notation, the value of the address still includes all bits supplied
+in the external representation, even those bits which are the host
+part of an Internet address.
+Also, unlike
+.Xr inet_pton 3
+where the external representation is assumed to be a host address, the
+external representation for
+.Fn inet_net_pton
+is assumed to be a network address.
+Thus
+.Dq Li 10.1
+is assumed to be
+.Dq Li 10.1.0.0
+not
+.Dq Li 10.0.0.1
+.Pp
+All numbers supplied as
+.Dq parts
+in a
+.Ql \&.
+notation
+may be decimal, octal, or hexadecimal, as specified
+in the C language (i.e., a leading 0x or 0X implies
+hexadecimal; otherwise, a leading 0 implies octal;
+otherwise, the number is interpreted as decimal).
+.Sh SEE ALSO
+.Xr byteorder 3 ,
+.Xr inet 3 ,
+.Xr inet_pton 3 ,
+.Xr networks 5
+.Sh HISTORY
+The
+.Nm inet_net_ntop
+and
+.Nm inet_net_pton
+functions first appeared in BIND 4.9.4.
diff --git a/src/lib/libc/net/inet_net_ntop.c b/src/lib/libc/net/inet_net_ntop.c
new file mode 100644
index 0000000000..fc9071798a
--- /dev/null
+++ b/src/lib/libc/net/inet_net_ntop.c
@@ -0,0 +1,135 @@
+/*      $OpenBSD: inet_net_ntop.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
+
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+static char *inet_net_ntop_ipv4(const u_char *, int, char *, size_t);
+
+/*
+ * char *
+ * inet_net_ntop(af, src, bits, dst, size)
+ *      convert network number from network to presentation format.
+ *      generates CIDR style result always.
+ * return:
+ *      pointer to dst, or NULL if an error occurred (check errno).
+ * author:
+ *      Paul Vixie (ISC), July 1996
+ */
+char *
+inet_net_ntop(int af, const void *src, int bits, char *dst, size_t size)
+{
+        switch (af) {
+        case AF_INET:
+                return (inet_net_ntop_ipv4(src, bits, dst, size));
+        default:
+                errno = EAFNOSUPPORT;
+                return (NULL);
+        }
+}
+
+/*
+ * static char *
+ * inet_net_ntop_ipv4(src, bits, dst, size)
+ *      convert IPv4 network number from network to presentation format.
+ *      generates CIDR style result always.
+ * return:
+ *      pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *      network byte order assumed.  this means 192.5.5.240/28 has
+ *      0x11110000 in its fourth octet.
+ * author:
+ *      Paul Vixie (ISC), July 1996
+ */
+static char *
+inet_net_ntop_ipv4(const u_char *src, int bits, char *dst, size_t size)
+{
+        char *odst = dst;
+        u_int m;
+        int b;
+        char *ep;
+        int advance;
+
+        ep = dst + size;
+        if (ep <= dst)
+                goto emsgsize;
+
+        if (bits < 0 || bits > 32) {
+                errno = EINVAL;
+                return (NULL);
+        }
+        if (bits == 0) {
+                if (ep - dst < sizeof "0")
+                        goto emsgsize;
+                *dst++ = '0';
+                *dst = '\0';
+        }
+
+        /* Format whole octets. */
+        for (b = bits / 8; b > 0; b--) {
+                if (ep - dst < sizeof "255.")
+                        goto emsgsize;
+                advance = snprintf(dst, ep - dst, "%u", *src++);
+                if (advance <= 0 || advance >= ep - dst)
+                        goto emsgsize;
+                dst += advance;
+                if (b > 1) {
+                        if (dst + 1 >= ep)
+                                goto emsgsize;
+                        *dst++ = '.';
+                        *dst = '\0';
+                }
+        }
+
+        /* Format partial octet. */
+        b = bits % 8;
+        if (b > 0) {
+                if (ep - dst < sizeof ".255")
+                        goto emsgsize;
+                if (dst != odst)
+                        if (dst + 1 >= ep)
+                                goto emsgsize;
+                        *dst++ = '.';
+                m = ((1 << b) - 1) << (8 - b);
+                advance = snprintf(dst, ep - dst, "%u", *src & m);
+                if (advance <= 0 || advance >= ep - dst)
+                        goto emsgsize;
+                dst += advance;
+        }
+
+        /* Format CIDR /width. */
+        if (ep - dst < sizeof "/32")
+                goto emsgsize;
+        advance = snprintf(dst, ep - dst, "/%u", bits);
+        if (advance <= 0 || advance >= ep - dst)
+                goto emsgsize;
+        dst += advance;
+        return (odst);
+
+ emsgsize:
+        errno = EMSGSIZE;
+        return (NULL);
+}
diff --git a/src/lib/libc/net/inet_net_pton.c b/src/lib/libc/net/inet_net_pton.c
new file mode 100644
index 0000000000..3105c33b43
--- /dev/null
+++ b/src/lib/libc/net/inet_net_pton.c
@@ -0,0 +1,191 @@
+/*      $OpenBSD: inet_net_pton.c,v 1.6 2008/09/01 09:40:43 markus Exp $        */
+
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <assert.h>
+#include <ctype.h>
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+#include <stdlib.h>
+
+static int      inet_net_pton_ipv4(const char *, u_char *, size_t);
+
+/*
+ * static int
+ * inet_net_pton(af, src, dst, size)
+ *      convert network number from presentation to network format.
+ *      accepts hex octets, hex strings, decimal octets, and /CIDR.
+ *      "size" is in bytes and describes "dst".
+ * return:
+ *      number of bits, either imputed classfully or specified with /CIDR,
+ *      or -1 if some failure occurred (check errno).  ENOENT means it was
+ *      not a valid network specification.
+ * author:
+ *      Paul Vixie (ISC), June 1996
+ */
+int
+inet_net_pton(int af, const char *src, void *dst, size_t size)
+{
+        switch (af) {
+        case AF_INET:
+                return (inet_net_pton_ipv4(src, dst, size));
+        default:
+                errno = EAFNOSUPPORT;
+                return (-1);
+        }
+}
+
+/*
+ * static int
+ * inet_net_pton_ipv4(src, dst, size)
+ *      convert IPv4 network number from presentation to network format.
+ *      accepts hex octets, hex strings, decimal octets, and /CIDR.
+ *      "size" is in bytes and describes "dst".
+ * return:
+ *      number of bits, either imputed classfully or specified with /CIDR,
+ *      or -1 if some failure occurred (check errno).  ENOENT means it was
+ *      not an IPv4 network specification.
+ * note:
+ *      network byte order assumed.  this means 192.5.5.240/28 has
+ *      0x11110000 in its fourth octet.
+ * author:
+ *      Paul Vixie (ISC), June 1996
+ */
+static int
+inet_net_pton_ipv4(const char *src, u_char *dst, size_t size)
+{
+        static const char
+                xdigits[] = "0123456789abcdef",
+                digits[] = "0123456789";
+        int n, ch, tmp, dirty, bits;
+        const u_char *odst = dst;
+
+        ch = *src++;
+        if (ch == '0' && (src[0] == 'x' || src[0] == 'X')
+            && isascii(src[1]) && isxdigit(src[1])) {
+                /* Hexadecimal: Eat nybble string. */
+                if (size <= 0)
+                        goto emsgsize;
+                *dst = 0, dirty = 0;
+                src++;  /* skip x or X. */
+                while ((ch = *src++) != '\0' &&
+                       isascii(ch) && isxdigit(ch)) {
+                        if (isupper(ch))
+                                ch = tolower(ch);
+                        n = strchr(xdigits, ch) - xdigits;
+                        assert(n >= 0 && n <= 15);
+                        *dst |= n;
+                        if (!dirty++)
+                                *dst <<= 4;
+                        else if (size-- > 0)
+                                *++dst = 0, dirty = 0;
+                        else
+                                goto emsgsize;
+                }
+                if (dirty)
+                        size--;
+        } else if (isascii(ch) && isdigit(ch)) {
+                /* Decimal: eat dotted digit string. */
+                for (;;) {
+                        tmp = 0;
+                        do {
+                                n = strchr(digits, ch) - digits;
+                                assert(n >= 0 && n <= 9);
+                                tmp *= 10;
+                                tmp += n;
+                                if (tmp > 255)
+                                        goto enoent;
+                        } while ((ch = *src++) != '\0' &&
+                                 isascii(ch) && isdigit(ch));
+                        if (size-- <= 0)
+                                goto emsgsize;
+                        *dst++ = (u_char) tmp;
+                        if (ch == '\0' || ch == '/')
+                                break;
+                        if (ch != '.')
+                                goto enoent;
+                        ch = *src++;
+                        if (!isascii(ch) || !isdigit(ch))
+                                goto enoent;
+                }
+        } else
+                goto enoent;
+
+        bits = -1;
+        if (ch == '/' && isascii(src[0]) && isdigit(src[0]) && dst > odst) {
+                /* CIDR width specifier.  Nothing can follow it. */
+                ch = *src++;    /* Skip over the /. */
+                bits = 0;
+                do {
+                        n = strchr(digits, ch) - digits;
+                        assert(n >= 0 && n <= 9);
+                        bits *= 10;
+                        bits += n;
+                        if (bits > 32)
+                                goto emsgsize;
+                } while ((ch = *src++) != '\0' &&
+                         isascii(ch) && isdigit(ch));
+                if (ch != '\0')
+                        goto enoent;
+        }
+
+        /* Firey death and destruction unless we prefetched EOS. */
+        if (ch != '\0')
+                goto enoent;
+
+        /* If nothing was written to the destination, we found no address. */
+        if (dst == odst)
+                goto enoent;
+        /* If no CIDR spec was given, infer width from net class. */
+        if (bits == -1) {
+                if (*odst >= 240)       /* Class E */
+                        bits = 32;
+                else if (*odst >= 224)  /* Class D */
+                        bits = 4;
+                else if (*odst >= 192)  /* Class C */
+                        bits = 24;
+                else if (*odst >= 128)  /* Class B */
+                        bits = 16;
+                else                    /* Class A */
+                        bits = 8;
+                /* If imputed mask is narrower than specified octets, widen. */
+                if (bits < ((dst - odst) * 8))
+                        bits = (dst - odst) * 8;
+        }
+        /* Extend network to cover the actual mask. */
+        while (bits > ((dst - odst) * 8)) {
+                if (size-- <= 0)
+                        goto emsgsize;
+                *dst++ = '\0';
+        }
+        return (bits);
+
+ enoent:
+        errno = ENOENT;
+        return (-1);
+
+ emsgsize:
+        errno = EMSGSIZE;
+        return (-1);
+}
diff --git a/src/lib/libc/net/inet_neta.c b/src/lib/libc/net/inet_neta.c
new file mode 100644
index 0000000000..e3e7d0eb71
--- /dev/null
+++ b/src/lib/libc/net/inet_neta.c
@@ -0,0 +1,80 @@
+/*      $OpenBSD: inet_neta.c,v 1.7 2005/08/06 20:30:03 espie Exp $     */
+
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <errno.h>
+#include <stdio.h>
+#include <string.h>
+
+/*
+ * char *
+ * inet_neta(src, dst, size)
+ *      format an in_addr_t network number into presentation format.
+ * return:
+ *      pointer to dst, or NULL if an error occurred (check errno).
+ * note:
+ *      format of ``src'' is as for inet_network().
+ * author:
+ *      Paul Vixie (ISC), July 1996
+ */
+char *
+inet_neta(in_addr_t src, char *dst, size_t size)
+{
+        char *odst = dst;
+        char *ep;
+        int advance;
+
+        if (src == 0x00000000) {
+                if (size < sizeof "0.0.0.0")
+                        goto emsgsize;
+                strlcpy(dst, "0.0.0.0", size);
+                return dst;
+        }
+        ep = dst + size;
+        if (ep <= dst)
+                goto emsgsize;
+        while (src & 0xffffffff) {
+                u_char b = (src & 0xff000000) >> 24;
+
+                src <<= 8;
+                if (b || src) {
+                        if (ep - dst < sizeof "255.")
+                                goto emsgsize;
+                        advance = snprintf(dst, ep - dst, "%u", b);
+                        if (advance <= 0 || advance >= ep - dst)
+                                goto emsgsize;
+                        dst += advance;
+                        if (src != 0L) {
+                                if (dst + 1 >= ep)
+                                        goto emsgsize;
+                                *dst++ = '.';
+                                *dst = '\0';
+                        }
+                }
+        }
+        return (odst);
+
+ emsgsize:
+        errno = EMSGSIZE;
+        return (NULL);
+}
diff --git a/src/lib/libc/net/inet_netof.c b/src/lib/libc/net/inet_netof.c
index 02f52ca318..2f468c3aca 100644
--- a/src/lib/libc/net/inet_netof.c
+++ b/src/lib/libc/net/inet_netof.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: inet_netof.c,v 1.4 1995/02/25 06:20:43 cgd Exp $       */
-
+/*      $OpenBSD: inet_netof.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_netof.c        8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: inet_netof.c,v 1.4 1995/02/25 06:20:43 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -49,11 +36,10 @@ static char rcsid[] = "$NetBSD: inet_netof.c,v 1.4 1995/02/25 06:20:43 cgd Exp $
  * Return the network number from an internet
  * address; handles class a/b/c network #'s.
  */
-u_long
-inet_netof(in)
-        struct in_addr in;
+in_addr_t
+inet_netof(struct in_addr in)
 {
-        register u_long i = ntohl(in.s_addr);
+        in_addr_t i = ntohl(in.s_addr);
 
         if (IN_CLASSA(i))
                 return (((i)&IN_CLASSA_NET) >> IN_CLASSA_NSHIFT);
diff --git a/src/lib/libc/net/inet_network.c b/src/lib/libc/net/inet_network.c
index 35105fa75a..8b26ba8ff9 100644
--- a/src/lib/libc/net/inet_network.c
+++ b/src/lib/libc/net/inet_network.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: inet_network.c,v 1.4 1995/02/25 06:20:45 cgd Exp $     */
-
+/*      $OpenBSD: inet_network.c,v 1.10 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_network.c      8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: inet_network.c,v 1.4 1995/02/25 06:20:45 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
@@ -51,14 +38,13 @@ static char rcsid[] = "$NetBSD: inet_network.c,v 1.4 1995/02/25 06:20:45 cgd Exp
  * The library routines call this routine to interpret
  * network numbers.
  */
-u_long
-inet_network(cp)
-        register const char *cp;
+in_addr_t
+inet_network(const char *cp)
 {
-        register u_long val, base, n;
-        register char c;
-        u_long parts[4], *pp = parts;
-        register int i;
+        in_addr_t val, base, n;
+        char c;
+        in_addr_t parts[4], *pp = parts;
+        int i;
 
 again:
         val = 0; base = 10;
@@ -66,7 +52,7 @@ again:
                 base = 8, cp++;
         if (*cp == 'x' || *cp == 'X')
                 base = 16, cp++;
-        while (c = *cp) {
+        while ((c = *cp)) {
                 if (isdigit(c)) {
                         val = (val * base) + (c - '0');
                         cp++;
@@ -80,7 +66,7 @@ again:
                 break;
         }
         if (*cp == '.') {
-                if (pp >= parts + 4)
+                if (pp >= parts + 3)
                         return (INADDR_NONE);
                 *pp++ = val, cp++;
                 goto again;
@@ -89,11 +75,10 @@ again:
                 return (INADDR_NONE);
         *pp++ = val;
         n = pp - parts;
-        if (n > 4)
-                return (INADDR_NONE);
-        for (val = 0, i = 0; i < n; i++) {
+        for (val = 0, i = 0; i < 4; i++) {
                 val <<= 8;
-                val |= parts[i] & 0xff;
+                if (i < n)
+                        val |= parts[i] & 0xff;
         }
         return (val);
 }
diff --git a/src/lib/libc/net/inet_ntoa.c b/src/lib/libc/net/inet_ntoa.c
index 2da0ab00ff..ff5d93ded2 100644
--- a/src/lib/libc/net/inet_ntoa.c
+++ b/src/lib/libc/net/inet_ntoa.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: inet_ntoa.c,v 1.4 1995/02/25 06:20:46 cgd Exp $        */
-
+/*      $OpenBSD: inet_ntoa.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1983, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)inet_ntoa.c 8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: inet_ntoa.c,v 1.4 1995/02/25 06:20:46 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 /*
  * Convert network-format internet address
  * to base 256 d.d.d.d representation.
@@ -51,15 +38,14 @@ static char rcsid[] = "$NetBSD: inet_ntoa.c,v 1.4 1995/02/25 06:20:46 cgd Exp $"
 #include <stdio.h>
 
 char *
-inet_ntoa(in)
-        struct in_addr in;
+inet_ntoa(struct in_addr in)
 {
         static char b[18];
-        register char *p;
+        char *p;
 
         p = (char *)&in;
 #define UC(b)   (((int)b)&0xff)
         (void)snprintf(b, sizeof(b),
-            "%d.%d.%d.%d", UC(p[0]), UC(p[1]), UC(p[2]), UC(p[3]));
+            "%u.%u.%u.%u", UC(p[0]), UC(p[1]), UC(p[2]), UC(p[3]));
         return (b);
 }
diff --git a/src/lib/libc/net/inet_ntop.c b/src/lib/libc/net/inet_ntop.c
new file mode 100644
index 0000000000..9deb352e24
--- /dev/null
+++ b/src/lib/libc/net/inet_ntop.c
@@ -0,0 +1,195 @@
+/*      $OpenBSD: inet_ntop.c,v 1.8 2008/12/09 19:38:38 otto Exp $      */
+
+/* Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <string.h>
+#include <errno.h>
+#include <stdio.h>
+
+/*
+ * WARNING: Don't even consider trying to compile this on a system where
+ * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
+ */
+
+static const char *inet_ntop4(const u_char *src, char *dst, size_t size);
+static const char *inet_ntop6(const u_char *src, char *dst, size_t size);
+
+/* char *
+ * inet_ntop(af, src, dst, size)
+ *      convert a network format address to presentation format.
+ * return:
+ *      pointer to presentation format address (`dst'), or NULL (see errno).
+ * author:
+ *      Paul Vixie, 1996.
+ */
+const char *
+inet_ntop(int af, const void *src, char *dst, socklen_t size)
+{
+        switch (af) {
+        case AF_INET:
+                return (inet_ntop4(src, dst, (size_t)size));
+        case AF_INET6:
+                return (inet_ntop6(src, dst, (size_t)size));
+        default:
+                errno = EAFNOSUPPORT;
+                return (NULL);
+        }
+        /* NOTREACHED */
+}
+
+/* const char *
+ * inet_ntop4(src, dst, size)
+ *      format an IPv4 address, more or less like inet_ntoa()
+ * return:
+ *      `dst' (as a const)
+ * notes:
+ *      (1) uses no statics
+ *      (2) takes a u_char* not an in_addr as input
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static const char *
+inet_ntop4(const u_char *src, char *dst, size_t size)
+{
+        static const char fmt[] = "%u.%u.%u.%u";
+        char tmp[sizeof "255.255.255.255"];
+        int l;
+
+        l = snprintf(tmp, size, fmt, src[0], src[1], src[2], src[3]);
+        if (l <= 0 || l >= size) {
+                errno = ENOSPC;
+                return (NULL);
+        }
+        strlcpy(dst, tmp, size);
+        return (dst);
+}
+
+/* const char *
+ * inet_ntop6(src, dst, size)
+ *      convert IPv6 binary address into presentation (printable) format
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static const char *
+inet_ntop6(const u_char *src, char *dst, size_t size)
+{
+        /*
+         * Note that int32_t and int16_t need only be "at least" large enough
+         * to contain a value of the specified size.  On some systems, like
+         * Crays, there is no such thing as an integer variable with 16 bits.
+         * Keep this in mind if you think this function should have been coded
+         * to use pointer overlays.  All the world's not a VAX.
+         */
+        char tmp[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
+        char *tp, *ep;
+        struct { int base, len; } best, cur;
+        u_int words[IN6ADDRSZ / INT16SZ];
+        int i;
+        int advance;
+
+        /*
+         * Preprocess:
+         *      Copy the input (bytewise) array into a wordwise array.
+         *      Find the longest run of 0x00's in src[] for :: shorthanding.
+         */
+        memset(words, '\0', sizeof words);
+        for (i = 0; i < IN6ADDRSZ; i++)
+                words[i / 2] |= (src[i] << ((1 - (i % 2)) << 3));
+        best.base = -1;
+        cur.base = -1;
+        for (i = 0; i < (IN6ADDRSZ / INT16SZ); i++) {
+                if (words[i] == 0) {
+                        if (cur.base == -1)
+                                cur.base = i, cur.len = 1;
+                        else
+                                cur.len++;
+                } else {
+                        if (cur.base != -1) {
+                                if (best.base == -1 || cur.len > best.len)
+                                        best = cur;
+                                cur.base = -1;
+                        }
+                }
+        }
+        if (cur.base != -1) {
+                if (best.base == -1 || cur.len > best.len)
+                        best = cur;
+        }
+        if (best.base != -1 && best.len < 2)
+                best.base = -1;
+
+        /*
+         * Format the result.
+         */
+        tp = tmp;
+        ep = tmp + sizeof(tmp);
+        for (i = 0; i < (IN6ADDRSZ / INT16SZ) && tp < ep; i++) {
+                /* Are we inside the best run of 0x00's? */
+                if (best.base != -1 && i >= best.base &&
+                    i < (best.base + best.len)) {
+                        if (i == best.base) {
+                                if (tp + 1 >= ep)
+                                        return (NULL);
+                                *tp++ = ':';
+                        }
+                        continue;
+                }
+                /* Are we following an initial run of 0x00s or any real hex? */
+                if (i != 0) {
+                        if (tp + 1 >= ep)
+                                return (NULL);
+                        *tp++ = ':';
+                }
+                /* Is this address an encapsulated IPv4? */
+                if (i == 6 && best.base == 0 &&
+                    (best.len == 6 || (best.len == 5 && words[5] == 0xffff))) {
+                        if (!inet_ntop4(src+12, tp, (size_t)(ep - tp)))
+                                return (NULL);
+                        tp += strlen(tp);
+                        break;
+                }
+                advance = snprintf(tp, ep - tp, "%x", words[i]);
+                if (advance <= 0 || advance >= ep - tp)
+                        return (NULL);
+                tp += advance;
+        }
+        /* Was it a trailing run of 0x00's? */
+        if (best.base != -1 && (best.base + best.len) == (IN6ADDRSZ / INT16SZ)) {
+                if (tp + 1 >= ep)
+                        return (NULL);
+                *tp++ = ':';
+        }
+        if (tp + 1 >= ep)
+                return (NULL);
+        *tp++ = '\0';
+
+        /*
+         * Check for overflow, copy, and we're done.
+         */
+        if ((size_t)(tp - tmp) > size) {
+                errno = ENOSPC;
+                return (NULL);
+        }
+        strlcpy(dst, tmp, size);
+        return (dst);
+}
diff --git a/src/lib/libc/net/inet_pton.c b/src/lib/libc/net/inet_pton.c
new file mode 100644
index 0000000000..7e521c3286
--- /dev/null
+++ b/src/lib/libc/net/inet_pton.c
@@ -0,0 +1,213 @@
+/*      $OpenBSD: inet_pton.c,v 1.8 2010/05/06 15:47:14 claudio Exp $   */
+
+/* Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+#include <string.h>
+#include <errno.h>
+
+/*
+ * WARNING: Don't even consider trying to compile this on a system where
+ * sizeof(int) < 4.  sizeof(int) > 4 is fine; all the world's not a VAX.
+ */
+
+static int      inet_pton4(const char *src, u_char *dst);
+static int      inet_pton6(const char *src, u_char *dst);
+
+/* int
+ * inet_pton(af, src, dst)
+ *      convert from presentation format (which usually means ASCII printable)
+ *      to network format (which is usually some kind of binary format).
+ * return:
+ *      1 if the address was valid for the specified address family
+ *      0 if the address wasn't valid (`dst' is untouched in this case)
+ *      -1 if some other error occurred (`dst' is untouched in this case, too)
+ * author:
+ *      Paul Vixie, 1996.
+ */
+int
+inet_pton(int af, const char *src, void *dst)
+{
+        switch (af) {
+        case AF_INET:
+                return (inet_pton4(src, dst));
+        case AF_INET6:
+                return (inet_pton6(src, dst));
+        default:
+                errno = EAFNOSUPPORT;
+                return (-1);
+        }
+        /* NOTREACHED */
+}
+
+/* int
+ * inet_pton4(src, dst)
+ *      like inet_aton() but without all the hexadecimal and shorthand.
+ * return:
+ *      1 if `src' is a valid dotted quad, else 0.
+ * notice:
+ *      does not touch `dst' unless it's returning 1.
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static int
+inet_pton4(const char *src, u_char *dst)
+{
+        static const char digits[] = "0123456789";
+        int saw_digit, octets, ch;
+        u_char tmp[INADDRSZ], *tp;
+
+        saw_digit = 0;
+        octets = 0;
+        *(tp = tmp) = 0;
+        while ((ch = *src++) != '\0') {
+                const char *pch;
+
+                if ((pch = strchr(digits, ch)) != NULL) {
+                        u_int new = *tp * 10 + (pch - digits);
+
+                        if (new > 255)
+                                return (0);
+                        if (! saw_digit) {
+                                if (++octets > 4)
+                                        return (0);
+                                saw_digit = 1;
+                        }
+                        *tp = new;
+                } else if (ch == '.' && saw_digit) {
+                        if (octets == 4)
+                                return (0);
+                        *++tp = 0;
+                        saw_digit = 0;
+                } else
+                        return (0);
+        }
+        if (octets < 4)
+                return (0);
+
+        memcpy(dst, tmp, INADDRSZ);
+        return (1);
+}
+
+/* int
+ * inet_pton6(src, dst)
+ *      convert presentation level address to network order binary form.
+ * return:
+ *      1 if `src' is a valid [RFC1884 2.2] address, else 0.
+ * notice:
+ *      does not touch `dst' unless it's returning 1.
+ * credit:
+ *      inspired by Mark Andrews.
+ * author:
+ *      Paul Vixie, 1996.
+ */
+static int
+inet_pton6(const char *src, u_char *dst)
+{
+        static const char xdigits_l[] = "0123456789abcdef",
+                          xdigits_u[] = "0123456789ABCDEF";
+        u_char tmp[IN6ADDRSZ], *tp, *endp, *colonp;
+        const char *xdigits, *curtok;
+        int ch, saw_xdigit, count_xdigit;
+        u_int val;
+
+        memset((tp = tmp), '\0', IN6ADDRSZ);
+        endp = tp + IN6ADDRSZ;
+        colonp = NULL;
+        /* Leading :: requires some special handling. */
+        if (*src == ':')
+                if (*++src != ':')
+                        return (0);
+        curtok = src;
+        saw_xdigit = count_xdigit = 0;
+        val = 0;
+        while ((ch = *src++) != '\0') {
+                const char *pch;
+
+                if ((pch = strchr((xdigits = xdigits_l), ch)) == NULL)
+                        pch = strchr((xdigits = xdigits_u), ch);
+                if (pch != NULL) {
+                        if (count_xdigit >= 4)
+                                return (0);
+                        val <<= 4;
+                        val |= (pch - xdigits);
+                        if (val > 0xffff)
+                                return (0);
+                        saw_xdigit = 1;
+                        count_xdigit++;
+                        continue;
+                }
+                if (ch == ':') {
+                        curtok = src;
+                        if (!saw_xdigit) {
+                                if (colonp)
+                                        return (0);
+                                colonp = tp;
+                                continue;
+                        } else if (*src == '\0') {
+                                return (0);
+                        }
+                        if (tp + INT16SZ > endp)
+                                return (0);
+                        *tp++ = (u_char) (val >> 8) & 0xff;
+                        *tp++ = (u_char) val & 0xff;
+                        saw_xdigit = 0;
+                        count_xdigit = 0;
+                        val = 0;
+                        continue;
+                }
+                if (ch == '.' && ((tp + INADDRSZ) <= endp) &&
+                    inet_pton4(curtok, tp) > 0) {
+                        tp += INADDRSZ;
+                        saw_xdigit = 0;
+                        count_xdigit = 0;
+                        break;  /* '\0' was seen by inet_pton4(). */
+                }
+                return (0);
+        }
+        if (saw_xdigit) {
+                if (tp + INT16SZ > endp)
+                        return (0);
+                *tp++ = (u_char) (val >> 8) & 0xff;
+                *tp++ = (u_char) val & 0xff;
+        }
+        if (colonp != NULL) {
+                /*
+                 * Since some memmove()'s erroneously fail to handle
+                 * overlapping regions, we'll do the shift by hand.
+                 */
+                const int n = tp - colonp;
+                int i;
+
+                if (tp == endp)
+                        return (0);
+                for (i = 1; i <= n; i++) {
+                        endp[- i] = colonp[n - i];
+                        colonp[n - i] = 0;
+                }
+                tp = endp;
+        }
+        if (tp != endp)
+                return (0);
+        memcpy(dst, tmp, IN6ADDRSZ);
+        return (1);
+}
diff --git a/src/lib/libc/net/ip6opt.c b/src/lib/libc/net/ip6opt.c
new file mode 100644
index 0000000000..b215f9ac3e
--- /dev/null
+++ b/src/lib/libc/net/ip6opt.c
@@ -0,0 +1,596 @@
+/*      $OpenBSD: ip6opt.c,v 1.4 2006/12/09 01:12:28 itojun Exp $       */
+/*      $KAME: ip6opt.c,v 1.18 2005/06/15 07:11:35 keiichi Exp $        */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <netinet/ip6.h>
+
+#include <string.h>
+#include <stdio.h>
+
+static int ip6optlen(u_int8_t *opt, u_int8_t *lim);
+static void inet6_insert_padopt(u_char *p, int len);
+
+/*
+ * This function returns the number of bytes required to hold an option
+ * when it is stored as ancillary data, including the cmsghdr structure
+ * at the beginning, and any padding at the end (to make its size a
+ * multiple of 8 bytes).  The argument is the size of the structure
+ * defining the option, which must include any pad bytes at the
+ * beginning (the value y in the alignment term "xn + y"), the type
+ * byte, the length byte, and the option data.
+ */
+int
+inet6_option_space(int nbytes)
+{
+        nbytes += 2;    /* we need space for nxt-hdr and length fields */
+        return (CMSG_SPACE((nbytes + 7) & ~7));
+}
+
+/*
+ * This function is called once per ancillary data object that will
+ * contain either Hop-by-Hop or Destination options.  It returns 0 on
+ * success or -1 on an error.
+ */
+int
+inet6_option_init(void *bp, struct cmsghdr **cmsgp, int type)
+{
+        struct cmsghdr *ch = (struct cmsghdr *)bp;
+
+        /* argument validation */
+        if (type != IPV6_HOPOPTS && type != IPV6_DSTOPTS)
+                return (-1);
+        
+        ch->cmsg_level = IPPROTO_IPV6;
+        ch->cmsg_type = type;
+        ch->cmsg_len = CMSG_LEN(0);
+
+        *cmsgp = ch;
+        return (0);
+}
+
+/*
+ * This function appends a Hop-by-Hop option or a Destination option
+ * into an ancillary data object that has been initialized by
+ * inet6_option_init().  This function returns 0 if it succeeds or -1 on
+ * an error.
+ * multx is the value x in the alignment term "xn + y" described
+ * earlier.  It must have a value of 1, 2, 4, or 8.
+ * plusy is the value y in the alignment term "xn + y" described
+ * earlier.  It must have a value between 0 and 7, inclusive.
+ */
+int
+inet6_option_append(struct cmsghdr *cmsg, const u_int8_t *typep, int multx,
+    int plusy)
+{
+        int padlen, optlen, off;
+        u_char *bp = (u_char *)cmsg + cmsg->cmsg_len;
+        struct ip6_ext *eh = (struct ip6_ext *)CMSG_DATA(cmsg);
+
+        /* argument validation */
+        if (multx != 1 && multx != 2 && multx != 4 && multx != 8)
+                return (-1);
+        if (plusy < 0 || plusy > 7)
+                return (-1);
+#if 0
+        if (typep[0] > 255)
+                return (-1);
+#endif
+
+        /*
+         * If this is the first option, allocate space for the
+         * first 2 bytes(for next header and length fields) of
+         * the option header.
+         */
+        if (bp == (u_char *)eh) {
+                bp += 2;
+                cmsg->cmsg_len += 2;
+        }
+
+        /* calculate pad length before the option. */
+        off = bp - (u_char *)eh;
+        padlen = (((off % multx) + (multx - 1)) & ~(multx - 1)) -
+                (off % multx);
+        padlen += plusy;
+        padlen %= multx;        /* keep the pad as short as possible */
+        /* insert padding */
+        inet6_insert_padopt(bp, padlen);
+        cmsg->cmsg_len += padlen;
+        bp += padlen;
+
+        /* copy the option */
+        if (typep[0] == IP6OPT_PAD1)
+                optlen = 1;
+        else
+                optlen = typep[1] + 2;
+        memcpy(bp, typep, optlen);
+        bp += optlen;
+        cmsg->cmsg_len += optlen;
+
+        /* calculate pad length after the option and insert the padding */
+        off = bp - (u_char *)eh;
+        padlen = ((off + 7) & ~7) - off;
+        inet6_insert_padopt(bp, padlen);
+        bp += padlen;
+        cmsg->cmsg_len += padlen;
+
+        /* update the length field of the ip6 option header */
+        eh->ip6e_len = ((bp - (u_char *)eh) >> 3) - 1;
+
+        return (0);
+}
+
+/*
+ * This function appends a Hop-by-Hop option or a Destination option
+ * into an ancillary data object that has been initialized by
+ * inet6_option_init().  This function returns a pointer to the 8-bit
+ * option type field that starts the option on success, or NULL on an
+ * error.
+ * The difference between this function and inet6_option_append() is
+ * that the latter copies the contents of a previously built option into
+ * the ancillary data object while the current function returns a
+ * pointer to the space in the data object where the option's TLV must
+ * then be built by the caller.
+ * 
+ */
+u_int8_t *
+inet6_option_alloc(struct cmsghdr *cmsg, int datalen, int multx, int plusy)
+{
+        int padlen, off;
+        u_int8_t *bp = (u_char *)cmsg + cmsg->cmsg_len;
+        u_int8_t *retval;
+        struct ip6_ext *eh = (struct ip6_ext *)CMSG_DATA(cmsg);
+
+        /* argument validation */
+        if (multx != 1 && multx != 2 && multx != 4 && multx != 8)
+                return (NULL);
+        if (plusy < 0 || plusy > 7)
+                return (NULL);
+
+        /*
+         * If this is the first option, allocate space for the
+         * first 2 bytes(for next header and length fields) of
+         * the option header.
+         */
+        if (bp == (u_char *)eh) {
+                bp += 2;
+                cmsg->cmsg_len += 2;
+        }
+
+        /* calculate pad length before the option. */
+        off = bp - (u_char *)eh;
+        padlen = (((off % multx) + (multx - 1)) & ~(multx - 1)) -
+                (off % multx);
+        padlen += plusy;
+        padlen %= multx;        /* keep the pad as short as possible */
+        /* insert padding */
+        inet6_insert_padopt(bp, padlen);
+        cmsg->cmsg_len += padlen;
+        bp += padlen;
+
+        /* keep space to store specified length of data */
+        retval = bp;
+        bp += datalen;
+        cmsg->cmsg_len += datalen;
+
+        /* calculate pad length after the option and insert the padding */
+        off = bp - (u_char *)eh;
+        padlen = ((off + 7) & ~7) - off;
+        inet6_insert_padopt(bp, padlen);
+        bp += padlen;
+        cmsg->cmsg_len += padlen;
+
+        /* update the length field of the ip6 option header */
+        eh->ip6e_len = ((bp - (u_char *)eh) >> 3) - 1;
+
+        return (retval);
+}
+
+/*
+ * This function processes the next Hop-by-Hop option or Destination
+ * option in an ancillary data object.  If another option remains to be
+ * processed, the return value of the function is 0 and *tptrp points to
+ * the 8-bit option type field (which is followed by the 8-bit option
+ * data length, followed by the option data).  If no more options remain
+ * to be processed, the return value is -1 and *tptrp is NULL.  If an
+ * error occurs, the return value is -1 and *tptrp is not NULL.
+ * (RFC 2292, 6.3.5)
+ */
+int
+inet6_option_next(const struct cmsghdr *cmsg, u_int8_t **tptrp)
+{
+        struct ip6_ext *ip6e;
+        int hdrlen, optlen;
+        u_int8_t *lim;
+
+        if (cmsg->cmsg_level != IPPROTO_IPV6 ||
+            (cmsg->cmsg_type != IPV6_HOPOPTS &&
+             cmsg->cmsg_type != IPV6_DSTOPTS))
+                return (-1);
+
+        /* message length validation */
+        if (cmsg->cmsg_len < CMSG_SPACE(sizeof(struct ip6_ext)))
+                return (-1);
+        ip6e = (struct ip6_ext *)CMSG_DATA(cmsg);
+        hdrlen = (ip6e->ip6e_len + 1) << 3;
+        if (cmsg->cmsg_len < CMSG_SPACE(hdrlen))
+                return (-1);
+
+        /*
+         * If the caller does not specify the starting point,
+         * simply return the 1st option.
+         * Otherwise, search the option list for the next option.
+         */
+        lim = (u_int8_t *)ip6e + hdrlen;
+        if (*tptrp == NULL)
+                *tptrp = (u_int8_t *)(ip6e + 1);
+        else {
+                if ((optlen = ip6optlen(*tptrp, lim)) == 0)
+                        return (-1);
+
+                *tptrp = *tptrp + optlen;
+        }
+        if (*tptrp >= lim) {    /* there is no option */
+                *tptrp = NULL;
+                return (-1);
+        }
+        /*
+         * Finally, checks if the next option is safely stored in the
+         * cmsg data.
+         */
+        if (ip6optlen(*tptrp, lim) == 0)
+                return (-1);
+        else
+                return (0);
+}
+
+/*
+ * This function is similar to the inet6_option_next() function,
+ * except this function lets the caller specify the option type to be
+ * searched for, instead of always returning the next option in the
+ * ancillary data object.
+ * Note: RFC 2292 says the type of tptrp is u_int8_t *, but we think
+ *       it's a typo. The variable should be type of u_int8_t **.
+ */
+int
+inet6_option_find(const struct cmsghdr *cmsg, u_int8_t **tptrp, int type)
+{
+        struct ip6_ext *ip6e;
+        int hdrlen, optlen;
+        u_int8_t *optp, *lim;
+
+        if (cmsg->cmsg_level != IPPROTO_IPV6 ||
+            (cmsg->cmsg_type != IPV6_HOPOPTS &&
+             cmsg->cmsg_type != IPV6_DSTOPTS))
+                return (-1);
+
+        /* message length validation */
+        if (cmsg->cmsg_len < CMSG_SPACE(sizeof(struct ip6_ext)))
+                return (-1);
+        ip6e = (struct ip6_ext *)CMSG_DATA(cmsg);
+        hdrlen = (ip6e->ip6e_len + 1) << 3;
+        if (cmsg->cmsg_len < CMSG_SPACE(hdrlen))
+                return (-1);    
+
+        /*
+         * If the caller does not specify the starting point,
+         * search from the beginning of the option list.
+         * Otherwise, search from *the next option* of the specified point.
+         */
+        lim = (u_int8_t *)ip6e + hdrlen;
+        if (*tptrp == NULL)
+                *tptrp = (u_int8_t *)(ip6e + 1);
+        else {
+                if ((optlen = ip6optlen(*tptrp, lim)) == 0)
+                        return (-1);
+
+                *tptrp = *tptrp + optlen;
+        }
+        for (optp = *tptrp; optp < lim; optp += optlen) {
+                if (*optp == type) {
+                        *tptrp = optp;
+                        return (0);
+                }
+                if ((optlen = ip6optlen(optp, lim)) == 0)
+                        return (-1);
+        }
+
+        /* search failed */
+        *tptrp = NULL;
+        return (-1);
+}
+
+/*
+ * Calculate the length of a given IPv6 option. Also checks
+ * if the option is safely stored in user's buffer according to the
+ * calculated length and the limitation of the buffer.
+ */
+static int
+ip6optlen(u_int8_t *opt, u_int8_t *lim)
+{
+        int optlen;
+
+        if (*opt == IP6OPT_PAD1)
+                optlen = 1;
+        else {
+                /* is there enough space to store type and len? */
+                if (opt + 2 > lim)
+                        return (0);
+                optlen = *(opt + 1) + 2;
+        }
+        if (opt + optlen <= lim)
+                return (optlen);
+
+        return (0);
+}
+
+static void
+inet6_insert_padopt(u_char *p, int len)
+{
+        switch(len) {
+         case 0:
+                 return;
+         case 1:
+                 p[0] = IP6OPT_PAD1;
+                 return;
+         default:
+                 p[0] = IP6OPT_PADN;
+                 p[1] = len - 2; 
+                 memset(&p[2], 0, len - 2);
+                 return;
+        }
+}
+
+/*
+ * The following functions are defined in RFC3542, which is a successor
+ * of RFC2292.
+ */
+
+int
+inet6_opt_init(void *extbuf, socklen_t extlen)
+{
+        struct ip6_ext *ext = (struct ip6_ext *)extbuf;
+
+        if (extlen < 0 || (extlen % 8))
+                return (-1);
+
+        if (ext) {
+                if (extlen == 0)
+                        return (-1);
+                ext->ip6e_len = (extlen >> 3) - 1;
+        }
+
+        return (2);             /* sizeof the next and the length fields */
+}
+
+int
+inet6_opt_append(void *extbuf, socklen_t extlen, int offset, u_int8_t type,
+                 socklen_t len, u_int8_t align, void **databufp)
+{
+        int currentlen = offset, padlen = 0;
+
+        /*
+         * The option type must have a value from 2 to 255, inclusive.
+         * (0 and 1 are reserved for the Pad1 and PadN options, respectively.)
+         */
+#if 0 /* always false */
+        if (type < 2 || type > 255)
+#else
+        if (type < 2)
+#endif
+                return (-1);
+
+        /*
+         * The option data length must have a value between 0 and 255,
+         * inclusive, and is the length of the option data that follows.
+         */
+        if (len < 0 || len > 255)
+                return (-1);
+
+        /*
+         * The align parameter must have a value of 1, 2, 4, or 8.
+         * The align value can not exceed the value of len.
+         */
+        if (align != 1 && align != 2 && align != 4 && align != 8)
+                return (-1);
+        if (align > len)
+                return (-1);
+
+        /* Calculate the padding length. */
+        currentlen += 2 + len;  /* 2 means "type + len" */
+        if (currentlen % align)
+                padlen = align - (currentlen % align);
+
+        /* The option must fit in the extension header buffer. */
+        currentlen += padlen;
+        if (extlen &&           /* XXX: right? */
+            currentlen > extlen)
+                return (-1);
+
+        if (extbuf) {
+                u_int8_t *optp = (u_int8_t *)extbuf + offset;
+
+                if (padlen == 1) {
+                        /* insert a Pad1 option */
+                        *optp = IP6OPT_PAD1;
+                        optp++;
+                } else if (padlen > 0) {
+                        /* insert a PadN option for alignment */
+                        *optp++ = IP6OPT_PADN;
+                        *optp++ = padlen - 2;
+                        memset(optp, 0, padlen - 2);
+                        optp += (padlen - 2);
+                }
+
+                *optp++ = type;
+                *optp++ = len;
+
+                *databufp = optp;
+        }
+
+        return (currentlen);
+}
+
+int
+inet6_opt_finish(void *extbuf, socklen_t extlen, int offset)
+{
+        int updatelen = offset > 0 ? (1 + ((offset - 1) | 7)) : 0;;
+
+        if (extbuf) {
+                u_int8_t *padp;
+                int padlen = updatelen - offset;
+
+                if (updatelen > extlen)
+                        return (-1);
+
+                padp = (u_int8_t *)extbuf + offset;
+                if (padlen == 1)
+                        *padp = IP6OPT_PAD1;
+                else if (padlen > 0) {
+                        *padp++ = IP6OPT_PADN;
+                        *padp++ = (padlen - 2);
+                        memset(padp, 0, padlen - 2);
+                }
+        }
+
+        return (updatelen);
+}
+
+int
+inet6_opt_set_val(void *databuf, int offset, void *val, socklen_t vallen)
+{
+
+        memcpy((u_int8_t *)databuf + offset, val, vallen);
+        return (offset + vallen);
+}
+
+int
+inet6_opt_next(void *extbuf, socklen_t extlen, int offset, u_int8_t *typep,
+               socklen_t *lenp, void **databufp)
+{
+        u_int8_t *optp, *lim;
+        int optlen;
+
+        /* Validate extlen. XXX: is the variable really necessary?? */
+        if (extlen == 0 || (extlen % 8))
+                return (-1);
+        lim = (u_int8_t *)extbuf + extlen;
+
+        /*
+         * If this is the first time this function called for this options
+         * header, simply return the 1st option.
+         * Otherwise, search the option list for the next option.
+         */
+        if (offset == 0)
+                optp = (u_int8_t *)((struct ip6_hbh *)extbuf + 1);
+        else
+                optp = (u_int8_t *)extbuf + offset;
+
+        /* Find the next option skipping any padding options. */
+        while (optp < lim) {
+                switch(*optp) {
+                case IP6OPT_PAD1:
+                        optp++;
+                        break;
+                case IP6OPT_PADN:
+                        if ((optlen = ip6optlen(optp, lim)) == 0)
+                                goto optend;
+                        optp += optlen;
+                        break;
+                default:        /* found */
+                        if ((optlen = ip6optlen(optp, lim)) == 0)
+                                goto optend;
+                        *typep = *optp;
+                        *lenp = optlen - 2;
+                        *databufp = optp + 2;
+                        return (optp + optlen - (u_int8_t *)extbuf);
+                }
+        }
+
+  optend:
+        *databufp = NULL; /* for safety */
+        return (-1);
+}
+
+int
+inet6_opt_find(void *extbuf, socklen_t extlen, int offset, u_int8_t type,
+               socklen_t *lenp, void **databufp)
+{
+        u_int8_t *optp, *lim;
+        int optlen;
+
+        /* Validate extlen. XXX: is the variable really necessary?? */
+        if (extlen == 0 || (extlen % 8))
+                return (-1);
+        lim = (u_int8_t *)extbuf + extlen;
+
+        /*
+         * If this is the first time this function called for this options
+         * header, simply return the 1st option.
+         * Otherwise, search the option list for the next option.
+         */
+        if (offset == 0)
+                optp = (u_int8_t *)((struct ip6_hbh *)extbuf + 1);
+        else
+                optp = (u_int8_t *)extbuf + offset;
+
+        /* Find the specified option */
+        while (optp < lim) {
+                if ((optlen = ip6optlen(optp, lim)) == 0)
+                        goto optend;
+
+                if (*optp == type) { /* found */
+                        *lenp = optlen - 2;
+                        *databufp = optp + 2;
+                        return (optp + optlen - (u_int8_t *)extbuf);
+                }
+
+                optp += optlen;
+        }
+
+  optend:
+        *databufp = NULL; /* for safety */
+        return (-1);
+}
+
+int
+inet6_opt_get_val(void *databuf, int offset, void *val, socklen_t vallen)
+{
+
+        /* we can't assume alignment here */
+        memcpy(val, (u_int8_t *)databuf + offset, vallen);
+
+        return (offset + vallen);
+}
diff --git a/src/lib/libc/net/iso_addr.3 b/src/lib/libc/net/iso_addr.3
deleted file mode 100644
index 95c136e5fc..0000000000
--- a/src/lib/libc/net/iso_addr.3
+++ /dev/null
@@ -1,112 +0,0 @@
-.\"     $NetBSD: iso_addr.3,v 1.2 1995/02/25 06:20:46 cgd Exp $
-.\"
-.\" Copyright (c) 1993
-.\"     The Regents of the University of California.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\"     @(#)iso_addr.3  8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
-.Dt ISO_ADDR 3
-.Os
-.Sh NAME
-.Nm iso_addr ,
-.Nm iso_ntoa
-.Nd "elementary network address conversion routines for Open System Interconnection
-.Sh SYNOPSIS
-.Fd #include <sys/types.h>
-.Fd #include <netiso/iso.h>
-.Ft struct iso_addr *
-.Fn iso_addr "char *cp"
-.Ft char *
-.Fn iso_ntoa "struct iso_addr *isoa"
-.Sh DESCRIPTION
-The routine
-.Fn iso_addr
-interprets character strings representing
-.Tn OSI
-addresses, returning binary information suitable
-for use in system calls.
-The routine
-.Fn iso_ntoa
-takes
-.Tn OSI
-addresses and returns
-.Tn ASCII
-strings representing NSAPs (network service
-access points) in a
-notation inverse to that accepted by 
-.Fn iso_addr .
-.Pp
-Unfortunately, no universal standard exists for representing
-.Tn OSI
-network addresses.
-.Pp
-The format employed by
-.Fn iso_addr
-is a sequence of hexadecimal
-.Dq digits
-(optionally separated by periods),
-of the form:
-.Bd -filled -offset indent
-<hex digits>.<hex digits>.<hex digits>
-.Ed
-.Pp
-Each pair of hexadecimal digits represents a byte
-with the leading digit indicating the higher-ordered bits.
-A period following an even number of bytes has no
-effect (but may be used to increase legibility).
-A period following an odd number of bytes has the
-effect of causing the byte of address being translated
-to have its higher order bits filled with zeros.
-.Sh RETURN VALUES
-.Fn iso_ntoa
-always returns a null terminated string.
-.Fn iso_addr
-always returns a pointer to a struct iso_addr.
-(See
-.Sx BUGS . )
-.Sh SEE ALSO
-.Xr iso 4
-.Sh HISTORY
-The
-.Fn iso_addr
-and
-.Fn iso_ntoa
-functions appeared in 
-.Bx 4.3 Reno .
-.Sh BUGS
-The returned values
-reside in a static memory area.
-.Pp
-The function
-.Fn iso_addr
-should diagnose improperly formed input, and there should be an unambiguous
-way to recognize this.
diff --git a/src/lib/libc/net/iso_addr.c b/src/lib/libc/net/iso_addr.c
deleted file mode 100644
index c26ec1a64a..0000000000
--- a/src/lib/libc/net/iso_addr.c
+++ /dev/null
@@ -1,125 +0,0 @@
-/*      $NetBSD: iso_addr.c,v 1.4 1995/02/25 06:20:47 cgd Exp $ */
-
-/*
- * Copyright (c) 1989, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)iso_addr.c  8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: iso_addr.c,v 1.4 1995/02/25 06:20:47 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/types.h>
-#include <netiso/iso.h>
-#include <string.h>
-
-/* States*/
-#define VIRGIN  0
-#define GOTONE  1
-#define GOTTWO  2
-/* Inputs */
-#define DIGIT   (4*0)
-#define END     (4*1)
-#define DELIM   (4*2)
-
-struct iso_addr *
-iso_addr(addr)
-        register const char *addr;
-{
-        static struct iso_addr out_addr;
-        register char *cp = out_addr.isoa_genaddr;
-        char *cplim = cp + sizeof(out_addr.isoa_genaddr);
-        register int byte = 0, state = VIRGIN, new;
-
-        bzero((char *)&out_addr, sizeof(out_addr));
-        do {
-                if ((*addr >= '0') && (*addr <= '9')) {
-                        new = *addr - '0';
-                } else if ((*addr >= 'a') && (*addr <= 'f')) {
-                        new = *addr - 'a' + 10;
-                } else if ((*addr >= 'A') && (*addr <= 'F')) {
-                        new = *addr - 'A' + 10;
-                } else if (*addr == 0) 
-                        state |= END;
-                else
-                        state |= DELIM;
-                addr++;
-                switch (state /* | INPUT */) {
-                case GOTTWO | DIGIT:
-                        *cp++ = byte; /*FALLTHROUGH*/
-                case VIRGIN | DIGIT:
-                        state = GOTONE; byte = new; continue;
-                case GOTONE | DIGIT:
-                        state = GOTTWO; byte = new + (byte << 4); continue;
-                default: /* | DELIM */
-                        state = VIRGIN; *cp++ = byte; byte = 0; continue;
-                case GOTONE | END:
-                case GOTTWO | END:
-                        *cp++ = byte; /* FALLTHROUGH */
-                case VIRGIN | END:
-                        break;
-                }
-                break;
-        } while (cp < cplim); 
-        out_addr.isoa_len = cp - out_addr.isoa_genaddr;
-        return (&out_addr);
-}
-static char hexlist[] = "0123456789abcdef";
-
-char *
-iso_ntoa(isoa)
-        const struct iso_addr *isoa;
-{
-        static char obuf[64];
-        register char *out = obuf; 
-        register int i;
-        register u_char *in = (u_char *)isoa->isoa_genaddr;
-        u_char *inlim = in + isoa->isoa_len;
-
-        out[1] = 0;
-        while (in < inlim) {
-                i = *in++;
-                *out++ = '.';
-                if (i > 0xf) {
-                        out[1] = hexlist[i & 0xf];
-                        i >>= 4;
-                        out[0] = hexlist[i];
-                        out += 2;
-                } else
-                        *out++ = hexlist[i];
-        }
-        *out = 0;
-        return(obuf + 1);
-}
diff --git a/src/lib/libc/net/linkaddr.3 b/src/lib/libc/net/link_addr.3
index 1a2af9b30d..e6210ef2d0 100644
--- a/src/lib/libc/net/linkaddr.3
+++ b/src/lib/libc/net/link_addr.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: linkaddr.3,v 1.2 1995/02/25 06:20:48 cgd Exp $
+.\"     $OpenBSD: link_addr.3,v 1.12 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -14,11 +14,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -34,11 +30,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)linkaddr.3  8.1 (Berkeley) 7/28/93
-.\"
-.Dd July 28, 1993
+.Dd $Mdocdate: May 31 2007 $
 .Dt LINK_ADDR 3
-.Os BSD 4.4
+.Os
 .Sh NAME
 .Nm link_addr ,
 .Nm link_ntoa
@@ -52,12 +46,11 @@
 .Ft char *
 .Fn link_ntoa "const struct sockaddr_dl *sdl"
 .Sh DESCRIPTION
-The routine
+The
 .Fn link_addr
-interprets character strings representing
+function interprets character strings representing
 link-level addresses, returning binary information suitable
 for use in system calls.
-The routine
 .Fn link_ntoa
 takes
 a link-level
@@ -75,9 +68,9 @@ the string
 .Fa addr
 may contain
 an optional network interface identifier of the form
-.Dq "name unit-number" ,
+.Dq name unit-number ,
 suitable for the first argument to
-.Xr ifconfig 4 ,
+.Xr ifconfig 8 ,
 followed in all cases by a colon and
 an interface address in the form of
 groups of hexadecimal digits
@@ -93,26 +86,27 @@ low order bytes through high order bytes.
 .\" .Pp
 Thus
 .Li le0:8.0.9.13.d.30
-represents an ethernet address
-to be transmitted on the first Lance ethernet interface.
+represents an Ethernet address
+to be transmitted on the first Lance Ethernet interface.
 .Sh RETURN VALUES
 .Fn link_ntoa
-always returns a null terminated string.
+always returns a NUL-terminated string.
 .Fn link_addr
 has no return value.
 (See
 .Sx BUGS . )
 .Sh SEE ALSO
-.Xr iso 4 ,
+.Xr ifconfig 8
 .Sh HISTORY
 The
 .Fn link_addr
 and
 .Fn link_ntoa
-functions appeared in 
-.Bx 4.3 Reno  .
+functions appeared in
+.Bx 4.3 Reno .
 .Sh BUGS
-The returned values for link_ntoa
+The returned values for
+.Fn link_ntoa
 reside in a static memory area.
 .Pp
 The function
@@ -121,7 +115,7 @@ should diagnose improperly formed input, and there should be an unambiguous
 way to recognize this.
 .Pp
 If the
-.Va sdl_len
+.Fa sdl_len
 field of the link socket address
 .Fa sdl
 is 0,
diff --git a/src/lib/libc/net/linkaddr.c b/src/lib/libc/net/linkaddr.c
index 19a0de3abd..ac96f3acdf 100644
--- a/src/lib/libc/net/linkaddr.c
+++ b/src/lib/libc/net/linkaddr.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: linkaddr.c,v 1.5 1995/02/25 06:20:49 cgd Exp $ */
-
+/*      $OpenBSD: linkaddr.c,v 1.5 2005/08/06 20:30:03 espie Exp $ */
 /*-
  * Copyright (c) 1990, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)linkaddr.c  8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: linkaddr.c,v 1.5 1995/02/25 06:20:49 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <sys/socket.h>
 #include <net/if_dl.h>
@@ -58,13 +45,11 @@ static char rcsid[] = "$NetBSD: linkaddr.c,v 1.5 1995/02/25 06:20:49 cgd Exp $";
 #define LETTER  (4*3)
 
