WIP use user+net namespace

WIP namespaces.py
2024-06-24 16:31:21 +02:00 · 2024-06-24 16:30:09 +02:00
1780 changed files with 110244 additions and 88447 deletions
@@ -79,5 +79,3 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -78,5 +78,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -1540,11 +1540,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 79d93600116faabd89798522817ad95a69684fff
 # Reformat sources with up-to-date clang-format-18
 b7de2c7cb959fa35099d72c3f9b13938348c74e6
-# Reformat sources with up-to-date clang-format-19
-ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
-# Reformat sources with up-to-date clang-format-19
-ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
-# Remove redundant semicolons after the closing braces of functions
-1a19ce39db12ed4ecf59a3d0f5734656d24999a5
-# Remove redundant parentheses from the return statement
-0258850f202b7a46b52f3e3a4968c3fc68fe9a45
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/dtrace.sh		-export-ignore
+/util/mksymtbl.pl		-export-ignore
@@ -1 +0,0 @@
-contrib/gitchangelog/changelog.rc.py
@@ -96,7 +96,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop
@@ -12,14 +12,12 @@ confidential!
 | Deputy Incident Manager: | @user                                |
 | Public Disclosure Date:  | YYYY-MM-DD                           |
 | CVSS Score:              | [0.0][cvss_score]                    |
-| CWE:                     | [CWE-NNN][cwe_category]
 | Security Advisory:       | isc-private/printing-press!NNN       |
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |

 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[cwe_category]: https://cwe.mitre.org/data/definitions/NNN.html
 [mattermost_url]:

 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
@@ -31,13 +29,13 @@ confidential!
  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and the CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
-  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
+  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
+  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -48,20 +46,18 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_coordinate_check]  **(SwEng)** Make sure other vendors are able to release on the date that was previously agreed upon
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)

 ### At T-5

-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in the support portal with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 5 Day queue in RT with the text of the advisory (earliest, and T-5)
+  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
+  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
+  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes

-### At T-3
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 3 Day queue in RT with the text of the advisory (T-3)
-
 ### At T-1

  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
@@ -69,16 +65,15 @@ confidential!
 ### On the Day of Public Disclosure

  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the appropriate announce queue in RT that the release is published
+  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
+  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted

 ### After Public Disclosure

@@ -87,13 +82,13 @@ confidential!
 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-ticket-in-support-portal-earliest-queue-which-will-notify-earliest-customers
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
+[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -104,26 +99,25 @@ confidential!
 [step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
 [step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
 [step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_coordinate_check]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#make-sure-other-vendors-are-able-to-release-on-the-date-that-was-previously-agreed-upon
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-the-support-portal-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-5-day-queue-in-rt-with-the-text-of-the-advisory-earliest-and-t-5
+[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
+[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
+[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-3-day-queue-in-rt-with-the-text-of-the-advisory-t-3
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
+[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-tickets-in-the-asn-queues-in-rt-that-the-embargo-is-lifted
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#open-a-ticket-in-the-appropriate-announce-queue-in-rt-that-the-release-is-published
+[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches

 /confidential
@@ -1,5 +1,4 @@
 Alan Clegg <aclegg@isc.org>
-Alessio Podda <alessio@isc.org>
 Aram Sargsyan <aram@isc.org>
 Artem Boldariev <artem@isc.org> <artem@boldariev.com>
 Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
@@ -1,10 +1,4 @@
-[IMPORTS]
-
-deprecated-modules=
-    dns.resolver,
-
-[MESSAGES CONTROL]
-
+[MASTER]
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
@@ -12,17 +6,6 @@ disable=
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
    C0301, # line-too-long, handled better by black
-    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    R0901, # too-many-ancestors
-    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
-    R0904, # too-many-public-methods
-    R0911, # too-many-return-statements
-    R0912, # too-many-branches
-    R0913, # too-many-arguments
-    R0914, # too-many-locals
-    R0915, # too-many-statements
-    R0916, # too-many-boolean-expressions
-    R0917, # too-many-positional-arguments
@@ -6,9 +6,6 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
-  jobs:
-    pre_build:
-      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -16,3 +13,8 @@ sphinx:

 # Build all formats
 formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
@@ -26,6 +26,7 @@ Files: **/*.after*
       .gitlab/*
       .mailmap
       AUTHORS
+       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -73,11 +74,6 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/notify/CA/CA.cfg
-       bin/tests/system/notify/CA/README
-       bin/tests/system/notify/CA/index.txt
-       bin/tests/system/notify/CA/index.txt.attr
-       bin/tests/system/notify/CA/serial
       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
@@ -195,8 +191,6 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
-       contrib/gitchangelog/changelog.rc.py
-       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -21,6 +21,7 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
+	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -26,3 +26,4 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
+| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -20,6 +20,7 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
+1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -48,7 +49,8 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the [changelog](doc/arm/changelog.rst).
+the file [CHANGES](CHANGES). See [below](#changes) for details on the
+CHANGES file format.

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -161,9 +163,38 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

+### <a name="changes"/> Change log
+
+A detailed list of all changes that have been made throughout the
+development of BIND 9 is included in the file CHANGES, with the most recent
+changes listed first. Change notes include tags indicating the category of
+the change that was made; these categories are:
+
+|Category	|Description	        			|
+|--------------	|-----------------------------------------------|
+| [func] | New feature |
+| [bug] | General bug fix |
+| [security] | Fix for a significant security flaw |
+| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
+| [port] | Portability enhancement |
+| [maint] | Updates to built-in data such as root server addresses and keys |
+| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
+| [performance] | Other changes to improve server performance |
+| [protocol] | Updates to the DNS protocol such as new RR types |
+| [test] | Changes to the automatic tests, not affecting server functionality |
+| [cleanup] | Minor corrections and refactoring |
+| [doc] | Documentation |
+| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
+| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+
+In general, [func] and [experimental] tags only appear in new-feature
+releases (i.e., those with version numbers ending in zero). Some new
+functionality may be backported to older releases on a case-by-case basis.
+All other change types may be applied to all currently supported releases.
+
 #### Bug report identifiers

-Most notes in the ARM Changelog appendix include a reference to a bug report or
+Most notes in the CHANGES file include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -33,6 +33,7 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -42,6 +43,10 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include "check-tool.h"

 #ifndef CHECK_SIBLING
@@ -92,6 +97,13 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

+/*
+ * This needs to match the list in bin/named/log.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
 static isc_symtab_t *symtab = NULL;
 static isc_mem_t *sym_mctx;

@@ -112,7 +124,11 @@ add(char *key, int value) {
 	}

 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
+					   false, &symtab);
+		if (result != ISC_R_SUCCESS) {
+			return;
+		}
 	}

 	key = isc_mem_strdup(sym_mctx, key);
@@ -130,92 +146,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return false;
+		return (false);
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return true;
-	}
-	return false;
-}
-
-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
+		return (true);
 	}
+	return (false);
 }

 static bool
@@ -223,14 +161,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -238,7 +169,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;