 void
-link_addr(addr, sdl)
-        register const char *addr;
-        register struct sockaddr_dl *sdl;
+link_addr(const char *addr, struct sockaddr_dl *sdl)
 {
-        register char *cp = sdl->sdl_data;
+        char *cp = sdl->sdl_data;
         char *cplim = sdl->sdl_len + (char *)sdl;
-        register int byte = 0, state = NAMING, new;
+        int byte = 0, state = NAMING, new;
 
         bzero((char *)&sdl->sdl_family, sdl->sdl_len - 1);
         sdl->sdl_family = AF_LINK;
@@ -129,13 +114,12 @@ link_addr(addr, sdl)
 static char hexlist[] = "0123456789abcdef";
 
 char *
-link_ntoa(sdl)
-        register const struct sockaddr_dl *sdl;
+link_ntoa(const struct sockaddr_dl *sdl)
 {
         static char obuf[64];
-        register char *out = obuf; 
-        register int i;
-        register u_char *in = (u_char *)LLADDR(sdl);
+        char *out = obuf; 
+        int i;
+        u_char *in = (u_char *)LLADDR(sdl);
         u_char *inlim = in + sdl->sdl_alen;
         int firsttime = 1;
 
diff --git a/src/lib/libc/net/net_addrcmp.3 b/src/lib/libc/net/net_addrcmp.3
new file mode 100644
index 0000000000..a02e6e2619
--- /dev/null
+++ b/src/lib/libc/net/net_addrcmp.3
@@ -0,0 +1,91 @@
+.\"     $OpenBSD: net_addrcmp.3,v 1.4 2007/05/31 19:19:30 jmc Exp $
+.\"
+.\" Copyright (c) 1999 Theo de Raadt
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+.\" IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+.\" OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+.\" IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+.\" INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+.\" NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+.\" DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+.\" THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+.\" (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+.\" THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: May 31 2007 $
+.Dt NET_ADDRCMP 3
+.Os
+.Sh NAME
+.Nm net_addrcmp
+.Nd compare socket address structures
+.Sh SYNOPSIS
+.Fd #include <netdb.h>
+.Ft int
+.Fn net_addrcmp "struct sockaddr *sa1" "struct sockaddr *sa2"
+.Sh DESCRIPTION
+The
+.Fn net_addrcmp
+function compares two socket address structures,
+.Fa sa1
+and
+.Fa sa2 .
+.Sh RETURN VALUES
+If
+.Fa sa1
+and
+.Fa sa2
+are for the same address,
+.Fn net_addrcmp
+returns 0.
+.Pp
+The
+.Fa sa_len
+fields are compared first.
+If they do not match,
+.Fn net_addrcmp
+returns \-1 or 1 if
+.Li sa1->sa_len
+is less than or greater than
+.Li sa2->sa_len ,
+respectively.
+.Pp
+Next, the
+.Fa sa_family
+members are compared.
+If they do not match,
+.Fn net_addrcmp
+returns \-1 or 1 if
+.Li sa1->sa_family
+is less than or greater than
+.Li sa2->sa_family ,
+respectively.
+.Pp
+Lastly, if each socket address structure's
+.Fa sa_len
+and
+.Fa sa_family
+fields match,
+the protocol-specific data (the
+.Fa sa_data
+field) is compared.
+If there's a match, both
+.Fa sa1
+and
+.Fa sa2
+must refer to the same address, and 0 is returned; otherwise, a value >0
+or <0 is returned.
+.Sh HISTORY
+A
+.Fn net_addrcmp
+function was added in
+.Ox 2.5 .
diff --git a/src/lib/libc/net/net_addrcmp.c b/src/lib/libc/net/net_addrcmp.c
new file mode 100644
index 0000000000..c2630a5265
--- /dev/null
+++ b/src/lib/libc/net/net_addrcmp.c
@@ -0,0 +1,63 @@
+/*      $OpenBSD: net_addrcmp.c,v 1.10 2005/06/17 20:36:16 henning Exp $        */
+
+/*
+ * Copyright (c) 1999 Theo de Raadt
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <sys/socket.h>
+#include <sys/un.h>
+#include <netinet/in.h>
+#include <string.h>
+
+int
+net_addrcmp(struct sockaddr *sa1, struct sockaddr *sa2)
+{
+
+        if (sa1->sa_len != sa2->sa_len)
+                return (sa1->sa_len < sa2->sa_len) ? -1 : 1;
+        if (sa1->sa_family != sa2->sa_family)
+                return (sa1->sa_family < sa2->sa_family) ? -1 : 1;
+
+        switch(sa1->sa_family) {
+        case AF_INET:
+                return (memcmp(&((struct sockaddr_in *)sa1)->sin_addr,
+                    &((struct sockaddr_in *)sa2)->sin_addr,
+                    sizeof(struct in_addr)));
+        case AF_INET6:
+                if (((struct sockaddr_in6 *)sa1)->sin6_scope_id !=
+                    ((struct sockaddr_in6 *)sa2)->sin6_scope_id)
+                        return (((struct sockaddr_in6 *)sa1)->sin6_scope_id < 
+                            ((struct sockaddr_in6 *)sa2)->sin6_scope_id)
+                            ? -1 : 1;
+                return memcmp(&((struct sockaddr_in6 *)sa1)->sin6_addr,
+                    &((struct sockaddr_in6 *)sa2)->sin6_addr,
+                    sizeof(struct in6_addr));
+        case AF_LOCAL:
+                return (strcmp(((struct sockaddr_un *)sa1)->sun_path,
+                    ((struct sockaddr_un *)sa1)->sun_path));
+        default:
+                return -1;
+        }
+}
diff --git a/src/lib/libc/net/ns.3 b/src/lib/libc/net/ns.3
deleted file mode 100644
index f89b4fe042..0000000000
--- a/src/lib/libc/net/ns.3
+++ /dev/null
@@ -1,132 +0,0 @@
-.\"     $NetBSD: ns.3,v 1.3 1995/02/25 06:20:50 cgd Exp $
-.\"
-.\" Copyright (c) 1986, 1991, 1993
-.\"     The Regents of the University of California.  All rights reserved.
-.\"
-.\" Redistribution and use in source and binary forms, with or without
-.\" modification, are permitted provided that the following conditions
-.\" are met:
-.\" 1. Redistributions of source code must retain the above copyright
-.\"    notice, this list of conditions and the following disclaimer.
-.\" 2. Redistributions in binary form must reproduce the above copyright
-.\"    notice, this list of conditions and the following disclaimer in the
-.\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
-.\"    may be used to endorse or promote products derived from this software
-.\"    without specific prior written permission.
-.\"
-.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
-.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
-.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
-.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
-.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
-.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
-.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
-.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
-.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
-.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
-.\" SUCH DAMAGE.
-.\"
-.\"     @(#)ns.3        8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
-.Dt NS 3
-.Os BSD 4.3
-.Sh NAME
-.Nm ns_addr ,
-.Nm ns_ntoa
-.Nd Xerox
-.Tn NS Ns (tm)
-address conversion routines
-.Sh SYNOPSIS
-.Fd #include <sys/types.h>
-.Fd #include <netns/ns.h>
-.Ft struct ns_addr 
-.Fn ns_addr "char *cp"
-.Ft char *
-.Fn ns_ntoa "struct ns_addr ns"
-.Sh DESCRIPTION
-The routine
-.Fn ns_addr
-interprets character strings representing
-.Tn XNS
-addresses, returning binary information suitable
-for use in system calls.
-The routine
-.Fn ns_ntoa
-takes
-.Tn XNS
-addresses and returns
-.Tn ASCII
-strings representing the address in a
-notation in common use in the Xerox Development Environment:
-.Bd -filled -offset indent
-<network number>.<host number>.<port number>
-.Ed
-.Pp
-Trailing zero fields are suppressed, and each number is printed in hexadecimal,
-in a format suitable for input to 
-.Fn ns_addr .
-Any fields lacking super-decimal digits will have a
-trailing
-.Ql H
-appended.
-.Pp
-Unfortunately, no universal standard exists for representing
-.Tn XNS
-addresses.
-An effort has been made to insure that
-.Fn ns_addr
-be compatible with most formats in common use.
-It will first separate an address into 1 to 3 fields using a single delimiter
-chosen from
-period
-.Ql \&. ,
-colon
-.Ql \&:
-or pound-sign
-.Ql \&# .
-Each field is then examined for byte separators (colon or period).
-If there are byte separators, each subfield separated is taken to be
-a small hexadecimal number, and the entirety is taken as a network-byte-ordered
-quantity to be zero extended in the high-network-order bytes.
-Next, the field is inspected for hyphens, in which case
-the field is assumed to be a number in decimal notation
-with hyphens separating the millenia.
-Next, the field is assumed to be a number:
-It is interpreted
-as hexadecimal if there is a leading
-.Ql 0x
-(as in C),
-a trailing
-.Ql H
-(as in Mesa), or there are any super-decimal digits present.
-It is interpreted as octal is there is a leading
-.Ql 0
-and there are no super-octal digits.
-Otherwise, it is converted as a decimal number.
-.Sh RETURN VALUES
-None. (See
-.Sx BUGS . )
-.Sh SEE ALSO
-.Xr hosts 5 ,
-.Xr networks 5 ,
-.Sh HISTORY
-The
-.Fn ns_addr
-and
-.Fn ns_toa
-functions appeared in 
-.Bx 4.3 .
-.Sh BUGS
-The string returned by
-.Fn ns_ntoa
-resides in a static memory area.
-The function
-.Fn ns_addr
-should diagnose improperly formed input, and there should be an unambiguous
-way to recognize this.
diff --git a/src/lib/libc/net/ns_addr.c b/src/lib/libc/net/ns_addr.c
deleted file mode 100644
index f75ddb23b7..0000000000
--- a/src/lib/libc/net/ns_addr.c
+++ /dev/null
@@ -1,233 +0,0 @@
-/*      $NetBSD: ns_addr.c,v 1.5 1995/02/25 06:20:51 cgd Exp $  */
-
-/*
- * Copyright (c) 1986, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
- * This code is derived from software contributed to Berkeley by
- * J.Q. Johnson.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)ns_addr.c   8.1 (Berkeley) 6/7/93";
-#else
-static char rcsid[] = "$NetBSD: ns_addr.c,v 1.5 1995/02/25 06:20:51 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <netns/ns.h>
-#include <stdio.h>
-#include <string.h>
-
-static struct ns_addr addr, zero_addr;
-
-static void Field(), cvtbase();
-
-struct ns_addr 
-ns_addr(name)
-        const char *name;
-{
-        char separator;
-        char *hostname, *socketname, *cp;
-        char buf[50];
-
-        (void)strncpy(buf, name, sizeof(buf) - 1);
-        buf[sizeof(buf) - 1] = '\0';
-
-        /*
-         * First, figure out what he intends as a field separtor.
-         * Despite the way this routine is written, the prefered
-         * form  2-272.AA001234H.01777, i.e. XDE standard.
-         * Great efforts are made to insure backward compatability.
-         */
-        if (hostname = strchr(buf, '#'))
-                separator = '#';
-        else {
-                hostname = strchr(buf, '.');
-                if ((cp = strchr(buf, ':')) &&
-                    ((hostname && cp < hostname) || (hostname == 0))) {
-                        hostname = cp;
-                        separator = ':';
-                } else
-                        separator = '.';
-        }
-        if (hostname)
-                *hostname++ = 0;
-
-        addr = zero_addr;
-        Field(buf, addr.x_net.c_net, 4);
-        if (hostname == 0)
-                return (addr);  /* No separator means net only */
-
-        socketname = strchr(hostname, separator);
-        if (socketname) {
-                *socketname++ = 0;
-                Field(socketname, (u_char *)&addr.x_port, 2);
-        }
-
-        Field(hostname, addr.x_host.c_host, 6);
-
-        return (addr);
-}
-
-static void
-Field(buf, out, len)
-        char *buf;
-        u_char *out;
-        int len;
-{
-        register char *bp = buf;
-        int i, ibase, base16 = 0, base10 = 0, clen = 0;
-        int hb[6], *hp;
-        char *fmt;
-
-        /*
-         * first try 2-273#2-852-151-014#socket
-         */
-        if ((*buf != '-') &&
-            (1 < (i = sscanf(buf, "%d-%d-%d-%d-%d",
-                        &hb[0], &hb[1], &hb[2], &hb[3], &hb[4])))) {
-                cvtbase(1000L, 256, hb, i, out, len);
-                return;
-        }
-        /*
-         * try form 8E1#0.0.AA.0.5E.E6#socket
-         */
-        if (1 < (i = sscanf(buf,"%x.%x.%x.%x.%x.%x",
-                        &hb[0], &hb[1], &hb[2], &hb[3], &hb[4], &hb[5]))) {
-                cvtbase(256L, 256, hb, i, out, len);
-                return;
-        }
-        /*
-         * try form 8E1#0:0:AA:0:5E:E6#socket
-         */
-        if (1 < (i = sscanf(buf,"%x:%x:%x:%x:%x:%x",
-                        &hb[0], &hb[1], &hb[2], &hb[3], &hb[4], &hb[5]))) {
-                cvtbase(256L, 256, hb, i, out, len);
-                return;
-        }
-        /*
-         * This is REALLY stretching it but there was a
-         * comma notation separting shorts -- definitely non standard
-         */
-        if (1 < (i = sscanf(buf,"%x,%x,%x",
-                        &hb[0], &hb[1], &hb[2]))) {
-                hb[0] = htons(hb[0]); hb[1] = htons(hb[1]);
-                hb[2] = htons(hb[2]);
-                cvtbase(65536L, 256, hb, i, out, len);
-                return;
-        }
-
-        /* Need to decide if base 10, 16 or 8 */
-        while (*bp) switch (*bp++) {
-
-        case '0': case '1': case '2': case '3': case '4': case '5':
-        case '6': case '7': case '-':
-                break;
-
-        case '8': case '9':
-                base10 = 1;
-                break;
-
-        case 'a': case 'b': case 'c': case 'd': case 'e': case 'f':
-        case 'A': case 'B': case 'C': case 'D': case 'E': case 'F':
-                base16 = 1;
-                break;
-        
-        case 'x': case 'X':
-                *--bp = '0';
-                base16 = 1;
-                break;
-
-        case 'h': case 'H':
-                base16 = 1;
-                /* fall into */
-
-        default:
-                *--bp = 0; /* Ends Loop */
-        }
-        if (base16) {
-                fmt = "%3x";
-                ibase = 4096;
-        } else if (base10 == 0 && *buf == '0') {
-                fmt = "%3o";
-                ibase = 512;
-        } else {
-                fmt = "%3d";
-                ibase = 1000;
-        }
-
-        for (bp = buf; *bp++; ) clen++;
-        if (clen == 0) clen++;
-        if (clen > 18) clen = 18;
-        i = ((clen - 1) / 3) + 1;
-        bp = clen + buf - 3;
-        hp = hb + i - 1;
-
-        while (hp > hb) {
-                (void)sscanf(bp, fmt, hp);
-                bp[0] = 0;
-                hp--;
-                bp -= 3;
-        }
-        (void)sscanf(buf, fmt, hp);
-        cvtbase((long)ibase, 256, hb, i, out, len);
-}
-
-static void
-cvtbase(oldbase,newbase,input,inlen,result,reslen)
-        long oldbase;
-        int newbase;
-        int input[];
-        int inlen;
-        unsigned char result[];
-        int reslen;
-{
-        int d, e;
-        long sum;
-
-        e = 1;
-        while (e > 0 && reslen > 0) {
-                d = 0; e = 0; sum = 0;
-                /* long division: input=input/newbase */
-                while (d < inlen) {
-                        sum = sum*oldbase + (long) input[d];
-                        e += (sum > 0);
-                        input[d++] = sum / newbase;
-                        sum %= newbase;
-                }
-                result[--reslen] = sum; /* accumulate remainder */
-        }
-        for (d=0; d < reslen; d++)
-                result[d] = 0;
-}
diff --git a/src/lib/libc/net/ns_ntoa.c b/src/lib/libc/net/ns_ntoa.c
deleted file mode 100644
index ad3265399b..0000000000
--- a/src/lib/libc/net/ns_ntoa.c
+++ /dev/null
@@ -1,106 +0,0 @@
-/*      $NetBSD: ns_ntoa.c,v 1.4 1995/02/25 06:20:51 cgd Exp $  */
-
-/*
- * Copyright (c) 1986, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
- *    may be used to endorse or promote products derived from this software
- *    without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
- * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
- * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
- * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
- * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
- * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
- * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
- * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
- * SUCH DAMAGE.
- */
-
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)ns_ntoa.c   8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: ns_ntoa.c,v 1.4 1995/02/25 06:20:51 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
-#include <sys/param.h>
-#include <netns/ns.h>
-#include <stdio.h>
-
-char *
-ns_ntoa(addr)
-        struct ns_addr addr;
-{
-        static char obuf[40];
-        union { union ns_net net_e; u_long long_e; } net;
-        u_short port = htons(addr.x_port);
-        register char *cp;
-        char *cp2;
-        register u_char *up = addr.x_host.c_host;
-        u_char *uplim = up + 6;
-        static char *spectHex();
-
-        net.net_e = addr.x_net;
-        sprintf(obuf, "%lx", ntohl(net.long_e));
-        cp = spectHex(obuf);
-        cp2 = cp + 1;
-        while (*up==0 && up < uplim) up++;
-        if (up == uplim) {
-                if (port) {
-                        sprintf(cp, ".0");
-                        cp += 2;
-                }
-        } else {
-                sprintf(cp, ".%x", *up++);
-                while (up < uplim) {
-                        while (*cp) cp++;
-                        sprintf(cp, "%02x", *up++);
-                }
-                cp = spectHex(cp2);
-        }
-        if (port) {
-                sprintf(cp, ".%x", port);
-                spectHex(cp + 1);
-        }
-        return (obuf);
-}
-
-static char *
-spectHex(p0)
-        char *p0;
-{
-        int ok = 0;
-        int nonzero = 0;
-        register char *p = p0;
-        for (; *p; p++) switch (*p) {
-
-        case 'a': case 'b': case 'c': case 'd': case 'e': case 'f':
-                *p += ('A' - 'a');
-                /* fall into . . . */
-        case 'A': case 'B': case 'C': case 'D': case 'E': case 'F':
-                ok = 1;
-        case '1': case '2': case '3': case '4': case '5':
-        case '6': case '7': case '8': case '9':
-                nonzero = 1;
-        }
-        if (nonzero && !ok) { *p++ = 'H'; *p = 0; }
-        return (p);
-}
diff --git a/src/lib/libc/net/nsap_addr.c b/src/lib/libc/net/nsap_addr.c
new file mode 100644
index 0000000000..8cfe86f475
--- /dev/null
+++ b/src/lib/libc/net/nsap_addr.c
@@ -0,0 +1,94 @@
+/*      $OpenBSD: nsap_addr.c,v 1.7 2006/03/31 05:35:44 deraadt Exp $   */
+
+/*
+ * Copyright (c) 1996 by Internet Software Consortium.
+ *
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS" AND INTERNET SOFTWARE CONSORTIUM DISCLAIMS
+ * ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL INTERNET SOFTWARE
+ * CONSORTIUM BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+#include <ctype.h>
+#include <resolv.h>
+
+static u_char
+xtob(int c)
+{
+        return (c - (((c >= '0') && (c <= '9')) ? '0' : '7'));
+}
+
+u_int
+inet_nsap_addr(const char *ascii, u_char *binary, int maxlen)
+{
+        u_char c, nib;
+        u_int len = 0;
+
+        while ((c = *ascii++) != '\0' && len < maxlen) {
+                if (c == '.' || c == '+' || c == '/')
+                        continue;
+                if (!isascii(c))
+                        return (0);
+                if (islower(c))
+                        c = (u_char)toupper(c);
+                if (isxdigit(c)) {
+                        nib = xtob(c);
+                        if ((c = *ascii++)) {
+                                c = (u_char)toupper(c);
+                                if (isxdigit(c)) {
+                                        *binary++ = (nib << 4) | xtob(c);
+                                        len++;
+                                } else
+                                        return (0);
+                        }
+                        else
+                                return (0);
+                }
+                else
+                        return (0);
+        }
+        return (len);
+}
+
+char *
+inet_nsap_ntoa(int binlen, const u_char *binary, char *ascii)
+{
+        int nib;
+        int i;
+        static char tmpbuf[255*3];
+        char *start;
+
+        if (ascii)
+                start = ascii;
+        else {
+                ascii = tmpbuf;
+                start = tmpbuf;
+        }
+
+        if (binlen > 255)
+                binlen = 255;
+
+        for (i = 0; i < binlen; i++) {
+                nib = *binary >> 4;
+                *ascii++ = nib + (nib < 10 ? '0' : '7');
+                nib = *binary++ & 0x0f;
+                *ascii++ = nib + (nib < 10 ? '0' : '7');
+                if (((i % 2) == 0 && (i + 1) < binlen))
+                        *ascii++ = '.';
+        }
+        *ascii = '\0';
+        return (start);
+}
diff --git a/src/lib/libc/net/ntohl.c b/src/lib/libc/net/ntohl.c
index 05b7f4c9a3..36414b7a13 100644
--- a/src/lib/libc/net/ntohl.c
+++ b/src/lib/libc/net/ntohl.c
@@ -1,29 +1,21 @@
-/*      $NetBSD: ntohl.c,v 1.5 1995/04/28 23:25:21 jtc Exp $    */
-
+/*      $OpenBSD: ntohl.c,v 1.6 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Written by J.T. Conklin <jtc@netbsd.org>.
  * Public domain.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$NetBSD: ntohl.c,v 1.5 1995/04/28 23:25:21 jtc Exp $";
-#endif
-
 #include <sys/types.h>
 #include <machine/endian.h>
 
 #undef ntohl
 
-unsigned long
-ntohl(x)
-        unsigned long x;
+u_int32_t
+ntohl(u_int32_t x)
 {
-        u_int32_t y = x;
-
 #if BYTE_ORDER == LITTLE_ENDIAN
-        u_char *s = (u_char *)&y;
-        return s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3];
+        u_char *s = (u_char *)&x;
+        return (u_int32_t)(s[0] << 24 | s[1] << 16 | s[2] << 8 | s[3]);
 #else
-        return y;
+        return x;
 #endif
 }
diff --git a/src/lib/libc/net/ntohs.c b/src/lib/libc/net/ntohs.c
index 93ab83ee4d..8f345e84ad 100644
--- a/src/lib/libc/net/ntohs.c
+++ b/src/lib/libc/net/ntohs.c
@@ -1,26 +1,20 @@
-/*      $NetBSD: ntohs.c,v 1.5 1995/04/28 23:25:23 jtc Exp $    */
-
+/*      $OpenBSD: ntohs.c,v 1.8 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Written by J.T. Conklin <jtc@netbsd.org>.
  * Public domain.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-static char *rcsid = "$NetBSD: ntohs.c,v 1.5 1995/04/28 23:25:23 jtc Exp $";
-#endif
-
 #include <sys/types.h>
 #include <machine/endian.h>
 