 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -246,9 +177,15 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return answer;
+		return (answer);
 	}

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -258,9 +195,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -297,16 +234,16 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}

 	/*
@@ -433,27 +370,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
-	return answer;
+	freeaddrinfo(ai);
+	return (answer);
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -463,9 +398,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -498,10 +433,8 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -515,34 +448,34 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -552,9 +485,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -587,10 +520,8 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -604,28 +535,45 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

 isc_result_t
-setup_logging(FILE *errout) {
-	isc_logconfig_t *logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
-		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;

-	return ISC_R_SUCCESS;
+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_registercategories(log, categories);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
+	cfg_log_init(log);
+	ns_log_init(log);
+
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
+	return (ISC_R_SUCCESS);
 }

 /*% load the zone */
@@ -655,18 +603,18 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
-	dns_zone_setorigin(zone, origin);
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
+	CHECK(dns_zone_setorigin(zone, origin));
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
-		dns_zone_setstream(zone, stdin, fileformat,
-				   &dns_master_style_default);
+		CHECK(dns_zone_setstream(zone, stdin, fileformat,
+					 &dns_master_style_default));
 	} else {
-		dns_zone_setfile(zone, filename, fileformat,
-				 &dns_master_style_default);
+		CHECK(dns_zone_setfile(zone, filename, fileformat,
+				       &dns_master_style_default));
 	}
 	if (journal != NULL) {
-		dns_zone_setjournal(zone, journal);
+		CHECK(dns_zone_setjournal(zone, journal));
 	}

 	region.base = UNCONST(classname);
@@ -684,7 +632,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);
@@ -701,7 +648,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return result;
+	return (result);
 }

 /*% dump the zone */
@@ -732,7 +679,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 	}

@@ -742,5 +689,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return result;
+	return (result);
 }
@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

@@ -25,8 +26,10 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
-setup_logging(FILE *errout);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp);

 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,7 +30,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -45,6 +44,8 @@

 static const char *program = "named-checkconf";

+isc_log_t *logc = NULL;
+
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -53,7 +54,7 @@ static const char *program = "named-checkconf";
 	} while (0)

 /*% usage */
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -82,13 +83,13 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	directory = cfg_obj_asstring(obj);
 	result = isc_dir_chdir(directory);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(obj, ISC_LOG_ERROR,
+		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
@@ -96,10 +97,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return true;
+			return (true);
 		}
 	}
 }
@@ -115,7 +116,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -124,7 +125,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return true;
+			return (true);
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -138,7 +139,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return true;
+			return (true);
 		}
 	}
 }
@@ -151,23 +152,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_db_detach(&db);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% configure the zone */
@@ -223,18 +224,18 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -244,12 +245,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -263,12 +264,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return configure_hint(zfile, zclass, mctx);
+		return (configure_hint(zfile, zclass, mctx));
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -281,12 +282,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	obj = NULL;
@@ -464,7 +465,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 /*% configure a view */
@@ -499,7 +500,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -509,11 +510,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return dns_rdataclass_fromtext(classp, &r);
+	return (dns_rdataclass_fromtext(classp, &r));
 }

 /*% load zones from the configuration */
@@ -571,7 +572,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return result;
+	return (result);
 }

 static void
@@ -592,11 +593,11 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
-	bool allconfigs = false;
 	unsigned int flags = 0;
 	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;

@@ -605,7 +606,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:nt:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -659,10 +660,6 @@ main(int argc, char **argv) {
 		case 'm':
 			break;

-		case 'n':
-			allconfigs = true;
-			break;
-
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -729,20 +726,20 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}

-	CHECK(setup_logging(stdout));
+	CHECK(setup_logging(mctx, stdout, &logc));

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(dst_lib_init(mctx, NULL));
+	cleanup_dst = true;
+
+	CHECK(cfg_parser_create(mctx, logc, &parser));

 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
-	if (allconfigs) {
-		cfg_parser_setflags(parser, CFG_PCTX_ALLCONFIGS, true);
-	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);

 	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, mctx));
+	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
 	if (load_zones || list_zones) {
 		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
@@ -760,9 +757,17 @@ cleanup:
 		cfg_parser_destroy(&parser);
 	}

-	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+	if (cleanup_dst) {
+		dst_lib_destroy();
 	}

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	if (logc != NULL) {
+		isc_log_destroy(&logc);
+	}
+
+	if (mctx != NULL) {
+		isc_mem_destroy(&mctx);
+	}
+
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkconf` [**-achjlnvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}