 #undef ntohs
 
-unsigned short
-ntohs(x)
-        unsigned short x;
+u_int16_t
+ntohs(u_int16_t x)
 {
 #if BYTE_ORDER == LITTLE_ENDIAN
         u_char *s = (u_char *) &x;
-        return s[0] << 8 | s[1];
+        return (u_int16_t)(s[0] << 8 | s[1]);
 #else
         return x;
 #endif
diff --git a/src/lib/libc/net/rcmd.3 b/src/lib/libc/net/rcmd.3
index 4db847c392..87e9a760a8 100644
--- a/src/lib/libc/net/rcmd.3
+++ b/src/lib/libc/net/rcmd.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: rcmd.3,v 1.8 1995/02/25 06:20:52 cgd Exp $
+.\"     $OpenBSD: rcmd.3,v 1.27 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1983, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,38 +27,67 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)rcmd.3      8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
+.Dd $Mdocdate: May 31 2007 $
 .Dt RCMD 3
-.Os BSD 4.2
+.Os
 .Sh NAME
 .Nm rcmd ,
+.Nm rcmd_af ,
 .Nm rresvport ,
+.Nm rresvport_af ,
 .Nm iruserok ,
-.Nm ruserok
+.Nm ruserok ,
+.Nm iruserok_sa
 .Nd routines for returning a stream to a remote command
 .Sh SYNOPSIS
 .Fd #include <unistd.h>
 .Ft int
 .Fn rcmd "char **ahost" "int inport" "const char *locuser" "const char *remuser" "const char *cmd" "int *fd2p"
 .Ft int
+.Fn rcmd_af "char **ahost" "int inport" "const char *locuser" "const char *remuser" "const char *cmd" "int *fd2p" "int af"
+.Ft int
 .Fn rresvport "int *port"
 .Ft int
-.Fn iruserok "u_long raddr" "int superuser" "const char *ruser" "const char *luser"
+.Fn rresvport_af "int *port" "int af"
+.Ft int
+.Fn iruserok "u_int32_t raddr" "int superuser" "const char *ruser" "const char *luser"
 .Ft int
 .Fn ruserok "const char *rhost" "int superuser" "const char *ruser" "const char *luser"
+.Ft int
+.Fn iruserok_sa "const void *sa" "int salen" "int superuser" "const char *ruser" "const char *luser"
 .Sh DESCRIPTION
 The
 .Fn rcmd
-function
-is used by the super-user to execute a command on
-a remote machine using an authentication scheme based
-on reserved port numbers.
+function is used by the superuser to execute a command on a remote
+machine using an authentication scheme based on reserved
+port numbers.
+If the calling process is not setuid, the
+.Ev RSH
+environment variable is set, and
+.Fa inport
+is
+.Dq shell/tcp ,
+.Xr rcmdsh 3
+is called instead with the value of
+.Ev RSH .
+Alternately, if the user is not the superuser,
+.Fn rcmd
+will invoke
+.Xr rcmdsh 3
+to run the command via
+.Xr rsh 1 .
+While
+.Fn rcmd
+can handle IPv4 cases only,
+the
+.Fn rcmd_af
+function can handle other cases as well.
+.Pp
 The
 .Fn rresvport
-function
-returns a descriptor to a socket
+and
+.Fn rresvport_af
+functions return a descriptor to a socket
 with an address in the privileged port space.
 The
 .Fn iruserok
@@ -75,11 +100,13 @@ All four functions are present in the same file and are used
 by the
 .Xr rshd 8
 server (among others).
+.Fn iruserok_sa
+is an address family independent variant of
+.Fn iruserok .
 .Pp
 The
 .Fn rcmd
-function
-looks up the host
+function looks up the host
 .Fa *ahost
 using
 .Xr gethostbyname 3 ,
@@ -90,15 +117,15 @@ is set to the standard name of the host
 and a connection is established to a server
 residing at the well-known Internet port
 .Fa inport .
+If the user is not the superuser, the only valid port is
+.Dq shell/tcp
+(usually port 514).
 .Pp
 If the connection succeeds,
 a socket in the Internet domain of type
 .Dv SOCK_STREAM
 is returned to the caller, and given to the remote
-command as 
-.Em stdin
-and
-.Em stdout .
+command as stdin and stdout.
 If
 .Fa fd2p
 is non-zero, then an auxiliary channel to a control
@@ -113,27 +140,46 @@ signal numbers, to be
 forwarded to the process group of the command.
 If
 .Fa fd2p
-is 0, then the 
-.Em stderr
-(unit 2 of the remote
-command) will be made the same as the 
-.Em stdout
-and no
-provision is made for sending arbitrary signals to the remote process,
-although you may be able to get its attention by using out-of-band data.
+is
+.Va NULL ,
+then the standard error (unit 2 of the remote command) will be made
+the same as the standard output and no provision is made for sending
+arbitrary signals to the remote process, although you may be able to
+get its attention by using out-of-band data.
+Note that if the user is not the superuser,
+.Fa fd2p
+must be
+.Va NULL .
+.Pp
+.Fn rcmd_af
+takes address family in the last argument.
+If the last argument is
+.Dv PF_UNSPEC ,
+interpretation of
+.Fa *ahost
+will obey the underlying address resolution like DNS.
 .Pp
 The protocol is described in detail in
 .Xr rshd 8 .
 .Pp
 The
 .Fn rresvport
-function is used to obtain a socket with a privileged
-address bound to it.  This socket is suitable for use
-by 
+and
+.Fn rresvport_af
+functions are used to obtain a socket with a privileged
+address bound to it.
+This socket is suitable for use by
 .Fn rcmd
-and several other functions.  Privileged Internet ports are those
-in the range 0 to 1023.  Only the super-user
-is allowed to bind an address of this sort to a socket.
+and several other functions.
+Privileged Internet ports are those in the range 0 to
+.Va IPPORT_RESERVED - 1 ,
+which happens to be 1023.
+Only the superuser is allowed to bind an address of this sort to a socket.
+.Fn rresvport
+and
+.Fn rresvport_af
+need to be seeded with a port number; if that port
+is not available these functions will find another.
 .Pp
 The
 .Fn iruserok
@@ -141,10 +187,10 @@ and
 .Fn ruserok
 functions take a remote host's IP address or name, respectively,
 two user names and a flag indicating whether the local user's
-name is that of the super-user.
+name is that of the superuser.
 Then, if the user is
-.Em NOT
-the super-user, it checks the
+.Em not
+the superuser, it checks the
 .Pa /etc/hosts.equiv
 file.
 If that lookup is not done, or is unsuccessful, the
@@ -153,19 +199,19 @@ in the local user's home directory is checked to see if the request for
 service is allowed.
 .Pp
 If this file does not exist, is not a regular file, is owned by anyone
-other than the user or the super-user, or is writeable by anyone other
+other than the user or the superuser, or is writeable by anyone other
 than the owner, the check automatically fails.
 Zero is returned if the machine name is listed in the
-.Dq Pa hosts.equiv
+.Pa hosts.equiv
 file, or the host and remote user name are found in the
-.Dq Pa .rhosts
+.Pa .rhosts
 file; otherwise
 .Fn iruserok
 and
 .Fn ruserok
 return \-1.
 If the local domain (as obtained from
-.Xr gethostname 2 )
+.Xr gethostname 3 )
 is the same as the remote domain, only the machine name need be specified.
 .Pp
 If the IP address of the remote host is known,
@@ -173,32 +219,48 @@ If the IP address of the remote host is known,
 should be used in preference to
 .Fn ruserok ,
 as it does not require trusting the DNS server for the remote host's domain.
+.Pp
+While
+.Fn iruserok
+can handle IPv4 addresses only,
+.Fn iruserok_sa
+and
+.Fn ruserok
+can handle other address families as well, like IPv6.
+The first argument of
+.Fn iruserok_sa
+is typed as
+.Li "void *"
+to avoid dependency between
+.Aq Pa unistd.h
+and
+.Aq Pa sys/socket.h .
 .Sh DIAGNOSTICS
 The
 .Fn rcmd
-function
-returns a valid socket descriptor on success.
+function returns a valid socket descriptor on success.
 It returns \-1 on error and prints a diagnostic message on the standard error.
 .Pp
 The
 .Fn rresvport
-function
-returns a valid, bound socket descriptor on success.
+and
+.Fn rresvport_af
+functions return a valid, bound socket descriptor on success.
 It returns \-1 on error with the global value
 .Va errno
 set according to the reason for failure.
 The error code
-.Dv EAGAIN
-is overloaded to mean ``All network ports in use.''
+.Er EAGAIN
+is overloaded to mean
+.Dq all network ports in use .
 .Sh SEE ALSO
-.Xr rlogin 1 ,
 .Xr rsh 1 ,
 .Xr intro 2 ,
-.Xr rexec 3 ,
-.Xr rexecd 8 ,
-.Xr rlogind 8 ,
+.Xr bindresvport 3 ,
+.Xr bindresvport_sa 3 ,
+.Xr rcmdsh 3 ,
 .Xr rshd 8
 .Sh HISTORY
 These
-functions appeared in 
+functions appeared in
 .Bx 4.2 .
diff --git a/src/lib/libc/net/rcmd.c b/src/lib/libc/net/rcmd.c
index e0310031b0..d566e0ca4c 100644
--- a/src/lib/libc/net/rcmd.c
+++ b/src/lib/libc/net/rcmd.c
@@ -1,6 +1,5 @@
-/*      $NetBSD: rcmd.c,v 1.12 1995/06/03 22:33:34 mycroft Exp $        */
-
 /*
+ * Copyright (c) 1995, 1996, 1998 Theo de Raadt.  All rights reserved.
  * Copyright (c) 1983, 1993, 1994
  *      The Regents of the University of California.  All rights reserved.
  *
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,14 +28,6 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)rcmd.c      8.3 (Berkeley) 3/26/94";
-#else
-static char *rcsid = "$NetBSD: rcmd.c,v 1.12 1995/06/03 22:33:34 mycroft Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <sys/socket.h>
 #include <sys/stat.h>
@@ -57,35 +44,77 @@ static char *rcsid = "$NetBSD: rcmd.c,v 1.12 1995/06/03 22:33:34 mycroft Exp $";
 #include <stdio.h>
 #include <ctype.h>
 #include <string.h>
+#include <syslog.h>
+#include <stdlib.h>
 
-int     __ivaliduser __P((FILE *, u_long, const char *, const char *));
-static int __icheckhost __P((u_long, const char *));
+int
+rcmd(char **ahost, int rport, const char *locuser, const char *remuser,
+    const char *cmd, int *fd2p)
+{
+        return rcmd_af(ahost, rport, locuser, remuser, cmd, fd2p, AF_INET);
+}
 
 int
-rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
-        char **ahost;
-        u_short rport;
-        const char *locuser, *remuser, *cmd;
-        int *fd2p;
+rcmd_af(char **ahost, int porta, const char *locuser, const char *remuser,
+    const char *cmd, int *fd2p, int af)
 {
-        struct hostent *hp;
-        struct sockaddr_in sin, from;
-        fd_set reads;
-        long oldmask;
+        static char hbuf[MAXHOSTNAMELEN];
+        char pbuf[NI_MAXSERV];
+        struct addrinfo hints, *res, *r;
+        int error;
+        struct sockaddr_storage from;
+        fd_set *readsp = NULL;
+        sigset_t oldmask, mask;
         pid_t pid;
         int s, lport, timo;
-        char c;
+        char c, *p;
+        int refused;
+        in_port_t rport = porta;
+
+        /* call rcmdsh() with specified remote shell if appropriate. */
+        if (!issetugid() && (p = getenv("RSH")) && *p) {
+                struct servent *sp = getservbyname("shell", "tcp");
+
+                if (sp && sp->s_port == rport)
+                        return (rcmdsh(ahost, rport, locuser, remuser,
+                            cmd, p));
+        }
+
+        /* use rsh(1) if non-root and remote port is shell. */
+        if (geteuid()) {
+                struct servent *sp = getservbyname("shell", "tcp");
+
+                if (sp && sp->s_port == rport)
+                        return (rcmdsh(ahost, rport, locuser, remuser,
+                            cmd, NULL));
+        }
 
         pid = getpid();
-        hp = gethostbyname(*ahost);
-        if (hp == NULL) {
-                herror(*ahost);
+        snprintf(pbuf, sizeof(pbuf), "%u", ntohs(rport));
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = af;
+        hints.ai_socktype = SOCK_STREAM;
+        hints.ai_flags = AI_CANONNAME;
+        error = getaddrinfo(*ahost, pbuf, &hints, &res);
+        if (error) {
+#if 0
+                warnx("%s: %s", *ahost, gai_strerror(error));
+#endif
                 return (-1);
         }
-        *ahost = hp->h_name;
-        oldmask = sigblock(sigmask(SIGURG));
+        if (res->ai_canonname) {
+                strlcpy(hbuf, res->ai_canonname, sizeof(hbuf));
+                *ahost = hbuf;
+        } else
+                ; /*XXX*/
+
+        r = res;
+        refused = 0;
+        sigemptyset(&mask);
+        sigaddset(&mask, SIGURG);
+        sigprocmask(SIG_BLOCK, &mask, &oldmask);
         for (timo = 1, lport = IPPORT_RESERVED - 1;;) {
-                s = rresvport(&lport);
+                s = rresvport_af(&lport, r->ai_family);
                 if (s < 0) {
                         if (errno == EAGAIN)
                                 (void)fprintf(stderr,
@@ -93,54 +122,84 @@ rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
                         else
                                 (void)fprintf(stderr, "rcmd: socket: %s\n",
                                     strerror(errno));
-                        sigsetmask(oldmask);
-                        return (-1);
+                        if (r->ai_next) {
+                                r = r->ai_next;
+                                continue;
+                        } else {
+                                sigprocmask(SIG_SETMASK, &oldmask, NULL);
+                                freeaddrinfo(res);
+                                return (-1);
+                        }
                 }
                 fcntl(s, F_SETOWN, pid);
-                sin.sin_len = sizeof(struct sockaddr_in);
-                sin.sin_family = hp->h_addrtype;
-                sin.sin_port = rport;
-                bcopy(hp->h_addr_list[0], &sin.sin_addr, hp->h_length);
-                if (connect(s, (struct sockaddr *)&sin, sizeof(sin)) >= 0)
+                if (connect(s, r->ai_addr, r->ai_addrlen) >= 0)
                         break;
                 (void)close(s);
                 if (errno == EADDRINUSE) {
                         lport--;
                         continue;
                 }
-                if (errno == ECONNREFUSED && timo <= 16) {
-                        (void)sleep(timo);
-                        timo *= 2;
-                        continue;
-                }
-                if (hp->h_addr_list[1] != NULL) {
+                if (errno == ECONNREFUSED)
+                        refused++;
+                if (r->ai_next) {
                         int oerrno = errno;
-
-                        (void)fprintf(stderr, "connect to address %s: ",
-                            inet_ntoa(sin.sin_addr));
+                        char hbuf[NI_MAXHOST];
+                        const int niflags = NI_NUMERICHOST;
+
+                        hbuf[0] = '\0';
+                        if (getnameinfo(r->ai_addr, r->ai_addrlen,
+                            hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
+                                strlcpy(hbuf, "(invalid)", sizeof hbuf);
+                        (void)fprintf(stderr, "connect to address %s: ", hbuf);
                         errno = oerrno;
                         perror(0);
-                        hp->h_addr_list++;
-                        bcopy(hp->h_addr_list[0], &sin.sin_addr, hp->h_length);
-                        (void)fprintf(stderr, "Trying %s...\n",
-                            inet_ntoa(sin.sin_addr));
+                        r = r->ai_next;
+                        hbuf[0] = '\0';
+                        if (getnameinfo(r->ai_addr, r->ai_addrlen,
+                            hbuf, sizeof(hbuf), NULL, 0, niflags) != 0)
+                                strlcpy(hbuf, "(invalid)", sizeof hbuf);
+                        (void)fprintf(stderr, "Trying %s...\n", hbuf);
                         continue;
                 }
-                (void)fprintf(stderr, "%s: %s\n", hp->h_name, strerror(errno));
-                sigsetmask(oldmask);
+                if (refused && timo <= 16) {
+                        (void)sleep(timo);
+                        timo *= 2;
+                        r = res;
+                        refused = 0;
+                        continue;
+                }
+                (void)fprintf(stderr, "%s: %s\n", res->ai_canonname,
+                    strerror(errno));
+                sigprocmask(SIG_SETMASK, &oldmask, NULL);
+                freeaddrinfo(res);
                 return (-1);
         }
+        /* given "af" can be PF_UNSPEC, we need the real af for "s" */
+        af = r->ai_family;
+        freeaddrinfo(res);
+#if 0
+        /*
+         * try to rresvport() to the same port. This will make rresvport()
+         * fail it's first bind, resulting in it choosing a random port.
+         */
         lport--;
+#endif
         if (fd2p == 0) {
                 write(s, "", 1);
                 lport = 0;
         } else {
                 char num[8];
-                int s2 = rresvport(&lport), s3;
-                int len = sizeof(from);
+                int s2 = rresvport_af(&lport, af), s3;
+                socklen_t len = sizeof(from);
+                int fdssize = howmany(MAX(s, s2)+1, NFDBITS) * sizeof(fd_mask);
 
                 if (s2 < 0)
                         goto bad;
+                readsp = (fd_set *)malloc(fdssize);
+                if (readsp == NULL) {
+                        close(s2);
+                        goto bad;
+                }
                 listen(s2, 1);
                 (void)snprintf(num, sizeof(num), "%d", lport);
                 if (write(s, num, strlen(num)+1) != strlen(num)+1) {
@@ -150,12 +209,13 @@ rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
                         (void)close(s2);
                         goto bad;
                 }
-                FD_ZERO(&reads);
-                FD_SET(s, &reads);
-                FD_SET(s2, &reads);
+again:
+                bzero(readsp, fdssize);
+                FD_SET(s, readsp);
+                FD_SET(s2, readsp);
                 errno = 0;
-                if (select(MAX(s, s2) + 1, &reads, 0, 0, 0) < 1 ||
-                    !FD_ISSET(s2, &reads)) {
+                if (select(MAX(s, s2) + 1, readsp, 0, 0, 0) < 1 ||
+                    !FD_ISSET(s2, readsp)) {
                         if (errno != 0)
                                 (void)fprintf(stderr,
                                     "rcmd: select (setting up stderr): %s\n",
@@ -167,21 +227,48 @@ rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
                         goto bad;
                 }
                 s3 = accept(s2, (struct sockaddr *)&from, &len);
-                (void)close(s2);
                 if (s3 < 0) {
                         (void)fprintf(stderr,
                             "rcmd: accept: %s\n", strerror(errno));
                         lport = 0;
+                        close(s2);
                         goto bad;
                 }
+
+                /*
+                 * XXX careful for ftp bounce attacks. If discovered, shut them
+                 * down and check for the real auxiliary channel to connect.
+                 */
+                switch (from.ss_family) {
+                case AF_INET:
+                case AF_INET6:
+                        if (getnameinfo((struct sockaddr *)&from, len,
+                            NULL, 0, num, sizeof(num), NI_NUMERICSERV) == 0 &&
+                            atoi(num) != 20) {
+                                break;
+                        }
+                        close(s3);
+                        goto again;
+                default:
+                        break;
+                }
+                (void)close(s2);
+
                 *fd2p = s3;
-                from.sin_port = ntohs(from.sin_port);
-                if (from.sin_family != AF_INET ||
-                    from.sin_port >= IPPORT_RESERVED ||
-                    from.sin_port < IPPORT_RESERVED / 2) {
-                        (void)fprintf(stderr,
-                            "socket: protocol failure in circuit setup.\n");
-                        goto bad2;
+                switch (from.ss_family) {
+                case AF_INET:
+                case AF_INET6:
+                        if (getnameinfo((struct sockaddr *)&from, len,
+                            NULL, 0, num, sizeof(num), NI_NUMERICSERV) != 0 ||
+                            (atoi(num) >= IPPORT_RESERVED ||
+                             atoi(num) < IPPORT_RESERVED / 2)) {
+                                (void)fprintf(stderr,
+                                    "socket: protocol failure in circuit setup.\n");
+                                goto bad2;
+                        }
+                        break;
+                default:
+                        break;
                 }
         }
         (void)write(s, locuser, strlen(locuser)+1);
@@ -200,318 +287,17 @@ rcmd(ahost, rport, locuser, remuser, cmd, fd2p)
                 }
                 goto bad2;
         }
-        sigsetmask(oldmask);
+        sigprocmask(SIG_SETMASK, &oldmask, NULL);
+        free(readsp);
         return (s);
 bad2:
         if (lport)
                 (void)close(*fd2p);
 bad:
+        if (readsp)
+                free(readsp);
         (void)close(s);
-        sigsetmask(oldmask);
-        return (-1);
-}
-
-int
-rresvport(alport)
-        int *alport;
-{
-        struct sockaddr_in sin;
-        int s;
-
-        sin.sin_len = sizeof(struct sockaddr_in);
-        sin.sin_family = AF_INET;
-        sin.sin_addr.s_addr = INADDR_ANY;
-        s = socket(AF_INET, SOCK_STREAM, 0);
-        if (s < 0)
-                return (-1);
-        for (;;) {
-                sin.sin_port = htons((u_short)*alport);
-                if (bind(s, (struct sockaddr *)&sin, sizeof(sin)) >= 0)
-                        return (s);
-                if (errno != EADDRINUSE) {
-                        (void)close(s);
-                        return (-1);
-                }
-                (*alport)--;
-                if (*alport == IPPORT_RESERVED/2) {
-                        (void)close(s);
-                        errno = EAGAIN;         /* close */
-                        return (-1);
-                }
-        }
-}
-
-int     __check_rhosts_file = 1;
-char    *__rcmd_errstr;
-
-int
-ruserok(rhost, superuser, ruser, luser)
-        const char *rhost, *ruser, *luser;
-        int superuser;
-{
-        struct hostent *hp;
-        char **ap;
-        int i;
-#define MAXADDRS        35
-        u_long addrs[MAXADDRS + 1];
-
-        if ((hp = gethostbyname(rhost)) == NULL)
-                return (-1);
-        for (i = 0, ap = hp->h_addr_list; *ap && i < MAXADDRS; ++ap, ++i)
-                bcopy(*ap, &addrs[i], sizeof(addrs[i]));
-        addrs[i] = 0;
-
-        for (i = 0; i < MAXADDRS && addrs[i]; i++)
-                if (iruserok(addrs[i], superuser, ruser, luser) == 0)
-                        return (0);
-        return (-1);
-}
-
-/*
- * New .rhosts strategy: We are passed an ip address. We spin through
- * hosts.equiv and .rhosts looking for a match. When the .rhosts only
- * has ip addresses, we don't have to trust a nameserver.  When it
- * contains hostnames, we spin through the list of addresses the nameserver
- * gives us and look for a match.
- *
- * Returns 0 if ok, -1 if not ok.
- */
-int
-iruserok(raddr, superuser, ruser, luser)
-        u_long raddr;
-        int superuser;
-        const char *ruser, *luser;
-{
-        register char *cp;
-        struct stat sbuf;
-        struct passwd *pwd;
-        FILE *hostf;
-        uid_t uid;
-        int first;
-        char pbuf[MAXPATHLEN];
-
-        first = 1;
-        hostf = superuser ? NULL : fopen(_PATH_HEQUIV, "r");
-again:
-        if (hostf) {
-                if (__ivaliduser(hostf, raddr, luser, ruser) == 0) {
-                        (void)fclose(hostf);
-                        return (0);
-                }
-                (void)fclose(hostf);
-        }
-        if (first == 1 && (__check_rhosts_file || superuser)) {
-                first = 0;
-                if ((pwd = getpwnam(luser)) == NULL)
-                        return (-1);
-                (void)strcpy(pbuf, pwd->pw_dir);
-                (void)strcat(pbuf, "/.rhosts");
-
-                /*
-                 * Change effective uid while opening .rhosts.  If root and
-                 * reading an NFS mounted file system, can't read files that
-                 * are protected read/write owner only.
-                 */
-                uid = geteuid();
-                (void)seteuid(pwd->pw_uid);
-                hostf = fopen(pbuf, "r");
-                (void)seteuid(uid);
-
-                if (hostf == NULL)
-                        return (-1);
-                /*
-                 * If not a regular file, or is owned by someone other than
-                 * user or root or if writeable by anyone but the owner, quit.
-                 */
-                cp = NULL;
-                if (lstat(pbuf, &sbuf) < 0)
-                        cp = ".rhosts lstat failed";
-                else if (!S_ISREG(sbuf.st_mode))
-                        cp = ".rhosts not regular file";
-                else if (fstat(fileno(hostf), &sbuf) < 0)
-                        cp = ".rhosts fstat failed";
-                else if (sbuf.st_uid && sbuf.st_uid != pwd->pw_uid)
-                        cp = "bad .rhosts owner";
-                else if (sbuf.st_mode & (S_IWGRP|S_IWOTH))
-                        cp = ".rhosts writeable by other than owner";
-                /* If there were any problems, quit. */
-                if (cp) {
-                        __rcmd_errstr = cp;
-                        (void)fclose(hostf);
-                        return (-1);
-                }
-                goto again;
-        }
+        sigprocmask(SIG_SETMASK, &oldmask, NULL);
         return (-1);
 }
 
-/*
- * XXX
- * Don't make static, used by lpd(8).
- *
- * Returns 0 if ok, -1 if not ok.
- */
-int
-__ivaliduser(hostf, raddr, luser, ruser)
-        FILE *hostf;
-        u_long raddr;
-        const char *luser, *ruser;
-{
-        register char *user, *p;
-        int ch;
-        char buf[MAXHOSTNAMELEN + 128];         /* host + login */
-        const char *auser, *ahost;
-        int hostok, userok;
-        char rhost[MAXHOSTNAMELEN];
-        struct hostent *hp;
-        char domain[MAXHOSTNAMELEN];
-
-        getdomainname(domain, sizeof(domain));
-
-        while (fgets(buf, sizeof(buf), hostf)) {
-                p = buf;
-                /* Skip lines that are too long. */
-                if (strchr(p, '\n') == NULL) {
-                        while ((ch = getc(hostf)) != '\n' && ch != EOF);
-                        continue;
-                }
-                while (*p != '\n' && *p != ' ' && *p != '\t' && *p != '\0') {
-                        *p = isupper(*p) ? tolower(*p) : *p;
-                        p++;
-                }
-                if (*p == ' ' || *p == '\t') {
-                        *p++ = '\0';
-                        while (*p == ' ' || *p == '\t')
-                                p++;
-                        user = p;
-                        while (*p != '\n' && *p != ' ' &&
-                            *p != '\t' && *p != '\0')
-                                p++;
-                } else
-                        user = p;
-                *p = '\0';
-
-                if (p == buf)
-                        continue;
-
-                auser = *user ? user : luser;
-                ahost = buf;
-
-                if ((hp = gethostbyaddr((char *) &raddr,
-                                        sizeof(raddr), AF_INET)) == NULL) {
-                        abort();
-                        return -1;
-                }
-                (void) strncpy(rhost, hp->h_name, sizeof(rhost));
-                rhost[sizeof(rhost) - 1] = '\0';
-
-                if (ahost[0] == '+')
-                        switch (ahost[1]) {
-                        case '\0':
-                                hostok = 1;
-                                break;
-
-                        case '@':
-                                hostok = innetgr(&ahost[2], rhost, NULL,
-                                                 domain);
-                                break;
-
-                        default:
-                                hostok = __icheckhost(raddr, &ahost[1]);
-                                break;
-                        }
-                else if (ahost[0] == '-')
-                        switch (ahost[1]) {
-                        case '\0':
-                                hostok = -1;
-                                break;
-
-                        case '@':
-                                hostok = -innetgr(&ahost[2], rhost, NULL,
-                                                  domain);
-                                break;
-
-                        default:
-                                hostok = -__icheckhost(raddr, &ahost[1]);
-                                break;
-                        }
-                else
-                        hostok = __icheckhost(raddr, ahost);
-
-
-                if (auser[0] == '+')
-                        switch (auser[1]) {
-                        case '\0':
-                                userok = 1;
-                                break;
-
-                        case '@':
-                                userok = innetgr(&auser[2], NULL, ruser,
-                                                 domain);
-                                break;
-
-                        default:
-                                userok = strcmp(ruser, &auser[1]) == 0;
-                                break;
-                        }
-                else if (auser[0] == '-')
-                        switch (auser[1]) {
-                        case '\0':
-                                userok = -1;
-                                break;
-
-                        case '@':
-                                userok = -innetgr(&auser[2], NULL, ruser,
-                                                  domain);
-                                break;
-
-                        default:
-                                userok = -(strcmp(ruser, &auser[1]) == 0);
-                                break;
-                        }
-                else
-                        userok = strcmp(ruser, auser) == 0;
-
-                /* Check if one component did not match */
-                if (hostok == 0 || userok == 0)
-                        continue;
-
-                /* Check if we got a forbidden pair */
-                if (userok == -1 || hostok == -1)
-                        return -1;
-
-                /* Check if we got a valid pair */
-                if (hostok == 1 && userok == 1)
-                        return 0;
-        }
-        return -1;
-}
-
-/*
- * Returns "true" if match, 0 if no match.
- */
-static int
-__icheckhost(raddr, lhost)
-        u_long raddr;
-        const char *lhost;
-{
-        register struct hostent *hp;
-        register u_long laddr;
-        register char **pp;
-
-        /* Try for raw ip address first. */
-        if (isdigit(*lhost) && (long)(laddr = inet_addr(lhost)) != -1)
-                return (raddr == laddr);
-
-        /* Better be a hostname. */
-        if ((hp = gethostbyname(lhost)) == NULL)
-                return (0);
-
-        /* Spin through ip addresses. */
-        for (pp = hp->h_addr_list; *pp; ++pp)
-                if (!bcmp(&raddr, *pp, sizeof(u_long)))
-                        return (1);
-
-        /* No match. */
-        return (0);
-}
diff --git a/src/lib/libc/net/rcmdsh.3 b/src/lib/libc/net/rcmdsh.3
new file mode 100644
index 0000000000..f7de0808f5
--- /dev/null
+++ b/src/lib/libc/net/rcmdsh.3
@@ -0,0 +1,96 @@
+.\"     $OpenBSD: rcmdsh.3,v 1.13 2009/12/29 10:25:43 sobrado Exp $
+.\"
+.\" Copyright (c) 1983, 1991, 1993
+.\"     The Regents of the University of California.  All rights reserved.
+.\"
+.\" Redistribution and use in source and binary forms, with or without
+.\" modification, are permitted provided that the following conditions
+.\" are met:
+.\" 1. Redistributions of source code must retain the above copyright
+.\"    notice, this list of conditions and the following disclaimer.
+.\" 2. Redistributions in binary form must reproduce the above copyright
+.\"    notice, this list of conditions and the following disclaimer in the
+.\"    documentation and/or other materials provided with the distribution.
+.\" 3. Neither the name of the University nor the names of its contributors
+.\"    may be used to endorse or promote products derived from this software
+.\"    without specific prior written permission.
+.\"
+.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+.\" SUCH DAMAGE.
+.\"
+.Dd $Mdocdate: December 29 2009 $
+.Dt RCMDSH 3
+.Os
+.Sh NAME
+.Nm rcmdsh
+.Nd return a stream to a remote command without superuser
+.Sh SYNOPSIS
+.Fd #include <unistd.h>
+.Ft int
+.Fn rcmdsh "char **ahost" "int inport" "const char *locuser" "const char *remuser" "const char *cmd" "char *rshprog"
+.Sh DESCRIPTION
+The
+.Fn rcmdsh
+function is used by normal users to execute a command on a remote machine
+using an authentication scheme based on reserved port numbers using
+.Xr rsh 1
+or the value of
+.Fa rshprog
+(if non-null).
+.Fa rshprog
+may be a fully-qualified path, a non-qualified command, or a command containing
+space-separated command line arguments.
+.Pp
+The
+.Fn rcmdsh
+function looks up the host
+.Fa *ahost
+using
+.Xr gethostbyname 3 ,
+returning \-1 if the host does not exist.
+Otherwise
+.Fa *ahost
+is set to the standard name of the host and a connection is established to
+a server residing at the well-known Internet port
+.Li shell/tcp
+(or whatever port is used by
+.Fa rshprog ) .
+The parameter
+.Fa inport
+is ignored; it is only included to provide an interface similar to
+.Xr rcmd 3 .
+.Pp
+If the connection succeeds, a socket in the
+.Ux Ns -domain
+of type
+.Dv SOCK_STREAM
+is returned to the caller, and given to the remote
+command as stdin and stdout, and stderr.
+.Sh DIAGNOSTICS
+The
+.Fn rcmdsh
+function returns a valid socket descriptor on success.
+It returns \-1 on error and prints a diagnostic message on the standard error.
+.Sh SEE ALSO
+.Xr rsh 1 ,
+.Xr socketpair 2 ,
+.Xr rcmd 3 ,
+.Xr rshd 8
+.Sh HISTORY
+The
+.Fn rcmdsh
+function first appeared in
+.Ox 2.0 .
+.Sh BUGS
+If
+.Xr rsh 1
+encounters an error, a file descriptor is still returned instead of \-1.
diff --git a/src/lib/libc/net/rcmdsh.c b/src/lib/libc/net/rcmdsh.c
new file mode 100644
index 0000000000..a472162711
--- /dev/null
+++ b/src/lib/libc/net/rcmdsh.c
@@ -0,0 +1,186 @@
+/*      $OpenBSD: rcmdsh.c,v 1.12 2007/09/02 15:19:17 deraadt Exp $     */ 
+
+/*
+ * Copyright (c) 2001, MagniComp
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright 
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright 
+ *    notice, this list of conditions and the following disclaimer in 
+ *    the documentation and/or other materials provided with the distribution. 
+ * 3. Neither the name of the MagniComp nor the names of its contributors may
+ *    be used to endorse or promote products derived from this software
+ *    without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE FOR
+ * ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+ * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+ * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE
+ * USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/*
+ * This is an rcmd() replacement originally by 
+ * Chris Siebenmann <cks@utcc.utoronto.ca>.
+ */
+
+#include      <sys/types.h>
+#include      <sys/socket.h>
+#include      <sys/wait.h>
+#include      <signal.h>
+#include      <errno.h>
+#include      <netdb.h>
+#include      <stdio.h>
+#include      <stdlib.h>
+#include      <string.h>
+#include      <pwd.h>
+#include      <paths.h>
+#include      <unistd.h>
+
+/*
+ * This is a replacement rcmd() function that uses the rsh(1)
+ * program in place of a direct rcmd(3) function call so as to
+ * avoid having to be root.  Note that rport is ignored.
+ */
+/* ARGSUSED */
+int
+rcmdsh(char **ahost, int rport, const char *locuser, const char *remuser,
+    const char *cmd, char *rshprog)
+{
+        struct hostent *hp;
+        int sp[2];
+        pid_t cpid;
+        char *p;
+        struct passwd *pw;
+
+        /* What rsh/shell to use. */
+        if (rshprog == NULL)
+                rshprog = _PATH_RSH;
+
+        /* locuser must exist on this host. */
+        if ((pw = getpwnam(locuser)) == NULL) {
+                (void) fprintf(stderr, "rcmdsh: unknown user: %s\n", locuser);
+                return(-1);
+        }
+
+        /* Validate remote hostname. */
+        if (strcmp(*ahost, "localhost") != 0) {
+                if (((hp = gethostbyname2(*ahost, AF_INET)) == NULL) &&
+                    ((hp = gethostbyname2(*ahost, AF_INET6)) == NULL)) {
+                        herror(*ahost);
+                        return(-1);
+                }
+                *ahost = hp->h_name;
+        }
+
+        /* Get a socketpair we'll use for stdin and stdout. */
+        if (socketpair(AF_UNIX, SOCK_STREAM, PF_UNSPEC, sp) < 0) {
+                perror("rcmdsh: socketpair");
+                return(-1);
+        }
+
+        cpid = fork();
+        if (cpid < 0) {
+                perror("rcmdsh: fork failed");
+                return(-1);
+        } else if (cpid == 0) {
+                /*
+                 * Child.  We use sp[1] to be stdin/stdout, and close sp[0].
+                 */
+                (void) close(sp[0]);
+                if (dup2(sp[1], 0) < 0 || dup2(0, 1) < 0) {
+                        perror("rcmdsh: dup2 failed");
+                        _exit(255);
+                }
+                /* Fork again to lose parent. */
+                cpid = fork();
+                if (cpid < 0) {
+                        perror("rcmdsh: fork to lose parent failed");
+                        _exit(255);
+                }
+                if (cpid > 0)
+                        _exit(0);
+
+                /* In grandchild here.  Become local user for rshprog. */
+                if (setuid(pw->pw_uid)) {
+                        (void) fprintf(stderr, "rcmdsh: setuid(%u): %s\n",
+                                       pw->pw_uid, strerror(errno));
+                        _exit(255);
+                }
+
+                /*
+                 * If remote host is "localhost" and local and remote user
+                 * are the same, avoid running remote shell for efficiency.
+                 */
+                if (!strcmp(*ahost, "localhost") && !strcmp(locuser, remuser)) {
+                        char *argv[4];
+                        if (pw->pw_shell[0] == '\0')
+                                rshprog = _PATH_BSHELL;
+                        else
+                                rshprog = pw->pw_shell;
+                        p = strrchr(rshprog, '/');
+                        argv[0] = p ? p + 1 : rshprog;
+                        argv[1] = "-c";
+                        argv[2] = (char *)cmd;
+                        argv[3] = NULL;
+                        execvp(rshprog, argv);
+                } else if ((p = strchr(rshprog, ' ')) == NULL) {
+                        /* simple case */
+                        char *argv[6];
+                        p = strrchr(rshprog, '/');
+                        argv[0] = p ? p + 1 : rshprog;
+                        argv[1] = "-l";
+                        argv[2] = (char *)remuser;
+                        argv[3] = *ahost;
+                        argv[4] = (char *)cmd;
+                        argv[5] = NULL;
+                        execvp(rshprog, argv);
+                } else {
+                        /* must pull args out of rshprog and dyn alloc argv */
+                        char **argv, **ap;
+                        int n;
+                        for (n = 7; (p = strchr(++p, ' ')) != NULL; n++)
+                                continue;
+                        rshprog = strdup(rshprog);
+                        ap = argv = calloc(sizeof(char *), n);
+                        if (rshprog == NULL || argv == NULL) {
+                                perror("rcmdsh");
+                                _exit(255);
+                        }
+                        while ((p = strsep(&rshprog, " ")) != NULL) {
+                                if (*p == '\0')
+                                        continue;
+                                *ap++ = p;
+                        }
+                        if (ap != argv)         /* all spaces?!? */
+                                rshprog = argv[0];
+                        if ((p = strrchr(argv[0], '/')) != NULL)
+                                argv[0] = p + 1;
+                        *ap++ = "-l";
+                        *ap++ = (char *)remuser;
+                        *ap++ = *ahost;
+                        *ap++ = (char *)cmd;
+                        *ap++ = NULL;
+                        execvp(rshprog, argv);
+                }
+                (void) fprintf(stderr, "rcmdsh: execvp %s failed: %s\n",
+                               rshprog, strerror(errno));
+                _exit(255);
+        } else {
+                /* Parent. close sp[1], return sp[0]. */
+                (void) close(sp[1]);
+                /* Reap child. */
+                (void) wait(NULL);
+                return(sp[0]);
+        }
+        /* NOTREACHED */
+}
diff --git a/src/lib/libc/net/recv.c b/src/lib/libc/net/recv.c
index 44296378cb..6241cc6b12 100644
--- a/src/lib/libc/net/recv.c
+++ b/src/lib/libc/net/recv.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: recv.c,v 1.6 1995/02/25 06:20:54 cgd Exp $     */
-
+/*      $OpenBSD: recv.c,v 1.5 2005/08/06 20:30:03 espie Exp $ */
 /*
  * Copyright (c) 1988, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,24 +28,13 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)recv.c      8.2 (Berkeley) 2/21/94";
-#else
-static char rcsid[] = "$NetBSD: recv.c,v 1.6 1995/02/25 06:20:54 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <sys/socket.h>
 
 #include <stddef.h>
 
 ssize_t
-recv(s, buf, len, flags)
-        int s, flags;
-        size_t len;
-        void *buf;
+recv(int s, void *buf, size_t len, int flags)
 {
         return (recvfrom(s, buf, len, flags, NULL, 0));
 }
diff --git a/src/lib/libc/net/res_comp.c b/src/lib/libc/net/res_comp.c
index 9d7bbecdda..69a6ce0abb 100644
--- a/src/lib/libc/net/res_comp.c
+++ b/src/lib/libc/net/res_comp.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_comp.c,v 1.6 1995/02/25 06:20:55 cgd Exp $ */
+/*      $OpenBSD: res_comp.c,v 1.14 2008/04/16 22:35:23 deraadt Exp $   */
 
-/*-
+/*
+ * ++Copyright++ 1985, 1993
+ * -
  * Copyright (c) 1985, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,22 +51,19 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_comp.c  8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: res_comp.c,v 4.9.1.1 1993/05/02 22:43:03 vixie Rel ";
-#else
-static char rcsid[] = "$NetBSD: res_comp.c,v 1.6 1995/02/25 06:20:55 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
+#include <sys/types.h>
 #include <sys/param.h>
-#include <arpa/nameser.h>
 #include <netinet/in.h>
-#include <resolv.h>
+#include <arpa/nameser.h>
+
 #include <stdio.h>
+#include <resolv.h>
+#include <ctype.h>
+
+#include <unistd.h>
+#include <string.h>
 
-static int dn_find();
+static int dn_find(u_char *, u_char *, u_char **, u_char **);
 
 /*
  * Expand compressed domain name 'comp_dn' to full domain name.
@@ -77,23 +72,25 @@ static int dn_find();
  * 'exp_dn' is a pointer to a buffer of size 'length' for the result.
  * Return size of compressed name or -1 if there was an error.
  */
-dn_expand(msg, eomorig, comp_dn, exp_dn, length)
-        const u_char *msg, *eomorig, *comp_dn;
-        u_char *exp_dn;
-        int length;
+int
+dn_expand(const u_char *msg, const u_char *eomorig, const u_char *comp_dn,
+    char *exp_dn, int length)
 {
-        register u_char *cp, *dn;
-        register int n, c;
-        u_char *eom;
+        const u_char *cp;
+        char *dn;
+        int n, c;
+        char *eom;
         int len = -1, checked = 0;
 
         dn = exp_dn;
-        cp = (u_char *)comp_dn;
+        cp = comp_dn;
+        if (length > MAXHOSTNAMELEN-1)
+                length = MAXHOSTNAMELEN-1;
         eom = exp_dn + length;
         /*
          * fetch next label in domain name
          */
-        while (n = *cp++) {
+        while ((n = *cp++)) {
                 /*
                  * Check for indirection
                  */
@@ -108,23 +105,23 @@ dn_expand(msg, eomorig, comp_dn, exp_dn, length)
                                 return (-1);
                         checked += n + 1;
                         while (--n >= 0) {
-                                if ((c = *cp++) == '.') {
+                                if (((c = *cp++) == '.') || (c == '\\')) {
                                         if (dn + n + 2 >= eom)
                                                 return (-1);
                                         *dn++ = '\\';
                                 }
                                 *dn++ = c;
                                 if (cp >= eomorig)      /* out of range */
-                                        return(-1);
+                                        return (-1);
                         }
                         break;
 
                 case INDIR_MASK:
                         if (len < 0)
                                 len = cp - comp_dn + 1;
-                        cp = (u_char *)msg + (((n & 0x3f) << 8) | (*cp & 0xff));
+                        cp = msg + (((n & 0x3f) << 8) | (*cp & 0xff));
                         if (cp < msg || cp >= eomorig)  /* out of range */
-                                return(-1);
+                                return (-1);
                         checked += 2;
                         /*
                          * Check for loops in the compressed name;
@@ -157,19 +154,19 @@ dn_expand(msg, eomorig, comp_dn, exp_dn, length)
  * If 'dnptr' is NULL, we don't try to compress names. If 'lastdnptr'
  * is NULL, we don't update the list.
  */
-dn_comp(exp_dn, comp_dn, length, dnptrs, lastdnptr)
-        const u_char *exp_dn;
-        u_char *comp_dn, **dnptrs, **lastdnptr;
-        int length;
+int
+dn_comp(const char *exp_dn, u_char *comp_dn, int length, u_char **dnptrs,
+    u_char **lastdnptr)
 {
-        register u_char *cp, *dn;
-        register int c, l;
+        u_char *cp, *dn;
+        int c, l;
         u_char **cpp, **lpp, *sp, *eob;
         u_char *msg;
 
         dn = (u_char *)exp_dn;
         cp = comp_dn;
         eob = cp + length;
+        lpp = cpp = NULL;
         if (dnptrs != NULL) {
                 if ((msg = *dnptrs++) != NULL) {
                         for (cpp = dnptrs; *cpp != NULL; cpp++)
@@ -235,13 +232,13 @@ dn_comp(exp_dn, comp_dn, length, dnptrs, lastdnptr)
 /*
  * Skip over a compressed domain name. Return the size or -1.
  */
-__dn_skipname(comp_dn, eom)
-        const u_char *comp_dn, *eom;
+int
+__dn_skipname(const u_char *comp_dn, const u_char *eom)
 {
-        register u_char *cp;
-        register int n;
+        const u_char *cp;
+        int n;
 
-        cp = (u_char *)comp_dn;
+        cp = comp_dn;
         while (cp < eom && (n = *cp++)) {
                 /*
                  * check for indirection
@@ -259,10 +256,18 @@ __dn_skipname(comp_dn, eom)
                 break;
         }
         if (cp > eom)
-                return -1;
+                return (-1);
         return (cp - comp_dn);
 }
 
+static int
+mklower(int ch)
+{
+        if (isascii(ch) && isupper(ch))
+                return (tolower(ch));
+        return (ch);
+}
+
 /*
  * Search for expanded name from a list of previously compressed names.
  * Return the offset from msg if found or -1.
@@ -270,18 +275,16 @@ __dn_skipname(comp_dn, eom)
  * not the pointer to the start of the message.
  */
 static int
-dn_find(exp_dn, msg, dnptrs, lastdnptr)
-        u_char *exp_dn, *msg;
-        u_char **dnptrs, **lastdnptr;
+dn_find(u_char *exp_dn, u_char *msg, u_char **dnptrs, u_char **lastdnptr)
 {
-        register u_char *dn, *cp, **cpp;
-        register int n;
+        u_char *dn, *cp, **cpp;
+        int n;
         u_char *sp;
 
         for (cpp = dnptrs; cpp < lastdnptr; cpp++) {
                 dn = exp_dn;
                 sp = cp = *cpp;
-                while (n = *cp++) {
+                while ((n = *cp++)) {
                         /*
                          * check for indirection
                          */
@@ -292,7 +295,7 @@ dn_find(exp_dn, msg, dnptrs, lastdnptr)
                                                 goto next;
                                         if (*dn == '\\')
                                                 dn++;
-                                        if (*dn++ != *cp++)
+                                        if (mklower(*dn++) != mklower(*cp++))
                                                 goto next;
                                 }
                                 if ((n = *dn++) == '\0' && *cp == '\0')
@@ -301,11 +304,12 @@ dn_find(exp_dn, msg, dnptrs, lastdnptr)
                                         continue;
                                 goto next;
 
-                        default:        /* illegal type */
-                                return (-1);
-
                         case INDIR_MASK:        /* indirection */
                                 cp = msg + (((n & 0x3f) << 8) | *cp);
+                                break;
+
+                        default:        /* illegal type */
+                                return (-1);
                         }
                 }
                 if (*dn == '\0')
@@ -316,49 +320,156 @@ dn_find(exp_dn, msg, dnptrs, lastdnptr)
 }
 
 /*
- * Routines to insert/extract short/long's. Must account for byte
- * order and non-alignment problems. This code at least has the
- * advantage of being portable.
- *
- * used by sendmail.
+ * Verify that a domain name uses an acceptable character set.
+ */
+
+/*
+ * Note the conspicuous absence of ctype macros in these definitions.  On
+ * non-ASCII hosts, we can't depend on string literals or ctype macros to
+ * tell us anything about network-format data.  The rest of the BIND system
+ * is not careful about this, but for some reason, we're doing it right here.
+ */
+#define PERIOD 0x2e
+#define hyphenchar(c) ((c) == 0x2d)
+#define bslashchar(c) ((c) == 0x5c)
+#define underscorechar(c) ((c) == 0x5f)
+#define periodchar(c) ((c) == PERIOD)
+#define asterchar(c) ((c) == 0x2a)
+#define alphachar(c) (((c) >= 0x41 && (c) <= 0x5a) \
+                   || ((c) >= 0x61 && (c) <= 0x7a))
+#define digitchar(c) ((c) >= 0x30 && (c) <= 0x39)
+
+#define borderchar(c) (alphachar(c) || digitchar(c))
+#define middlechar(c) (borderchar(c) || hyphenchar(c) || underscorechar(c))
+#define domainchar(c) ((c) > 0x20 && (c) < 0x7f)
+
+int
+res_hnok(const char *dn)
+{
+        int pch = PERIOD, ch = *dn++;
+
+        while (ch != '\0') {
+                int nch = *dn++;
+
+                if (periodchar(ch)) {
+                        ;
+                } else if (periodchar(pch)) {
+                        if (!borderchar(ch))
+                                return (0);
+                } else if (periodchar(nch) || nch == '\0') {
+                        if (!borderchar(ch))
+                                return (0);
+                } else {
+                        if (!middlechar(ch))
+                                return (0);
+                }
+                pch = ch, ch = nch;
+        }
+        return (1);
+}
+
+/*
+ * hostname-like (A, MX, WKS) owners can have "*" as their first label
+ * but must otherwise be as a host name.
  */
+int
+res_ownok(const char *dn)
+{
+        if (asterchar(dn[0])) {
+                if (periodchar(dn[1]))
+                        return (res_hnok(dn+2));
+                if (dn[1] == '\0')
+                        return (1);
+        }
+        return (res_hnok(dn));
+}
 
-u_short
-_getshort(msgp)
-        register u_char *msgp;
+/*
+ * SOA RNAMEs and RP RNAMEs can have any printable character in their first
+ * label, but the rest of the name has to look like a host name.
+ */
+int
+res_mailok(const char *dn)
 {
-        register u_int16_t u;
+        int ch, escaped = 0;
+
+        /* "." is a valid missing representation */
+        if (*dn == '\0')
+                return(1);
+
+        /* otherwise <label>.<hostname> */
+        while ((ch = *dn++) != '\0') {
+                if (!domainchar(ch))
+                        return (0);
+                if (!escaped && periodchar(ch))
+                        break;
+                if (escaped)
+                        escaped = 0;
+                else if (bslashchar(ch))
+                        escaped = 1;
+        }
+        if (periodchar(ch))
+                return (res_hnok(dn));
+        return(0);
+}
+
+/*
+ * This function is quite liberal, since RFC 1034's character sets are only
+ * recommendations.
+ */
+int
+res_dnok(const char *dn)
+{
+        int ch;
+
+        while ((ch = *dn++) != '\0')
+                if (!domainchar(ch))
+                        return (0);
+        return (1);
+}
+
+/*
+ * Routines to insert/extract short/long's.
+ */
+
+u_int16_t
+_getshort(const u_char *msgp)
+{
+        u_int16_t u;
 
         GETSHORT(u, msgp);
         return (u);
 }
 
+#ifdef NeXT
+/*
+ * nExt machines have some funky library conventions, which we must maintain.
+ */
+u_int16_t
+res_getshort(msgp)
+        const u_char *msgp;
+{
+        return (_getshort(msgp));
+}
+#endif
+
 u_int32_t
-_getlong(msgp)
-        register u_char *msgp;
+_getlong(const u_char *msgp)
 {
-        register u_int32_t u;
+        u_int32_t u;
 
         GETLONG(u, msgp);
         return (u);
 }
 
 void
-#if defined(__STDC__) || defined(__cplusplus)
-__putshort(register u_int16_t s, register u_char *msgp)
-#else
-__putshort(s, msgp)
-        register u_int16_t s;
-        register u_char *msgp;
-#endif
+__putshort(u_int16_t s, u_char *msgp)
 {
         PUTSHORT(s, msgp);
 }
 
 void
-__putlong(l, msgp)
-        register u_int32_t l;
-        register u_char *msgp;
+__putlong(u_int32_t l, u_char *msgp)
 {
         PUTLONG(l, msgp);
 }
diff --git a/src/lib/libc/net/res_data.c b/src/lib/libc/net/res_data.c
new file mode 100644
index 0000000000..a5f6b03a7f
--- /dev/null
+++ b/src/lib/libc/net/res_data.c
@@ -0,0 +1,105 @@
+/*      $OpenBSD: res_data.c,v 1.3 2005/08/06 20:30:03 espie Exp $      */
+
+/*
+ * ++Copyright++ 1995
+ * -
+ * Copyright (c) 1995
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * -
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * -
+ * --Copyright--
+ */
+
+#include <sys/types.h>
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/time.h>
+#include <netinet/in.h>
+#include <arpa/inet.h>
+#include <arpa/nameser.h>
+
+#include <stdio.h>
+#include <ctype.h>
+#include <resolv.h>
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+
+const char *_res_opcodes[] = {
+        "QUERY",
+        "IQUERY",
+        "CQUERYM",
+        "CQUERYU",      /* experimental */
+        "NOTIFY",       /* experimental */
+        "5",
+        "6",
+        "7",
+        "8",
+        "UPDATEA",
+        "UPDATED",
+        "UPDATEDA",
+        "UPDATEM",
+        "UPDATEMA",
+        "ZONEINIT",
+        "ZONEREF",
+};
+
+const char *_res_resultcodes[] = {
+        "NOERROR",
+        "FORMERR",
+        "SERVFAIL",
+        "NXDOMAIN",
+        "NOTIMP",
+        "REFUSED",
+        "6",
+        "7",
+        "8",
+        "9",
+        "10",
+        "11",
+        "12",
+        "13",
+        "14",
+        "NOCHANGE",
+};
diff --git a/src/lib/libc/net/res_debug.c b/src/lib/libc/net/res_debug.c
index d841293f18..246fefef3c 100644
--- a/src/lib/libc/net/res_debug.c
+++ b/src/lib/libc/net/res_debug.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_debug.c,v 1.7 1995/02/25 06:20:56 cgd Exp $        */
+/*      $OpenBSD: res_debug.c,v 1.22 2007/10/11 18:36:41 jakob Exp $    */
 
-/*-
+/*
+ * ++Copyright++ 1985, 1990, 1993
+ * -
  * Copyright (c) 1985, 1990, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,11 +14,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  * 
@@ -50,174 +48,179 @@
  * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
  * SOFTWARE.
  * -
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_debug.c 8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: res_debug.c,v 1.7 1995/02/25 06:20:56 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
+
+#include <ctype.h>
+#include <netdb.h>
 #include <resolv.h>
 #include <stdio.h>
+#include <time.h>
+
+#include <stdlib.h>
 #include <string.h>
 
-void __fp_query();
-char *__p_class(), *__p_time(), *__p_type();
-char *p_cdname(), *p_fqname(), *p_rr();
-static char *p_option __P((u_int32_t));
-
-char *_res_opcodes[] = {
-        "QUERY",
-        "IQUERY",
-        "CQUERYM",
-        "CQUERYU",
-        "4",
-        "5",
-        "6",
-        "7",
-        "8",
-        "UPDATEA",
-        "UPDATED",
-        "UPDATEDA",
-        "UPDATEM",
-        "UPDATEMA",
-        "ZONEINIT",
-        "ZONEREF",
-};
-
-char *_res_resultcodes[] = {
-        "NOERROR",
-        "FORMERR",
-        "SERVFAIL",
-        "NXDOMAIN",
-        "NOTIMP",
-        "REFUSED",
-        "6",
-        "7",
-        "8",
-        "9",
-        "10",
-        "11",
-        "12",
-        "13",
-        "14",
-        "NOCHANGE",
-};
-
-static char retbuf[16];
-
-static char *
-dewks(wks)
-        int wks;
+#include "thread_private.h"
+
+extern const char *_res_opcodes[];
+extern const char *_res_resultcodes[];
+
+static const char *loc_ntoal(const u_char *binary, char *ascii, int ascii_len);
+
+/* XXX: we should use getservbyport() instead. */
+static const char *
+dewks(int wks)
 {
+        static char nbuf[20];
+
         switch (wks) {
-        case 5: return("rje");
-        case 7: return("echo");
-        case 9: return("discard");
-        case 11: return("systat");
-        case 13: return("daytime");
-        case 15: return("netstat");
-        case 17: return("qotd");
-        case 19: return("chargen");
-        case 20: return("ftp-data");
-        case 21: return("ftp");
-        case 23: return("telnet");
-        case 25: return("smtp");
-        case 37: return("time");
-        case 39: return("rlp");
-        case 42: return("name");
-        case 43: return("whois");
-        case 53: return("domain");
-        case 57: return("apts");
-        case 59: return("apfs");
-        case 67: return("bootps");
-        case 68: return("bootpc");
-        case 69: return("tftp");
-        case 77: return("rje");
-        case 79: return("finger");
-        case 87: return("link");
-        case 95: return("supdup");
-        case 100: return("newacct");
-        case 101: return("hostnames");
-        case 102: return("iso-tsap");
-        case 103: return("x400");
-        case 104: return("x400-snd");
-        case 105: return("csnet-ns");
-        case 109: return("pop-2");
-        case 111: return("sunrpc");
-        case 113: return("auth");
-        case 115: return("sftp");
-        case 117: return("uucp-path");
-        case 119: return("nntp");
-        case 121: return("erpc");
-        case 123: return("ntp");
-        case 133: return("statsrv");
-        case 136: return("profile");
-        case 144: return("NeWS");
-        case 161: return("snmp");
-        case 162: return("snmp-trap");
-        case 170: return("print-srv");
-        default: (void) sprintf(retbuf, "%d", wks); return(retbuf);
+        case 5: return "rje";
+        case 7: return "echo";
+        case 9: return "discard";
+        case 11: return "systat";
+        case 13: return "daytime";
+        case 15: return "netstat";
+        case 17: return "qotd";
+        case 19: return "chargen";
+        case 20: return "ftp-data";
+        case 21: return "ftp";
+        case 23: return "telnet";
+        case 25: return "smtp";
+        case 37: return "time";
+        case 39: return "rlp";
+        case 42: return "name";
+        case 43: return "whois";
+        case 53: return "domain";
+        case 57: return "apts";
+        case 59: return "apfs";
+        case 67: return "bootps";
+        case 68: return "bootpc";
+        case 69: return "tftp";
+        case 77: return "rje";
+        case 79: return "finger";
+        case 87: return "link";
+        case 95: return "supdup";
+        case 100: return "newacct";
+        case 101: return "hostnames";
+        case 102: return "iso-tsap";
+        case 103: return "x400";
+        case 104: return "x400-snd";
+        case 105: return "csnet-ns";
+        case 109: return "pop-2";
+        case 111: return "sunrpc";
+        case 113: return "auth";
+        case 115: return "sftp";
+        case 117: return "uucp-path";
+        case 119: return "nntp";
+        case 121: return "erpc";
+        case 123: return "ntp";
+        case 133: return "statsrv";
+        case 136: return "profile";
+        case 144: return "NeWS";
+        case 161: return "snmp";
+        case 162: return "snmp-trap";
+        case 170: return "print-srv";
+        default:
+                (void) snprintf(nbuf, sizeof nbuf, "%d", wks);
+                return (nbuf);
         }
 }
 
-static char *
-deproto(protonum)
-        int protonum;
+/* XXX: we should use getprotobynumber() instead. */
+static const char *
+deproto(int protonum)
 {
+        static char nbuf[20];
+
         switch (protonum) {
-        case 1: return("icmp");
-        case 2: return("igmp");
-        case 3: return("ggp");
-        case 5: return("st");
-        case 6: return("tcp");
-        case 7: return("ucl");
-        case 8: return("egp");
-        case 9: return("igp");
-        case 11: return("nvp-II");
-        case 12: return("pup");
-        case 16: return("chaos");
-        case 17: return("udp");
-        default: (void) sprintf(retbuf, "%d", protonum); return(retbuf);
+        case 1: return "icmp";
+        case 2: return "igmp";
+        case 3: return "ggp";
+        case 5: return "st";
+        case 6: return "tcp";
+        case 7: return "ucl";
+        case 8: return "egp";
+        case 9: return "igp";
+        case 11: return "nvp-II";
+        case 12: return "pup";
+        case 16: return "chaos";
+        case 17: return "udp";
+        default:
+                (void) snprintf(nbuf, sizeof nbuf, "%d", protonum);
+                return (nbuf);
         }
 }
 
-static char *
-do_rrset(msg, cp, cnt, pflag, file, hs)
-        int cnt, pflag;
-        char *cp,*msg, *hs;
-        FILE *file;
+static const u_char *
+do_rrset(const u_char *msg, int len, const u_char *cp, int cnt, int pflag,
+    FILE *file, const char *hs)
 {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
         int n;
         int sflag;
+
         /*
-         * Print  answer records
+         * Print answer records.
          */
-        sflag = (_res.pfcode & pflag);
-        if (n = ntohs(cnt)) {
-                if ((!_res.pfcode) || ((sflag) && (_res.pfcode & RES_PRF_HEAD1)))
-                        fprintf(file, hs);
+        sflag = (_resp->pfcode & pflag);
+        if ((n = ntohs(cnt))) {
+                if ((!_resp->pfcode) ||
+                    ((sflag) && (_resp->pfcode & RES_PRF_HEAD1)))
+                        fprintf(file, "%s", hs);
                 while (--n >= 0) {
-                        cp = p_rr(cp, msg, file);
-                        if ((cp-msg) > PACKETSZ)
+                        if ((!_resp->pfcode) || sflag) {
+                                cp = p_rr(cp, msg, file);
+                        } else {
+                                unsigned int dlen;
+                                cp += __dn_skipname(cp, cp + MAXCDNAME);
+                                cp += INT16SZ;
+                                cp += INT16SZ;
+                                cp += INT32SZ;
+                                dlen = _getshort((u_char*)cp);
+                                cp += INT16SZ;
+                                cp += dlen;
+                        }
+                        if ((cp - msg) > len)
                                 return (NULL);
                 }
-                if ((!_res.pfcode) || ((sflag) && (_res.pfcode & RES_PRF_HEAD1)))
+                if ((!_resp->pfcode) ||
+                    ((sflag) && (_resp->pfcode & RES_PRF_HEAD1)))
                         putc('\n', file);
         }
-        return(cp);
+        return (cp);
 }
 
-__p_query(msg)
-        char *msg;
+void
+__p_query(const u_char *msg)
 {
         __fp_query(msg, stdout);
 }
@@ -227,19 +230,16 @@ __p_query(msg)
  * This is intended to be primarily a debugging routine.
  */
 void
-__fp_resstat(statp, file)
-        struct __res_state *statp;
-        FILE *file;
+__fp_resstat(struct __res_state *statp, FILE *file)
 {
-        int bit;
+        u_long mask;
 
         fprintf(file, ";; res options:");
         if (!statp)
                 statp = &_res;
-        for (bit = 0;  bit < 32;  bit++) {      /* XXX 32 - bad assumption! */
-                if (statp->options & (1<<bit))
-                        fprintf(file, " %s", p_option(1<<bit));
-        }
+        for (mask = 1;  mask != 0;  mask <<= 1)
+                if (statp->options & mask)
+                        fprintf(file, " %s", p_option(mask));
         putc('\n', file);
 }
 
@@ -248,109 +248,144 @@ __fp_resstat(statp, file)
  * This is intended to be primarily a debugging routine.
  */
 void
-__fp_query(msg,file)
-        char *msg;
-        FILE *file;
+__fp_nquery(const u_char *msg, int len, FILE *file)
 {
-        register char *cp;
-        register HEADER *hp;
-        register int n;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        const u_char *cp, *endMark;
+        const HEADER *hp;
+        int n;
+
+        if (_res_init(0) == -1)
+                return;
+
+#define TruncTest(x) if (x > endMark) goto trunc
+#define ErrorTest(x) if (x == NULL) goto error
 
         /*
          * Print header fields.
          */
         hp = (HEADER *)msg;
-        cp = msg + sizeof(HEADER);
-        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_HEADX) || hp->rcode) {
-                fprintf(file,";; ->>HEADER<<- opcode: %s, status: %s, id: %d",
+        cp = msg + HFIXEDSZ;
+        endMark = msg + len;
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_HEADX) || hp->rcode) {
+                fprintf(file, ";; ->>HEADER<<- opcode: %s, status: %s, id: %u",
                         _res_opcodes[hp->opcode],
                         _res_resultcodes[hp->rcode],
                         ntohs(hp->id));
                 putc('\n', file);
         }
-        putc(';', file);
-        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_HEAD2)) {
-                fprintf(file,"; flags:");
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_HEADX))
+                putc(';', file);
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_HEAD2)) {
+                fprintf(file, "; flags:");
                 if (hp->qr)
-                        fprintf(file," qr");
+                        fprintf(file, " qr");
                 if (hp->aa)
-                        fprintf(file," aa");
+                        fprintf(file, " aa");
                 if (hp->tc)
-                        fprintf(file," tc");
+                        fprintf(file, " tc");
                 if (hp->rd)
-                        fprintf(file," rd");
+                        fprintf(file, " rd");
                 if (hp->ra)
-                        fprintf(file," ra");
-                if (hp->pr)
-                        fprintf(file," pr");
+                        fprintf(file, " ra");
+                if (hp->unused)
+                        fprintf(file, " UNUSED-BIT-ON");
+                if (hp->ad)
+                        fprintf(file, " ad");
+                if (hp->cd)
+                        fprintf(file, " cd");
         }
-        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_HEAD1)) {
-                fprintf(file,"; Ques: %d", ntohs(hp->qdcount));
-                fprintf(file,", Ans: %d", ntohs(hp->ancount));
-                fprintf(file,", Auth: %d", ntohs(hp->nscount));
-                fprintf(file,", Addit: %d\n", ntohs(hp->arcount));
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_HEAD1)) {
+                fprintf(file, "; Ques: %u", ntohs(hp->qdcount));
+                fprintf(file, ", Ans: %u", ntohs(hp->ancount));
+                fprintf(file, ", Auth: %u", ntohs(hp->nscount));
+                fprintf(file, ", Addit: %u", ntohs(hp->arcount));
         }
-#if 0
-        if (_res.pfcode & (RES_PRF_HEADX | RES_PRF_HEAD2 | RES_PRF_HEAD1)) {
+        if ((!_resp->pfcode) || (_resp->pfcode & 
+                (RES_PRF_HEADX | RES_PRF_HEAD2 | RES_PRF_HEAD1))) {
                 putc('\n',file);
         }
-#endif
         /*
          * Print question records.
          */
-        if (n = ntohs(hp->qdcount)) {
-                if ((!_res.pfcode) || (_res.pfcode & RES_PRF_QUES))
-                        fprintf(file,";; QUESTIONS:\n");
+        if ((n = ntohs(hp->qdcount))) {
+                if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
+                        fprintf(file, ";; QUESTIONS:\n");
                 while (--n >= 0) {
-                        fprintf(file,";;\t");
-                        cp = p_cdname(cp, msg, file);
-                        if (cp == NULL)
-                                return;
-                        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_QUES))
+                        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
+                                fprintf(file, ";;\t");
+                        TruncTest(cp);
+                        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
+                                cp = p_cdnname(cp, msg, len, file);
+                        else {
+                                int n;
+                                char name[MAXDNAME];
+
+                                if ((n = dn_expand(msg, msg+len, cp, name,
+                                                sizeof name)) < 0)
+                                        cp = NULL;
+                                else
+                                        cp += n;
+                        }
+                        ErrorTest(cp);
+                        TruncTest(cp);
+                        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
                                 fprintf(file, ", type = %s",
-                                        __p_type(_getshort(cp)));
-                        cp += sizeof(u_int16_t);
-                        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_QUES))
-                                fprintf(file, ", class = %s\n\n",
-                                        __p_class(_getshort(cp)));
-                        cp += sizeof(u_int16_t);
+                                        __p_type(_getshort((u_char*)cp)));
+                        cp += INT16SZ;
+                        TruncTest(cp);
+                        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
+                                fprintf(file, ", class = %s\n",
+                                        __p_class(_getshort((u_char*)cp)));
+                        cp += INT16SZ;
+                        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_QUES))
+                                putc('\n', file);
                 }
         }
         /*
          * Print authoritative answer records
          */
-        cp = do_rrset(msg, cp, hp->ancount, RES_PRF_ANS, file,
+        TruncTest(cp);
+        cp = do_rrset(msg, len, cp, hp->ancount, RES_PRF_ANS, file,
                       ";; ANSWERS:\n");
-        if (cp == NULL)
-                return;
+        ErrorTest(cp);
 
         /*
          * print name server records
          */
-        cp = do_rrset(msg, cp, hp->nscount, RES_PRF_AUTH, file,
+        TruncTest(cp);
+        cp = do_rrset(msg, len, cp, hp->nscount, RES_PRF_AUTH, file,
                       ";; AUTHORITY RECORDS:\n");
-        if (!cp)
-                return;
+        ErrorTest(cp);
 
+        TruncTest(cp);
         /*
          * print additional records
          */
-        cp = do_rrset(msg, cp, hp->arcount, RES_PRF_ADD, file,
+        cp = do_rrset(msg, len, cp, hp->arcount, RES_PRF_ADD, file,
                       ";; ADDITIONAL RECORDS:\n");
-        if (!cp)
-                return;
+        ErrorTest(cp);
+        return;
+ trunc:
+        fprintf(file, "\n;; ...truncated\n");
+        return;
+ error:
+        fprintf(file, "\n;; ...malformed\n");
 }
 
-char *
-p_cdname(cp, msg, file)
-        char *cp, *msg;
-        FILE *file;
+void
+__fp_query(const u_char *msg, FILE *file)
+{
+        fp_nquery(msg, PACKETSZ, file);
+}
+
+const u_char *
+__p_cdnname(const u_char *cp, const u_char *msg, int len, FILE *file)
 {
         char name[MAXDNAME];
         int n;
 
-        if ((n = dn_expand((u_char *)msg, (u_char *)cp + MAXCDNAME,
-            (u_char *)cp, (u_char *)name, sizeof(name))) < 0)
+        if ((n = dn_expand(msg, msg + len, cp, name, sizeof name)) < 0)
                 return (NULL);
         if (name[0] == '\0')
                 putc('.', file);
@@ -359,55 +394,86 @@ p_cdname(cp, msg, file)
         return (cp + n);
 }
 
-char *
-p_fqname(cp, msg, file)
-        char *cp, *msg;
-        FILE *file;
+const u_char *
+__p_cdname(const u_char *cp, const u_char *msg, FILE *file)
 {
-        char name[MAXDNAME];
-        int n, len;
+        return (p_cdnname(cp, msg, PACKETSZ, file));
+}
+
+
+/* Return a fully-qualified domain name from a compressed name (with
+   length supplied).  */
+
+const u_char *
+__p_fqnname(const u_char *cp, const u_char *msg, int msglen, char *name, int namelen)
+{
+        int n, newlen;
 
-        if ((n = dn_expand((u_char *)msg, (u_char *)cp + MAXCDNAME,
-            (u_char *)cp, (u_char *)name, sizeof(name))) < 0)
+        if ((n = dn_expand(msg, cp + msglen, cp, name, namelen)) < 0)
                 return (NULL);
-        if (name[0] == '\0') {
-                putc('.', file);
-        } else {
-                fputs(name, file);
-                if (name[strlen(name) - 1] != '.')
-                        putc('.', file);
+        newlen = strlen(name);
+        if (newlen == 0 || name[newlen - 1] != '.') {
+                if (newlen + 1 >= namelen)      /* Lack space for final dot */
+                        return (NULL);
+                else
+                        strlcpy(name + newlen, ".", namelen - newlen);
         }
         return (cp + n);
 }
 
+/* XXX: the rest of these functions need to become length-limited, too. (vix)
+ */
+
+const u_char *
+__p_fqname(const u_char *cp, const u_char *msg, FILE *file)
+{
+        char name[MAXDNAME];
+        const u_char *n;
+
+        n = __p_fqnname(cp, msg, MAXCDNAME, name, sizeof name);
+        if (n == NULL)
+                return (NULL);
+        fputs(name, file);
+        return (n);
+}
+
 /*
  * Print resource record fields in human readable form.
  */
-char *
-p_rr(cp, msg, file)
-        char *cp, *msg;
-        FILE *file;
+const u_char *
+__p_rr(const u_char *cp, const u_char *msg, FILE *file)
 {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
         int type, class, dlen, n, c;
         struct in_addr inaddr;
-        char *cp1, *cp2;
+        const u_char *cp1, *cp2;
         u_int32_t tmpttl, t;
         int lcnt;
+        u_int16_t keyflags;
+        char rrname[MAXDNAME];          /* The fqdn of this RR */
+        char base64_key[MAX_KEY_BASE64];
 
-        if ((cp = p_fqname(cp, msg, file)) == NULL)
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                return (NULL);
+        }
+        cp = __p_fqnname(cp, msg, MAXCDNAME, rrname, sizeof rrname);
+        if (!cp)
                 return (NULL);                  /* compression error */
-        type = _getshort(cp);
-        cp += sizeof(u_int16_t);
-        class = _getshort(cp);
-        cp += sizeof(u_int16_t);
-        tmpttl = _getlong(cp);
-        cp += sizeof(u_int32_t);
-        dlen = _getshort(cp);
-        cp += sizeof(u_int16_t);
+        fputs(rrname, file);
+        
+        type = _getshort((u_char*)cp);
+        cp += INT16SZ;
+        class = _getshort((u_char*)cp);
+        cp += INT16SZ;
+        tmpttl = _getlong((u_char*)cp);
+        cp += INT32SZ;
+        dlen = _getshort((u_char*)cp);
+        cp += INT16SZ;
         cp1 = cp;
-        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_TTLID))
-                fprintf(file, "\t%lu", tmpttl);
-        if ((!_res.pfcode) || (_res.pfcode & RES_PRF_CLASS))
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_TTLID))
+                fprintf(file, "\t%lu", (u_long)tmpttl);
+        if ((!_resp->pfcode) || (_resp->pfcode & RES_PRF_CLASS))
                 fprintf(file, "\t%s", __p_class(class));
         fprintf(file, "\t%s", __p_type(type));
         /*
@@ -418,22 +484,22 @@ p_rr(cp, msg, file)
                 switch (class) {
                 case C_IN:
                 case C_HS:
-                        bcopy(cp, (char *)&inaddr, sizeof(inaddr));
+                        bcopy(cp, (char *)&inaddr, INADDRSZ);
                         if (dlen == 4) {
-                                fprintf(file,"\t%s", inet_ntoa(inaddr));
+                                fprintf(file, "\t%s", inet_ntoa(inaddr));
                                 cp += dlen;
                         } else if (dlen == 7) {
                                 char *address;
                                 u_char protocol;
-                                u_short port;
+                                in_port_t port;
 
                                 address = inet_ntoa(inaddr);
-                                cp += sizeof(inaddr);
+                                cp += INADDRSZ;
                                 protocol = *(u_char*)cp;
-                                cp += sizeof(u_char);
-                                port = _getshort(cp);
-                                cp += sizeof(u_int16_t);
-                                fprintf(file, "\t%s\t; proto %d, port %d",
+                                cp += sizeof (u_char);
+                                port = _getshort((u_char*)cp);
+                                cp += INT16SZ;
+                                fprintf(file, "\t%s\t; proto %u, port %u",
                                         address, protocol, port);
                         }
                         break;
@@ -448,98 +514,205 @@ p_rr(cp, msg, file)
         case T_NS:
         case T_PTR:
                 putc('\t', file);
-                cp = p_fqname(cp, msg, file);
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 break;
 
         case T_HINFO:
-                if (n = *cp++) {
-                        fprintf(file,"\t%.*s", n, cp);
-                        cp += n;
+        case T_ISDN:
+                cp2 = cp + dlen;
+                (void) fputs("\t\"", file);
+                if ((n = (unsigned char) *cp++) != 0) {
+                        for (c = n; c > 0 && cp < cp2; c--) {
+                                if (strchr("\n\"\\", *cp))
+                                        (void) putc('\\', file);
+                                (void) putc(*cp++, file);
+                        }
                 }
-                if (n = *cp++) {
-                        fprintf(file,"\t%.*s", n, cp);
-                        cp += n;
+                putc('"', file);
+                if (cp < cp2 && (n = (unsigned char) *cp++) != 0) {
+                        (void) fputs ("\t\"", file);
+                        for (c = n; c > 0 && cp < cp2; c--) {
+                                if (strchr("\n\"\\", *cp))
+                                        (void) putc('\\', file);
+                                (void) putc(*cp++, file);
+                        }
+                        putc('"', file);
+                } else if (type == T_HINFO) {
+                        (void) fputs("\"?\"", file);
+                        fprintf(file, "\n;; *** Warning *** OS-type missing");
                 }
                 break;
 
         case T_SOA:
                 putc('\t', file);
-                cp = p_fqname(cp, msg, file);   /* origin */
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 putc(' ', file);
-                cp = p_fqname(cp, msg, file);   /* mail addr */
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 fputs(" (\n", file);
-                t = _getlong(cp);  cp += sizeof(u_int32_t);
-                fprintf(file,"\t\t\t%lu\t; serial\n", t);
-                t = _getlong(cp);  cp += sizeof(u_int32_t);
-                fprintf(file,"\t\t\t%lu\t; refresh (%s)\n", t, __p_time(t));
-                t = _getlong(cp);  cp += sizeof(u_int32_t);
-                fprintf(file,"\t\t\t%lu\t; retry (%s)\n", t, __p_time(t));
-                t = _getlong(cp);  cp += sizeof(u_int32_t);
-                fprintf(file,"\t\t\t%lu\t; expire (%s)\n", t, __p_time(t));
-                t = _getlong(cp);  cp += sizeof(u_int32_t);
-                fprintf(file,"\t\t\t%lu )\t; minimum (%s)", t, __p_time(t));
+                t = _getlong((u_char*)cp);  cp += INT32SZ;
+                fprintf(file, "\t\t\t%lu\t; serial\n", (u_long)t);
+                t = _getlong((u_char*)cp);  cp += INT32SZ;
+                fprintf(file, "\t\t\t%lu\t; refresh (%s)\n",
+                        (u_long)t, __p_time(t));
+                t = _getlong((u_char*)cp);  cp += INT32SZ;
+                fprintf(file, "\t\t\t%lu\t; retry (%s)\n",
+                        (u_long)t, __p_time(t));
+                t = _getlong((u_char*)cp);  cp += INT32SZ;
+                fprintf(file, "\t\t\t%lu\t; expire (%s)\n",
+                        (u_long)t, __p_time(t));
+                t = _getlong((u_char*)cp);  cp += INT32SZ;
+                fprintf(file, "\t\t\t%lu )\t; minimum (%s)",
+                        (u_long)t, __p_time(t));
                 break;
 
         case T_MX:
         case T_AFSDB:
-                fprintf(file,"\t%d ", _getshort(cp));
-                cp += sizeof(u_int16_t);
-                cp = p_fqname(cp, msg, file);
+        case T_RT:
+                fprintf(file, "\t%u ", _getshort((u_char*)cp));
+                cp += INT16SZ;
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 break;
 
-        case T_TXT:
+        case T_PX:
+                fprintf(file, "\t%u ", _getshort((u_char*)cp));
+                cp += INT16SZ;
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
+                putc(' ', file);
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
+                break;
+
+        case T_X25:
+                cp2 = cp + dlen;
                 (void) fputs("\t\"", file);
+                if ((n = (unsigned char) *cp++) != 0) {
+                        for (c = n; c > 0 && cp < cp2; c--) {
+                                if (strchr("\n\"\\", *cp))
+                                        (void) putc('\\', file);
+                                (void) putc(*cp++, file);
+                        }
+                }
+                putc('"', file);
+                break;
+
+        case T_TXT:
+                (void) putc('\t', file);
                 cp2 = cp1 + dlen;
                 while (cp < cp2) {
-                        if (n = (unsigned char) *cp++) {
-                                for (c = n; c > 0 && cp < cp2; c--)
-                                        if (*cp == '\n') {
-                                            (void) putc('\\', file);
-                                            (void) putc(*cp++, file);
-                                        } else
-                                            (void) putc(*cp++, file);
+                        putc('"', file);
+                        if ((n = (unsigned char) *cp++)) {
+                                for (c = n; c > 0 && cp < cp2; c--) {
+                                        if (strchr("\n\"\\", *cp))
+                                                (void) putc('\\', file);
+                                        (void) putc(*cp++, file);
+                                }
                         }
+                        putc('"', file);
+                        if (cp < cp2)
+                                putc(' ', file);
                 }
-                putc('"', file);
-                break;
+                break;
+
+        case T_NSAP:
+                (void) fprintf(file, "\t%s", inet_nsap_ntoa(dlen, cp, NULL));
+                cp += dlen;
+                break;
+
+        case T_AAAA: {
+                char t[sizeof "ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255"];
+
+                fprintf(file, "\t%s", inet_ntop(AF_INET6, cp, t, sizeof t));
+                cp += dlen;
+                break;
+            }
+
+        case T_LOC: {
+                char t[255];
+
+                fprintf(file, "\t%s", loc_ntoal(cp, t, sizeof t));
+                cp += dlen;
+                break;
+            }
+
+        case T_NAPTR: {
+                u_int order, preference;
+
+                order = _getshort(cp);  cp += INT16SZ;
+                preference   = _getshort(cp);  cp += INT16SZ;
+                fprintf(file, "\t%u %u ",order, preference);
+                /* Flags */
+                n = *cp++;
+                fprintf(file,"\"%.*s\" ", (int)n, cp);
+                cp += n;
+                /* Service */
+                n = *cp++;
+                fprintf(file,"\"%.*s\" ", (int)n, cp);
+                cp += n;
+                /* Regexp */
+                n = *cp++;
+                fprintf(file,"\"%.*s\" ", (int)n, cp);
+                cp += n;
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
+                break;
+            }
+
+        case T_SRV: {
+                u_int priority, weight, port;
+
+                priority = _getshort(cp);  cp += INT16SZ;
+                weight   = _getshort(cp);  cp += INT16SZ;
+                port     = _getshort(cp);  cp += INT16SZ;
+                fprintf(file, "\t%u %u %u ", priority, weight, port);
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
+                break;
+            }
 
         case T_MINFO:
         case T_RP:
                 putc('\t', file);
-                cp = p_fqname(cp, msg, file);
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 putc(' ', file);
-                cp = p_fqname(cp, msg, file);
+                if ((cp = p_fqname(cp, msg, file)) == NULL)
+                        return (NULL);
                 break;
 
         case T_UINFO:
                 putc('\t', file);
-                fputs(cp, file);
+                fputs((char *)cp, file);
                 cp += dlen;
                 break;
 
         case T_UID:
         case T_GID:
                 if (dlen == 4) {
-                        fprintf(file,"\t%u", _getlong(cp));
-                        cp += sizeof(int32_t);
+                        fprintf(file, "\t%u", _getlong((u_char*)cp));
+                        cp += INT32SZ;
                 }
                 break;
 
         case T_WKS:
-                if (dlen < sizeof(u_int32_t) + 1)
+                if (dlen < INT32SZ + 1)
                         break;
-                bcopy(cp, (char *)&inaddr, sizeof(inaddr));
-                cp += sizeof(u_int32_t);
+                bcopy(cp, (char *)&inaddr, INADDRSZ);
+                cp += INT32SZ;
                 fprintf(file, "\t%s %s ( ",
                         inet_ntoa(inaddr),
                         deproto((int) *cp));
-                cp += sizeof(u_char);
+                cp += sizeof (u_char);
                 n = 0;
                 lcnt = 0;
                 while (cp < cp1 + dlen) {
                         c = *cp++;
                         do {
-                                if (c & 0200) {
+                                if (c & 0200) {
                                         if (lcnt == 0) {
                                                 fputs("\n\t\t\t", file);
                                                 lcnt = 5;
@@ -548,17 +721,84 @@ p_rr(cp, msg, file)
                                         putc(' ', file);
                                         lcnt--;
                                 }
-                                c <<= 1;
+                                c <<= 1;
                         } while (++n & 07);
                 }
                 putc(')', file);
                 break;
 
+        case T_KEY:
+                putc('\t', file);
+                keyflags = _getshort(cp);
+                cp += 2;
+                fprintf(file,"0x%04x", keyflags );      /* flags */
+                fprintf(file," %u", *cp++);     /* protocol */
+                fprintf(file," %u (", *cp++);   /* algorithm */
+
+                n = b64_ntop(cp, (cp1 + dlen) - cp,
+                             base64_key, sizeof base64_key);
+                for (c = 0; c < n; ++c) {
+                        if (0 == (c & 0x3F))
+                                fprintf(file, "\n\t");
+                        putc(base64_key[c], file);  /* public key data */
+                }
+
+                fprintf(file, " )");
+                if (n < 0)
+                        fprintf(file, "\t; BAD BASE64");
+                fflush(file);
+                cp = cp1 + dlen;
+                break;
+
+        case T_SIG:
+        case T_RRSIG:
+                type = _getshort((u_char*)cp);
+                cp += INT16SZ;
+                fprintf(file, " %s", p_type(type));
+                fprintf(file, "\t%u", *cp++);   /* algorithm */
+                /* Check label value and print error if wrong. */
+                n = *cp++;
+                c = dn_count_labels (rrname);
+                if (n != c)
+                        fprintf(file, "\t; LABELS WRONG (%d should be %d)\n\t",
+                                n, c);
+                /* orig ttl */
+                n = _getlong((u_char*)cp);
+                if (n != tmpttl)
+                        fprintf(file, " %u", n);
+                cp += INT32SZ;
+                /* sig expire */
+                fprintf(file, " (\n\t%s",
+                                     __p_secstodate(_getlong((u_char*)cp)));
+                cp += INT32SZ;
+                /* time signed */
+                fprintf(file, " %s", __p_secstodate(_getlong((u_char*)cp)));
+                cp += INT32SZ;
+                /* sig footprint */
+                fprintf(file," %u ", _getshort((u_char*)cp));
+                cp += INT16SZ;
+                /* signer's name */
+                cp = p_fqname(cp, msg, file);
+                n = b64_ntop(cp, (cp1 + dlen) - cp,
+                             base64_key, sizeof base64_key);
+                for (c = 0; c < n; c++) {
+                        if (0 == (c & 0x3F))
+                                fprintf (file, "\n\t");
+                        putc(base64_key[c], file);              /* signature */
+                }
+                /* Clean up... */
+                fprintf(file, " )");
+                if (n < 0)
+                        fprintf(file, "\t; BAD BASE64");
+                fflush(file);
+                cp = cp1+dlen;
+                break;
+
 #ifdef ALLOW_T_UNSPEC
         case T_UNSPEC:
                 {
                         int NumBytes = 8;
-                        char *DataPtr;
+                        u_char *DataPtr;
                         int i;
 