 Description
 ~~~~~~~~~~~
@@ -71,12 +71,6 @@ Options

   This option ignores warnings on deprecated options.

-.. option:: -n
-
-   Do not print errors when encountering options that are disabled in
-   this build. This allows checking of configuration files for other
-   builds, in which those options are enabled.
-
 .. option:: -p

   This option prints out the :iscman:`named.conf` and included files in canonical form if
@@ -22,7 +22,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,7 +31,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -63,7 +62,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -96,6 +95,7 @@ main(int argc, char **argv) {
 	int c;
 	char *origin = NULL;
 	const char *filename = NULL;
+	isc_log_t *lctx = NULL;
 	isc_result_t result;
 	char classname_in[] = "IN";
 	char *classname = classname_in;
@@ -161,7 +161,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:R:S:T:W:")) != EOF)
+					  "DF:M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -325,18 +325,6 @@ main(int argc, char **argv) {
 			}
 			break;

-		case 'R':
-			if (ARGCMP("fail")) {
-				zone_options |= DNS_ZONEOPT_LOGREPORTS;
-			} else if (ARGCMP("ignore")) {
-				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
-			} else {
-				fprintf(stderr, "invalid argument to -R: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
 		case 's':
 			if (ARGCMP("full")) {
 				outputstyle = &dns_master_style_full;
@@ -537,7 +525,8 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	if (!quiet) {
-		RUNTIME_CHECK(setup_logging(errout) == ISC_R_SUCCESS);
+		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx) ==
+			      ISC_R_SUCCESS);
 	}

 	origin = argv[isc_commandline_index++];
@@ -577,7 +566,10 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	if (lctx != NULL) {
+		isc_log_destroy(&lctx);
+	}
+	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS) ? 0 : 1;
+	return ((result == ISC_R_SUCCESS) ? 0 : 1);
 }
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -91,13 +91,9 @@ Options
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
   checks SRV records which refer to in-zone hostnames.

-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
   Mode ``full`` checks that delegation NS records refer to A or AAAA
   records (both in-zone and out-of-zone hostnames). It also checks that
   glue address records in the zone match those advertised by the child.
-
   Mode ``local`` only checks NS records which refer to in-zone
   hostnames or verifies that some required glue exists, i.e., when the
   name server is in a child zone.
@@ -170,12 +166,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -175,12 +175,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn``, and ``ignore`` (the default).

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -17,6 +17,10 @@

 #include <stdio.h>

+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
 *   0 		success
 *   -1 	insufficient permissions, or 'user' does not exist.
 */
+
+ISC_LANG_ENDDECLS
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return DST_ALG_HMACMD5;
+		return (DST_ALG_HMACMD5);
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return DST_ALG_HMACSHA1;
+		return (DST_ALG_HMACSHA1);
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return DST_ALG_HMACSHA224;
+		return (DST_ALG_HMACSHA224);
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return DST_ALG_HMACSHA256;
+		return (DST_ALG_HMACSHA256);
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return DST_ALG_HMACSHA384;
+		return (DST_ALG_HMACSHA384);
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return DST_ALG_HMACSHA512;
+		return (DST_ALG_HMACSHA512);
 	}
-	return DST_ALG_UNKNOWN;
+	return (DST_ALG_UNKNOWN);
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return 128;
+		return (128);
 	case DST_ALG_HMACSHA1:
-		return 160;
+		return (160);
 	case DST_ALG_HMACSHA224:
-		return 224;
+		return (224);
 	case DST_ALG_HMACSHA256:
-		return 256;
+		return (256);
 	case DST_ALG_HMACSHA384:
-		return 384;
+		return (384);
 	case DST_ALG_HMACSHA512:
-		return 512;
+		return (512);
 	default:
-		return 0;
+		return (0);
 	}
 }

@@ -120,6 +120,8 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

+	DO("initialize dst library", dst_lib_init(mctx, NULL));
+
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
 			    dns_rdataclass_in, NULL, mctx, &key, NULL));
@@ -130,12 +132,14 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,

 	isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);

-	DO("base64 encode secret",
+	DO("bsse64 encode secret",
 	   isc_base64_totext(&key_rawregion, -1, "", key_txtbuffer));

 	if (key != NULL) {
 		dst_key_free(&key);
 	}
+
+	dst_lib_destroy();
 }

 /*%
@@ -16,10 +16,13 @@
 /*! \file */

 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>

 #include <dns/secalg.h>

+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS
@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return -1;
+		return (-1);
 	}
-	return fchown(fileno(fd), pw->pw_uid, -1);
+	return (fchown(fileno(fd), pw->pw_uid, -1));
 }
@@ -32,7 +32,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -41,7 +40,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -62,7 +60,7 @@ bool verbose = false;

 const char *keyfile, *keydef;

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -290,7 +288,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -37,7 +36,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -55,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -296,7 +294,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -20,5 +19,4 @@ delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
 	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)		\
-	$(OPENSSL_LIBS)
+	$(LIBISCCFG_LIBS)
@@ -25,15 +25,11 @@
 #include <sys/types.h>
 #include <unistd.h>

-#include <openssl/opensslv.h>
-
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -56,7 +52,7 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -74,6 +70,7 @@

 #include <dst/dst.h>

+#include <isccfg/log.h>
 #include <isccfg/namedconf.h>

 #include <ns/client.h>
@@ -91,13 +88,10 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  50
-#define MAX_TOTAL    200
-#define MAX_RESTARTS 11
-
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
+static isc_log_t *lctx = NULL;
 static dns_view_t *view = NULL;
 static ns_server_t *sctx = NULL;
 static ns_interface_t *ifp = NULL;
@@ -136,10 +130,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

-static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t maxtotal = MAX_TOTAL;
-static uint32_t restarts = MAX_RESTARTS;
-
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -222,6 +212,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -259,7 +250,7 @@ usage(void) {
 	exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -290,6 +281,12 @@ warn(const char *format, ...) {
 	fprintf(stderr, "\n");
 }

+static isc_logcategory_t categories[] = { { "delv", 0 }, { NULL, 0 } };
+#define LOGCATEGORY_DEFAULT (&categories[0])
+#define LOGMODULE_DEFAULT   (&modules[0])
+
+static isc_logmodule_t modules[] = { { "delv", 0 }, { NULL, 0 } };
+
 static void
 delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

@@ -298,15 +295,15 @@ delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];

-	if (!isc_log_wouldlog(level)) {
+	if (!isc_log_wouldlog(lctx, level)) {
 		return;
 	}

 	va_start(ap, fmt);

 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	isc_log_write(DELV_LOGCATEGORY_DEFAULT, DELV_LOGMODULE_DEFAULT, level,
-		      "%s", msgbuf);
+	isc_log_write(lctx, LOGCATEGORY_DEFAULT, LOGMODULE_DEFAULT, level, "%s",
+		      msgbuf);
 	va_end(ap);
 }

@@ -314,45 +311,76 @@ static int loglevel = 0;

 static void
 setup_logging(FILE *errout) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
 	int packetlevel = 10;

-	isc_log_setdebuglevel(loglevel);
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_registercategories(lctx, categories);
+	isc_log_registermodules(lctx, modules);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+	cfg_log_init(lctx);

-	isc_logconfig_t *logconfig = isc_logconfig_get();
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX);

+	isc_log_setdebuglevel(lctx, loglevel);
 	isc_log_settag(logconfig, ";; ");

-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout),
-		ISC_LOG_PRINTPREFIX, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	result = isc_log_usechannel(logconfig, "stderr",
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Couldn't attach to log channel 'stderr'");
+	}

 	if (resolve_trace && loglevel < 1) {
-		isc_log_createandusechannel(
-			logconfig, "resolver", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(1), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_RESOLVER,
-			DNS_LOGMODULE_RESOLVER);
+		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(1), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "resolver",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_RESOLVER);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'resolver'");
+		}
 	}

 	if (validator_trace && loglevel < 3) {
-		isc_log_createandusechannel(
-			logconfig, "validator", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(3), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_DNSSEC,
-			DNS_LOGMODULE_VALIDATOR);
+		isc_log_createchannel(logconfig, "validator",