                         if (dlen < NumBytes) NumBytes = dlen;
@@ -572,7 +812,7 @@ p_rr(cp, msg, file)
 #endif /* ALLOW_T_UNSPEC */
 
         default:
-                fprintf(file,"\t?%d?", type);
+                fprintf(file, "\t?%d?", type);
                 cp += dlen;
         }
 #if 0
@@ -581,136 +821,91 @@ p_rr(cp, msg, file)
         putc('\n', file);
 #endif
         if (cp - cp1 != dlen) {
-                fprintf(file,";; packet size error (found %d, dlen was %d)\n",
-                        cp - cp1, dlen);
+                fprintf(file, ";; packet size error (found %ld, dlen was %d)\n",
+                        (long)(cp - cp1), dlen);
                 cp = NULL;
         }
         return (cp);
 }
 
-static  char nbuf[40];
-
-/*
- * Return a string for the type
- */
-char *
-__p_type(type)
-        int type;
+int
+__sym_ston(const struct res_sym *syms, char *name, int *success)
 {
-        switch (type) {
-        case T_A:
-                return("A");
-        case T_NS:              /* authoritative server */
-                return("NS");
-        case T_CNAME:           /* canonical name */
-                return("CNAME");
-        case T_SOA:             /* start of authority zone */
-                return("SOA");
-        case T_MB:              /* mailbox domain name */
-                return("MB");
-        case T_MG:              /* mail group member */
-                return("MG");
-        case T_MR:              /* mail rename name */
-                return("MR");
-        case T_NULL:            /* null resource record */
-                return("NULL");
-        case T_WKS:             /* well known service */
-                return("WKS");
-        case T_PTR:             /* domain name pointer */
-                return("PTR");
-        case T_HINFO:           /* host information */
-                return("HINFO");
-        case T_MINFO:           /* mailbox information */
-                return("MINFO");
-        case T_MX:              /* mail routing info */
-                return("MX");
-        case T_TXT:             /* text */
-                return("TXT");
-        case T_RP:              /* responsible person */
-                return("RP");
-        case T_AFSDB:           /* AFS cell database */
-                return("AFSDB");
-        case T_AXFR:            /* zone transfer */
-                return("AXFR");
-        case T_MAILB:           /* mail box */
-                return("MAILB");
-        case T_MAILA:           /* mail address */
-                return("MAILA");
-        case T_ANY:             /* matches any type */
-                return("ANY");
-        case T_UINFO:
-                return("UINFO");
-        case T_UID:
-                return("UID");
-        case T_GID:
-                return("GID");
-#ifdef ALLOW_T_UNSPEC
-        case T_UNSPEC:
-                return("UNSPEC");
-#endif /* ALLOW_T_UNSPEC */
-
-        default:
-                (void)sprintf(nbuf, "%d", type);
-                return(nbuf);
+        for (; syms->name != 0; syms++) {
+                if (strcasecmp (name, syms->name) == 0) {
+                        if (success)
+                                *success = 1;
+                        return (syms->number);
+                }
         }
+        if (success)
+                *success = 0;
+        return (syms->number);          /* The default value. */
 }
 
-/*
- * Return a mnemonic for class
- */
-char *
-__p_class(class)
-        int class;
+
+const char *
+__sym_ntop(const struct res_sym *syms, int number, int *success)
 {
+        static char unname[20];
 
-        switch (class) {
-        case C_IN:              /* internet class */
-                return("IN");
-        case C_HS:              /* hesiod class */
-                return("HS");
-        case C_ANY:             /* matches any class */
-                return("ANY");
-        default:
-                (void)sprintf(nbuf, "%d", class);
-                return(nbuf);
+        for (; syms->name != 0; syms++) {
+                if (number == syms->number) {
+                        if (success)
+                                *success = 1;
+                        return (syms->humanname);
+                }
         }
+        snprintf(unname, sizeof unname, "%d", number);
+        if (success)
+                *success = 0;
+        return (unname);
 }
 
 /*
  * Return a mnemonic for an option
  */
-static char *
-p_option(option)
-        u_int32_t option;
+const char *
+__p_option(u_long option)
 {
+        static char nbuf[40];
+
         switch (option) {
         case RES_INIT:          return "init";
         case RES_DEBUG:         return "debug";
-        case RES_AAONLY:        return "aaonly";
+        case RES_AAONLY:        return "aaonly(unimpl)";
         case RES_USEVC:         return "usevc";
-        case RES_PRIMARY:       return "primry";
+        case RES_PRIMARY:       return "primry(unimpl)";
         case RES_IGNTC:         return "igntc";
         case RES_RECURSE:       return "recurs";
         case RES_DEFNAMES:      return "defnam";
         case RES_STAYOPEN:      return "styopn";
         case RES_DNSRCH:        return "dnsrch";
-        default:                sprintf(nbuf, "?0x%x?", option); return nbuf;
+        case RES_INSECURE1:     return "insecure1";
+        case RES_INSECURE2:     return "insecure2";
+        case RES_USE_INET6:     return "inet6";
+        case RES_USE_EDNS0:     return "edns0";
+        default:
+                snprintf(nbuf, sizeof nbuf, "?0x%lx?", (u_long)option);
+                return (nbuf);
         }
 }
 
 /*
  * Return a mnemonic for a time to live
  */
-char *
-__p_time(value)
-        u_int32_t value;
+const char *
+p_time(u_int32_t value)
 {
+        static char nbuf[40];
+        char *ebuf;
         int secs, mins, hours, days;
-        register char *p;
+        char *p;
+        int tmp;
 
         if (value == 0) {
-                strcpy(nbuf, "0 secs");
-                return(nbuf);
+                strlcpy(nbuf, "0 secs", sizeof nbuf);
+                return (nbuf);
         }
 
         secs = value % 60;
@@ -724,26 +919,477 @@ __p_time(value)
 
 #define PLURALIZE(x)    x, (x == 1) ? "" : "s"
         p = nbuf;
+        ebuf = nbuf + sizeof(nbuf);
         if (days) {
-                (void)sprintf(p, "%d day%s", PLURALIZE(days));
-                while (*++p);
+                if ((tmp = snprintf(p, ebuf - p, "%d day%s",
+                    PLURALIZE(days))) >= ebuf - p || tmp < 0)
+                        goto full;
+                p += tmp;
         }
         if (hours) {
                 if (days)
                         *p++ = ' ';
-                (void)sprintf(p, "%d hour%s", PLURALIZE(hours));
-                while (*++p);
+                if (p >= ebuf)
+                        goto full;
+                if ((tmp = snprintf(p, ebuf - p, "%d hour%s",
+                    PLURALIZE(hours))) >= ebuf - p || tmp < 0)
+                        goto full;
+                p += tmp;
         }
         if (mins) {
                 if (days || hours)
                         *p++ = ' ';
-                (void)sprintf(p, "%d min%s", PLURALIZE(mins));
-                while (*++p);
+                if (p >= ebuf)
+                        goto full;
+                if ((tmp = snprintf(p, ebuf - p, "%d min%s",
+                    PLURALIZE(mins))) >= ebuf - p || tmp < 0)
+                        goto full;
+                p += tmp;
         }
         if (secs || ! (days || hours || mins)) {
                 if (days || hours || mins)
                         *p++ = ' ';
-                (void)sprintf(p, "%d sec%s", PLURALIZE(secs));
+                if (p >= ebuf)
+                        goto full;
+                if ((tmp = snprintf(p, ebuf - p, "%d sec%s",
+                    PLURALIZE(secs))) >= ebuf - p || tmp < 0)
+                        goto full;
         }
-        return(nbuf);
+        return (nbuf);
+full:
+        p = nbuf + sizeof(nbuf) - 4;
+        *p++ = '.';
+        *p++ = '.';
+        *p++ = '.';
+        *p++ = '\0';
+        return (nbuf);
+}
+
+/*
+ * routines to convert between on-the-wire RR format and zone file format.
+ * Does not contain conversion to/from decimal degrees; divide or multiply
+ * by 60*60*1000 for that.
+ */
+
+static unsigned int poweroften[10] = {1, 10, 100, 1000, 10000, 100000,
+                                      1000000,10000000,100000000,1000000000};
+
+/* takes an XeY precision/size value, returns a string representation. */
+static const char *
+precsize_ntoa(u_int8_t prec)
+{
+        static char retbuf[sizeof "90000000.00"];
+        unsigned long val;
+        int mantissa, exponent;
+
+        mantissa = (int)((prec >> 4) & 0x0f) % 10;
+        exponent = (int)((prec >> 0) & 0x0f) % 10;
+
+        val = mantissa * poweroften[exponent];
+
+        (void) snprintf(retbuf, sizeof retbuf, "%ld.%.2ld", val/100, val%100);
+        return (retbuf);
+}
+
+/* converts ascii size/precision X * 10**Y(cm) to 0xXY.  moves pointer. */
+static u_int8_t
+precsize_aton(char **strptr)
+{
+        unsigned int mval = 0, cmval = 0;
+        u_int8_t retval = 0;
+        char *cp;
+        int exponent;
+        int mantissa;
+
+        cp = *strptr;
+
+        while (isdigit(*cp))
+                mval = mval * 10 + (*cp++ - '0');
+
+        if (*cp == '.') {               /* centimeters */
+                cp++;
+                if (isdigit(*cp)) {
+                        cmval = (*cp++ - '0') * 10;
+                        if (isdigit(*cp)) {
+                                cmval += (*cp++ - '0');
+                        }
+                }
+        }
+        cmval = (mval * 100) + cmval;
+
+        for (exponent = 0; exponent < 9; exponent++)
+                if (cmval < poweroften[exponent+1])
+                        break;
+
+        mantissa = cmval / poweroften[exponent];
+        if (mantissa > 9)
+                mantissa = 9;
+
+        retval = (mantissa << 4) | exponent;
+
+        *strptr = cp;
+
+        return (retval);
+}
+
+/* converts ascii lat/lon to unsigned encoded 32-bit number.  moves pointer. */
+static u_int32_t
+latlon2ul(char **latlonstrptr, int *which)
+{
+        char *cp;
+        u_int32_t retval;
+        int deg = 0, min = 0, secs = 0, secsfrac = 0;
+
+        cp = *latlonstrptr;
+
+        while (isdigit(*cp))
+                deg = deg * 10 + (*cp++ - '0');
+
+        while (isspace(*cp))
+                cp++;
+
+        if (!(isdigit(*cp)))
+                goto fndhemi;
+
+        while (isdigit(*cp))
+                min = min * 10 + (*cp++ - '0');
+
+        while (isspace(*cp))
+                cp++;
+
+        if (!(isdigit(*cp)))
+                goto fndhemi;
+
+        while (isdigit(*cp))
+                secs = secs * 10 + (*cp++ - '0');
+
+        if (*cp == '.') {               /* decimal seconds */
+                cp++;
+                if (isdigit(*cp)) {
+                        secsfrac = (*cp++ - '0') * 100;
+                        if (isdigit(*cp)) {
+                                secsfrac += (*cp++ - '0') * 10;
+                                if (isdigit(*cp)) {
+                                        secsfrac += (*cp++ - '0');
+                                }
+                        }
+                }
+        }
+
+        while (!isspace(*cp))   /* if any trailing garbage */
+                cp++;
+
+        while (isspace(*cp))
+                cp++;
+
+ fndhemi:
+        switch (*cp) {
+        case 'N': case 'n':
+        case 'E': case 'e':
+                retval = ((unsigned)1<<31)
+                        + (((((deg * 60) + min) * 60) + secs) * 1000)
+                        + secsfrac;
+                break;
+        case 'S': case 's':
+        case 'W': case 'w':
+                retval = ((unsigned)1<<31)
+                        - (((((deg * 60) + min) * 60) + secs) * 1000)
+                        - secsfrac;
+                break;
+        default:
+                retval = 0;     /* invalid value -- indicates error */
+                break;
+        }
+
+        switch (*cp) {
+        case 'N': case 'n':
+        case 'S': case 's':
+                *which = 1;     /* latitude */
+                break;
+        case 'E': case 'e':
+        case 'W': case 'w':
+                *which = 2;     /* longitude */
+                break;
+        default:
+                *which = 0;     /* error */
+                break;
+        }
+
+        cp++;                   /* skip the hemisphere */
+
+        while (!isspace(*cp))   /* if any trailing garbage */
+                cp++;
+
+        while (isspace(*cp))    /* move to next field */
+                cp++;
+
+        *latlonstrptr = cp;
+
+        return (retval);
+}
+
+/* converts a zone file representation in a string to an RDATA on-the-wire
+ * representation. */
+int
+loc_aton(const char *ascii, u_char *binary)
+{
+        const char *maxcp;
+        u_char *bcp;
+        char *cp;
+
+        u_int32_t latit = 0, longit = 0, alt = 0;
+        u_int32_t lltemp1 = 0, lltemp2 = 0;
+        int altmeters = 0, altfrac = 0, altsign = 1;
+        u_int8_t hp = 0x16;     /* default = 1e6 cm = 10000.00m = 10km */
+        u_int8_t vp = 0x13;     /* default = 1e3 cm = 10.00m */
+        u_int8_t siz = 0x12;    /* default = 1e2 cm = 1.00m */
+        int which1 = 0, which2 = 0;
+
+        cp = (char *)ascii;
+        maxcp = cp + strlen(ascii);
+
+        lltemp1 = latlon2ul(&cp, &which1);
+
+        lltemp2 = latlon2ul(&cp, &which2);
+
+        switch (which1 + which2) {
+        case 3:                 /* 1 + 2, the only valid combination */
+                if ((which1 == 1) && (which2 == 2)) { /* normal case */
+                        latit = lltemp1;
+                        longit = lltemp2;
+                } else if ((which1 == 2) && (which2 == 1)) { /* reversed */
+                        longit = lltemp1;
+                        latit = lltemp2;
+                } else {        /* some kind of brokenness */
+                        return (0);
+                }
+                break;
+        default:                /* we didn't get one of each */
+                return (0);
+        }
+
+        /* altitude */
+        if (*cp == '-') {
+                altsign = -1;
+                cp++;
+        }
+    
+        if (*cp == '+')
+                cp++;
+
+        while (isdigit(*cp))
+                altmeters = altmeters * 10 + (*cp++ - '0');
+
+        if (*cp == '.') {               /* decimal meters */
+                cp++;
+                if (isdigit(*cp)) {
+                        altfrac = (*cp++ - '0') * 10;
+                        if (isdigit(*cp)) {
+                                altfrac += (*cp++ - '0');
+                        }
+                }
+        }
+
+        alt = (10000000 + (altsign * (altmeters * 100 + altfrac)));
+
+        while (!isspace(*cp) && (cp < maxcp)) /* if trailing garbage or m */
+                cp++;
+
+        while (isspace(*cp) && (cp < maxcp))
+                cp++;
+
+        if (cp >= maxcp)
+                goto defaults;
+
+        siz = precsize_aton(&cp);
+        
+        while (!isspace(*cp) && (cp < maxcp))   /* if trailing garbage or m */
+                cp++;
+
+        while (isspace(*cp) && (cp < maxcp))
+                cp++;
+
+        if (cp >= maxcp)
+                goto defaults;
+
+        hp = precsize_aton(&cp);
+
+        while (!isspace(*cp) && (cp < maxcp))   /* if trailing garbage or m */
+                cp++;
+
+        while (isspace(*cp) && (cp < maxcp))
+                cp++;
+
+        if (cp >= maxcp)
+                goto defaults;
+
+        vp = precsize_aton(&cp);
+
+ defaults:
+
+        bcp = binary;
+        *bcp++ = (u_int8_t) 0;  /* version byte */
+        *bcp++ = siz;
+        *bcp++ = hp;
+        *bcp++ = vp;
+        PUTLONG(latit,bcp);
+        PUTLONG(longit,bcp);
+        PUTLONG(alt,bcp);
+    
+        return (16);            /* size of RR in octets */
+}
+
+const char *
+loc_ntoa(const u_char *binary, char *ascii)
+{
+        return loc_ntoal(binary, ascii, 255);
+}
+
+/* takes an on-the-wire LOC RR and formats it in a human readable format. */
+static const char *
+loc_ntoal(const u_char *binary, char *ascii, int ascii_len)
+{
+        static char *error = "?";
+        const u_char *cp = binary;
+
+        int latdeg, latmin, latsec, latsecfrac;
+        int longdeg, longmin, longsec, longsecfrac;
+        char northsouth, eastwest;
+        int altmeters, altfrac, altsign;
+
+        const int referencealt = 100000 * 100;
+
+        int32_t latval, longval, altval;
+        u_int32_t templ;
+        u_int8_t sizeval, hpval, vpval, versionval;
+    
+        char *sizestr, *hpstr, *vpstr;
+
+        versionval = *cp++;
+
+        if (versionval) {
+                snprintf(ascii, ascii_len, "; error: unknown LOC RR version");
+                return (ascii);
+        }
+
+        sizeval = *cp++;
+
+        hpval = *cp++;
+        vpval = *cp++;
+
+        GETLONG(templ, cp);
+        latval = (templ - ((unsigned)1<<31));
+
+        GETLONG(templ, cp);
+        longval = (templ - ((unsigned)1<<31));
+
+        GETLONG(templ, cp);
+        if (templ < referencealt) { /* below WGS 84 spheroid */
+                altval = referencealt - templ;
+                altsign = -1;
+        } else {
+                altval = templ - referencealt;
+                altsign = 1;
+        }
+
+        if (latval < 0) {
+                northsouth = 'S';
+                latval = -latval;
+        } else
+                northsouth = 'N';
+
+        latsecfrac = latval % 1000;
+        latval = latval / 1000;
+        latsec = latval % 60;
+        latval = latval / 60;
+        latmin = latval % 60;
+        latval = latval / 60;
+        latdeg = latval;
+
+        if (longval < 0) {
+                eastwest = 'W';
+                longval = -longval;
+        } else
+                eastwest = 'E';
+
+        longsecfrac = longval % 1000;
+        longval = longval / 1000;
+        longsec = longval % 60;
+        longval = longval / 60;
+        longmin = longval % 60;
+        longval = longval / 60;
+        longdeg = longval;
+
+        altfrac = altval % 100;
+        altmeters = (altval / 100) * altsign;
+
+        if ((sizestr = strdup(precsize_ntoa(sizeval))) == NULL)
+                sizestr = error;
+        if ((hpstr = strdup(precsize_ntoa(hpval))) == NULL)
+                hpstr = error;
+        if ((vpstr = strdup(precsize_ntoa(vpval))) == NULL)
+                vpstr = error;
+
+        snprintf(ascii, ascii_len,
+              "%d %.2d %.2d.%.3d %c %d %.2d %.2d.%.3d %c %d.%.2dm %sm %sm %sm",
+                latdeg, latmin, latsec, latsecfrac, northsouth,
+                longdeg, longmin, longsec, longsecfrac, eastwest,
+                altmeters, altfrac, sizestr, hpstr, vpstr);
+
+        if (sizestr != error)
+                free(sizestr);
+        if (hpstr != error)
+                free(hpstr);
+        if (vpstr != error)
+                free(vpstr);
+
+        return (ascii);
+}
+
+
+/* Return the number of DNS hierarchy levels in the name. */
+int
+__dn_count_labels(char *name)
+{
+        int i, len, count;
+
+        len = strlen(name);
+
+        for(i = 0, count = 0; i < len; i++) {
+                if (name[i] == '.')
+                        count++;
+        }
+
+        /* don't count initial wildcard */
+        if (name[0] == '*')
+                if (count)
+                        count--;
+
+        /* don't count the null label for root. */
+        /* if terminating '.' not found, must adjust */
+        /* count to include last label */
+        if (len > 0 && name[len-1] != '.')
+                count++;
+        return (count);
+}
+
+
+/* 
+ * Make dates expressed in seconds-since-Jan-1-1970 easy to read.  
+ * SIG records are required to be printed like this, by the Secure DNS RFC.
+ */
+char *
+__p_secstodate (long unsigned int secs)
+{
+        static char output[15];         /* YYYYMMDDHHMMSS and null */
+        time_t clock = secs;
+        struct tm *time;
+        
+        time = gmtime(&clock);
+        time->tm_year += 1900;
+        time->tm_mon += 1;
+        snprintf(output, sizeof output, "%04d%02d%02d%02d%02d%02d",
+                time->tm_year, time->tm_mon, time->tm_mday,
+                time->tm_hour, time->tm_min, time->tm_sec);
+        return (output);
 }
diff --git a/src/lib/libc/net/res_debug_syms.c b/src/lib/libc/net/res_debug_syms.c
new file mode 100644
index 0000000000..7e7d22c914
--- /dev/null
+++ b/src/lib/libc/net/res_debug_syms.c
@@ -0,0 +1,189 @@
+/*      $OpenBSD: res_debug_syms.c,v 1.1 2005/08/06 20:30:04 espie Exp $        */
+
+/*
+ * ++Copyright++ 1985, 1990, 1993
+ * -
+ * Copyright (c) 1985, 1990, 1993
+ *    The Regents of the University of California.  All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * -
+ * Portions Copyright (c) 1993 by Digital Equipment Corporation.
+ * 
+ * Permission to use, copy, modify, and distribute this software for any
+ * purpose with or without fee is hereby granted, provided that the above
+ * copyright notice and this permission notice appear in all copies, and that
+ * the name of Digital Equipment Corporation not be used in advertising or
+ * publicity pertaining to distribution of the document or software without
+ * specific, written prior permission.
+ * 
+ * THE SOFTWARE IS PROVIDED "AS IS" AND DIGITAL EQUIPMENT CORP. DISCLAIMS ALL
+ * WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS.   IN NO EVENT SHALL DIGITAL EQUIPMENT
+ * CORPORATION BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL
+ * DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR
+ * PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS
+ * ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS
+ * SOFTWARE.
+ * -
+ * Portions Copyright (c) 1995 by International Business Machines, Inc.
+ *
+ * International Business Machines, Inc. (hereinafter called IBM) grants
+ * permission under its copyrights to use, copy, modify, and distribute this
+ * Software with or without fee, provided that the above copyright notice and
+ * all paragraphs of this notice appear in all copies, and that the name of IBM
+ * not be used in connection with the marketing of any product incorporating
+ * the Software or modifications thereof, without specific, written prior
+ * permission.
+ *
+ * To the extent it has a right to do so, IBM grants an immunity from suit
+ * under its patents, if any, for the use, sale or manufacture of products to
+ * the extent that such products are used for performing Domain Name System
+ * dynamic updates in TCP/IP networks by means of the Software.  No immunity is
+ * granted for any product per se or for any other function of any product.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", AND IBM DISCLAIMS ALL WARRANTIES,
+ * INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE.  IN NO EVENT SHALL IBM BE LIABLE FOR ANY SPECIAL,
+ * DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER ARISING
+ * OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE, EVEN
+ * IF IBM IS APPRISED OF THE POSSIBILITY OF SUCH DAMAGES.
+ * --Copyright--
+ */
+
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <arpa/nameser.h>
+
+#include <resolv.h>
+#include <stdio.h>
+
+/*
+ * Names of RR classes and qclasses.  Classes and qclasses are the same, except
+ * that C_ANY is a qclass but not a class.  (You can ask for records of class
+ * C_ANY, but you can't have any records of that class in the database.)
+ */
+const struct res_sym __p_class_syms[] = {
+        {C_IN,          "IN"},
+        {C_CHAOS,       "CHAOS"},
+        {C_HS,          "HS"},
+        {C_HS,          "HESIOD"},
+        {C_ANY,         "ANY"},
+        {C_IN,          (char *)0}
+};
+
+/*
+ * Names of RR types and qtypes.  Types and qtypes are the same, except
+ * that T_ANY is a qtype but not a type.  (You can ask for records of type
+ * T_ANY, but you can't have any records of that type in the database.)
+ */
+const struct res_sym __p_type_syms[] = {
+        {T_A,           "A",            "address"},
+        {T_NS,          "NS",           "name server"},
+        {T_MD,          "MD",           "mail destination (deprecated)"},
+        {T_MF,          "MF",           "mail forwarder (deprecated)"},
+        {T_CNAME,       "CNAME",        "canonical name"},
+        {T_SOA,         "SOA",          "start of authority"},
+        {T_MB,          "MB",           "mailbox"},
+        {T_MG,          "MG",           "mail group member"},
+        {T_MR,          "MR",           "mail rename"},
+        {T_NULL,        "NULL",         "null"},
+        {T_WKS,         "WKS",          "well-known service (deprecated)"},
+        {T_PTR,         "PTR",          "domain name pointer"},
+        {T_HINFO,       "HINFO",        "host information"},
+        {T_MINFO,       "MINFO",        "mailbox information"},
+        {T_MX,          "MX",           "mail exchanger"},
+        {T_TXT,         "TXT",          "text"},
+        {T_RP,          "RP",           "responsible person"},
+        {T_AFSDB,       "AFSDB",        "DCE or AFS server"},
+        {T_X25,         "X25",          "X25 address"},
+        {T_ISDN,        "ISDN",         "ISDN address"},
+        {T_RT,          "RT",           "router"},
+        {T_NSAP,        "NSAP",         "nsap address"},
+        {T_NSAP_PTR,    "NSAP_PTR",     "domain name pointer"},
+        {T_SIG,         "SIG",          "signature"},
+        {T_KEY,         "KEY",          "key"},
+        {T_PX,          "PX",           "mapping information"},
+        {T_GPOS,        "GPOS",         "geographical position (withdrawn)"},
+        {T_AAAA,        "AAAA",         "IPv6 address"},
+        {T_LOC,         "LOC",          "location"},
+        {T_NXT,         "NXT",          "next valid name (unimplemented)"},
+        {T_EID,         "EID",          "endpoint identifier (unimplemented)"},
+        {T_NIMLOC,      "NIMLOC",       "NIMROD locator (unimplemented)"},
+        {T_SRV,         "SRV",          "server selection"},
+        {T_ATMA,        "ATMA",         "ATM address (unimplemented)"},
+        {T_IXFR,        "IXFR",         "incremental zone transfer"},
+        {T_AXFR,        "AXFR",         "zone transfer"},
+        {T_MAILB,       "MAILB",        "mailbox-related data (deprecated)"},
+        {T_MAILA,       "MAILA",        "mail agent (deprecated)"},
+        {T_UINFO,       "UINFO",        "user information (nonstandard)"},
+        {T_UID,         "UID",          "user ID (nonstandard)"},
+        {T_GID,         "GID",          "group ID (nonstandard)"},
+        {T_NAPTR,       "NAPTR",        "URN Naming Authority"},
+#ifdef ALLOW_T_UNSPEC
+        {T_UNSPEC,      "UNSPEC",       "unspecified data (nonstandard)"},
+#endif /* ALLOW_T_UNSPEC */
+        {T_ANY,         "ANY",          "\"any\""},
+        {0,             NULL,           NULL}
+};
+
+const char *
+__sym_ntos(const struct res_sym *syms, int number, int *success)
+{
+        static char unname[20];
+
+        for (; syms->name != 0; syms++) {
+                if (number == syms->number) {
+                        if (success)
+                                *success = 1;
+                        return (syms->name);
+                }
+        }
+
+        snprintf(unname, sizeof unname, "%d", number);
+        if (success)
+                *success = 0;
+        return (unname);
+}
+
+/*
+ * Return a string for the type
+ */
+const char *
+__p_type(int type)
+{
+        return (__sym_ntos (__p_type_syms, type, (int *)0));
+}
+
+/*
+ * Return a mnemonic for class
+ */
+const char *
+__p_class(int class)
+{
+        return (__sym_ntos (__p_class_syms, class, (int *)0));
+}
+
diff --git a/src/lib/libc/net/res_init.c b/src/lib/libc/net/res_init.c
index 33cc8d39f1..18de3550e6 100644
--- a/src/lib/libc/net/res_init.c
+++ b/src/lib/libc/net/res_init.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_init.c,v 1.8 1995/06/03 22:33:36 mycroft Exp $     */
+/*      $OpenBSD: res_init.c,v 1.40 2009/06/05 09:52:26 pyr Exp $       */
 
-/*-
+/*
+ * ++Copyright++ 1985, 1989, 1993
+ * -
  * Copyright (c) 1985, 1989, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,80 +51,200 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_init.c  8.1 (Berkeley) 6/7/93";
-static char rcsid[] = "$Id: res_init.c,v 4.9.1.1 1993/05/02 22:43:03 vixie Rel ";
-#else
-static char rcsid[] = "$NetBSD: res_init.c,v 1.8 1995/06/03 22:33:36 mycroft Exp $";
+#ifndef INET6
+#define INET6
 #endif
-#endif /* LIBC_SCCS and not lint */
 
+#include <sys/types.h>
 #include <sys/param.h>
 #include <sys/socket.h>
+#include <sys/time.h>
+#include <sys/stat.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
+
+#include <stdio.h>
+#include <ctype.h>
 #include <resolv.h>
 #include <unistd.h>
-#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
+#ifdef INET6
+#include <netdb.h>
+#endif /* INET6 */
 
-static void res_setoptions __P((char *, char *));
-static u_int32_t net_mask __P((struct in_addr));
+#include "thread_private.h"
+
+/*-------------------------------------- info about "sortlist" --------------
+ * Marc Majka           1994/04/16
+ * Allan Nathanson      1994/10/29 (BIND 4.9.3.x)
+ *
+ * NetInfo resolver configuration directory support.
+ *
+ * Allow a NetInfo directory to be created in the hierarchy which
+ * contains the same information as the resolver configuration file.
+ *
+ * - The local domain name is stored as the value of the "domain" property.
+ * - The Internet address(es) of the name server(s) are stored as values
+ *   of the "nameserver" property.
+ * - The name server addresses are stored as values of the "nameserver"
+ *   property.
+ * - The search list for host-name lookup is stored as values of the
+ *   "search" property.
+ * - The sortlist comprised of IP address netmask pairs are stored as
+ *   values of the "sortlist" property. The IP address and optional netmask
+ *   should be separated by a slash (/) or ampersand (&) character.
+ * - Internal resolver variables can be set from the value of the "options"
+ *   property.
+ */
+
+static void res_setoptions(char *, char *);
+
+#ifdef RESOLVSORT
+static const char sort_mask[] = "/&";
+#define ISSORTMASK(ch) (strchr(sort_mask, ch) != NULL)
+static u_int32_t net_mask(struct in_addr);
+#endif
 
 /*
- * Resolver state default settings
+ * Resolver state default settings.
  */
+void *__THREAD_NAME(_res);
+
+struct __res_state _res
+# if defined(__BIND_RES_TEXT)
+        = { RES_TIMEOUT, }      /* Motorola, et al. */
+# endif
+        ;
+#ifdef INET6
+void *__THREAD_NAME(_res_ext);
 
-struct __res_state _res = {
-        RES_TIMEOUT,                    /* retransmition time interval */
-        4,                              /* number of times to retransmit */
-        RES_DEFAULT,                    /* options flags */
-        1,                              /* number of name servers */
-};
+struct __res_state_ext _res_ext;
+#endif /* INET6 */
+
+int __res_chktime = 30;
 
 /*
  * Set up default settings.  If the configuration file exist, the values
  * there will have precedence.  Otherwise, the server address is set to
  * INADDR_ANY and the default domain name comes from the gethostname().
  *
- * The configuration file should only be used if you want to redefine your
- * domain or run without a server on your machine.
+ * An interrim version of this code (BIND 4.9, pre-4.4BSD) used 127.0.0.1
+ * rather than INADDR_ANY ("0.0.0.0") as the default name server address
+ * since it was noted that INADDR_ANY actually meant ``the first interface
+ * you "ifconfig"'d at boot time'' and if this was a SLIP or PPP interface,
+ * it had to be "up" in order for you to reach your own name server.  It
+ * was later decided that since the recommended practice is to always 
+ * install local static routes through 127.0.0.1 for all your network
+ * interfaces, that we could solve this problem without a code change.
+ *
+ * The configuration file should always be used, since it is the only way
+ * to specify a default domain.  If you are running a server on your local
+ * machine, you should say "nameserver 0.0.0.0" or "nameserver 127.0.0.1"
+ * in the configuration file.
  *
  * Return 0 if completes successfully, -1 on error
  */
-res_init()
+int
+res_init(void)
 {
-        register FILE *fp;
-        register char *cp, **pp, *net;
-        register int n;
-        char buf[BUFSIZ], buf2[BUFSIZ];
+
+        return (_res_init(1));
+}
+
+int
+_res_init(int usercall)
+{
+        struct stat sb;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+#ifdef INET6
+        struct __res_state_ext *_res_extp = _THREAD_PRIVATE(_res_ext, _res_ext,
+                                                            &_res_ext);
+#endif
+        FILE *fp;
+        char *cp, **pp;
+        int n;
+        int findex;
+        char buf[BUFSIZ];
         int nserv = 0;    /* number of nameserver records read from file */
         int haveenv = 0;
         int havesearch = 0;
+        size_t len;
+#ifdef RESOLVSORT
         int nsort = 0;
-        u_long mask;
+        char *net;
+#endif
+#ifndef RFC1535
+        int dots;
+#endif
+
+        if (!usercall && _resp->options & RES_INIT &&
+            _resp->reschktime >= time(NULL))
+                return (0);
+        _resp->reschktime = time(NULL) + __res_chktime;
+        if (stat(_PATH_RESCONF, &sb) != -1) {
+                if (!usercall && timespeccmp(&sb.st_mtimespec,
+                    &_resp->restimespec, ==))
+                        return (0);
+                else
+                        _resp->restimespec = sb.st_mtimespec;
+        } else {
+                /*
+                 * Lost the file, in chroot?
+                 * Don't trash settings
+                 */
+                if (!usercall && timespecisset(&_resp->restimespec))
+                        return (0);
+        }
+
+
+        /*
+         * These three fields used to be statically initialized.  This made
+         * it hard to use this code in a shared library.  It is necessary,
+         * now that we're doing dynamic initialization here, that we preserve
+         * the old semantics: if an application modifies one of these three
+         * fields of _res before res_init() is called, res_init() will not
+         * alter them.  Of course, if an application is setting them to
+         * _zero_ before calling res_init(), hoping to override what used
+         * to be the static default, we can't detect it and unexpected results
+         * will follow.  Zero for any of these fields would make no sense,
+         * so one can safely assume that the applications were already getting
+         * unexpected results.
+         *
+         * _res.options is tricky since some apps were known to diddle the bits
+         * before res_init() was first called. We can't replicate that semantic
+         * with dynamic initialization (they may have turned bits off that are
+         * set in RES_DEFAULT).  Our solution is to declare such applications
+         * "broken".  They could fool us by setting RES_INIT but none do (yet).
+         */
+        if (!_resp->retrans)
+                _resp->retrans = RES_TIMEOUT;
+        if (!_resp->retry)
+                _resp->retry = 4;
+        if (!(_resp->options & RES_INIT))
+                _resp->options = RES_DEFAULT;
 
-        _res.nsaddr.sin_len = sizeof(struct sockaddr_in);
-        _res.nsaddr.sin_family = AF_INET;
-        _res.nsaddr.sin_port = htons(NAMESERVER_PORT);
 #ifdef USELOOPBACK
-        _res.nsaddr.sin_addr = inet_makeaddr(IN_LOOPBACKNET, 1);
+        _resp->nsaddr.sin_addr = inet_makeaddr(IN_LOOPBACKNET, 1);
 #else
-        _res.nsaddr.sin_addr.s_addr = INADDR_ANY;
+        _resp->nsaddr.sin_addr.s_addr = INADDR_ANY;
+#endif
+        _resp->nsaddr.sin_family = AF_INET;
+        _resp->nsaddr.sin_port = htons(NAMESERVER_PORT);
+        _resp->nsaddr.sin_len = sizeof(struct sockaddr_in);
+#ifdef INET6
+        if (sizeof(_res_extp->nsaddr) >= _resp->nsaddr.sin_len)
+                memcpy(&_res_extp->nsaddr, &_resp->nsaddr, _resp->nsaddr.sin_len);
 #endif
-        _res.nscount = 1;
-        _res.ndots = 1;
-        _res.pfcode = 0;
-        strncpy(_res.lookups, "f", sizeof _res.lookups);
+        _resp->nscount = 1;
+        _resp->ndots = 1;
+        _resp->pfcode = 0;
+        strlcpy(_resp->lookups, "f", sizeof _resp->lookups);
 
         /* Allow user to override the local domain definition */
-        if ((cp = getenv("LOCALDOMAIN")) != NULL) {
-                (void)strncpy(_res.defdname, cp, sizeof(_res.defdname) - 1);
-                if ((cp = strpbrk(_res.defdname, " \t\n")) != NULL)
-                        *cp = '\0';
+        if (issetugid() == 0 && (cp = getenv("LOCALDOMAIN")) != NULL) {
+                strlcpy(_resp->defdname, cp, sizeof(_resp->defdname));
                 haveenv++;
 
                 /*
@@ -136,11 +254,11 @@ res_init()
                  * one that they want to use as an individual (even more
                  * important now that the rfc1535 stuff restricts searches)
                  */
-                cp = _res.defdname;
-                pp = _res.dnsrch;
+                cp = _resp->defdname;
+                pp = _resp->dnsrch;
                 *pp++ = cp;
-                for (n = 0; *cp && pp < _res.dnsrch + MAXDNSRCH; cp++) {
-                        if (*cp == '\n')        /* silly backwards compat */
+                for (n = 0; *cp && pp < _resp->dnsrch + MAXDNSRCH; cp++) {
+                        if (*cp == '\n')        /* silly backwards compat */
                                 break;
                         else if (*cp == ' ' || *cp == '\t') {
                                 *cp = 0;
@@ -158,16 +276,67 @@ res_init()
                 *pp++ = 0;
         }
 
+#define MATCH(line, name) \
+        (!strncmp(line, name, sizeof(name) - 1) && \
+        (line[sizeof(name) - 1] == ' ' || \
+         line[sizeof(name) - 1] == '\t'))
+
+        /* initialize family lookup preference: inet4 first */
+        _resp->family[0] = AF_INET;
+        _resp->family[1] = AF_INET6;
         if ((fp = fopen(_PATH_RESCONF, "r")) != NULL) {
-            strncpy(_res.lookups, "bf", sizeof _res.lookups);
+            strlcpy(_resp->lookups, "bf", sizeof _resp->lookups);
 
             /* read the config file */
-            while (fgets(buf, sizeof(buf), fp) != NULL) {
+            buf[0] = '\0';
+            while ((cp = fgetln(fp, &len)) != NULL) {
+                /* skip lines that are too long */
+                if (len >= sizeof(buf))
+                    continue;
+                (void)memcpy(buf, cp, len);
+                buf[len] = '\0';
                 /* skip comments */
-                if ((*buf == ';') || (*buf == '#'))
+                if ((cp = strpbrk(buf, ";#")) != NULL)
+                        *cp = '\0';
+                if (buf[0] == '\0')
                         continue;
+                /* set family lookup order */
+                if (MATCH(buf, "family")) {
+                        cp = buf + sizeof("family") - 1;
+                        cp += strspn(cp, " \t");
+                        cp[strcspn(cp, "\n")] = '\0';
+                        findex = 0;
+                        _resp->family[0] = _resp->family[1] = -1;
+#define INETLEN (sizeof("inetX") - 1)
+                        while (*cp != '\0' && findex < 2) {
+                                if (!strncmp(cp, "inet6", INETLEN)) {
+                                        _resp->family[findex] = AF_INET6;
+                                        cp += INETLEN;
+                                } else if (!strncmp(cp, "inet4", INETLEN)) {
+                                        _resp->family[findex] = AF_INET;
+                                        cp += INETLEN;
+                                } else {
+                                        _resp->family[0] = -1;
+                                        break;
+                                }
+                                if (*cp != ' ' && *cp != '\t' && *cp != '\0') {
+                                        _resp->family[findex] = -1;
+                                        break;
+                                }
+                                findex++;
+                                cp += strspn(cp, " \t");
+                        }
+
+                        if (_resp->family[0] == -1) {
+                                /* line contains errors, reset to defaults */
+                                _resp->family[0] = AF_INET;
+                                _resp->family[1] = AF_INET6;
+                        }
+                        if (_resp->family[0] == _resp->family[1])
+                                _resp->family[1] = -1;
+                }
                 /* read default domain name */
-                if (!strncmp(buf, "domain", sizeof("domain") - 1)) {
+                if (MATCH(buf, "domain")) {
                     if (haveenv)        /* skip if have from environ */
                             continue;
                     cp = buf + sizeof("domain") - 1;
@@ -175,18 +344,17 @@ res_init()
                             cp++;
                     if ((*cp == '\0') || (*cp == '\n'))
                             continue;
-                    (void)strncpy(_res.defdname, cp,
-                                  sizeof(_res.defdname) - 1);
-                    if ((cp = strpbrk(_res.defdname, " \t\n")) != NULL)
+                    strlcpy(_resp->defdname, cp, sizeof(_resp->defdname));
+                    if ((cp = strpbrk(_resp->defdname, " \t\n")) != NULL)
                             *cp = '\0';
                     havesearch = 0;
                     continue;
                 }
                 /* lookup types */
-                if (!strncmp(buf, "lookup", sizeof("lookup") -1)) {
+                if (MATCH(buf, "lookup")) {
                     char *sp = NULL;
 