+				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
+				      &destination, ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "validator",
+					    DNS_LOGCATEGORY_DNSSEC,
+					    DNS_LOGMODULE_VALIDATOR);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'validator'");
+		}
 	}

 	if (send_trace) {
 		packetlevel = 11;
 	}
 	if ((message_trace || send_trace) && loglevel < packetlevel) {
-		isc_log_createandusechannel(
-			logconfig, "messages", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(packetlevel),
-			ISC_LOGDESTINATION_FILE(errout), ISC_LOG_PRINTPREFIX,
-			DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS);
+		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(packetlevel), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "messages",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_PACKETS);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'messagse'");
+		}
 	}
 }

@@ -572,7 +600,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -589,15 +617,15 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);

-	result = dns_name_fromtext(n, &b, dns_rootname, 0);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return result;
+		return (result);
 	}

 	*name = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -630,7 +658,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (anchor_name) {
@@ -638,11 +666,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -661,7 +689,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	if (cfg_obj_isvoid(obj)) {
 		/*
 		 * "anchortype" is not defined, this must be a static-key
-		 * configured with trust-anchors.
+		 * configured with trusted-keys.
 		 */
 		anchortype = STATIC_KEY;
 	} else {
@@ -781,19 +809,21 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	num_keys++;

 cleanup:
-	if (result == DST_R_UNSUPPORTEDALG) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+	if (result == DST_R_NOCRYPTO) {
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR, "no crypto support");
+	} else if (result == DST_R_UNSUPPORTEDALG) {
+		cfg_obj_log(key, lctx, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_ERROR,
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR,
 			    "failed to add trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_FAILURE;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -815,18 +845,23 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	}

 cleanup:
-	return result;
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
+	return (result);
 }

 static isc_result_t
 setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
+	const cfg_obj_t *trusted_keys = NULL;
+	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (trust_anchor == NULL) {
@@ -837,7 +872,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	}

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));

 	if (anchorfile != NULL) {
 		if (access(anchorfile, R_OK) != 0) {
@@ -863,7 +898,16 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	}

 	INSIST(bindkeys != NULL);
+	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
+	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+
+	if (trusted_keys != NULL) {
+		CHECK(load_keys(trusted_keys, client, toview));
+	}
+	if (managed_keys != NULL) {
+		CHECK(load_keys(managed_keys, client, toview));
+	}
 	if (trust_anchors != NULL) {
 		CHECK(load_keys(trust_anchors, client, toview));
 	}
@@ -884,7 +928,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -931,7 +975,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		result = ISC_R_SUCCESS;
@@ -967,7 +1011,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1036,7 +1080,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1049,10 +1093,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1113,6 +1157,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -1139,47 +1191,6 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a':
-			switch (cmd[3]) {
-			case 'q': /* maxqueries */
-				FULLCHECK("maxqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxqueries, value,
-						    UINT_MAX, "maxqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxqueries");
-				}
-				if (maxqueries == 0) {
-					fatal("maxqueries must be nonzero");
-				}
-				break;
-			case 't': /* maxtotalqueries */
-				FULLCHECK("maxtotalqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxtotal, value, UINT_MAX,
-						    "maxtotalqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxtotalqueries");
-				}
-				if (maxtotal == 0) {
-					fatal("maxtotalqueries must be "
-					      "nonzero");
-				}
-				break;
-			default:
-				goto invalid_option;
-			}
-			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1232,22 +1243,6 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'e': /* restarts */
-			FULLCHECK("restarts");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&restarts, value, 255, "restarts");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse restarts");
-			}
-			if (restarts == 0) {
-				fatal("restarts must be between 1..255");
-			}
-			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1375,7 +1370,10 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-	need_value:
+		/*
+		 * We can also add a "need_value:" case here if we ever
+		 * add a plus-option that requires a specified value
+		 */
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1385,8 +1383,8 @@ plus_option(char *option) {
 /*
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
-static const char *single_dash_opts = "46Fhimv";
-static const char *dash_opts = "46abcdFhimpqtvx";
+static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";

 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
@@ -1429,9 +1427,6 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				use_ipv4 = false;
 			}
 			break;
-		case 'F': /* FIPS */
-			/* handled in preparse_args() */
-			break;
 		case 'h':
 			usage();
 			exit(EXIT_SUCCESS);
@@ -1451,7 +1446,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -1468,7 +1463,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1505,7 +1500,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1523,28 +1518,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1565,7 +1560,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1583,14 +1578,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*
@@ -1610,11 +1605,6 @@ preparse_args(int argc, char **argv) {
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
-			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-					fatal("setting FIPS mode failed");
-				}
-				break;
 			case 'm':
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 						    ISC_MEM_DEBUGRECORD;
@@ -1762,11 +1752,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1777,17 +1767,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return append_str(in, len, p, end);
+	return (append_str(in, len, p, end));
 }

 static isc_result_t
@@ -1806,10 +1796,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1822,17 +1812,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -1908,8 +1898,6 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
-	dns_client_setmaxrestarts(client, restarts);
-	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2070,7 +2058,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return result;
+	return (result);
 }

 static void
@@ -2114,15 +2102,9 @@ sendquery(void *arg) {
 				    &requestmgr));

 	dns_view_attach(view, &(dns_view_t *){ NULL });
-
-	uint32_t initial;
-	isc_nm_gettimeouts(netmgr, &initial, NULL, NULL, NULL);
-	const unsigned int connect_timeout = initial, timeout = initial;
-
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, connect_timeout,
-				 timeout, 0, 0, isc_loop(), recvresponse,
-				 message, &request));
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
+				 recvresponse, message, &request));
 	return;

 cleanup:
@@ -2135,23 +2117,16 @@ cleanup:

 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
-	  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-	  isc_result_t *sigresultp, isc_result_t *viewpatchresultp,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
 	  dns_view_t **viewp) {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(lsctx);
-	UNUSED(loop);
-	UNUSED(cb);
-	UNUSED(cbarg);
 	UNUSED(sigresultp);

 	*viewp = view;
-	*viewpatchresultp = ISC_R_SUCCESS;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -2172,16 +2147,14 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, &interfacemgr));
+				     NULL, false, &interfacemgr));

-	dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			"_default", &view);
+	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
+			      &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
-	dns_view_setmaxrestarts(view, restarts);
-	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2195,7 +2168,6 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
-	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2241,6 +2213,11 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	loop = isc_loop_main(loopmgr);

+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dst_lib_init failed: %d", result);
+	}
+
 	parse_args(argc, argv);

 	CHECK(setup_style());
@@ -2282,7 +2259,10 @@ cleanup:
 		dns_master_styledestroy(&style, mctx);
 	}

+	isc_log_destroy(&lctx);
+	dst_lib_destroy();
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ delv - DNS lookup and validation utility
 Synopsis
 ~~~~~~~~

-:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-F**] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]
+:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]

 :program:`delv` [**-h**]

@@ -138,10 +138,6 @@ Options
   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
   additional debugging details.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   This option displays the :program:`delv` help usage output and exits.
@@ -341,23 +337,6 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

-.. option:: +restarts
-
-   When name server mode (``delv +ns``) is in use, this option sets the
-   maximum number of CNAME queries to follow before terminating resolution.
-   This prevents ``delv`` from hanging in the event of a CNAME loop.
-   The default is 11.
-
-.. option:: +maxqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 50.
-
-.. option:: +maxtotalqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a client request before giving up. The default is 200.
-
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -5,16 +5,13 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(OPENSSL_CFLAGS)	\
-	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBUV_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)		\
 	$(LIBIDN2_LIBS)

 noinst_LTLIBRARIES = libdighost.la
@@ -20,9 +20,7 @@
 #include <time.h>

 #include <isc/attributes.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -34,7 +32,6 @@
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -72,8 +69,6 @@ static bool short_form = false, printcmd = true, plusquest = false,
 	    pluscomm = false, ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

-#include <openssl/opensslv.h>
-
 /*% opcode text */
 static const char *const opcodetext[] = {
 	"QUERY",      "IQUERY",	    "STATUS",	  "RESERVED3",
@@ -94,9 +89,9 @@ rcode_totext(dns_rcode_t rcode) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
 		buf[0] = '?';
-		return buf;
+		return (buf);
 	}
-	return buf + 1;
+	return (buf + 1);
 }

 /*% print usage */
@@ -116,7 +111,7 @@ usage(void) {
 	fprintf(stderr, "Press <Help> for complete list of options\n");
 }
 #else  /* if TARGET_OS_IPHONE */
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -297,8 +292,6 @@ help(void) {
 	       "statistics)\n"
 	       "                 +subnet=addr        (Set edns-client-subnet "
 	       "option)\n"
-	       "                 +[no]svcparamkeycompat (Display backward-"
-	       "compatible SvcParamKey names (keyN) for non-initial entries)\n"
 	       "                 +[no]tcflag         (Set TC flag in query "
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
@@ -480,7 +473,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		ADD_STRING(buf, " ");
 	}
@@ -498,13 +491,10 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->expandaaaa) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	}
-	if (query->lookup->svcparamkeycompat) {
-		styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-	}
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
-		return result;
+		return (result);
 	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
@@ -521,7 +511,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -545,14 +535,14 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 				      dns_rdatatype_aaaa, dns_rdatatype_none,
 				      NULL, &rdataset);
 	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_dns64_findprefix(rdataset, prefix, &count);
 	if (result == ISC_R_NOTFOUND) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	if (count > 10) {
 		count = 10;
@@ -560,15 +550,15 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -585,12 +575,12 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,

 	UNUSED(flags);

-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -605,7 +595,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdataset_current(rdataset, &rdata);
 				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE) {
-					return result;
+					return (result);
 				}
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
@@ -616,18 +606,20 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
-	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);
+	static unsigned char local_offsets[] = { 0, 6 };
+	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
+							local_offsets);

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -636,10 +628,10 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local)) {
-			return true;
+			return (true);
 		}
 	}
-	return false;
+	return (false);
 }

 /*
@@ -692,9 +684,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		if (query->lookup->expandaaaa) {
 			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 		}
-		if (query->lookup->svcparamkeycompat) {
-			styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-		}
 		if (query->lookup->multiline) {
 			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -759,7 +748,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		char *hash;
 		int pf;

-		printf("- type: MESSAGE\n");
+		printf("-\n");
+		printf("  type: MESSAGE\n");
 		printf("  message:\n");

 		if (isquery) {
@@ -1035,7 +1025,7 @@ repopulate_buffer:

 	dig_idnsetup(query->lookup, false);

-	return result;
+	return (result);
 }

 /*%
@@ -1204,7 +1194,7 @@ proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
 		}
 	}

-	return result;
+	return (result);
 }

 static bool
@@ -1224,7 +1214,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	/* start syntax analysis and verification */
 	if (!rule_proxy_addrs(&st)) {
 		warn("PROXY source and destination addresses cannot be parsed");
-		return false;
+		return (false);
 	}

 	/* get port numeric values */
@@ -1251,7 +1241,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY source address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
@@ -1259,26 +1249,26 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY destination address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	/* addresses should be of the same type */
 	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
 		warn("PROXY source and destination addresses must be of the "
 		     "same type");
-		return false;
+		return (false);
 	}

 	*psrc = src;
 	*pdst = dst;

-	return true;
+	return (true);
 }

 static bool
 rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->src_addr_start = st->last_addr_start;
@@ -1287,13 +1277,13 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->src_port_len = st->last_port_len;

 	if (!MATCH('-')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->dst_addr_start = st->last_addr_start;
@@ -1302,17 +1292,17 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->dst_port_len = st->last_port_len;

 	if (!MATCH('\0')) {
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_addr(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!rule_addr_char(st)) {
-		return false;
+		return (false);
 	}

 	while (rule_addr_char(st)) {
@@ -1326,18 +1316,18 @@ rule_addr(isc_proxy_addrs_parser_state_t *st) {
 		ADVANCE();

 		if (!rule_port(st)) {
-			return false;
+			return (false);
 		}
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_port(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!MATCH_DIGIT()) {
-		return false;
+		return (false);
 	}

 	ADVANCE();
@@ -1349,18 +1339,18 @@ rule_port(isc_proxy_addrs_parser_state_t *st) {
 	st->last_port_start = start;
 	st->last_port_len = GETP() - start;

-	return true;
+	return (true);
 }

 static bool
 rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
 	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

-	return true;
+	return (true);
 }

 #undef GETP
@@ -1377,20 +1367,20 @@ plus_proxy_handle_addresses(const char *value, const bool state,
 		 * We are not interested in the option value in that
 		 * case
 		 */
-		return true;
+		return (true);
 	}

 	if (value == NULL || *value == '\0') {
 		lookup->proxy_local = true;
-		return true;
+		return (true);
 	}

 	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
 				   &lookup->proxy_dst_addr))
 	{
-		return false;
+		return (false);
 	}
-	return true;
+	return (true);
 }

 static bool
@@ -1413,10 +1403,10 @@ plus_proxy_options(const char *cmd, const char *value, const bool state,
 	default:
 		goto invalid_option;
 	}
-	return true;
+	return (true);

 invalid_option:
-	return false;
+	return (false);
 }

 static bool
@@ -1536,7 +1526,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return lookup;
+		return (lookup);
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1835,12 +1825,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "",
+						extra = strtok_r(NULL, "\0",
 								 &last);
 						save_opt(lookup, code, extra);
-						if (extra != NULL) {
-							extra[-1] = ':';
-						}
 						break;
 					default:
 						goto invalid_option;
@@ -2394,10 +2381,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				goto exit_or_usage;
 			}
 			break;
-		case 'v': /* svcparamkeycompat */
-			FULLCHECK("svcparamkeycompat");
-			lookup->svcparamkeycompat = state;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -2573,10 +2556,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	if (value != NULL) {
-		value[-1] = '=';
-	}
-	return lookup;
+	return (lookup);