-                    bzero(_res.lookups, sizeof _res.lookups);
+                    bzero(_resp->lookups, sizeof _resp->lookups);
                     cp = buf + sizeof("lookup") - 1;
                     for (n = 0;; cp++) {
                             if (n == MAXDNSLUS)
@@ -194,14 +362,14 @@ res_init()
                             if ((*cp == '\0') || (*cp == '\n')) {
                                     if (sp) {
                                             if (*sp=='y' || *sp=='b' || *sp=='f')
-                                                    _res.lookups[n++] = *sp;
+                                                    _resp->lookups[n++] = *sp;
                                             sp = NULL;
                                     }
                                     break;
                             } else if ((*cp == ' ') || (*cp == '\t') || (*cp == ',')) {
                                     if (sp) {
                                             if (*sp=='y' || *sp=='b' || *sp=='f')
-                                                    _res.lookups[n++] = *sp;
+                                                    _resp->lookups[n++] = *sp;
                                             sp = NULL;
                                     }
                             } else if (sp == NULL)
@@ -210,7 +378,7 @@ res_init()
                     continue;
                 }
                 /* set search list */
-                if (!strncmp(buf, "search", sizeof("search") - 1)) {
+                if (MATCH(buf, "search")) {
                     if (haveenv)        /* skip if have from environ */
                             continue;
                     cp = buf + sizeof("search") - 1;
@@ -218,18 +386,17 @@ res_init()
                             cp++;
                     if ((*cp == '\0') || (*cp == '\n'))
                             continue;
-                    (void)strncpy(_res.defdname, cp,
-                                  sizeof(_res.defdname) - 1);
-                    if ((cp = strchr(_res.defdname, '\n')) != NULL)
+                    strlcpy(_resp->defdname, cp, sizeof(_resp->defdname));
+                    if ((cp = strchr(_resp->defdname, '\n')) != NULL)
                             *cp = '\0';
                     /*
                      * Set search list to be blank-separated strings
                      * on rest of line.
                      */
-                    cp = _res.defdname;
-                    pp = _res.dnsrch;
+                    cp = _resp->defdname;
+                    pp = _resp->dnsrch;
                     *pp++ = cp;
-                    for (n = 0; *cp && pp < _res.dnsrch + MAXDNSRCH; cp++) {
+                    for (n = 0; *cp && pp < _resp->dnsrch + MAXDNSRCH; cp++) {
                             if (*cp == ' ' || *cp == '\t') {
                                     *cp = 0;
                                     n = 1;
@@ -247,130 +414,274 @@ res_init()
                     continue;
                 }
                 /* read nameservers to query */
-                if (!strncmp(buf, "nameserver", sizeof("nameserver") - 1) &&
-                   nserv < MAXNS) {
-                   struct in_addr a;
+                if (MATCH(buf, "nameserver") && nserv < MAXNS) {
+                    char *q;
+                    struct addrinfo hints, *res;
+                    char pbuf[NI_MAXSERV];
 
                     cp = buf + sizeof("nameserver") - 1;
                     while (*cp == ' ' || *cp == '\t')
                         cp++;
-                    if ((*cp != '\0') && (*cp != '\n') && inet_aton(cp, &a)) {
-                        _res.nsaddr_list[nserv].sin_len = sizeof(struct sockaddr_in);
-                        _res.nsaddr_list[nserv].sin_family = AF_INET;
-                        _res.nsaddr_list[nserv].sin_port =
-                                htons(NAMESERVER_PORT);
-                        _res.nsaddr_list[nserv].sin_addr = a;
+                    if ((*cp == '\0') || (*cp == '\n'))
+                        continue;
+                    for (q = cp; *q; q++) {
+                        if (isspace(*q)) {
+                            *q = '\0';
+                            break;
+                        }
+                    }
+
+                    /* Handle addresses enclosed in [] */
+                    *pbuf = '\0';
+                    if (*cp == '[') {
+                        cp++;
+                        if ((q = strchr(cp, ']')) == NULL)
+                                continue;
+                        *q++ = '\0';
+                        /* Extract port, if specified */
+                        if (*q++ == ':') {
+                            if (strlcpy(pbuf, q, sizeof(pbuf)) >= sizeof(pbuf))
+                                continue;
+                        }
+                    }
+                    if (*pbuf == '\0')
+                        snprintf(pbuf, sizeof(pbuf), "%u", NAMESERVER_PORT);
+
+                    memset(&hints, 0, sizeof(hints));
+                    hints.ai_flags = AI_NUMERICHOST;
+                    hints.ai_socktype = SOCK_DGRAM;
+                    res = NULL;
+                    if (getaddrinfo(cp, pbuf, &hints, &res) == 0 &&
+                            res->ai_next == NULL) {
+                        if (res->ai_addrlen <= sizeof(_res_extp->nsaddr_list[nserv])) {
+                            memcpy(&_res_extp->nsaddr_list[nserv], res->ai_addr,
+                                res->ai_addrlen);
+                        } else {
+                            memset(&_res_extp->nsaddr_list[nserv], 0,
+                                sizeof(_res_extp->nsaddr_list[nserv]));
+                        }
+                        if (res->ai_addrlen <= sizeof(_resp->nsaddr_list[nserv])) {
+                            memcpy(&_resp->nsaddr_list[nserv], res->ai_addr,
+                                res->ai_addrlen);
+                        } else {
+                            memset(&_resp->nsaddr_list[nserv], 0,
+                                sizeof(_resp->nsaddr_list[nserv]));
+                        }
                         nserv++;
                     }
+                    if (res)
+                        freeaddrinfo(res);
                     continue;
                 }
-                if (!strncmp(buf, "sortlist", sizeof("sortlist") - 1)) {
+#ifdef RESOLVSORT
+                if (MATCH(buf, "sortlist")) {
                     struct in_addr a;
+#ifdef INET6
+                    struct in6_addr a6;
+                    int m, i;
+                    u_char *u;
+#endif /* INET6 */
 
                     cp = buf + sizeof("sortlist") - 1;
-                    while (*cp == ' ' || *cp == '\t')
-                        cp++;
-                    while (sscanf(cp,"%[0-9./]s", buf2) && nsort < MAXRESOLVSORT) {
-                        if (net = strchr(buf2, '/'))
-                            *net = '\0';
-                        if (inet_aton(buf2, &a)) {
-                            _res.sort_list[nsort].addr = a;
-                            if (net && inet_aton(net+1, &a)) {
-                                _res.sort_list[nsort].mask = a.s_addr;
+                    while (nsort < MAXRESOLVSORT) {
+                        while (*cp == ' ' || *cp == '\t')
+                            cp++;
+                        if (*cp == '\0' || *cp == '\n' || *cp == ';')
+                            break;
+                        net = cp;
+                        while (*cp && !ISSORTMASK(*cp) && *cp != ';' &&
+                               isascii(*cp) && !isspace(*cp))
+                                cp++;
+                        n = *cp;
+                        *cp = 0;
+                        if (inet_aton(net, &a)) {
+                            _resp->sort_list[nsort].addr = a;
+                            if (ISSORTMASK(n)) {
+                                *cp++ = n;
+                                net = cp;
+                                while (*cp && *cp != ';' &&
+                                        isascii(*cp) && !isspace(*cp))
+                                    cp++;
+                                n = *cp;
+                                *cp = 0;
+                                if (inet_aton(net, &a)) {
+                                    _resp->sort_list[nsort].mask = a.s_addr;
+                                } else {
+                                    _resp->sort_list[nsort].mask = 
+                                        net_mask(_resp->sort_list[nsort].addr);
+                                }
                             } else {
-                                _res.sort_list[nsort].mask =
-                                        net_mask(_res.sort_list[nsort].addr);
+                                _resp->sort_list[nsort].mask = 
+                                    net_mask(_resp->sort_list[nsort].addr);
                             }
+#ifdef INET6
+                            _res_extp->sort_list[nsort].af = AF_INET;
+                            _res_extp->sort_list[nsort].addr.ina =
+                                _resp->sort_list[nsort].addr;
+                            _res_extp->sort_list[nsort].mask.ina.s_addr =
+                                _resp->sort_list[nsort].mask;
+#endif /* INET6 */
                             nsort++;
                         }
-                        if (net)
-                                *net = '/';
-                        cp += strlen(buf2);
-                        while (*cp == ' ' || *cp == '\t')
-                            cp++;
+#ifdef INET6
+                        else if (inet_pton(AF_INET6, net, &a6) == 1) {
+                            _res_extp->sort_list[nsort].af = AF_INET6;
+                            _res_extp->sort_list[nsort].addr.in6a = a6;
+                            u = (u_char *)&_res_extp->sort_list[nsort].mask.in6a;
+                            *cp++ = n;
+                            net = cp;
+                            while (*cp && *cp != ';' &&
+                                    isascii(*cp) && !isspace(*cp))
+                                cp++;
+                            m = n;
+                            n = *cp;
+                            *cp = 0;
+                            switch (m) {
+                            case '/':
+                                m = atoi(net);
+                                break;
+                            case '&':
+                                if (inet_pton(AF_INET6, net, u) == 1) {
+                                    m = -1;
+                                    break;
+                                }
+                                /* FALLTHROUGH */
+                            default:
+                                m = sizeof(struct in6_addr) * NBBY;
+                                break;
+                            }
+                            if (m >= 0) {
+                                for (i = 0; i < sizeof(struct in6_addr); i++) {
+                                    if (m <= 0) {
+                                        *u = 0;
+                                    } else {
+                                        m -= NBBY;
+                                        *u = (u_char)~0;
+                                        if (m < 0)
+                                            *u <<= -m;
+                                    }
+                                    u++;
+                                }
+                            }
+                            nsort++;
+                        }
+#endif /* INET6 */
+                        *cp = n;
                     }
                     continue;
                 }
-                if (!strncmp(buf, "options", sizeof("options") -1)) {
+#endif
+                if (MATCH(buf, "options")) {
                     res_setoptions(buf + sizeof("options") - 1, "conf");
                     continue;
                 }
             }
             if (nserv > 1) 
-                _res.nscount = nserv;
-            _res.nsort = nsort;
+                _resp->nscount = nserv;
+#ifdef RESOLVSORT
+            _resp->nsort = nsort;
+#endif
             (void) fclose(fp);
         }
-        if (_res.defdname[0] == 0) {
-                if (gethostname(buf, sizeof(_res.defdname) - 1) == 0 &&
-                   (cp = strchr(buf, '.')))
-                        (void)strcpy(_res.defdname, cp + 1);
+        if (_resp->defdname[0] == 0 &&
+            gethostname(buf, sizeof(_resp->defdname) - 1) == 0 &&
+            (cp = strchr(buf, '.')) != NULL)
+        {
+                strlcpy(_resp->defdname, cp + 1,
+                        sizeof(_resp->defdname));
         }
 
         /* find components of local domain that might be searched */
         if (havesearch == 0) {
-                pp = _res.dnsrch;
-                *pp++ = _res.defdname;
-#ifndef SEARCH_LOCAL_DOMAINS
+                pp = _resp->dnsrch;
+                *pp++ = _resp->defdname;
                 *pp = NULL;
-#else
-                for (cp = _res.defdname, n = 0; *cp; cp++)
-                        if (*cp == '.')
-                                n++;
-                cp = _res.defdname;
-                for (; n >= LOCALDOMAINPARTS && pp < _res.dnsrch + MAXDFLSRCH;
-                    n--) {
-                        cp = strchr(cp, '.');
-                        *pp++ = ++cp;
+
+#ifndef RFC1535
+                dots = 0;
+                for (cp = _resp->defdname; *cp; cp++)
+                        dots += (*cp == '.');
+
+                cp = _resp->defdname;
+                while (pp < _resp->dnsrch + MAXDFLSRCH) {
+                        if (dots < LOCALDOMAINPARTS)
+                                break;
+                        cp = strchr(cp, '.') + 1;    /* we know there is one */
+                        *pp++ = cp;
+                        dots--;
                 }
-                *pp++ = 0;
-#endif
+                *pp = NULL;
+#ifdef DEBUG
+                if (_resp->options & RES_DEBUG) {
+                        printf(";; res_init()... default dnsrch list:\n");
+                        for (pp = _resp->dnsrch; *pp; pp++)
+                                printf(";;\t%s\n", *pp);
+                        printf(";;\t..END..\n");
+                }
+#endif /* DEBUG */
+#endif /* !RFC1535 */
         }
 
-        if ((cp = getenv("RES_OPTIONS")) != NULL)
+        if (issetugid())
+                _resp->options |= RES_NOALIASES;
+        else if ((cp = getenv("RES_OPTIONS")) != NULL)
                 res_setoptions(cp, "env");
-        _res.options |= RES_INIT;
+        _resp->options |= RES_INIT;
         return (0);
 }
 
+/* ARGSUSED */
 static void
-res_setoptions(options, source)
-        char *options, *source;
+res_setoptions(char *options, char *source)
 {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
         char *cp = options;
-        int i;
+        char *endp;
+        long l;
 
 #ifdef DEBUG
-        if (_res.options & RES_DEBUG) {
+        if (_resp->options & RES_DEBUG)
                 printf(";; res_setoptions(\"%s\", \"%s\")...\n",
                        options, source);
-        }
 #endif
         while (*cp) {
                 /* skip leading and inner runs of spaces */
                 while (*cp == ' ' || *cp == '\t')
                         cp++;
                 /* search for and process individual options */
-                if (!strncmp(cp, "ndots:", sizeof("ndots:")-1)) {
-                        i = atoi(cp + sizeof("ndots:") - 1);
-                        if (i <= RES_MAXNDOTS)
-                                _res.ndots = i;
-                        else
-                                _res.ndots = RES_MAXNDOTS;
+                if (!strncmp(cp, "ndots:", sizeof("ndots:") - 1)) {
+                        char *p = cp + sizeof("ndots:") - 1;
+                        l = strtol(p, &endp, 10);
+                        if (l >= 0 && endp != p &&
+                            (*endp = '\0' || isspace(*endp))) {
+                                if (l <= RES_MAXNDOTS)
+                                        _resp->ndots = l;
+                                else
+                                        _resp->ndots = RES_MAXNDOTS;
 #ifdef DEBUG
-                        if (_res.options & RES_DEBUG) {
-                                printf(";;\tndots=%d\n", _res.ndots);
-                        }
+                                if (_resp->options & RES_DEBUG)
+                                        printf(";;\tndots=%u\n", _resp->ndots);
 #endif
-                } else if (!strncmp(cp, "debug", sizeof("debug")-1)) {
+                        }
+                } else if (!strncmp(cp, "debug", sizeof("debug") - 1)) {
 #ifdef DEBUG
-                        if (!(_res.options & RES_DEBUG)) {
+                        if (!(_resp->options & RES_DEBUG)) {
                                 printf(";; res_setoptions(\"%s\", \"%s\")..\n",
                                        options, source);
-                                _res.options |= RES_DEBUG;
+                                _resp->options |= RES_DEBUG;
                         }
                         printf(";;\tdebug\n");
 #endif
+                } else if (!strncmp(cp, "inet6", sizeof("inet6") - 1)) {
+                        _resp->options |= RES_USE_INET6;
+                } else if (!strncmp(cp, "insecure1", sizeof("insecure1") - 1)) {
+                        _resp->options |= RES_INSECURE1;
+                } else if (!strncmp(cp, "insecure2", sizeof("insecure2") - 1)) {
+                        _resp->options |= RES_INSECURE2;
+                } else if (!strncmp(cp, "edns0", sizeof("edns0") - 1)) {
+                        _resp->options |= RES_USE_EDNS0;
+                } else if (!strncmp(cp, "tcp", sizeof("tcp") - 1)) {
+                        _resp->options |= RES_USEVC;
                 } else {
                         /* XXX - print a warning here? */
                 }
@@ -380,15 +691,17 @@ res_setoptions(options, source)
         }
 }
 
+#ifdef RESOLVSORT
+/* XXX - should really support CIDR which means explicit masks always. */
 static u_int32_t
-net_mask(in)            /* XXX - should really use system's version of this */
-        struct in_addr in;
+net_mask(struct in_addr in)     /* XXX - should really use system's version of this */
 {
-        register u_int32_t i = ntohl(in.s_addr);
+        u_int32_t i = ntohl(in.s_addr);
 
         if (IN_CLASSA(i))
                 return (htonl(IN_CLASSA_NET));
-        if (IN_CLASSB(i))
+        else if (IN_CLASSB(i))
                 return (htonl(IN_CLASSB_NET));
         return (htonl(IN_CLASSC_NET));
 }
+#endif
diff --git a/src/lib/libc/net/res_mkquery.c b/src/lib/libc/net/res_mkquery.c
index 25f025e147..5c6b273abe 100644
--- a/src/lib/libc/net/res_mkquery.c
+++ b/src/lib/libc/net/res_mkquery.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_mkquery.c,v 1.5 1995/02/25 06:20:58 cgd Exp $      */
+/*      $OpenBSD: res_mkquery.c,v 1.17 2005/08/06 20:30:04 espie Exp $  */
 
-/*-
+/*
+ * ++Copyright++ 1985, 1993
+ * -
  * Copyright (c) 1985, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,101 +51,109 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_mkquery.c       8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: res_mkquery.c,v 4.9.1.2 1993/05/17 10:00:01 vixie Exp ";
-#else
-static char rcsid[] = "$NetBSD: res_mkquery.c,v 1.5 1995/02/25 06:20:58 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
+#include <sys/types.h>
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
-#include <resolv.h>
+
 #include <stdio.h>
+#include <netdb.h>
+#include <resolv.h>
 #include <string.h>
 
+#include "thread_private.h"
+
 /*
  * Form all types of queries.
  * Returns the size of the result or -1.
  */
-res_mkquery(op, dname, class, type, data, datalen, newrr_in, buf, buflen)
-        int op;                 /* opcode of query */
-        const char *dname;              /* domain name */
-        int class, type;        /* class and type of query */
-        const char *data;               /* resource record data */
-        int datalen;            /* length of data */
-        const char *newrr_in;   /* new rr for modify or append */
-        char *buf;              /* buffer to put query */
-        int buflen;             /* size of buffer */
+/* ARGSUSED */
+int
+res_mkquery(int op,
+    const char *dname,          /* opcode of query */
+    int class,                  /* domain name */
+    int type,                   /* class and type of query */
+    const u_char *data,         /* resource record data */
+    int datalen,                /* length of data */
+    const u_char *newrr_in,     /* new rr for modify or append */
+    u_char *buf,                /* buffer to put query */
+    int buflen)                 /* size of buffer */
 {
-        register HEADER *hp;
-        register char *cp;
-        register int n;
-        struct rrec *newrr = (struct rrec *) newrr_in;
-        char *dnptrs[10], **dpp, **lastdnptr;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        HEADER *hp;
+        u_char *cp, *ep;
+        int n;
+        u_char *dnptrs[20], **dpp, **lastdnptr;
 
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                return (-1);
+        }
 #ifdef DEBUG
-        if (_res.options & RES_DEBUG)
+        if (_resp->options & RES_DEBUG)
                 printf(";; res_mkquery(%d, %s, %d, %d)\n",
                        op, dname, class, type);
 #endif
         /*
          * Initialize header fields.
+         *
+         * A special random number generator is used to create non predictable
+         * and non repeating ids over a long period. It also avoids reuse
+         * by switching between two distinct number cycles.
          */
-        if ((buf == NULL) || (buflen < sizeof(HEADER)))
-                return(-1);
-        bzero(buf, sizeof(HEADER));
+
+        if ((buf == NULL) || (buflen < HFIXEDSZ))
+                return (-1);
+        bzero(buf, HFIXEDSZ);
         hp = (HEADER *) buf;
-        hp->id = htons(++_res.id);
+        _resp->id = res_randomid();
+        hp->id = htons(_resp->id);
         hp->opcode = op;
-        hp->pr = (_res.options & RES_PRIMARY) != 0;
-        hp->rd = (_res.options & RES_RECURSE) != 0;
+        hp->rd = (_resp->options & RES_RECURSE) != 0;
         hp->rcode = NOERROR;
-        cp = buf + sizeof(HEADER);
-        buflen -= sizeof(HEADER);
+        cp = buf + HFIXEDSZ;
+        ep = buf + buflen;
         dpp = dnptrs;
         *dpp++ = buf;
         *dpp++ = NULL;
-        lastdnptr = dnptrs + sizeof(dnptrs)/sizeof(dnptrs[0]);
+        lastdnptr = dnptrs + sizeof dnptrs / sizeof dnptrs[0];
         /*
          * perform opcode specific processing
          */
         switch (op) {
-        case QUERY:
-                if ((buflen -= QFIXEDSZ) < 0)
-                        return(-1);
-                if ((n = dn_comp((u_char *)dname, (u_char *)cp, buflen,
-                    (u_char **)dnptrs, (u_char **)lastdnptr)) < 0)
+        case QUERY:     /*FALLTHROUGH*/
+        case NS_NOTIFY_OP:
+                if (ep - cp < QFIXEDSZ)
+                        return (-1);
+                if ((n = dn_comp(dname, cp, ep - cp - QFIXEDSZ, dnptrs,
+                    lastdnptr)) < 0)
                         return (-1);
                 cp += n;
-                buflen -= n;
-                __putshort(type, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                __putshort(class, (u_char *)cp);
-                cp += sizeof(u_int16_t);
+                __putshort(type, cp);
+                cp += INT16SZ;
+                __putshort(class, cp);
+                cp += INT16SZ;
                 hp->qdcount = htons(1);
                 if (op == QUERY || data == NULL)
                         break;
                 /*
                  * Make an additional record for completion domain.
                  */
-                buflen -= RRFIXEDSZ;
-                if ((n = dn_comp((u_char *)data, (u_char *)cp, buflen,
-                    (u_char **)dnptrs, (u_char **)lastdnptr)) < 0)
+                if (ep - cp < RRFIXEDSZ)
+                        return (-1);
+                n = dn_comp((char *)data, cp, ep - cp - RRFIXEDSZ, dnptrs,
+                    lastdnptr);
+                if (n < 0)
                         return (-1);
                 cp += n;
-                buflen -= n;
-                __putshort(T_NULL, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                __putshort(class, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                __putlong(0, (u_char *)cp);
-                cp += sizeof(u_int32_t);
-                __putshort(0, (u_char *)cp);
-                cp += sizeof(u_int16_t);
+                __putshort(T_NULL, cp);
+                cp += INT16SZ;
+                __putshort(class, cp);
+                cp += INT16SZ;
+                __putlong(0, cp);
+                cp += INT32SZ;
+                __putshort(0, cp);
+                cp += INT16SZ;
                 hp->arcount = htons(1);
                 break;
 
@@ -155,82 +161,72 @@ res_mkquery(op, dname, class, type, data, datalen, newrr_in, buf, buflen)
                 /*
                  * Initialize answer section
                  */
-                if (buflen < 1 + RRFIXEDSZ + datalen)
+                if (ep - cp < 1 + RRFIXEDSZ + datalen)
                         return (-1);
                 *cp++ = '\0';   /* no domain name */
-                __putshort(type, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                __putshort(class, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                __putlong(0, (u_char *)cp);
-                cp += sizeof(u_int32_t);
-                __putshort(datalen, (u_char *)cp);
-                cp += sizeof(u_int16_t);
-                if (datalen) {
-                        bcopy(data, cp, datalen);
-                        cp += datalen;
-                }
-                hp->ancount = htons(1);
-                break;
-
-#ifdef ALLOW_UPDATES
-        /*
-         * For UPDATEM/UPDATEMA, do UPDATED/UPDATEDA followed by UPDATEA
-         * (Record to be modified is followed by its replacement in msg.)
-         */
-        case UPDATEM:
-        case UPDATEMA:
-
-        case UPDATED:
-                /*
-                 * The res code for UPDATED and UPDATEDA is the same; user
-                 * calls them differently: specifies data for UPDATED; server
-                 * ignores data if specified for UPDATEDA.
-                 */
-        case UPDATEDA:
-                buflen -= RRFIXEDSZ + datalen;
-                if ((n = dn_comp(dname, cp, buflen, dnptrs, lastdnptr)) < 0)
-                        return (-1);
-                cp += n;
                 __putshort(type, cp);
-                cp += sizeof(u_int16_t);
-                __putshort(class, cp);
-                cp += sizeof(u_int16_t);
+                cp += INT16SZ;
+                __putshort(class, cp);
+                cp += INT16SZ;
                 __putlong(0, cp);
-                cp += sizeof(u_int32_t);
+                cp += INT32SZ;
                 __putshort(datalen, cp);
-                cp += sizeof(u_int16_t);
+                cp += INT16SZ;
                 if (datalen) {
                         bcopy(data, cp, datalen);
                         cp += datalen;
                 }
-                if ( (op == UPDATED) || (op == UPDATEDA) ) {
-                        hp->ancount = htons(0);
-                        break;
-                }
-                /* Else UPDATEM/UPDATEMA, so drop into code for UPDATEA */
-
-        case UPDATEA:   /* Add new resource record */
-                buflen -= RRFIXEDSZ + datalen;
-                if ((n = dn_comp(dname, cp, buflen, dnptrs, lastdnptr)) < 0)
-                        return (-1);
-                cp += n;
-                __putshort(newrr->r_type, cp);
-                cp += sizeof(u_int16_t);
-                __putshort(newrr->r_class, cp);
-                cp += sizeof(u_int16_t);
-                __putlong(0, cp);
-                cp += sizeof(u_int32_t);
-                __putshort(newrr->r_size, cp);
-                cp += sizeof(u_int16_t);
-                if (newrr->r_size) {
-                        bcopy(newrr->r_data, cp, newrr->r_size);
-                        cp += newrr->r_size;
-                }
-                hp->ancount = htons(0);
+                hp->ancount = htons(1);
                 break;
 
-#endif /* ALLOW_UPDATES */
+        default:
+                return (-1);
         }
         return (cp - buf);
 }
+
+/* attach OPT pseudo-RR, as documented in RFC2671 (EDNS0). */
+int
+res_opt(int n0,
+        u_char *buf,            /* buffer to put query */
+        int buflen,             /* size of buffer */
+        int anslen)             /* answer buffer length */
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        HEADER *hp;
+        u_char *cp, *ep;
+
+        hp = (HEADER *) buf;
+        cp = buf + n0;
+        ep = buf + buflen;
+
+        if (ep - cp < 1 + RRFIXEDSZ)
+                return -1;
+
+        *cp++ = 0;      /* "." */
+
+        __putshort(T_OPT, cp);  /* TYPE */
+        cp += INT16SZ;
+        if (anslen > 0xffff)
+                anslen = 0xffff;                /* limit to 16bit value */
+        __putshort(anslen & 0xffff, cp);        /* CLASS = UDP payload size */
+        cp += INT16SZ;
+        *cp++ = NOERROR;        /* extended RCODE */
+        *cp++ = 0;              /* EDNS version */
+        if (_resp->options & RES_USE_DNSSEC) {
+#ifdef DEBUG
+                if (_resp->options & RES_DEBUG)
+                        printf(";; res_opt()... ENDS0 DNSSEC OK\n");
+#endif /* DEBUG */
+                __putshort(DNS_MESSAGEEXTFLAG_DO, cp);  /* EDNS Z field */
+                cp += INT16SZ;
+        } else {
+                __putshort(0, cp);      /* EDNS Z field */
+                cp += INT16SZ;
+        }
+        __putshort(0, cp);      /* RDLEN */
+        cp += INT16SZ;
+        hp->arcount = htons(ntohs(hp->arcount) + 1);
+
+        return cp - buf;
+}
diff --git a/src/lib/libc/net/res_query.c b/src/lib/libc/net/res_query.c
index 7649462e56..1485abb2d7 100644
--- a/src/lib/libc/net/res_query.c
+++ b/src/lib/libc/net/res_query.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_query.c,v 1.9 1995/02/25 06:58:58 cgd Exp $        */
+/*      $OpenBSD: res_query.c,v 1.26 2010/06/29 21:08:54 deraadt Exp $  */
 
-/*-
+/*
+ * ++Copyright++ 1988, 1993
+ * -
  * Copyright (c) 1988, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,26 +51,22 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_query.c 8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: res_query.c,v 1.1 1993/06/01 09:42:14 vixie Exp vixie ";
-#else
-static char rcsid[] = "$NetBSD: res_query.c,v 1.9 1995/02/25 06:58:58 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
+#include <sys/types.h>
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/inet.h>
 #include <arpa/nameser.h>
+
+#include <stdio.h>
 #include <netdb.h>
 #include <resolv.h>
-#include <stdio.h>
 #include <ctype.h>
 #include <errno.h>
 #include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
+
+#include "thread_private.h"
 
 #if PACKETSZ > 1024
 #define MAXPACKET       PACKETSZ
@@ -80,8 +74,9 @@ static char rcsid[] = "$NetBSD: res_query.c,v 1.9 1995/02/25 06:58:58 cgd Exp $"
 #define MAXPACKET       1024
 #endif
 
-char *__hostalias __P((const char *));
+const char *hostalias(const char *);
 int h_errno;
+extern int res_opt(int, u_char *, int, int);
 
 /*
  * Formulate a normal query, send, and await answer.
@@ -90,68 +85,82 @@ int h_errno;
  * if no error is indicated and the answer count is nonzero.
  * Return the size of the response on success, -1 on error.
  * Error number is left in h_errno.
+ *
  * Caller must parse answer and determine whether it answers the question.
  */
-res_query(name, class, type, answer, anslen)
-        char *name;             /* domain name */
-        int class, type;        /* class and type of query */
-        u_char *answer;         /* buffer to put answer */
-        int anslen;             /* size of answer buffer */
+int
+res_query(const char *name,
+    int class,          /* domain name */
+    int type,           /* class and type of query */
+    u_char *answer,     /* buffer to put answer */
+    int anslen)         /* size of answer buffer */
 {
-        char buf[MAXPACKET];
-        HEADER *hp;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        union {
+                HEADER hdr;
+                u_char buf[MAXPACKET];
+        } buf;
+        HEADER *hp = (HEADER *) answer;
         int n;
 
-        if ((_res.options & RES_INIT) == 0 && res_init() == -1)
+        hp->rcode = NOERROR;    /* default */
+
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
                 return (-1);
+        }
 #ifdef DEBUG
-        if (_res.options & RES_DEBUG)
+        if (_resp->options & RES_DEBUG)
                 printf(";; res_query(%s, %d, %d)\n", name, class, type);
 #endif
-        n = res_mkquery(QUERY, name, class, type, (char *)NULL, 0, NULL,
-            buf, sizeof(buf));
+
+        n = res_mkquery(QUERY, name, class, type, NULL, 0, NULL,
+                        buf.buf, sizeof(buf.buf));
+        if (n > 0 && ((_resp->options & RES_USE_EDNS0) ||
+            (_resp->options & RES_USE_DNSSEC))) {
+                n = res_opt(n, buf.buf, sizeof(buf.buf), anslen);
+        }
 
         if (n <= 0) {
 #ifdef DEBUG
-                if (_res.options & RES_DEBUG)
+                if (_resp->options & RES_DEBUG)
                         printf(";; res_query: mkquery failed\n");
 #endif
                 h_errno = NO_RECOVERY;
                 return (n);
         }
-        n = res_send(buf, n, (char *)answer, anslen);
+        n = res_send(buf.buf, n, answer, anslen);
         if (n < 0) {
 #ifdef DEBUG
-                if (_res.options & RES_DEBUG)
+                if (_resp->options & RES_DEBUG)
                         printf(";; res_query: send error\n");
 #endif
                 h_errno = TRY_AGAIN;
                 return (n);
         }
 
-        hp = (HEADER *) answer;
         if (hp->rcode != NOERROR || ntohs(hp->ancount) == 0) {
 #ifdef DEBUG
-                if (_res.options & RES_DEBUG)
-                        printf(";; rcode = %d, ancount=%d\n", hp->rcode,
+                if (_resp->options & RES_DEBUG)
+                        printf(";; rcode = %u, ancount=%u\n", hp->rcode,
                             ntohs(hp->ancount));
 #endif
                 switch (hp->rcode) {
-                        case NXDOMAIN:
-                                h_errno = HOST_NOT_FOUND;
-                                break;
-                        case SERVFAIL:
-                                h_errno = TRY_AGAIN;
-                                break;
-                        case NOERROR:
-                                h_errno = NO_DATA;
-                                break;
-                        case FORMERR:
-                        case NOTIMP:
-                        case REFUSED:
-                        default:
-                                h_errno = NO_RECOVERY;
-                                break;
+                case NXDOMAIN:
+                        h_errno = HOST_NOT_FOUND;
+                        break;
+                case SERVFAIL:
+                        h_errno = TRY_AGAIN;
+                        break;
+                case NOERROR:
+                        h_errno = NO_DATA;
+                        break;
+                case FORMERR:
+                case NOTIMP:
+                case REFUSED:
+                default:
+                        h_errno = NO_RECOVERY;
+                        break;
                 }
                 return (-1);
         }
@@ -162,39 +171,39 @@ res_query(name, class, type, answer, anslen)
  * Formulate a normal query, send, and retrieve answer in supplied buffer.
  * Return the size of the response on success, -1 on error.
  * If enabled, implement search rules until answer or unrecoverable failure
- * is detected.  Error number is left in h_errno.
- * Only useful for queries in the same name hierarchy as the local host
- * (not, for example, for host address-to-name lookups in domain in-addr.arpa).
+ * is detected.  Error code, if any, is left in h_errno.
  */
 int
-res_search(name, class, type, answer, anslen)
-        const char *name;       /* domain name */
-        int class, type;        /* class and type of query */
-        u_char *answer;         /* buffer to put answer */
-        int anslen;             /* size of answer */
+res_search(const char *name,
+    int class,          /* domain name */
+    int type,           /* class and type of query */
+    u_char *answer,     /* buffer to put answer */
+    int anslen)         /* size of answer */
 {
-        register char *cp, **domain;
-        int dots, trailing_dot, ret, got_nodata, saved_herrno, tried_as_is;
+        const char *cp, * const *domain;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        HEADER *hp = (HEADER *) answer;
+        u_int dots;
+        int trailing_dot, ret, saved_herrno;
+        int got_nodata = 0, got_servfail = 0, tried_as_is = 0;
 
-        if ((_res.options & RES_INIT) == 0 && res_init() == -1)
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
                 return (-1);
-
-        got_nodata = 0;
+        }
         errno = 0;
         h_errno = HOST_NOT_FOUND;       /* default, if we never query */
         dots = 0;
-        for (cp = (char *)name; *cp; cp++) {
-                if (*cp == '.')
-                        dots++;
-        }
+        for (cp = name; *cp; cp++)
+                dots += (*cp == '.');
         trailing_dot = 0;
-        if ((cp > name) && (*--cp == '.'))
+        if (cp > name && *--cp == '.')
                 trailing_dot++;
 
         /*
          * if there aren't any dots, it could be a user-level alias
          */
-        if (!dots && (cp = __hostalias(name)))
+        if (!dots && (cp = __hostalias(name)) != NULL)
                 return (res_query(cp, class, type, answer, anslen));
 
         /*
@@ -202,8 +211,7 @@ res_search(name, class, type, answer, anslen)
          * 'as is'.  The threshold can be set with the "ndots" option.
          */
         saved_herrno = -1;
-        tried_as_is = 0;
-        if (dots >= _res.ndots) {
+        if (dots >= _resp->ndots) {
                 ret = res_querydomain(name, NULL, class, type, answer, anslen);
                 if (ret > 0)
                         return (ret);
@@ -217,15 +225,19 @@ res_search(name, class, type, answer, anslen)
          *      - there is at least one dot, there is no trailing dot,
          *        and RES_DNSRCH is set.
          */
-        if ((!dots && (_res.options & RES_DEFNAMES)) ||
-            (dots && !trailing_dot && (_res.options & RES_DNSRCH))) {
-                for (domain = _res.dnsrch; *domain; domain++) {
-                        int done = 0;
+        if ((!dots && (_resp->options & RES_DEFNAMES)) ||
+            (dots && !trailing_dot && (_resp->options & RES_DNSRCH))) {
+                int done = 0;
+
+                for (domain = (const char * const *)_resp->dnsrch;
+                     *domain && !done;
+                     domain++) {
 
                         ret = res_querydomain(name, *domain, class, type,
-                            answer, anslen);
+                                              answer, anslen);
                         if (ret > 0)
                                 return (ret);
+
                         /*
                          * If no server present, give up.
                          * If name isn't found in this domain,
@@ -251,24 +263,27 @@ res_search(name, class, type, answer, anslen)
                         case HOST_NOT_FOUND:
                                 /* keep trying */
                                 break;
+                        case TRY_AGAIN:
+                                if (hp->rcode == SERVFAIL) {
+                                        /* try next search element, if any */
+                                        got_servfail++;
+                                        break;
+                                }
+                                /* FALLTHROUGH */
                         default:
                                 /* anything else implies that we're done */
                                 done++;
                         }
-                        /*
-                         * if we got here for some reason other than DNSRCH,
+
+                        /* if we got here for some reason other than DNSRCH,
                          * we only wanted one iteration of the loop, so stop.
                          */
-                        if (!(_res.options & RES_DNSRCH))
-                                done++;
-
-                        if (done)
-                                break;
+                        if (!(_resp->options & RES_DNSRCH))
+                                done++;
                 }
         }
 
-        /*
-         * if we have not already tried the name "as is", do that now.
+        /* if we have not already tried the name "as is", do that now.
          * note that we do this regardless of how many dots were in the
          * name or whether it ends with a dot.
          */
@@ -276,11 +291,9 @@ res_search(name, class, type, answer, anslen)
                 ret = res_querydomain(name, NULL, class, type, answer, anslen);
                 if (ret > 0)
                         return (ret);
-                saved_herrno = h_errno;
         }
 
-        /*
-         * if we got here, we didn't satisfy the search.
+        /* if we got here, we didn't satisfy the search.
          * if we did an initial full query, return that query's h_errno
          * (note that we wouldn't be here if that query had succeeded).
          * else if we ever got a nodata, send that back as the reason.
@@ -291,6 +304,8 @@ res_search(name, class, type, answer, anslen)
                 h_errno = saved_herrno;
         else if (got_nodata)
                 h_errno = NO_DATA;
+        else if (got_servfail)
+                h_errno = TRY_AGAIN;
         return (-1);
 }
 
@@ -298,20 +313,29 @@ res_search(name, class, type, answer, anslen)
  * Perform a call on res_query on the concatenation of name and domain,
  * removing a trailing dot from name if domain is NULL.
  */
-res_querydomain(name, domain, class, type, answer, anslen)
-        char *name, *domain;
-        int class, type;        /* class and type of query */
-        u_char *answer;         /* buffer to put answer */
-        int anslen;             /* size of answer */
+int
+res_querydomain(const char *name,
+    const char *domain,
+    int class,          /* class and type of query */
+    int type,
+    u_char *answer,     /* buffer to put answer */
+    int anslen)         /* size of answer */
 {
-        char nbuf[2*MAXDNAME+2];
-        char *longname = nbuf;
+#ifdef DEBUG
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+#endif
+        char nbuf[MAXDNAME*2+1+1];
+        const char *longname = nbuf;
         int n;
 
+        if (_res_init(0) == -1) {
+                h_errno = NETDB_INTERNAL;
+                return (-1);
+        }
 #ifdef DEBUG
-        if (_res.options & RES_DEBUG)
+        if (_resp->options & RES_DEBUG)
                 printf(";; res_querydomain(%s, %s, %d, %d)\n",
-                    name, domain, class, type);
+                       name, domain?domain:"<Nil>", class, type);
 #endif
         if (domain == NULL) {
                 /*
@@ -325,38 +349,51 @@ res_querydomain(name, domain, class, type, answer, anslen)
                 } else
                         longname = name;
         } else
-                (void)sprintf(nbuf, "%.*s.%.*s",
+                snprintf(nbuf, sizeof nbuf, "%.*s.%.*s",
                     MAXDNAME, name, MAXDNAME, domain);
 
         return (res_query(longname, class, type, answer, anslen));
 }
 
-char *
-__hostalias(name)
-        register const char *name;
+const char *
+hostalias(const char *name)
 {
-        register char *cp1, *cp2;
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        char *cp1, *cp2;
         FILE *fp;
-        char *file, *getenv(), *strcpy(), *strncpy();
+        char *file;
         char buf[BUFSIZ];
         static char abuf[MAXDNAME];
+        size_t len;
 