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2588,8 +2568,8 @@ exit_or_usage:
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dFhimnruv";
-static const char *dash_opts = "46bcdFfhikmnpqrtvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone, bool config_only, int argc,
@@ -2622,7 +2602,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv4 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case '6':
@@ -2632,7 +2612,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv6 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case 'd':
@@ -2641,14 +2621,11 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				cmd = option;
 				FULLCHECK("debug");
 				debugging = true;
-				return false;
+				return (false);
 			} else {
 				debugging = true;
 			}
 			break;
-		case 'F': /* FIPS */
-			/* FIPS is handled in preparse_args() */
-			break;
 		case 'h':
 			help();
 			exit(EXIT_SUCCESS);
@@ -2675,7 +2652,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -2719,7 +2696,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*hash = '#';
 		}
 		specified_source = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
@@ -2738,13 +2715,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid class %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'f':
 		batchname = value;
-		return value_from_next;
+		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS) {
@@ -2752,7 +2729,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		port = num;
 		port_set = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (!config_only) {
 			if (*need_clone) {
@@ -2771,7 +2748,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
@@ -2829,7 +2806,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid type %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'y':
 		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
@@ -2838,8 +2815,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
-								   * NULL */
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
+								    * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2850,11 +2827,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		if (ptr3 != NULL) {
-			ptr[-1] = ':';
-		}
-		ptr2[-1] = ':';
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		if (*need_clone) {
 			*lookup = clone_lookup(default_lookup, true);
@@ -2884,14 +2857,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*%
@@ -2922,11 +2895,6 @@ preparse_args(int argc, char **argv) {
 				/* For debugging early startup */
 				debugging = true;
 				break;
-			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-					fatal("setting FIPS mode failed");
-				}
-				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
@@ -2990,7 +2958,7 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 	{
 		debug("%s %d: %s", msg, bargc, bargv[bargc]);
 	}
-	return bargc;
+	return (bargc);
 }

 static void
@@ -3338,7 +3306,8 @@ dig_error(const char *format, ...) {
 	va_list args;

 	if (yaml) {
-		printf("- type: DIG_ERROR\n");
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");

 		/*
 		 * Print an indent before a literal block quote.
@@ -3355,7 +3324,10 @@ dig_error(const char *format, ...) {
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
-	printf("\n"); /* We get the error without a newline */
+
+	if (!yaml) {
+		printf("\n");
+	}
 }

 static void
@@ -3451,5 +3423,5 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-	return exitcode;
+	return (exitcode);
 }
@@ -20,7 +20,7 @@ dig - DNS lookup utility

 Synopsis
 ~~~~~~~~
-:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-F**] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]
+:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]

 :program:`dig` [**-h**]

@@ -126,10 +126,6 @@ Options
   same way it would be presented as a query to :program:`dig` using the
   command-line interface.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   Print a usage summary.
@@ -642,14 +638,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   prefix-length of zero, which signals a resolver that the client's
   address information must *not* be used when resolving this query.

-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag

   This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
@@ -36,10 +36,10 @@
 #endif /* HAVE_LIBIDN2 */

 #include <isc/base64.h>
-#include <isc/crypto.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -60,8 +60,8 @@
 #include <isc/xml.h>

 #include <dns/byaddr.h>
-#include <dns/ede.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/opcode.h>
@@ -93,12 +93,14 @@ static bool cancel_now = false;

 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
     specified_source = false, free_now = false, usesearch = false,
-     showsearch = false, keep_open = false, verbose = false, yaml = false;
+     showsearch = false, is_dst_up = false, keep_open = false, verbose = false,
+     yaml = false;
 in_port_t port = 53;
 bool port_set = false;
 unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
+isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_loopmgr_t *loopmgr = NULL;
 isc_loop_t *mainloop = NULL;
@@ -234,7 +236,7 @@ count_dots(char *string) {
 		}
 		s++;
 	}
-	return i;
+	return (i);
 }

 static void
@@ -282,11 +284,11 @@ hex_dump(isc_buffer_t *b) {
 static isc_result_t
 append(const char *text, size_t len, char **p, char *end) {
 	if (*p + len > end) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -297,17 +299,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = (int)strlen(in);
 	}
-	return append(in, len, p, end);
+	return (append(in, len, p, end));
 }

 isc_result_t
@@ -326,10 +328,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -342,18 +344,18 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		/* Append .in-addr.arpa. and a terminating NUL. */
 		result = append(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -454,7 +456,7 @@ make_server(const char *servname, const char *userarg) {
 	strlcpy(srv->servername, servname, MXNAME);
 	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
-	return srv;
+	return (srv);
 }

 /*%
@@ -630,7 +632,7 @@ make_empty_lookup(void) {
 	debug("make_empty_lookup() = %p->references = %" PRIuFAST32, looknew,
 	      isc_refcount_current(&looknew->references));

-	return looknew;
+	return (looknew);
 }

 #define EDNSOPT_OPTIONS 100U
@@ -758,7 +760,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
-	looknew->svcparamkeycompat = lookold->svcparamkeycompat;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
@@ -822,7 +823,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {

 	looknew->magic = DIG_LOOKUP_MAGIC;

-	return looknew;
+	return (looknew);
 }

 /*%
@@ -852,20 +853,20 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 	ISC_LIST_PREPEND(lookup_list, looknew, link);
 	debug("after insertion, init -> %p, new = %p, new -> %p", lookold,
 	      looknew, looknew->link.next);
-	return looknew;
+	return (looknew);
 }

 void
 setup_text_key(void) {
 	isc_result_t result;
-	dns_fixedname_t fkey;
-	dns_name_t *keyname = dns_fixedname_initname(&fkey);
+	dns_name_t keyname;
 	isc_buffer_t secretbuf;
 	unsigned int secretsize;
 	unsigned char *secretstore;

 	debug("setup_text_key()");
 	isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	dns_name_init(&keyname, NULL);
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int)strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -882,12 +883,12 @@ setup_text_key(void) {
 		goto failure;
 	}

-	result = dns_name_fromtext(keyname, namebuf, dns_rootname, 0);
+	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}

-	result = dns_tsigkey_create(keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -898,6 +899,7 @@ failure:
 	}

 	isc_mem_free(mctx, secretstore);
+	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 }

@@ -912,20 +914,20 @@ parse_uint_helper(uint32_t *uip, const char *value, uint32_t max,
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 10);
+	return (parse_uint_helper(uip, value, max, desc, 10));
 }

 isc_result_t
 parse_xint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 0);
+	return (parse_uint_helper(uip, value, max, desc, 0));
 }

 static uint32_t
@@ -938,7 +940,7 @@ parse_bits(char *arg, const char *desc, uint32_t max) {
 		fatal("couldn't parse digest bits");
 	}
 	tmp = (tmp + 7) & ~0x7U;
-	return tmp;
+	return (tmp);
 }

 isc_result_t
@@ -1016,7 +1018,7 @@ done:
 	sa->length = prefix_length;
 	*sap = sa;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*
@@ -1092,10 +1094,10 @@ read_confkey(void) {
 	isc_result_t result;

 	if (!isc_file_exists(keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

-	result = cfg_parser_create(mctx, &pctx);
+	result = cfg_parser_create(mctx, NULL, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1133,7 +1135,7 @@ cleanup:
 		cfg_parser_destroy(&pctx);
 	}

-	return result;
+	return (result);
 }

 void
@@ -1203,7 +1205,7 @@ make_searchlist_entry(char *domain) {
 	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME - 1] = 0;
 	ISC_LINK_INIT(search, link);
-	return search;
+	return (search);
 }

 static void
@@ -1360,15 +1362,22 @@ setup_libs(void) {

 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);

-	logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
-				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
-				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
-	isc_log_setdebuglevel(0);
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+
+	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
+	check_result(result, "isc_log_usechannel");
+
+	isc_log_setdebuglevel(lctx, 0);

 	isc_mem_setname(mctx, "dig");
 	mainloop = isc_loop_main(loopmgr);
+
+	result = dst_lib_init(mctx, NULL);
+	check_result(result, "dst_lib_init");
+	is_dst_up = true;
 }

 typedef struct dig_ednsoptname {
@@ -1377,27 +1386,24 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },		  /* draft-sekar-dns-llq */
-	{ 2, "UL" },		  /* draft-ietf-dnssd-update-lease */
-	{ 3, "NSID" },		  /* RFC 5001 */
-	{ 5, "DAU" },		  /* RFC 6975 */
-	{ 6, "DHU" },		  /* RFC 6975 */
-	{ 7, "N3U" },		  /* RFC 6975 */
-	{ 8, "ECS" },		  /* RFC 7871 */
-	{ 9, "EXPIRE" },	  /* RFC 7314 */
-	{ 10, "COOKIE" },	  /* RFC 7873 */
-	{ 11, "KEEPALIVE" },	  /* RFC 7828 */
-	{ 12, "PADDING" },	  /* RFC 7830 */
-	{ 12, "PAD" },		  /* shorthand */
-	{ 13, "CHAIN" },	  /* RFC 7901 */
-	{ 14, "KEY-TAG" },	  /* RFC 8145 */
-	{ 15, "EDE" },		  /* ietf-dnsop-extended-error-16 */
-	{ 16, "CLIENT-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 18, "REPORT-CHANNEL" }, /* RFC 9567 */
-	{ 18, "RC" },		  /* shorthand */
-	{ 19, "ZONEVERSION" },	  /* RFC 9660 */
-	{ 26946, "DEVICEID" },	  /* Brian Hartvigsen */
+	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
+	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
+	{ 3, "NSID" },	       /* RFC 5001 */
+	{ 5, "DAU" },	       /* RFC 6975 */
+	{ 6, "DHU" },	       /* RFC 6975 */
+	{ 7, "N3U" },	       /* RFC 6975 */
+	{ 8, "ECS" },	       /* RFC 7871 */
+	{ 9, "EXPIRE" },       /* RFC 7314 */
+	{ 10, "COOKIE" },      /* RFC 7873 */
+	{ 11, "KEEPALIVE" },   /* RFC 7828 */
+	{ 12, "PADDING" },     /* RFC 7830 */
+	{ 12, "PAD" },	       /* shorthand */
+	{ 13, "CHAIN" },       /* RFC 7901 */
+	{ 14, "KEY-TAG" },     /* RFC 8145 */
+	{ 15, "EDE" },	       /* ietf-dnsop-extended-error-16 */
+	{ 16, "CLIENT-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
 };

 #define N_EDNS_OPTNAMES (sizeof(optnames) / sizeof(optnames[0]))
@@ -1543,13 +1549,13 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
-				return false;
+				return (false);
 			}
 		}
 		q = ISC_LIST_NEXT(q, link);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -1859,7 +1865,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			result = dns_message_findtype(name, dns_rdatatype_soa,
 						      0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
-				return 0;
+				return (0);
 			}
 		}
 		rdataset = NULL;
@@ -1962,7 +1968,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	if (lookup == NULL && section == DNS_SECTION_ANSWER &&
 	    (query->lookup->trace || query->lookup->ns_search_only))
 	{
-		return followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
+		return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
 	}

 	/*
@@ -1994,7 +2000,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				    link);
 	}

-	return numLookups;
+	return (numLookups);
 }

 /*%
@@ -2021,7 +2027,7 @@ next_origin(dig_lookup_t *oldlookup) {
 		 * We're not using a search list, so don't even think
 		 * about finding the next entry.
 		 */
-		return false;
+		return (false);
 	}

 	/*
@@ -2033,14 +2039,14 @@ next_origin(dig_lookup_t *oldlookup) {
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 	{
-		return false;
+		return (false);
 	}

 	if (oldlookup->origin == NULL && !oldlookup->need_search) {
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		return false;
+		return (false);
 	}
 	if (oldlookup->origin == NULL && oldlookup->need_search) {
 		newlookup = requeue_lookup(oldlookup, true);
@@ -2049,13 +2055,13 @@ next_origin(dig_lookup_t *oldlookup) {
 	} else {
 		search = ISC_LIST_NEXT(oldlookup->origin, link);
 		if (search == NULL && oldlookup->done_as_is) {
-			return false;
+			return (false);
 		}
 		newlookup = requeue_lookup(oldlookup, true);
 		newlookup->origin = search;
 	}
 	cancel_lookup(oldlookup);
-	return true;
+	return (true);
 }

 /*%
@@ -2081,8 +2087,8 @@ insert_soa(dig_lookup_t *lookup) {
 	soa.common.rdclass = lookup->rdclass;
 	soa.common.rdtype = dns_rdatatype_soa;

-	dns_name_init(&soa.origin);
-	dns_name_init(&soa.contact);
+	dns_name_init(&soa.origin, NULL);
+	dns_name_init(&soa.contact, NULL);

 	dns_name_clone(dns_rootname, &soa.origin);
 	dns_name_clone(dns_rootname, &soa.contact);
@@ -2158,7 +2164,7 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	ISC_LINK_INIT(query, link);

 	query->magic = DIG_QUERY_MAGIC;
-	return query;
+	return (query);
 }

 /*%
@@ -2205,6 +2211,11 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	dns_message_gettempname(lookup->sendmsg, &lookup->name);

+	isc_buffer_init(&lookup->namebuf, lookup->name_space,
+			sizeof(lookup->name_space));
+	isc_buffer_init(&lookup->onamebuf, lookup->oname_space,