+        if (_resp->options & RES_NOALIASES)
+                return (NULL);
         file = getenv("HOSTALIASES");
-        if (file == NULL || (fp = fopen(file, "r")) == NULL)
+        if (issetugid() != 0 || file == NULL || (fp = fopen(file, "r")) == NULL)
                 return (NULL);
-        buf[sizeof(buf) - 1] = '\0';
-        while (fgets(buf, sizeof(buf), fp)) {
-                for (cp1 = buf; *cp1 && !isspace(*cp1); ++cp1);
+        setbuf(fp, NULL);
+        while ((cp1 = fgetln(fp, &len)) != NULL) {
+                if (cp1[len-1] == '\n')
+                        len--;
+                if (len >= sizeof(buf) || len == 0)
+                        continue;
+                (void)memcpy(buf, cp1, len);
+                buf[len] = '\0';
+                
+                for (cp1 = buf; *cp1 && !isspace(*cp1); ++cp1)
+                        ;
                 if (!*cp1)
                         break;
                 *cp1 = '\0';
                 if (!strcasecmp(buf, name)) {
-                        while (isspace(*++cp1));
+                        while (isspace(*++cp1))
+                                ;
                         if (!*cp1)
                                 break;
-                        for (cp2 = cp1 + 1; *cp2 && !isspace(*cp2); ++cp2);
-                        abuf[sizeof(abuf) - 1] = *cp2 = '\0';
-                        (void)strncpy(abuf, cp1, sizeof(abuf) - 1);
+                        for (cp2 = cp1 + 1; *cp2 && !isspace(*cp2); ++cp2)
+                                ;
+                        *cp2 = '\0';
+                        strlcpy(abuf, cp1, sizeof(abuf));
                         fclose(fp);
                         return (abuf);
                 }
diff --git a/src/lib/libc/net/res_random.c b/src/lib/libc/net/res_random.c
new file mode 100644
index 0000000000..f0beb7a573
--- /dev/null
+++ b/src/lib/libc/net/res_random.c
@@ -0,0 +1,264 @@
+/* $OpenBSD: res_random.c,v 1.17 2008/04/13 00:28:35 djm Exp $ */
+
+/*
+ * Copyright 1997 Niels Provos <provos@physnet.uni-hamburg.de>
+ * Copyright 2008 Damien Miller <djm@openbsd.org>
+ * All rights reserved.
+ *
+ * Theo de Raadt <deraadt@openbsd.org> came up with the idea of using
+ * such a mathematical system to generate more random (yet non-repeating)
+ * ids to solve the resolver/named problem.  But Niels designed the
+ * actual system based on the constraints.
+ *
+ * Later modified by Damien Miller to wrap the LCG output in a 15-bit
+ * permutation generator based on a Luby-Rackoff block cipher. This
+ * ensures the output is non-repeating and preserves the MSB twiddle
+ * trick, but makes it more resistant to LCG prediction.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+/* 
+ * seed = random 15bit
+ * n = prime, g0 = generator to n,
+ * j = random so that gcd(j,n-1) == 1
+ * g = g0^j mod n will be a generator again.
+ *
+ * X[0] = random seed.
+ * X[n] = a*X[n-1]+b mod m is a Linear Congruential Generator
+ * with a = 7^(even random) mod m, 
+ *      b = random with gcd(b,m) == 1
+ *      m = 31104 and a maximal period of m-1.
+ *
+ * The transaction id is determined by:
+ * id[n] = seed xor (g^X[n] mod n)
+ *
+ * Effectivly the id is restricted to the lower 15 bits, thus
+ * yielding two different cycles by toggling the msb on and off.
+ * This avoids reuse issues caused by reseeding.
+ *
+ * The output of this generator is then randomly permuted though a
+ * custom 15 bit Luby-Rackoff block cipher.
+ */
+
+#include <sys/types.h>
+#include <netinet/in.h>
+#include <sys/time.h>
+#include <resolv.h>
+
+#include <unistd.h>
+#include <stdlib.h>
+#include <string.h>
+
+#define RU_OUT          180     /* Time after wich will be reseeded */
+#define RU_MAX          30000   /* Uniq cycle, avoid blackjack prediction */
+#define RU_GEN          2       /* Starting generator */
+#define RU_N            32749   /* RU_N-1 = 2*2*3*2729 */
+#define RU_AGEN         7       /* determine ru_a as RU_AGEN^(2*rand) */
+#define RU_M            31104   /* RU_M = 2^7*3^5 - don't change */
+#define RU_ROUNDS       11      /* Number of rounds for permute (odd) */
+
+struct prf_ctx {
+        /* PRF lookup table for odd rounds (7 bits input to 8 bits output) */
+        u_char prf7[(RU_ROUNDS / 2) * (1 << 7)];
+
+        /* PRF lookup table for even rounds (8 bits input to 7 bits output) */
+        u_char prf8[((RU_ROUNDS + 1) / 2) * (1 << 8)];
+};
+
+#define PFAC_N 3
+const static u_int16_t pfacts[PFAC_N] = {
+        2, 
+        3,
+        2729
+};
+
+static u_int16_t ru_x;
+static u_int16_t ru_seed, ru_seed2;
+static u_int16_t ru_a, ru_b;
+static u_int16_t ru_g;
+static u_int16_t ru_counter = 0;
+static u_int16_t ru_msb = 0;
+static struct prf_ctx *ru_prf = NULL;
+static long ru_reseed;
+
+static u_int16_t pmod(u_int16_t, u_int16_t, u_int16_t);
+static void res_initid(void);
+
+/*
+ * Do a fast modular exponation, returned value will be in the range
+ * of 0 - (mod-1)
+ */
+static u_int16_t
+pmod(u_int16_t gen, u_int16_t exp, u_int16_t mod)
+{
+        u_int16_t s, t, u;
+
+        s = 1;
+        t = gen;
+        u = exp;
+
+        while (u) {
+                if (u & 1)
+                        s = (s * t) % mod;
+                u >>= 1;
+                t = (t * t) % mod;
+        }
+        return (s);
+}
+
+/*
+ * 15-bit permutation based on Luby-Rackoff block cipher
+ */
+u_int
+permute15(u_int in)
+{
+        int i;
+        u_int left, right, tmp;
+
+        if (ru_prf == NULL)
+                return in;
+
+        left = (in >> 8) & 0x7f;
+        right = in & 0xff;
+
+        /*
+         * Each round swaps the width of left and right. Even rounds have
+         * a 7-bit left, odd rounds have an 8-bit left. Since this uses an
+         * odd number of rounds, left is always 8 bits wide at the end.
+         */
+        for (i = 0; i < RU_ROUNDS; i++) {
+                if ((i & 1) == 0)
+                        tmp = ru_prf->prf8[(i << (8 - 1)) | right] & 0x7f;
+                else
+                        tmp = ru_prf->prf7[((i - 1) << (7 - 1)) | right];
+                tmp ^= left;
+                left = right;
+                right = tmp;
+        }
+
+        return (right << 8) | left;
+}
+
+/* 
+ * Initializes the seed and chooses a suitable generator. Also toggles 
+ * the msb flag. The msb flag is used to generate two distinct
+ * cycles of random numbers and thus avoiding reuse of ids.
+ *
+ * This function is called from res_randomid() when needed, an 
+ * application does not have to worry about it.
+ */
+static void 
+res_initid(void)
+{
+        u_int16_t j, i;
+        u_int32_t tmp;
+        int noprime = 1;
+        struct timeval tv;
+
+        ru_x = arc4random_uniform(RU_M);
+
+        /* 15 bits of random seed */
+        tmp = arc4random();
+        ru_seed = (tmp >> 16) & 0x7FFF;
+        ru_seed2 = tmp & 0x7FFF;
+
+        /* Determine the LCG we use */
+        tmp = arc4random();
+        ru_b = (tmp & 0xfffe) | 1;
+        ru_a = pmod(RU_AGEN, (tmp >> 16) & 0xfffe, RU_M);
+        while (ru_b % 3 == 0)
+                ru_b += 2;
+        
+        j = arc4random_uniform(RU_N);
+
+        /* 
+         * Do a fast gcd(j,RU_N-1), so we can find a j with
+         * gcd(j, RU_N-1) == 1, giving a new generator for
+         * RU_GEN^j mod RU_N
+         */
+
+        while (noprime) {
+                for (i = 0; i < PFAC_N; i++)
+                        if (j % pfacts[i] == 0)
+                                break;
+
+                if (i >= PFAC_N)
+                        noprime = 0;
+                else 
+                        j = (j + 1) % RU_N;
+        }
+
+        ru_g = pmod(RU_GEN, j, RU_N);
+        ru_counter = 0;
+
+        /* Initialise PRF for Luby-Rackoff permutation */
+        if (ru_prf == NULL)
+                ru_prf = malloc(sizeof(*ru_prf));
+        if (ru_prf != NULL)
+                arc4random_buf(ru_prf, sizeof(*ru_prf));
+
+        gettimeofday(&tv, NULL);
+        ru_reseed = tv.tv_sec + RU_OUT;
+        ru_msb = ru_msb == 0x8000 ? 0 : 0x8000; 
+}
+
+u_int
+res_randomid(void)
+{
+        struct timeval tv;
+
+        gettimeofday(&tv, NULL);
+        if (ru_counter >= RU_MAX || tv.tv_sec > ru_reseed)
+                res_initid();
+
+        /* Linear Congruential Generator */
+        ru_x = (ru_a * ru_x + ru_b) % RU_M;
+        ru_counter++;
+
+        return permute15(ru_seed ^ pmod(ru_g, ru_seed2 + ru_x, RU_N)) | ru_msb;
+}
+
+#if 0
+int
+main(int argc, char **argv)
+{
+        int i, n;
+        u_int16_t wert;
+
+        res_initid();
+
+        printf("Generator: %u\n", ru_g);
+        printf("Seed: %u\n", ru_seed);
+        printf("Reseed at %ld\n", ru_reseed);
+        printf("Ru_X: %u\n", ru_x);
+        printf("Ru_A: %u\n", ru_a);
+        printf("Ru_B: %u\n", ru_b);
+
+        n = argc > 1 ? atoi(argv[1]) : 60001;
+        for (i=0;i<n;i++) {
+                wert = res_randomid();
+                printf("%u\n", wert);
+        }
+        return 0;
+}
+#endif
+
diff --git a/src/lib/libc/net/res_send.c b/src/lib/libc/net/res_send.c
index e608358180..09b1385892 100644
--- a/src/lib/libc/net/res_send.c
+++ b/src/lib/libc/net/res_send.c
@@ -1,9 +1,11 @@
-/*      $NetBSD: res_send.c,v 1.4 1995/02/25 06:21:01 cgd Exp $ */
+/*      $OpenBSD: res_send.c,v 1.21 2008/05/11 05:03:03 brad Exp $      */
 
-/*-
+/*
+ * ++Copyright++ 1985, 1989, 1993
+ * -
  * Copyright (c) 1985, 1989, 1993
- *      The Regents of the University of California.  All rights reserved.
- *
+ *    The Regents of the University of California.  All rights reserved.
+ * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
@@ -12,14 +14,10 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
- *
+ * 
  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
@@ -53,19 +51,22 @@
  * --Copyright--
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)res_send.c  8.1 (Berkeley) 6/4/93";
-static char rcsid[] = "$Id: res_send.c,v 4.9.1.1 1993/05/02 22:43:03 vixie Rel ";
-#else
-static char rcsid[] = "$NetBSD: res_send.c,v 1.4 1995/02/25 06:21:01 cgd Exp $";
+#ifndef INET6
+#define INET6
 #endif
-#endif /* LIBC_SCCS and not lint */
+
+        /* change this to "0"
+         * if you talk to a lot
+         * of multi-homed SunOS
+         * ("broken") name servers.
+         */
+#define CHECK_SRVR_ADDR 1       /* XXX - should be in options.h */
 
 /*
  * Send query to name server and wait for reply.
  */
 
+#include <sys/types.h>
 #include <sys/param.h>
 #include <sys/time.h>
 #include <sys/socket.h>
@@ -73,139 +74,401 @@ static char rcsid[] = "$NetBSD: res_send.c,v 1.4 1995/02/25 06:21:01 cgd Exp $";
 #include <netinet/in.h>
 #include <arpa/nameser.h>
 #include <arpa/inet.h>
-#include <stdio.h>
+
 #include <errno.h>
+#include <netdb.h>
+#include <poll.h>
 #include <resolv.h>
-#include <unistd.h>
+#include <stdio.h>
+#include <stdlib.h>
 #include <string.h>
+#include <unistd.h>
+
+#include "thread_private.h"
 
 static int s = -1;      /* socket used for communications */
-static struct sockaddr no_addr;
-
-#ifndef FD_SET
-#define NFDBITS         32
-#define FD_SETSIZE      32
-#define FD_SET(n, p)    ((p)->fds_bits[(n)/NFDBITS] |= (1 << ((n) % NFDBITS)))
-#define FD_CLR(n, p)    ((p)->fds_bits[(n)/NFDBITS] &= ~(1 << ((n) % NFDBITS)))
-#define FD_ISSET(n, p)  ((p)->fds_bits[(n)/NFDBITS] & (1 << ((n) % NFDBITS)))
-#define FD_ZERO(p)      bzero((char *)(p), sizeof(*(p)))
+static int connected = 0;       /* is the socket connected */
+static int vc = 0;      /* is the socket a virtual ciruit? */
+static int af = 0;              /* address family of socket */
+
+#define CAN_RECONNECT 1
+
+#ifndef DEBUG
+#   define Dprint(cond, args) /*empty*/
+#   define DprintQ(cond, args, query, size) /*empty*/
+#   define Aerror(file, string, error, address) /*empty*/
+#   define Perror(file, string, error) /*empty*/
+#else
+#   define Dprint(cond, args) if (cond) {fprintf args;} else {}
+#   define DprintQ(cond, args, query, size) if (cond) {\
+                        fprintf args;\
+                        __fp_nquery(query, size, stdout);\
+                } else {}
+static char abuf[NI_MAXHOST];
+static char pbuf[NI_MAXSERV];
+static void Aerror(FILE *, char *, int, struct sockaddr *);
+static void Perror(FILE *, char *, int);
+
+    static void
+    Aerror(FILE *file, char *string, int error, struct sockaddr *address)
+    {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        int save = errno;
+
+        if (_resp->options & RES_DEBUG) {
+                if (getnameinfo(address, address->sa_len, abuf, sizeof(abuf),
+                    pbuf, sizeof(pbuf), NI_NUMERICHOST | NI_NUMERICSERV) != 0) {
+                        strlcpy(abuf, "?", sizeof(abuf));
+                        strlcpy(pbuf, "?", sizeof(pbuf));
+                }
+                fprintf(file, "res_send: %s ([%s].%s): %s\n",
+                        string, abuf, pbuf, strerror(error));
+        }
+        errno = save;
+    }
+    static void
+    Perror(FILE *file, char *string, int error)
+    {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        int save = errno;
+
+        if (_resp->options & RES_DEBUG) {
+                fprintf(file, "res_send: %s: %s\n",
+                        string, strerror(error));
+        }
+        errno = save;
+    }
 #endif
 
-res_send(buf, buflen, answer, anslen)
-        const char *buf;
-        int buflen;
-        char *answer;
-        int anslen;
+static res_send_qhook Qhook = NULL;
+static res_send_rhook Rhook = NULL;
+
+void
+res_send_setqhook(res_send_qhook hook)
 {
-        register int n;
-        int try, v_circuit, resplen, ns;
-        int gotsomewhere = 0, connected = 0;
-        int connreset = 0;
-        u_short id, len;
-        char *cp;
-        fd_set dsmask;
-        struct timeval timeout;
-        HEADER *hp = (HEADER *) buf;
-        HEADER *anhp = (HEADER *) answer;
-        u_int badns;            /* XXX NSMAX can't exceed #/bits per this */
-        struct iovec iov[2];
-        int terrno = ETIMEDOUT;
-        char junk[512];
-
-#ifdef DEBUG
-        if ((_res.options & RES_DEBUG) || (_res.pfcode & RES_PRF_QUERY)) {
-                printf(";; res_send()\n");
-                __p_query(buf);
+
+        Qhook = hook;
+}
+
+void
+res_send_setrhook(res_send_rhook hook)
+{
+
+        Rhook = hook;
+}
+
+#ifdef INET6
+static struct sockaddr * get_nsaddr(size_t);
+
+/*
+ * pick appropriate nsaddr_list for use.  see res_init() for initialization.
+ */
+static struct sockaddr *
+get_nsaddr(size_t n)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        struct __res_state_ext *_res_extp = _THREAD_PRIVATE(_res_ext, _res_ext,
+                                                            &_res_ext);
+
+        if (!_resp->nsaddr_list[n].sin_family) {
+                /*
+                 * - _res_extp->nsaddr_list[n] holds an address that is larger
+                 *   than struct sockaddr, and
+                 * - user code did not update _resp->nsaddr_list[n].
+                 */
+                return (struct sockaddr *)&_res_extp->nsaddr_list[n];
+        } else {
+                /*
+                 * - user code updated _res.nsaddr_list[n], or
+                 * - _resp->nsaddr_list[n] has the same content as
+                 *   _res_extp->nsaddr_list[n].
+                 */
+                return (struct sockaddr *)&_resp->nsaddr_list[n];
         }
+}
+#else
+#define get_nsaddr(n)   ((struct sockaddr *)&_resp->nsaddr_list[(n)])
+#endif
+
+/* int
+ * res_isourserver(ina)
+ *      looks up "ina" in _resp->ns_addr_list[]
+ * returns:
+ *      0  : not found
+ *      >0 : found
+ * author:
+ *      paul vixie, 29may94
+ */
+int
+res_isourserver(const struct sockaddr_in *inp)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+#ifdef INET6
+        const struct sockaddr_in6 *in6p = (const struct sockaddr_in6 *)inp;
+        const struct sockaddr_in6 *srv6;
 #endif
-        if (!(_res.options & RES_INIT))
-                if (res_init() == -1) {
-                        return(-1);
+        const struct sockaddr_in *srv;
+        int ns, ret;
+
+        ret = 0;
+        switch (inp->sin_family) {
+#ifdef INET6
+        case AF_INET6:
+                for (ns = 0; ns < _resp->nscount; ns++) {
+                        srv6 = (struct sockaddr_in6 *)get_nsaddr(ns);
+                        if (srv6->sin6_family == in6p->sin6_family &&
+                            srv6->sin6_port == in6p->sin6_port &&
+                            srv6->sin6_scope_id == in6p->sin6_scope_id &&
+                            (IN6_IS_ADDR_UNSPECIFIED(&srv6->sin6_addr) ||
+                             IN6_ARE_ADDR_EQUAL(&srv6->sin6_addr,
+                                 &in6p->sin6_addr))) {
+                                ret++;
+                                break;
+                        }
                 }
-        v_circuit = (_res.options & RES_USEVC) || buflen > PACKETSZ;
-        id = hp->id;
+                break;
+#endif
+        case AF_INET:
+                for (ns = 0; ns < _resp->nscount; ns++) {
+                        srv = (struct sockaddr_in *)get_nsaddr(ns);
+                        if (srv->sin_family == inp->sin_family &&
+                            srv->sin_port == inp->sin_port &&
+                            (srv->sin_addr.s_addr == INADDR_ANY ||
+                             srv->sin_addr.s_addr == inp->sin_addr.s_addr)) {
+                                ret++;
+                                break;
+                        }
+                }
+                break;
+        }
+        return (ret);
+}
+
+/* int
+ * res_nameinquery(name, type, class, buf, eom)
+ *      look for (name,type,class) in the query section of packet (buf,eom)
+ * returns:
+ *      -1 : format error
+ *      0  : not found
+ *      >0 : found
+ * author:
+ *      paul vixie, 29may94
+ */
+int
+res_nameinquery(const char *name, int type, int class, const u_char *buf,
+    const u_char *eom)
+{
+        const u_char *cp = buf + HFIXEDSZ;
+        int qdcount = ntohs(((HEADER*)buf)->qdcount);
+
+        while (qdcount-- > 0) {
+                char tname[MAXDNAME+1];
+                int n, ttype, tclass;
+
+                n = dn_expand(buf, eom, cp, tname, sizeof tname);
+                if (n < 0)
+                        return (-1);
+                cp += n;
+                ttype = _getshort(cp); cp += INT16SZ;
+                tclass = _getshort(cp); cp += INT16SZ;
+                if (ttype == type &&
+                    tclass == class &&
+                    strcasecmp(tname, name) == 0)
+                        return (1);
+        }
+        return (0);
+}
+
+/* int
+ * res_queriesmatch(buf1, eom1, buf2, eom2)
+ *      is there a 1:1 mapping of (name,type,class)
+ *      in (buf1,eom1) and (buf2,eom2)?
+ * returns:
+ *      -1 : format error
+ *      0  : not a 1:1 mapping
+ *      >0 : is a 1:1 mapping
+ * author:
+ *      paul vixie, 29may94
+ */
+int
+res_queriesmatch(const u_char *buf1, const u_char *eom1, const u_char *buf2,
+    const u_char *eom2)
+{
+        const u_char *cp = buf1 + HFIXEDSZ;
+        int qdcount = ntohs(((HEADER*)buf1)->qdcount);
+
+        if (qdcount != ntohs(((HEADER*)buf2)->qdcount))
+                return (0);
+        while (qdcount-- > 0) {
+                char tname[MAXDNAME+1];
+                int n, ttype, tclass;
+
+                n = dn_expand(buf1, eom1, cp, tname, sizeof tname);
+                if (n < 0)
+                        return (-1);
+                cp += n;
+                ttype = _getshort(cp);  cp += INT16SZ;
+                tclass = _getshort(cp); cp += INT16SZ;
+                if (!res_nameinquery(tname, ttype, tclass, buf2, eom2))
+                        return (0);
+        }
+        return (1);
+}
+
+int
+res_send(const u_char *buf, int buflen, u_char *ans, int anssiz)
+{
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+        HEADER *hp = (HEADER *) buf;
+        HEADER *anhp = (HEADER *) ans;
+        int gotsomewhere, connreset, terrno, try, v_circuit, resplen, ns;
+        int n;
+        u_int badns;    /* XXX NSMAX can't exceed #/bits in this var */
+
+        if (_res_init(0) == -1) {
+                /* errno should have been set by res_init() in this case. */
+                return (-1);
+        }
+        DprintQ((_resp->options & RES_DEBUG) || (_resp->pfcode & RES_PRF_QUERY),
+                (stdout, ";; res_send()\n"), buf, buflen);
+        v_circuit = (_resp->options & RES_USEVC) || buflen > PACKETSZ;
+        gotsomewhere = 0;
+        connreset = 0;
+        terrno = ETIMEDOUT;
         badns = 0;
+
         /*
          * Send request, RETRY times, or until successful
          */
-        for (try = 0; try < _res.retry; try++) {
-            for (ns = 0; ns < _res.nscount; ns++) {
-                if (badns & (1<<ns))
-                        continue;
-#ifdef DEBUG
-                if (_res.options & RES_DEBUG)
-                        printf(";; Querying server (# %d) address = %s\n",
-                               ns+1,
-                               inet_ntoa(_res.nsaddr_list[ns].sin_addr));
+        for (try = 0; try < _resp->retry; try++) {
+            for (ns = 0; ns < _resp->nscount; ns++) {
+                struct sockaddr *nsap = get_nsaddr(ns);
+                socklen_t salen;
+
+                if (nsap->sa_len)
+                        salen = nsap->sa_len;
+#ifdef INET6
+                else if (nsap->sa_family == AF_INET6)
+                        salen = sizeof(struct sockaddr_in6);
 #endif
-        usevc:
+                else if (nsap->sa_family == AF_INET)
+                        salen = sizeof(struct sockaddr_in);
+                else
+                        salen = 0;      /*unknown, die on connect*/
+
+    same_ns:
+                if (badns & (1 << ns)) {
+                        res_close();
+                        goto next_ns;
+                }
+
+                if (Qhook) {
+                        int done = 0, loops = 0;
+
+                        do {
+                                res_sendhookact act;
+
+                                act = (*Qhook)((struct sockaddr_in **)&nsap,
+                                               &buf, &buflen,
+                                               ans, anssiz, &resplen);
+                                switch (act) {
+                                case res_goahead:
+                                        done = 1;
+                                        break;
+                                case res_nextns:
+                                        res_close();
+                                        goto next_ns;
+                                case res_done:
+                                        return (resplen);
+                                case res_modified:
+                                        /* give the hook another try */
+                                        if (++loops < 42) /*doug adams*/
+                                                break;
+                                        /*FALLTHROUGH*/
+                                case res_error:
+                                        /*FALLTHROUGH*/
+                                default:
+                                        return (-1);
+                                }
+                        } while (!done);
+                }
+
+                Dprint((_resp->options & RES_DEBUG) &&
+                       getnameinfo(nsap, salen, abuf, sizeof(abuf),
+                           NULL, 0, NI_NUMERICHOST) == 0,
+                       (stdout, ";; Querying server (# %d) address = %s\n",
+                        ns + 1, abuf));
+
                 if (v_circuit) {
-                        int truncated = 0;
+                        int truncated;
+                        struct iovec iov[2];
+                        u_short len;
+                        u_char *cp;
 
                         /*
                          * Use virtual circuit;
                          * at most one attempt per server.
                          */
-                        try = _res.retry;
-                        if (s < 0) {
-                                s = socket(AF_INET, SOCK_STREAM, 0);
+                        try = _resp->retry;
+                        truncated = 0;
+                        if ((s < 0) || (!vc) || (af != nsap->sa_family)) {
+                                if (s >= 0)
+                                        res_close();
+
+                                af = nsap->sa_family;
+                                s = socket(af, SOCK_STREAM, 0);
                                 if (s < 0) {
                                         terrno = errno;
-#ifdef DEBUG
-                                        if (_res.options & RES_DEBUG)
-                                            perror("socket (vc) failed");
+                                        Perror(stderr, "socket(vc)", errno);
+#if 0
+                                        return (-1);
+#else
+                                        badns |= (1 << ns);
+                                        res_close();
+                                        goto next_ns;
 #endif
-                                        continue;
                                 }
-                                if (connect(s,
-                                    (struct sockaddr *)&(_res.nsaddr_list[ns]),
-                                    sizeof(struct sockaddr)) < 0) {
+                                errno = 0;
+                                if (connect(s, nsap, salen) < 0) {
                                         terrno = errno;
-#ifdef DEBUG
-                                        if (_res.options & RES_DEBUG)
-                                            perror("connect failed");
-#endif
-                                        (void) close(s);
-                                        s = -1;
-                                        continue;
+                                        Aerror(stderr, "connect/vc",
+                                               errno, nsap);
+                                        badns |= (1 << ns);
+                                        res_close();
+                                        goto next_ns;
                                 }
+                                vc = 1;
                         }
                         /*
                          * Send length & message
                          */
-                        len = htons((u_short)buflen);
+                        putshort((u_short)buflen, (u_char*)&len);
                         iov[0].iov_base = (caddr_t)&len;
-                        iov[0].iov_len = sizeof(len);
-                        iov[1].iov_base = (char *)buf;
+                        iov[0].iov_len = INT16SZ;
+                        iov[1].iov_base = (caddr_t)buf;
                         iov[1].iov_len = buflen;
-                        if (writev(s, iov, 2) != sizeof(len) + buflen) {
+                        if (writev(s, iov, 2) != (INT16SZ + buflen)) {
                                 terrno = errno;
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        perror("write failed");
-#endif
-                                (void) close(s);
-                                s = -1;
-                                continue;
+                                Perror(stderr, "write failed", errno);
+                                badns |= (1 << ns);
+                                res_close();
+                                goto next_ns;
                         }
                         /*
                          * Receive length & response
                          */
-                        cp = answer;
-                        len = sizeof(short);
-                        while (len != 0 &&
-                            (n = read(s, (char *)cp, (int)len)) > 0) {
+ read_len:
+                        cp = ans;
+                        len = INT16SZ;
+                        while ((n = read(s, (char *)cp, (int)len)) > 0) {
                                 cp += n;
-                                len -= n;
+                                if ((len -= n) <= 0)
+                                        break;
                         }
                         if (n <= 0) {
                                 terrno = errno;
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        perror("read failed");
-#endif
-                                (void) close(s);
-                                s = -1;
+                                Perror(stderr, "read failed", errno);
+                                res_close();
                                 /*
                                  * A long running process might get its TCP
                                  * connection reset if the remote server was
@@ -217,35 +480,32 @@ res_send(buf, buflen, answer, anslen)
                                  */
                                 if (terrno == ECONNRESET && !connreset) {
                                         connreset = 1;
-                                        ns--;
+                                        res_close();
+                                        goto same_ns;
                                 }
-                                continue;
+                                res_close();
+                                goto next_ns;
                         }
-                        cp = answer;
-                        if ((resplen = ntohs(*(u_short *)cp)) > anslen) {
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        fprintf(stderr,
-                                                ";; response truncated\n");
-#endif
-                                len = anslen;
+                        resplen = _getshort(ans);
+                        if (resplen > anssiz) {
+                                Dprint(_resp->options & RES_DEBUG,
+                                       (stdout, ";; response truncated\n")
+                                       );
                                 truncated = 1;
+                                len = anssiz;
                         } else
                                 len = resplen;
+                        cp = ans;
                         while (len != 0 &&
-                           (n = read(s, (char *)cp, (int)len)) > 0) {
+                               (n = read(s, (char *)cp, (int)len)) > 0) {
                                 cp += n;
                                 len -= n;
                         }
                         if (n <= 0) {
                                 terrno = errno;
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        perror("read failed");
-#endif
-                                (void) close(s);
-                                s = -1;
-                                continue;
+                                Perror(stderr, "read(vc)", errno);
+                                res_close();
+                                goto next_ns;
                         }
                         if (truncated) {
                                 /*
@@ -253,40 +513,79 @@ res_send(buf, buflen, answer, anslen)
                                  * so connection stays in synch.
                                  */
                                 anhp->tc = 1;
-                                len = resplen - anslen;
+                                len = resplen - anssiz;
                                 while (len != 0) {
-                                        n = (len > sizeof(junk) ?
-                                            sizeof(junk) : len);
+                                        char junk[PACKETSZ];
+
+                                        n = (len > sizeof(junk)
+                                             ? sizeof(junk)
+                                             : len);
                                         if ((n = read(s, junk, n)) > 0)
                                                 len -= n;
                                         else
                                                 break;
                                 }
                         }
+                        /*
+                         * The calling applicating has bailed out of
+                         * a previous call and failed to arrange to have
+                         * the circuit closed or the server has got
+                         * itself confused. Anyway drop the packet and
+                         * wait for the correct one.
+                         */
+                        if (hp->id != anhp->id) {
+                                DprintQ((_resp->options & RES_DEBUG) ||
+                                        (_resp->pfcode & RES_PRF_REPLY),
+                                        (stdout, ";; old answer (unexpected):\n"),
+                                        ans, (resplen>anssiz)?anssiz:resplen);
+                                goto read_len;
+                        }
                 } else {
                         /*
                          * Use datagrams.
                          */
-                        if (s < 0) {
-                                s = socket(AF_INET, SOCK_DGRAM, 0);
+                        struct pollfd pfd;
+                        int timeout;
+                        struct sockaddr_storage from;
+                        socklen_t fromlen;
+
+                        if ((s < 0) || vc || (af != nsap->sa_family)) {
+                                if (vc)
+                                        res_close();
+                                af = nsap->sa_family;
+                                s = socket(af, SOCK_DGRAM, 0);
                                 if (s < 0) {
+#if !CAN_RECONNECT
+ bad_dg_sock:
+#endif
                                         terrno = errno;
-#ifdef DEBUG
-                                        if (_res.options & RES_DEBUG)
-                                            perror("socket (dg) failed");
+                                        Perror(stderr, "socket(dg)", errno);
+#if 0
+                                        return (-1);
+#else
+                                        badns |= (1 << ns);
+                                        res_close();
+                                        goto next_ns;
 #endif
-                                        continue;
                                 }
+#ifdef IPV6_MINMTU
+                                if (af == AF_INET6) {
+                                        const int yes = 1;
+                                        (void)setsockopt(s, IPPROTO_IPV6,
+                                            IPV6_USE_MIN_MTU, &yes,
+                                            sizeof(yes));
+                                }
+#endif
+                                connected = 0;
                         }
                         /*
-                         * I'm tired of answering this question, so:
                          * On a 4.3BSD+ machine (client and server,
                          * actually), sending to a nameserver datagram
                          * port with no nameserver will cause an
                          * ICMP port unreachable message to be returned.
                          * If our datagram socket is "connected" to the
                          * server, we get an ECONNREFUSED error on the next
-                         * socket operation, and select returns if the
+                         * socket operation, and poll returns if the
                          * error message is received.  We can thus detect
                          * the absence of a nameserver without timing out.
                          * If we have sent queries to at least two servers,
@@ -294,31 +593,28 @@ res_send(buf, buflen, answer, anslen)
                          * as we wish to receive answers from the first
                          * server to respond.
                          */
-                        if (_res.nscount == 1 || (try == 0 && ns == 0)) {
+                        if (!(_resp->options & RES_INSECURE1) &&
+                            (_resp->nscount == 1 || (try == 0 && ns == 0))) {
                                 /*
-                                 * Don't use connect if we might
-                                 * still receive a response
-                                 * from another server.
+                                 * Connect only if we are sure we won't
+                                 * receive a response from another server.
                                  */
-                                if (connected == 0) {
-                                        if (connect(s,
-                                            (struct sockaddr *)
-                                            &_res.nsaddr_list[ns],
-                                            sizeof(struct sockaddr)) < 0) {
-#ifdef DEBUG
-                                                if (_res.options & RES_DEBUG)
-                                                        perror("connect");
-#endif
-                                                continue;
+                                if (!connected) {
+                                        if (connect(s, nsap, salen) < 0) {
+                                                Aerror(stderr,
+                                                       "connect(dg)",
+                                                       errno, nsap);
+                                                badns |= (1 << ns);
+                                                res_close();
+                                                goto next_ns;
                                         }
                                         connected = 1;
                                 }
-                                if (send(s, buf, buflen, 0) != buflen) {
-#ifdef DEBUG
-                                        if (_res.options & RES_DEBUG)
-                                                perror("send");
-#endif
-                                        continue;
+                                if (send(s, (char*)buf, buflen, 0) != buflen) {
+                                        Perror(stderr, "send", errno);
+                                        badns |= (1 << ns);
+                                        res_close();
+                                        goto next_ns;
                                 }
                         } else {
                                 /*
@@ -326,134 +622,213 @@ res_send(buf, buflen, answer, anslen)
                                  * for responses from more than one server.
                                  */
                                 if (connected) {
-                                        (void) connect(s, &no_addr,
-                                            sizeof(no_addr));
+#if CAN_RECONNECT
+#ifdef INET6
+                                        /* XXX: any errornous address */
+#endif /* INET6 */
+                                        struct sockaddr_in no_addr;
+
+                                        no_addr.sin_family = AF_INET;
+                                        no_addr.sin_addr.s_addr = INADDR_ANY;
+                                        no_addr.sin_port = 0;
+                                        (void) connect(s,
+                                                       (struct sockaddr *)
+                                                        &no_addr,
+                                                       sizeof(no_addr));
+#else
+                                        int s1 = socket(af, SOCK_DGRAM,0);
+                                        if (s1 < 0)
+                                                goto bad_dg_sock;
+                                        (void) dup2(s1, s);
+                                        (void) close(s1);
+                                        Dprint(_resp->options & RES_DEBUG,
+                                               (stdout, ";; new DG socket\n"))
+#endif
+#ifdef IPV6_MINMTU
+                                        if (af == AF_INET6) {
+                                                const int yes = 1;
+                                                (void)setsockopt(s, IPPROTO_IPV6,
+                                                    IPV6_USE_MIN_MTU, &yes,
+                                                    sizeof(yes));
+                                        }
+#endif
                                         connected = 0;
+                                        errno = 0;
                                 }
-                                if (sendto(s, buf, buflen, 0,
-                                    (struct sockaddr *)&_res.nsaddr_list[ns],
-                                    sizeof(struct sockaddr)) != buflen) {
-#ifdef DEBUG
-                                        if (_res.options & RES_DEBUG)
-                                                perror("sendto");
-#endif
-                                        continue;
+                                if (sendto(s, (char*)buf, buflen, 0,
+                                           nsap, salen) != buflen) {
+                                        Aerror(stderr, "sendto", errno, nsap);
+                                        badns |= (1 << ns);
+                                        res_close();
+                                        goto next_ns;
                                 }
                         }
 
                         /*
                          * Wait for reply
                          */
-                        timeout.tv_sec = (_res.retrans << try);
+                        timeout = 1000 * (_resp->retrans << try);
                         if (try > 0)
-                                timeout.tv_sec /= _res.nscount;
-                        if ((long) timeout.tv_sec <= 0)
-                                timeout.tv_sec = 1;
-                        timeout.tv_usec = 0;
-wait:
-                        FD_ZERO(&dsmask);
-                        FD_SET(s, &dsmask);
-                        n = select(s+1, &dsmask, (fd_set *)NULL,
-                                (fd_set *)NULL, &timeout);
+                                timeout /= _resp->nscount;
+                        if (timeout < 1000)
+                                timeout = 1000;
+    wait:
+                        pfd.fd = s;
+                        pfd.events = POLLIN;
+                        n = poll(&pfd, 1, timeout);
                         if (n < 0) {
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        perror("select");
-#endif
-                                continue;
+                                if (errno == EINTR)
+                                        goto wait;
+                                Perror(stderr, "poll", errno);
+                                res_close();
+                                goto next_ns;
                         }
                         if (n == 0) {
                                 /*
                                  * timeout
                                  */
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        printf(";; timeout\n");
-#endif
+                                Dprint(_resp->options & RES_DEBUG,
+                                       (stdout, ";; timeout\n"));
                                 gotsomewhere = 1;
-                                continue;
+                                res_close();
+                                goto next_ns;
                         }
-                        if ((resplen = recv(s, answer, anslen, 0)) <= 0) {
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        perror("recvfrom");
-#endif
-                                continue;
+                        errno = 0;
+                        fromlen = sizeof(from);
+                        resplen = recvfrom(s, (char*)ans, anssiz, 0,
+                                           (struct sockaddr *)&from, &fromlen);
+                        if (resplen <= 0) {
+                                Perror(stderr, "recvfrom", errno);
+                                res_close();
+                                goto next_ns;
                         }
                         gotsomewhere = 1;
-                        if (id != anhp->id) {
+                        if (hp->id != anhp->id) {
                                 /*
-                                 * response from old query, ignore it
+                                 * response from old query, ignore it.
+                                 * XXX - potential security hazard could
+                                 *       be detected here.
                                  */
-#ifdef DEBUG
-                                if ((_res.options & RES_DEBUG) ||
-                                    (_res.pfcode & RES_PRF_REPLY)) {
-                                        printf(";; old answer:\n");
-                                        __p_query(answer);
-                                }
+                                DprintQ((_resp->options & RES_DEBUG) ||
+                                        (_resp->pfcode & RES_PRF_REPLY),
+                                        (stdout, ";; old answer:\n"),
+                                        ans, (resplen>anssiz)?anssiz:resplen);
+                                goto wait;
+                        }
+#if CHECK_SRVR_ADDR
+                        if (!(_resp->options & RES_INSECURE1) &&
+                            !res_isourserver((struct sockaddr_in *)&from)) {
+                                /*
+                                 * response from wrong server? ignore it.
+                                 * XXX - potential security hazard could
+                                 *       be detected here.
+                                 */
+                                DprintQ((_resp->options & RES_DEBUG) ||
+                                        (_resp->pfcode & RES_PRF_REPLY),
+                                        (stdout, ";; not our server:\n"),
+                                        ans, (resplen>anssiz)?anssiz:resplen);
+                                goto wait;
+                        }
 #endif
+                        if (!(_resp->options & RES_INSECURE2) &&
+                            !res_queriesmatch(buf, buf + buflen,
+                                              ans, ans + anssiz)) {
+                                /*
+                                 * response contains wrong query? ignore it.
+                                 * XXX - potential security hazard could
+                                 *       be detected here.
+                                 */
+                                DprintQ((_resp->options & RES_DEBUG) ||
+                                        (_resp->pfcode & RES_PRF_REPLY),
+                                        (stdout, ";; wrong query name:\n"),
+                                        ans, (resplen>anssiz)?anssiz:resplen);
                                 goto wait;
                         }
-                        if (anhp->rcode == SERVFAIL || anhp->rcode == NOTIMP ||
+                        if (anhp->rcode == SERVFAIL ||
+                            anhp->rcode == NOTIMP ||
                             anhp->rcode == REFUSED) {
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG) {
-                                        printf("server rejected query:\n");
-                                        __p_query(answer);
-                                }
-#endif
-                                badns |= (1<<ns);
-                                continue;
+                                DprintQ(_resp->options & RES_DEBUG,
+                                        (stdout, "server rejected query:\n"),
+                                        ans, (resplen>anssiz)?anssiz:resplen);
+                                badns |= (1 << ns);
+                                res_close();
+                                /* don't retry if called from dig */
+                                if (!_resp->pfcode)
+                                        goto next_ns;
                         }
-                        if (!(_res.options & RES_IGNTC) && anhp->tc) {
+                        if (!(_resp->options & RES_IGNTC) && anhp->tc) {
                                 /*
                                  * get rest of answer;
                                  * use TCP with same server.
                                  */
-#ifdef DEBUG
-                                if (_res.options & RES_DEBUG)
-                                        printf(";; truncated answer\n");
-#endif
-                                (void) close(s);
-                                s = -1;
+                                Dprint(_resp->options & RES_DEBUG,
+                                       (stdout, ";; truncated answer\n"));
                                 v_circuit = 1;
-                                goto usevc;
+                                res_close();
+                                goto same_ns;
                         }
-                }
-#ifdef DEBUG
-                if (_res.options & RES_DEBUG)
-                        printf(";; got answer:\n");
-                if ((_res.options & RES_DEBUG) ||
-                    (_res.pfcode & RES_PRF_REPLY))
-                        __p_query(answer);
-#endif
+                } /*if vc/dg*/
+                Dprint((_resp->options & RES_DEBUG) ||
+                       ((_resp->pfcode & RES_PRF_REPLY) &&
+                        (_resp->pfcode & RES_PRF_HEAD1)),
+                       (stdout, ";; got answer:\n"));
+                DprintQ((_resp->options & RES_DEBUG) ||
+                        (_resp->pfcode & RES_PRF_REPLY),
+                        (stdout, "%s", ""),
+                        ans, (resplen>anssiz)?anssiz:resplen);
                 /*
                  * If using virtual circuits, we assume that the first server
-                 * is preferred * over the rest (i.e. it is on the local
+                 * is preferred over the rest (i.e. it is on the local
                  * machine) and only keep that one open.
                  * If we have temporarily opened a virtual circuit,
                  * or if we haven't been asked to keep a socket open,
                  * close the socket.
                  */
-                if ((v_circuit &&
-                    ((_res.options & RES_USEVC) == 0 || ns != 0)) ||
-                    (_res.options & RES_STAYOPEN) == 0) {
-                        (void) close(s);
-                        s = -1;
+                if ((v_circuit && (!(_resp->options & RES_USEVC) || ns != 0)) ||
+                    !(_resp->options & RES_STAYOPEN)) {
+                        res_close();
+                }
+                if (Rhook) {
+                        int done = 0, loops = 0;
+
+                        do {
+                                res_sendhookact act;
+
+                                act = (*Rhook)((struct sockaddr_in *)nsap,
+                                               buf, buflen,
+                                               ans, anssiz, &resplen);
+                                switch (act) {
+                                case res_goahead:
+                                case res_done:
+                                        done = 1;
+                                        break;
+                                case res_nextns:
+                                        res_close();
+                                        goto next_ns;
+                                case res_modified:
+                                        /* give the hook another try */
+                                        if (++loops < 42) /*doug adams*/
+                                                break;
+                                        /*FALLTHROUGH*/
+                                case res_error:
+                                        /*FALLTHROUGH*/
+                                default:
+                                        return (-1);
+                                }
+                        } while (!done);
+
                 }
                 return (resplen);
-           }
-        }
-        if (s >= 0) {
-                (void) close(s);
-                s = -1;
-        }
-        if (v_circuit == 0)
-                if (gotsomewhere == 0)
+    next_ns: ;
+           } /*foreach ns*/
+        } /*foreach retry*/
+        res_close();
+        if (!v_circuit) {
+                if (!gotsomewhere)
                         errno = ECONNREFUSED;   /* no nameservers found */
                 else
                         errno = ETIMEDOUT;      /* no answer obtained */
-        else
+        } else
                 errno = terrno;
         return (-1);
 }
@@ -465,10 +840,14 @@ wait:
  *
  * This routine is not expected to be user visible.
  */
-_res_close()
+void
+res_close(void)
 {
-        if (s != -1) {
+        if (s >= 0) {
                 (void) close(s);
                 s = -1;
+                connected = 0;
+                vc = 0;
+                af = 0;
         }
 }
diff --git a/src/lib/libc/net/resolver.3 b/src/lib/libc/net/resolver.3
index 99abe17f03..e820ea25ed 100644
--- a/src/lib/libc/net/resolver.3
+++ b/src/lib/libc/net/resolver.3
@@ -1,4 +1,4 @@
-.\"     $NetBSD: resolver.3,v 1.5 1995/02/25 06:21:02 cgd Exp $
+.\"     $OpenBSD: resolver.3,v 1.21 2007/05/31 19:19:30 jmc Exp $
 .\"
 .\" Copyright (c) 1985, 1991, 1993
 .\"     The Regents of the University of California.  All rights reserved.
@@ -11,11 +11,7 @@
 .\" 2. Redistributions in binary form must reproduce the above copyright
 .\"    notice, this list of conditions and the following disclaimer in the
 .\"    documentation and/or other materials provided with the distribution.
-.\" 3. All advertising materials mentioning features or use of this software
-.\"    must display the following acknowledgement:
-.\"     This product includes software developed by the University of
-.\"     California, Berkeley and its contributors.
-.\" 4. Neither the name of the University nor the names of its contributors
+.\" 3. Neither the name of the University nor the names of its contributors
 .\"    may be used to endorse or promote products derived from this software
 .\"    without specific prior written permission.
 .\"
@@ -31,11 +27,9 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.\"     @(#)resolver.3  8.1 (Berkeley) 6/4/93
-.\"
-.Dd June 4, 1993
+.Dd $Mdocdate: May 31 2007 $
 .Dt RESOLVER 3
-.Os BSD 4.3
+.Os
 .Sh NAME
 .Nm res_query ,
 .Nm res_search ,
@@ -50,69 +44,76 @@
 .Fd #include <netinet/in.h>
 .Fd #include <arpa/nameser.h>
 .Fd #include <resolv.h>
+.Ft int
 .Fo res_query
-.Fa "char *dname"
+.Fa "const char *dname"
 .Fa "int class"
 .Fa "int type"
-.Fa "u_char *answer"
+.Fa "unsigned char *answer"
 .Fa "int anslen"
 .Fc
+.Ft int
 .Fo res_search
-.Fa "char *dname"
+.Fa "const char *dname"
 .Fa "int class"
 .Fa "int type"
-.Fa "u_char *answer"
+.Fa "unsigned char *answer"
 .Fa "int anslen"
 .Fc
+.Ft int
 .Fo res_mkquery
 .Fa "int op"
-.Fa "char *dname"
+.Fa "const char *dname"
 .Fa "int class"
 .Fa "int type"
-.Fa "char *data"
+.Fa "const unsigned char *data"
 .Fa "int datalen"
-.Fa "struct rrec *newrr"
-.Fa "char *buf"
+.Fa "const unsigned char *newrr"
+.Fa "unsigned char *buf"
 .Fa "int buflen"
 .Fc
+.Ft int
 .Fo res_send
-.Fa "char *msg"
+.Fa "const unsigned char *msg"
 .Fa "int msglen"
-.Fa "char *answer"
+.Fa "unsigned char *answer"
 .Fa "int anslen"
 .Fc
-.Fn res_init 
+.Ft int
+.Fn res_init "void"
+.Ft int
 .Fo dn_comp
-.Fa "char *exp_dn"
-.Fa "char *comp_dn"
+.Fa "const char *exp_dn"
+.Fa "unsigned char *comp_dn"
 .Fa "int length"
-.Fa "char **dnptrs"
-.Fa "char **lastdnptr"
+.Fa "unsigned char **dnptrs"
+.Fa "unsigned char **lastdnptr"
 .Fc
+.Ft int
 .Fo dn_expand
-.Fa "u_char *msg"
-.Fa "u_char *eomorig"
-.Fa "u_char *comp_dn"
-.Fa "u_char *exp_dn"
+.Fa "const unsigned char *msg"
+.Fa "const unsigned char *eomorig"
+.Fa "const unsigned char *comp_dn"
+.Fa "char *exp_dn"
 .Fa "int length"
 .Fc
 .Sh DESCRIPTION
-These routines are used for making, sending and interpreting
+These routines are used for making, sending, and interpreting
 query and reply messages with Internet domain name servers.
 .Pp
 Global configuration and state information that is used by the
 resolver routines is kept in the structure
-.Em _res .
+.Li _res .
 Most of the values have reasonable defaults and can be ignored.
-Options
-stored in
-.Em _res.options
+Options stored in
+.Li _res.options
 are defined in
-.Pa resolv.h
+.Aq Pa resolv.h
 and are as follows.
-Options are stored as a simple bit mask containing the bitwise ``or''
+Options are stored as a simple bit mask containing the bitwise
+.Tn OR
 of the options enabled.
-.Bl -tag -width RES_DEFNAMES
+.Bl -tag -width RES_USE_INET6
 .It Dv RES_INIT
 True if the initial name server address and default domain name are
 initialized (i.e.,
@@ -137,8 +138,7 @@ Used with
 .Dv RES_USEVC
 to keep the
 .Tn TCP
-connection open between
-queries.
+connection open between queries.
 This is useful only in programs that regularly do many queries.
 .Tn UDP
 should be the normal mode used.
@@ -165,16 +165,28 @@ will search for host names in the current domain and in parent domains; see
 This is used by the standard host lookup routine
 .Xr gethostbyname 3 .
 This option is enabled by default.
+.It Dv RES_USE_INET6
+Enables support for IPv6-only applications.
+This causes IPv4 addresses to be returned as an IPv4 mapped address.
+For example, 10.1.1.1 will be returned as ::ffff:10.1.1.1.
+The option is not meaningful on
+.Ox .
+.It Dv RES_USE_EDNS0
+Enables support for OPT pseudo-RR for EDNS0 extension.
+With this option, resolver code will attach OPT pseudo-RR into DNS queries,
+to inform of our receive buffer size.
+The option will allow DNS servers to take advantage of non-default receive
+buffer size, and to send larger replies.
+DNS query packets with EDNS0 extension is not compatible with
+non-EDNS0 DNS servers.
 .El
 .Pp
 The
 .Fn res_init
-routine
-reads the configuration file (if any; see
+routine reads the configuration file (if any; see
 .Xr resolv.conf 5 )
-to get the default domain name,
-search list and
-the Internet address of the local name server(s).
+to get the default domain name, search list, and the Internet address
+of the local name server(s).
 If no server is configured, the host running
 the resolver is tried.
 The current domain name is defined by the hostname
@@ -212,20 +224,26 @@ The query requests information of the specified
 .Fa type
 and
 .Fa class
-for the specified fully-qualified domain name
+for the specified fully qualified domain name
 .Fa dname .
 The reply message is left in the
 .Fa answer
 buffer with length
 .Fa anslen
 supplied by the caller.
+Values for the
+.Fa class
+and
+.Fa type
+fields
+are defined in
+.Aq Pa arpa/nameser.h .
 .Pp
 The
 .Fn res_search
 routine makes a query and awaits a response like
 .Fn res_query ,
-but in addition, it implements the default and search rules
-controlled by the
+but in addition, it implements the default and search rules controlled by the
 .Dv RES_DEFNAMES
 and
 .Dv RES_DNSRCH
@@ -236,11 +254,9 @@ The remaining routines are lower-level routines used by
 .Fn res_query .
 The
 .Fn res_mkquery
-function
-constructs a standard query message and places it in
+function constructs a standard query message and places it in
 .Fa buf .
-It returns the size of the query, or \-1 if the query is
-larger than
+It returns the size of the query, or \-1 if the query is larger than
 .Fa buflen .
 The query type
 .Fa op
@@ -250,26 +266,23 @@ but can be any of the query types defined in
 .Aq Pa arpa/nameser.h .
 The domain name for the query is given by
 .Fa dname .
-.Fa Newrr
+.Fa newrr
 is currently unused but is intended for making update messages.
 .Pp
 The
 .Fn res_send
-routine
-sends a pre-formatted query and returns an answer.
+routine sends a pre-formatted query and returns an answer.
 It will call
 .Fn res_init
 if
 .Dv RES_INIT
 is not set, send the query to the local name server, and
 handle timeouts and retries.
-The length of the reply message is returned, or
-\-1 if there were errors.
+The length of the reply message is returned, or \-1 if there were errors.
 .Pp
 The
 .Fn dn_comp
-function
-compresses the domain name
+function compresses the domain name
 .Fa exp_dn
 and stores it in
 .Fa comp_dn .
@@ -278,24 +291,23 @@ The size of the array pointed to by
 .Fa comp_dn
 is given by
 .Fa length .
-The compression uses
-an array of pointers
+The compression uses an array of pointers
 .Fa dnptrs
-to previously-compressed names in the current message.
-The first pointer points to
+to previously compressed names in the current message.
+The first pointer points
 to the beginning of the message and the list ends with
 .Dv NULL .
 The limit to the array is specified by
 .Fa lastdnptr .
 A side effect of
 .Fn dn_comp
-is to update the list of pointers for
-labels inserted into the message
+is to update the list of pointers for labels inserted into the message
 as the name is compressed.
 If
-.Em dnptr
+.Fa dnptrs
 is
-.Dv NULL, names are not compressed.
+.Dv NULL ,
+names are not compressed.
 If
 .Fa lastdnptr
 is
@@ -304,10 +316,9 @@ the list of labels is not updated.
 .Pp
 The
 .Fn dn_expand
-entry
-expands the compressed domain name
+entry expands the compressed domain name
 .Fa comp_dn
-to a full domain name
+to a full domain name.
 The compressed name is contained in a query or reply message;
 .Fa msg
 is a pointer to the beginning of the message.
@@ -317,28 +328,27 @@ which is of size
 .Fa length .
 The size of compressed name is returned or \-1 if there was an error.
 .Sh FILES
-.Bl -tag -width Pa
-/etc/resolv.conf
-The configuration file
-see
-.Xr resolv.conf 5 .
+.Bl -tag -width "/etc/resolv.confXX"
+.It Pa /etc/resolv.conf
+The configuration file.
 .El
 .Sh SEE ALSO
 .Xr gethostbyname 3 ,
-.Xr named 8 ,
 .Xr resolv.conf 5 ,
 .Xr hostname 7 ,
+.Xr named 8
 .Pp
-.%T RFC1032 ,
-.%T RFC1033 ,
-.%T RFC1034 ,
-.%T RFC1035 ,
-.%T RFC974
+.%T RFC 974 ,
+.%T RFC 1032 ,
+.%T RFC 1033 ,
+.%T RFC 1034 ,
+.%T RFC 1035 ,
+.%T RFC 1535
 .Rs
 .%T "Name Server Operations Guide for BIND"
 .Re
 .Sh HISTORY
 The
 .Nm
-function appeared in 
+function appeared in
 .Bx 4.3 .
diff --git a/src/lib/libc/net/rresvport.c b/src/lib/libc/net/rresvport.c
new file mode 100644
index 0000000000..ccc411500b
--- /dev/null
+++ b/src/lib/libc/net/rresvport.c
@@ -0,0 +1,107 @@
+/* $OpenBSD: rresvport.c,v 1.9 2005/11/10 10:00:17 espie Exp $ */
+/*
+ * Copyright (c) 1995, 1996, 1998 Theo de Raadt.  All rights reserved.
+ * Copyright (c) 1983, 1993, 1994
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <signal.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <unistd.h>
+#include <pwd.h>
+#include <errno.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <string.h>
+#include <syslog.h>
+#include <stdlib.h>
+#include <netgroup.h>
+
+int
+rresvport(int *alport)
+{
+        return rresvport_af(alport, AF_INET);
+}
+
+
+int
+rresvport_af(int *alport, int af)
+{
+        struct sockaddr_storage ss;
+        struct sockaddr *sa;
+        u_int16_t *portp;
+        int s;
+
+        bzero(&ss, sizeof ss);
+        sa = (struct sockaddr *)&ss;
+
+        switch (af) {
+        case AF_INET:
+                sa->sa_len = sizeof(struct sockaddr_in);
+                portp = &((struct sockaddr_in *)sa)->sin_port;
+                break;
+        case AF_INET6:
+                sa->sa_len = sizeof(struct sockaddr_in6);
+                portp = &((struct sockaddr_in6 *)sa)->sin6_port;
+                break;
+        default:
+                errno = EPFNOSUPPORT;
+                return (-1);
+        }
+        sa->sa_family = af;
+        
+        s = socket(af, SOCK_STREAM, 0);
+        if (s < 0)
+                return (-1);
+
+        *portp = htons(*alport);
+        if (*alport < IPPORT_RESERVED - 1) {
+                if (bind(s, sa, sa->sa_len) >= 0)
+                        return (s);
+                if (errno != EADDRINUSE) {
+                        (void)close(s);
+                        return (-1);
+                }
+        }
+
+        *portp = 0;
+        sa->sa_family = af;
+        if (bindresvport_sa(s, sa) == -1) {
+                (void)close(s);
+                return (-1);
+        }
+        *alport = ntohs(*portp);
+        return (s);
+}
diff --git a/src/lib/libc/net/rthdr.c b/src/lib/libc/net/rthdr.c
new file mode 100644
index 0000000000..d10334e027
--- /dev/null
+++ b/src/lib/libc/net/rthdr.c
@@ -0,0 +1,378 @@
+/*      $OpenBSD: rthdr.c,v 1.8 2006/12/09 01:12:28 itojun Exp $        */
+/*      $KAME: rthdr.c,v 1.22 2006/02/09 08:18:58 keiichi Exp $ */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/types.h>
+#include <sys/socket.h>
+
+#include <netinet/in.h>
+#include <netinet/ip6.h>
+
+#include <string.h>
+#include <stdio.h>
+
+/*
+ * RFC2292 API
+ */
+
+size_t
+inet6_rthdr_space(int type, int seg)
+{
+        switch (type) {
+        case IPV6_RTHDR_TYPE_0:
+                if (seg < 1 || seg > 23)
+                        return (0);
+                return (CMSG_SPACE(sizeof(struct in6_addr) * seg +
+                    sizeof(struct ip6_rthdr0)));
+        default:
+                return (0);
+        }
+}
+
+struct cmsghdr *
+inet6_rthdr_init(void *bp, int type)
+{
+        struct cmsghdr *ch = (struct cmsghdr *)bp;
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(ch);
+
+        ch->cmsg_level = IPPROTO_IPV6;
+        ch->cmsg_type = IPV6_RTHDR;
+
+        switch (type) {
+        case IPV6_RTHDR_TYPE_0:
+                ch->cmsg_len = CMSG_LEN(sizeof(struct ip6_rthdr0));
+                bzero(rthdr, sizeof(struct ip6_rthdr0));
+                rthdr->ip6r_type = IPV6_RTHDR_TYPE_0;
+                return (ch);
+        default:
+                return (NULL);
+        }
+}
+
+int
+inet6_rthdr_add(struct cmsghdr *cmsg, const struct in6_addr *addr, u_int flags)
+{
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(cmsg);
+
+        switch (rthdr->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+        {
+                struct ip6_rthdr0 *rt0 = (struct ip6_rthdr0 *)rthdr;
+                if (flags != IPV6_RTHDR_LOOSE)
+                        return (-1);
+                if (rt0->ip6r0_segleft == 23)
+                        return (-1);
+                rt0->ip6r0_segleft++;
+                bcopy(addr, (caddr_t)rt0 + ((rt0->ip6r0_len + 1) << 3),
+                    sizeof(struct in6_addr));
+                rt0->ip6r0_len += sizeof(struct in6_addr) >> 3;
+                cmsg->cmsg_len = CMSG_LEN((rt0->ip6r0_len + 1) << 3);
+                break;
+        }
+        default:
+                return (-1);
+        }
+
+        return (0);
+}
+
+int
+inet6_rthdr_lasthop(struct cmsghdr *cmsg, unsigned int flags)
+{
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(cmsg);
+
+        switch (rthdr->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+        {
+                struct ip6_rthdr0 *rt0 = (struct ip6_rthdr0 *)rthdr;
+                if (flags != IPV6_RTHDR_LOOSE)
+                        return (-1);
+                if (rt0->ip6r0_segleft > 23)
+                        return (-1);
+                break;
+        }
+        default:
+                return (-1);
+        }
+
+        return (0);
+}
+
+#if 0
+int
+inet6_rthdr_reverse(in, out)
+        const struct cmsghdr *in;
+        struct cmsghdr *out;
+{
+
+        return (-1);
+}
+#endif
+
+int
+inet6_rthdr_segments(const struct cmsghdr *cmsg)
+{
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(cmsg);
+
+        switch (rthdr->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+        {
+                struct ip6_rthdr0 *rt0 = (struct ip6_rthdr0 *)rthdr;
+
+                if (rt0->ip6r0_len % 2 || 46 < rt0->ip6r0_len)
+                        return (-1);
+
+                return (rt0->ip6r0_len * 8) / sizeof(struct in6_addr);
+        }
+
+        default:
+                return (-1);
+        }
+}
+
+struct in6_addr *
+inet6_rthdr_getaddr(struct cmsghdr *cmsg, int index)
+{
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(cmsg);
+
+        switch (rthdr->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+        {
+                struct ip6_rthdr0 *rt0 = (struct ip6_rthdr0 *)rthdr;
+                int naddr;
+
+                if (rt0->ip6r0_len % 2 || 46 < rt0->ip6r0_len)
+                        return NULL;
+                naddr = (rt0->ip6r0_len * 8) / sizeof(struct in6_addr);
+                if (index <= 0 || naddr < index)
+                        return NULL;
+                return ((struct in6_addr *)(rt0 + 1)) + index;
+        }
+
+        default:
+                return NULL;
+        }
+}
+
+int
+inet6_rthdr_getflags(const struct cmsghdr *cmsg, int index)
+{
+        struct ip6_rthdr *rthdr;
+
+        rthdr = (struct ip6_rthdr *)CMSG_DATA(cmsg);
+
+        switch (rthdr->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+        {
+                struct ip6_rthdr0 *rt0 = (struct ip6_rthdr0 *)rthdr;
+                int naddr;
+
+                if (rt0->ip6r0_len % 2 || 46 < rt0->ip6r0_len)
+                        return (-1);
+                naddr = (rt0->ip6r0_len * 8) / sizeof(struct in6_addr);
+                if (index < 0 || naddr < index)
+                        return (-1);
+                return IPV6_RTHDR_LOOSE;
+        }
+
+        default:
+                return (-1);
+        }
+}
+
+/*
+ * RFC3542 (2292bis) API
+ */
+
+socklen_t
+inet6_rth_space(int type, int segments)
+{
+        switch (type) {
+        case IPV6_RTHDR_TYPE_0:
+                return (((segments * 2) + 1) << 3);
+        default:
+                return (0);     /* type not suppported */
+        }
+}
+
+void *
+inet6_rth_init(void *bp, socklen_t bp_len, int type, int segments)
+{
+        struct ip6_rthdr *rth = (struct ip6_rthdr *)bp;
+        struct ip6_rthdr0 *rth0;
+
+        switch (type) {
+        case IPV6_RTHDR_TYPE_0:
+                /* length validation */
+                if (bp_len < inet6_rth_space(IPV6_RTHDR_TYPE_0, segments))
+                        return (NULL);
+
+                memset(bp, 0, bp_len);
+                rth0 = (struct ip6_rthdr0 *)rth;
+                rth0->ip6r0_len = segments * 2;
+                rth0->ip6r0_type = IPV6_RTHDR_TYPE_0;
+                rth0->ip6r0_segleft = 0;
+                rth0->ip6r0_reserved = 0;
+                break;
+        default:
+                return (NULL);  /* type not supported */
+        }
+
+        return (bp);
+}
+
+int
+inet6_rth_add(void *bp, const struct in6_addr *addr)
+{
+        struct ip6_rthdr *rth = (struct ip6_rthdr *)bp;
+        struct ip6_rthdr0 *rth0;
+        struct in6_addr *nextaddr;
+
+        switch (rth->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+                rth0 = (struct ip6_rthdr0 *)rth;
+                nextaddr = (struct in6_addr *)(rth0 + 1) + rth0->ip6r0_segleft;
+                *nextaddr = *addr;
+                rth0->ip6r0_segleft++;
+                break;
+        default:
+                return (-1);    /* type not supported */
+        }
+
+        return (0);
+}
+
+int
+inet6_rth_reverse(const void *in, void *out)
+{
+        struct ip6_rthdr *rth_in = (struct ip6_rthdr *)in;
+        struct ip6_rthdr0 *rth0_in, *rth0_out;
+        int i, segments;
+
+        switch (rth_in->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+                rth0_in = (struct ip6_rthdr0 *)in;
+                rth0_out = (struct ip6_rthdr0 *)out;
+
+                /* parameter validation XXX too paranoid? */
+                if (rth0_in->ip6r0_len % 2)
+                        return (-1);
+                segments = rth0_in->ip6r0_len / 2;
+
+                /* we can't use memcpy here, since in and out may overlap */
+                memmove((void *)rth0_out, (void *)rth0_in,
+                        ((rth0_in->ip6r0_len) + 1) << 3);
+                rth0_out->ip6r0_segleft = segments;
+
+                /* reverse the addresses */
+                for (i = 0; i < segments / 2; i++) {
+                        struct in6_addr addr_tmp, *addr1, *addr2;
+
+                        addr1 = (struct in6_addr *)(rth0_out + 1) + i;
+                        addr2 = (struct in6_addr *)(rth0_out + 1) +
+                            (segments - i - 1);
+                        addr_tmp = *addr1;
+                        *addr1 = *addr2;
+                        *addr2 = addr_tmp;
+                }
+                
+                break;
+        default:
+                return (-1);    /* type not supported */
+        }
+
+        return (0);
+}
+
+int
+inet6_rth_segments(const void *bp)
+{
+        struct ip6_rthdr *rh = (struct ip6_rthdr *)bp;
+        struct ip6_rthdr0 *rh0;
+        int addrs;
+
+        switch (rh->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+                rh0 = (struct ip6_rthdr0 *)bp;
+
+                /*
+                 * Validation for a type-0 routing header.
+                 * Is this too strict?
+                 */
+                if ((rh0->ip6r0_len % 2) != 0 ||
+                    (addrs = (rh0->ip6r0_len >> 1)) < rh0->ip6r0_segleft)
+                        return (-1);
+
+                return (addrs);
+        default:
+                return (-1);    /* unknown type */
+        }
+}
+
+struct in6_addr *
+inet6_rth_getaddr(const void *bp, int idx)
+{
+        struct ip6_rthdr *rh = (struct ip6_rthdr *)bp;
+        struct ip6_rthdr0 *rh0;
+        int addrs;
+
+        switch (rh->ip6r_type) {
+        case IPV6_RTHDR_TYPE_0:
+                 rh0 = (struct ip6_rthdr0 *)bp;
+                 
+                /*
+                 * Validation for a type-0 routing header.
+                 * Is this too strict?
+                 */
+                if ((rh0->ip6r0_len % 2) != 0 ||
+                    (addrs = (rh0->ip6r0_len >> 1)) < rh0->ip6r0_segleft)
+                        return (NULL);
+
+                if (idx < 0 || addrs <= idx)
+                        return (NULL);
+
+                return (((struct in6_addr *)(rh0 + 1)) + idx);
+        default:
+                return (NULL);  /* unknown type */
+                break;
+        }
+}
diff --git a/src/lib/libc/net/ruserok.c b/src/lib/libc/net/ruserok.c
new file mode 100644
index 0000000000..5ef078ac95
--- /dev/null
+++ b/src/lib/libc/net/ruserok.c
@@ -0,0 +1,437 @@
+/*
+ * Copyright (c) 1995, 1996, 1998 Theo de Raadt.  All rights reserved.
+ * Copyright (c) 1983, 1993, 1994
+ *      The Regents of the University of California.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the University nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/param.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+
+#include <netinet/in.h>
+#include <arpa/inet.h>
+
+#include <signal.h>
+#include <fcntl.h>
+#include <netdb.h>
+#include <unistd.h>
+#include <pwd.h>
+#include <errno.h>
+#include <stdio.h>
+#include <ctype.h>
+#include <string.h>
+#include <syslog.h>
+#include <stdlib.h>
+#include <netgroup.h>
+
+int     __ivaliduser(FILE *, in_addr_t, const char *, const char *);
+int     __ivaliduser_sa(FILE *, struct sockaddr *, socklen_t,
+            const char *, const char *);
+static int __icheckhost(struct sockaddr *, socklen_t, const char *);
+static char *__gethostloop(struct sockaddr *, socklen_t);
+
+int     __check_rhosts_file = 1;
+char    *__rcmd_errstr;
+
+int
+ruserok(const char *rhost, int superuser, const char *ruser, const char *luser)
+{
+        struct addrinfo hints, *res, *r;
+        int error;
+
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = PF_UNSPEC;
+        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
+        error = getaddrinfo(rhost, "0", &hints, &res);
+        if (error)
+                return (-1);
+
+        for (r = res; r; r = r->ai_next) {
+                if (iruserok_sa(r->ai_addr, r->ai_addrlen, superuser, ruser,
+                    luser) == 0) {
+                        freeaddrinfo(res);
+                        return (0);
+                }
+        }
+        freeaddrinfo(res);
+        return (-1);
+}
+
+/*
+ * New .rhosts strategy: We are passed an ip address. We spin through
+ * hosts.equiv and .rhosts looking for a match. When the .rhosts only
+ * has ip addresses, we don't have to trust a nameserver.  When it
+ * contains hostnames, we spin through the list of addresses the nameserver
+ * gives us and look for a match.
+ *
+ * Returns 0 if ok, -1 if not ok.
+ */
+int
+iruserok(u_int32_t raddr, int superuser, const char *ruser, const char *luser)
+{
+        struct sockaddr_in sin;
+
+        memset(&sin, 0, sizeof(sin));
+        sin.sin_family = AF_INET;
+        sin.sin_len = sizeof(struct sockaddr_in);
+        memcpy(&sin.sin_addr, &raddr, sizeof(sin.sin_addr));
+        return iruserok_sa(&sin, sizeof(struct sockaddr_in), superuser, ruser,
+                    luser);
+}
+
+int
+iruserok_sa(const void *raddr, int rlen, int superuser, const char *ruser,
+    const char *luser)
+{
+        struct sockaddr *sa;
+        char *cp;
+        struct stat sbuf;
+        struct passwd *pwd;
+        FILE *hostf;
+        uid_t uid;
+        int first;
+        char pbuf[MAXPATHLEN];
+
+        sa = (struct sockaddr *)raddr;
+        first = 1;
+        hostf = superuser ? NULL : fopen(_PATH_HEQUIV, "r");
+again:
+        if (hostf) {
+                if (__ivaliduser_sa(hostf, sa, rlen, luser, ruser) == 0) {
+                        (void)fclose(hostf);
+                        return (0);
+                }
+                (void)fclose(hostf);
+        }
+        if (first == 1 && (__check_rhosts_file || superuser)) {
+                int len;
+
+                first = 0;
+                if ((pwd = getpwnam(luser)) == NULL)
+                        return (-1);
+                len = snprintf(pbuf, sizeof pbuf, "%s/.rhosts", pwd->pw_dir);
+                if (len < 0 || len >= sizeof pbuf)
+                        return (-1);
+
+                /*
+                 * Change effective uid while opening .rhosts.  If root and
+                 * reading an NFS mounted file system, can't read files that
+                 * are protected read/write owner only.
+                 */
+                uid = geteuid();
+                (void)seteuid(pwd->pw_uid);
+                hostf = fopen(pbuf, "r");
+                (void)seteuid(uid);
+
+                if (hostf == NULL)
+                        return (-1);
+                /*
+                 * If not a regular file, or is owned by someone other than
+                 * user or root or if writeable by anyone but the owner, quit.
+                 */
+                cp = NULL;
+                if (lstat(pbuf, &sbuf) < 0)
+                        cp = ".rhosts lstat failed";
+                else if (!S_ISREG(sbuf.st_mode))
+                        cp = ".rhosts not regular file";
+                else if (fstat(fileno(hostf), &sbuf) < 0)
+                        cp = ".rhosts fstat failed";
+                else if (sbuf.st_uid && sbuf.st_uid != pwd->pw_uid)
+                        cp = "bad .rhosts owner";
+                else if (sbuf.st_mode & (S_IWGRP|S_IWOTH))
+                        cp = ".rhosts writable by other than owner";
+                /* If there were any problems, quit. */
+                if (cp) {
+                        __rcmd_errstr = cp;
+                        (void)fclose(hostf);
+                        return (-1);
+                }
+                goto again;
+        }
+        return (-1);
+}
+
+/*
+ * XXX
+ * Don't make static, used by lpd(8).
+ *
+ * Returns 0 if ok, -1 if not ok.
+ */
+int
+__ivaliduser(FILE *hostf, in_addr_t raddrl, const char *luser,
+    const char *ruser)
+{
+        struct sockaddr_in sin;
+
+        memset(&sin, 0, sizeof(sin));
+        sin.sin_family = AF_INET;
+        sin.sin_len = sizeof(struct sockaddr_in);
+        memcpy(&sin.sin_addr, &raddrl, sizeof(sin.sin_addr));
+        return __ivaliduser_sa(hostf, (struct sockaddr *)&sin, sin.sin_len,
+                    luser, ruser);
+}
+
+int
+__ivaliduser_sa(FILE *hostf, struct sockaddr *raddr, socklen_t salen,
+    const char *luser, const char *ruser)
+{
+        char *user, *p;
+        char *buf;
+        const char *auser, *ahost;
+        int hostok, userok;
+        char *rhost = (char *)-1;
+        char domain[MAXHOSTNAMELEN];
+        size_t buflen;
+
+        getdomainname(domain, sizeof(domain));
+
+        while ((buf = fgetln(hostf, &buflen))) {
+                p = buf;
+                if (*p == '#')
+                        continue;
+                while (p < buf + buflen && *p != '\n' && *p != ' ' && *p != '\t') {
+                        if (!isprint(*p))
+                                goto bail;
+                        *p = isupper(*p) ? tolower(*p) : *p;
+                        p++;
+                }
+                if (p >= buf + buflen)
+                        continue;
+                if (*p == ' ' || *p == '\t') {
+                        *p++ = '\0';
+                        while (p < buf + buflen && (*p == ' ' || *p == '\t'))
+                                p++;
+                        if (p >= buf + buflen)
+                                continue;
+                        user = p;
+                        while (p < buf + buflen && *p != '\n' && *p != ' ' &&
+                            *p != '\t') {
+                                if (!isprint(*p))
+                                        goto bail;
+                                p++;
+                        }
+                } else
+                        user = p;
+                *p = '\0';
+
+                if (p == buf)
+                        continue;
+
+                auser = *user ? user : luser;
+                ahost = buf;
+
+                if (strlen(ahost) >= MAXHOSTNAMELEN)
+                        continue;
+
+                /*
+                 * innetgr() must lookup a hostname (we do not attempt
+                 * to change the semantics so that netgroups may have
+                 * #.#.#.# addresses in the list.)
+                 */
+                if (ahost[0] == '+')
+                        switch (ahost[1]) {
+                        case '\0':
+                                hostok = 1;
+                                break;
+                        case '@':
+                                if (rhost == (char *)-1)
+                                        rhost = __gethostloop(raddr, salen);
+                                hostok = 0;
+                                if (rhost)
+                                        hostok = innetgr(&ahost[2], rhost,
+                                            NULL, domain);
+                                break;
+                        default:
+                                hostok = __icheckhost(raddr, salen, &ahost[1]);
+                                break;
+                        }
+                else if (ahost[0] == '-')
+                        switch (ahost[1]) {
+                        case '\0':
+                                hostok = -1;
+                                break;
+                        case '@':
+                                if (rhost == (char *)-1)
+                                        rhost = __gethostloop(raddr, salen);
+                                hostok = 0;
+                                if (rhost)
+                                        hostok = -innetgr(&ahost[2], rhost,
+                                            NULL, domain);
+                                break;
+                        default:
+                                hostok = -__icheckhost(raddr, salen, &ahost[1]);
+                                break;
+                        }
+                else
+                        hostok = __icheckhost(raddr, salen, ahost);
+
+
+                if (auser[0] == '+')
+                        switch (auser[1]) {
+                        case '\0':
+                                userok = 1;
+                                break;
+                        case '@':
+                                userok = innetgr(&auser[2], NULL, ruser,
+                                    domain);
+                                break;
+                        default:
+                                userok = strcmp(ruser, &auser[1]) ? 0 : 1;
+                                break;
+                        }
+                else if (auser[0] == '-')
+                        switch (auser[1]) {
+                        case '\0':
+                                userok = -1;
+                                break;
+                        case '@':
+                                userok = -innetgr(&auser[2], NULL, ruser,
+                                    domain);
+                                break;
+                        default:
+                                userok = strcmp(ruser, &auser[1]) ? 0 : -1;
+                                break;
+                        }
+                else
+                        userok = strcmp(ruser, auser) ? 0 : 1;
+
+                /* Check if one component did not match */
+                if (hostok == 0 || userok == 0)
+                        continue;
+
+                /* Check if we got a forbidden pair */
+                if (userok <= -1 || hostok <= -1)
+                        return (-1);
+
+                /* Check if we got a valid pair */
+                if (hostok >= 1 && userok >= 1)
+                        return (0);
+        }
+bail:
+        return (-1);
+}
+
+/*
+ * Returns "true" if match, 0 if no match.  If we do not find any
+ * semblance of an A->PTR->A loop, allow a simple #.#.#.# match to work.
+ */
+static int
+__icheckhost(struct sockaddr *raddr, socklen_t salen, const char *lhost)
+{
+        struct addrinfo hints, *res, *r;
+        char h1[NI_MAXHOST], h2[NI_MAXHOST];
+        int error;
+        const int niflags = NI_NUMERICHOST;
+
+        h1[0] = '\0';
+        if (getnameinfo(raddr, salen, h1, sizeof(h1), NULL, 0,
+            niflags) != 0)
+                return (0);
+
+        /* Resolve laddr into sockaddr */
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = raddr->sa_family;
+        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
+        res = NULL;
+        error = getaddrinfo(lhost, "0", &hints, &res);
+        if (error)
+                return (0);
+
+        /*
+         * Try string comparisons between raddr and laddr.
+         */
+        for (r = res; r; r = r->ai_next) {
+                h2[0] = '\0';
+                if (getnameinfo(r->ai_addr, r->ai_addrlen, h2, sizeof(h2),
+                    NULL, 0, niflags) != 0)
+                        continue;
+                if (strcmp(h1, h2) == 0) {
+                        freeaddrinfo(res);
+                        return (1);
+                }
+        }
+
+        /* No match. */
+        freeaddrinfo(res);
+        return (0);
+}
+
+/*
+ * Return the hostname associated with the supplied address.
+ * Do a reverse lookup as well for security. If a loop cannot
+ * be found, pack the result of inet_ntoa() into the string.
+ */
+static char *
+__gethostloop(struct sockaddr *raddr, socklen_t salen)
+{
+        static char remotehost[NI_MAXHOST];
+        char h1[NI_MAXHOST], h2[NI_MAXHOST];
+        struct addrinfo hints, *res, *r;
+        int error;
+        const int niflags = NI_NUMERICHOST;
+
+        h1[0] = remotehost[0] = '\0';
+        if (getnameinfo(raddr, salen, remotehost, sizeof(remotehost),
+            NULL, 0, NI_NAMEREQD) != 0)
+                return (NULL);
+        if (getnameinfo(raddr, salen, h1, sizeof(h1), NULL, 0,
+            niflags) != 0)
+                return (NULL);
+
+        /*
+         * Look up the name and check that the supplied
+         * address is in the list
+         */
+        memset(&hints, 0, sizeof(hints));
+        hints.ai_family = raddr->sa_family;
+        hints.ai_socktype = SOCK_DGRAM; /*dummy*/
+        hints.ai_flags = AI_CANONNAME;
+        res = NULL;
+        error = getaddrinfo(remotehost, "0", &hints, &res);
+        if (error)
+                return (NULL);
+
+        for (r = res; r; r = r->ai_next) {
+                h2[0] = '\0';
+                if (getnameinfo(r->ai_addr, r->ai_addrlen, h2, sizeof(h2),
+                    NULL, 0, niflags) != 0)
+                        continue;
+                if (strcmp(h1, h2) == 0) {
+                        freeaddrinfo(res);
+                        return (remotehost);
+                }
+        }
+
+        /*
+         * either the DNS adminstrator has made a configuration
+         * mistake, or someone has attempted to spoof us
+         */
+        syslog(LOG_NOTICE, "rcmd: address %s not listed for host %s",
+            h1, res->ai_canonname ? res->ai_canonname : remotehost);
+        freeaddrinfo(res);
+        return (NULL);
+}
diff --git a/src/lib/libc/net/send.c b/src/lib/libc/net/send.c
index 88f3550ec6..1bfc80b87a 100644
--- a/src/lib/libc/net/send.c
+++ b/src/lib/libc/net/send.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: send.c,v 1.6 1995/02/25 06:21:02 cgd Exp $     */
-
+/*      $OpenBSD: send.c,v 1.5 2005/08/06 20:30:04 espie Exp $ */
 /*
  * Copyright (c) 1988, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,24 +28,13 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)send.c      8.2 (Berkeley) 2/21/94";
-#else
-static char rcsid[] = "$NetBSD: send.c,v 1.6 1995/02/25 06:21:02 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/types.h>
 #include <sys/socket.h>
 
 #include <stddef.h>
 
 ssize_t
-send(s, msg, len, flags)
-        int s, flags;
-        size_t len;
-        const void *msg;
+send(int s, const void *msg, size_t len, int flags)
 {
         return (sendto(s, msg, len, flags, NULL, 0));
 }
diff --git a/src/lib/libc/net/sethostent.c b/src/lib/libc/net/sethostent.c
index 00f6499695..6f6d0e405a 100644
--- a/src/lib/libc/net/sethostent.c
+++ b/src/lib/libc/net/sethostent.c
@@ -1,5 +1,4 @@
-/*      $NetBSD: sethostent.c,v 1.4 1995/02/25 06:21:03 cgd Exp $       */
-
+/*      $OpenBSD: sethostent.c,v 1.9 2005/08/06 20:30:04 espie Exp $ */
 /*
  * Copyright (c) 1985, 1993
  *      The Regents of the University of California.  All rights reserved.
@@ -12,11 +11,7 @@
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
- * 3. All advertising materials mentioning features or use of this software
- *    must display the following acknowledgement:
- *      This product includes software developed by the University of
- *      California, Berkeley and its contributors.
- * 4. Neither the name of the University nor the names of its contributors
+ * 3. Neither the name of the University nor the names of its contributors
  *    may be used to endorse or promote products derived from this software
  *    without specific prior written permission.
  *
@@ -33,30 +28,30 @@
  * SUCH DAMAGE.
  */
 
-#if defined(LIBC_SCCS) && !defined(lint)
-#if 0
-static char sccsid[] = "@(#)sethostent.c        8.1 (Berkeley) 6/4/93";
-#else
-static char rcsid[] = "$NetBSD: sethostent.c,v 1.4 1995/02/25 06:21:03 cgd Exp $";
-#endif
-#endif /* LIBC_SCCS and not lint */
-
 #include <sys/param.h>
 #include <netinet/in.h>
 #include <arpa/nameser.h>
 #include <netdb.h>
 #include <resolv.h>
 
+#include "thread_private.h"
+
 void
-sethostent(stayopen)
+sethostent(int stayopen)
 {
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+
+        if (_res_init(0) == -1)
+                return;
         if (stayopen)
-                _res.options |= RES_STAYOPEN | RES_USEVC;
+                _resp->options |= RES_STAYOPEN | RES_USEVC;
 }
 
 void
-endhostent()
+endhostent(void)
 {
-        _res.options &= ~(RES_STAYOPEN | RES_USEVC);
-        _res_close();
+        struct __res_state *_resp = _THREAD_PRIVATE(_res, _res, &_res);
+
+        _resp->options &= ~(RES_STAYOPEN | RES_USEVC);
+        res_close();
 }
diff --git a/src/lib/libc/net/vars6.c b/src/lib/libc/net/vars6.c
new file mode 100644
index 0000000000..a22d49d047
--- /dev/null
+++ b/src/lib/libc/net/vars6.c
@@ -0,0 +1,42 @@
+/*      $OpenBSD: vars6.c,v 1.2 2003/05/10 10:56:47 jmc Exp $   */
+
+/*
+ * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
+ * All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. Neither the name of the project nor the names of its contributors
+ *    may be used to endorse or promote products derived from this software
+ *    without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/types.h>
+#include <netinet/in.h>
+
+/*
+ * Definitions of some constant IPv6 addresses.
+ */
+const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
+const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
+const struct in6_addr in6addr_nodelocal_allnodes = IN6ADDR_NODELOCAL_ALLNODES_INIT;
+const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
+