+			sizeof(lookup->oname_space));
+
 	/*
 	 * We cannot convert `textname' and `origin' separately.
 	 * `textname' doesn't contain TLD, but local mapping needs
@@ -2252,7 +2263,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		len = (unsigned int)strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
-		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0,
+					   &lookup->onamebuf);
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg, &lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
@@ -2270,12 +2282,12 @@ setup_lookup(dig_lookup_t *lookup) {
 			len = (unsigned int)strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(name, &b, NULL, 0);
+			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
 			if (result == ISC_R_SUCCESS) {
 				if (!dns_name_isabsolute(name)) {
 					result = dns_name_concatenate(
 						name, lookup->oname,
-						lookup->name);
+						lookup->name, &lookup->namebuf);
 				} else {
 					dns_name_copy(name, lookup->name);
 				}
@@ -2286,7 +2298,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
 				if (result == DNS_R_NAMETOOLONG) {
-					return false;
+					return (false);
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
@@ -2303,7 +2315,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
-						   dns_rootname, 0);
+						   dns_rootname, 0,
+						   &lookup->namebuf);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
@@ -2312,7 +2325,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
 				clear_current_lookup();
-				return false;
+				return (false);
 #else  /* if TARGET_OS_IPHONE */
 				cleanup_openssl_refs();
 				digexit();
@@ -2645,7 +2658,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	return true;
+	return (true);
 }

 /*%
@@ -2772,12 +2785,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }

-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2796,7 +2803,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,

 	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
 	{
-		return NULL;
+		return (NULL);
 	}

 	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
@@ -2824,7 +2831,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -2872,7 +2882,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 			INSIST(*psess_cache == NULL);
 			*psess_cache = sess_cache;
 		}
-		return ctx;
+		return (ctx);
 	}

 	if (psess_cache != NULL) {
@@ -2881,7 +2891,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 	}

 	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
-	return found_ctx;
+	return (found_ctx);
 failure:
 	if (ctx != NULL) {
 		isc_tlsctx_free(&ctx);
@@ -2896,7 +2906,7 @@ failure:
 	if (store != NULL && store != found_store) {
 		isc_tls_cert_store_free(&store);
 	}
-	return NULL;
+	return (NULL);
 }

 static void
@@ -3038,8 +3048,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3059,15 +3068,14 @@ start_tcp(dig_query_t *query) {

 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}

 	return;
@@ -3223,7 +3231,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3280,10 +3288,6 @@ start_udp(dig_query_t *query) {
 		return;
 	}

-	if (!port_set) {
-		port = 53;
-	}
-
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -3352,12 +3356,12 @@ try_next_server(dig_lookup_t *lookup) {

 	current_query = lookup->current_query;
 	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
-		return false;
+		return (false);
 	}

 	next_query = ISC_LIST_NEXT(current_query, link);
 	if (next_query == NULL) {
-		return false;
+		return (false);
 	}

 	debug("trying next server...");
@@ -3368,7 +3372,7 @@ try_next_server(dig_lookup_t *lookup) {
 		start_udp(next_query);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -3419,10 +3423,10 @@ force_next(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));

-		dighost_error("no response from %s", buf);
+		dighost_error("no response from %s\n", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("no servers could be reached");
+		dighost_error("no servers could be reached\n");
 	}

 	if (exitcode < 9) {
@@ -3646,7 +3650,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3707,7 +3711,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result != ISC_R_SUCCESS) {
 		puts("; Transfer failed.");
-		return true;
+		return (true);
 	}
 	do {
 		dns_name_t *name;
@@ -3733,7 +3737,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
-					return true;
+					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
 				    (rdata.type != dns_rdatatype_soa))
@@ -3813,10 +3817,10 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
-	return false;
+	return (false);
 doexit:
 	dighost_received(len, peer, query);
-	return true;
+	return (true);
 }

 static void
@@ -3910,7 +3914,7 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {

 static int
 ednsvers(dns_rdataset_t *opt) {
-	return (opt->ttl >> 16) & 0xff;
+	return ((opt->ttl >> 16) & 0xff);
 }

 /*%
@@ -4099,7 +4103,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			 * and cancel the lookup.
 			 */
 			printf("%s", l->cmdline);
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");

 			if (exitcode < 9) {
 				exitcode = 9;
@@ -4124,7 +4128,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if (!query->first_soa_rcvd || query->warn_id) {
+				if ((!query->first_soa_rcvd || query->warn_id))
+				{
 					dighost_warning("%s: ID mismatch: "
 							"expected ID %u, got "
 							"%u",
@@ -4232,15 +4237,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
-		if (l->doing_xfr) {
-			if (query->msg_count == 0) {
-				dighost_warning("missing question section");
-			}
-		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
-			dighost_warning("missing question section");
-		}
-	} else {
+	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -4580,12 +4577,12 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	INSIST(count == 1);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 int
@@ -4607,7 +4604,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 			fatal("couldn't get address for '%s': %s", host,
 			      isc_result_totext(result));
 		}
-		return 0;
+		return (0);
 	}

 	for (i = 0; i < count; i++) {
@@ -4617,7 +4614,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 	}

-	return count;
+	return (count);
 }

 /*%
@@ -4717,6 +4714,12 @@ cleanup_openssl_refs(void) {
 		debug("freeing SIG(0) key %p", sig0key);
 		dst_key_free(&sig0key);
 	}
+
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
 }

 /*%
@@ -4747,6 +4750,9 @@ destroy_libs(void) {
 		isc_buffer_free(&namebuf);
 	}

+	debug("Removing log context");
+	isc_log_destroy(&lctx);
+
 	debug("Destroy memory");
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
@@ -4755,7 +4761,7 @@ destroy_libs(void) {
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -4790,7 +4796,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -4798,14 +4804,14 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

 	idn2_free(dst);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -4871,8 +4877,8 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup) {
 	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
-		return true;
+		return (true);
 	}

-	return false;
+	return (false);
 }
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
 * in a tight loop of constant lookups.  It's value is arbitrary.
 */

+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -104,8 +107,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -131,6 +135,8 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
+	isc_buffer_t namebuf;
+	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -287,13 +293,13 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 digexit(void);

 void
@@ -460,3 +466,5 @@ dig_shutdown(void);

 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS
@@ -21,7 +21,6 @@

 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -29,7 +28,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -82,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -99,10 +96,10 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

-ISC_NORETURN static void
+noreturn static void
 show_usage(void);

 static void
@@ -186,7 +183,6 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
-		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -221,13 +217,13 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}

-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -265,7 +261,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return result;
+					return (result);
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -320,11 +316,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -344,12 +340,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -426,7 +422,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -460,16 +456,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}

 	if (!short_form) {
@@ -530,7 +516,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -540,7 +526,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

@@ -551,7 +537,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -561,7 +547,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -569,7 +555,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!short_form) {
@@ -587,7 +573,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return result;
+	return (result);
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -930,5 +916,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (seen_error == 0) ? 0 : 1;
+	return ((seen_error == 0) ? 0 : 1);
 }
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -20,7 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -30,7 +30,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -129,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 static void
@@ -190,7 +189,6 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
-		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -211,9 +209,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -257,10 +255,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -295,9 +293,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -339,10 +337,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -425,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -479,7 +477,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -538,10 +536,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -555,10 +553,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -837,7 +835,7 @@ fgets_next_command(void *arg) {
 	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -976,5 +974,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return query_error | print_error;
+	return (query_error | print_error);
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return NULL;
+		return (NULL);
 	}
-	return buf;
-}
+	return (buf);
+};

 #define add_history(line)

@@ -41,14 +41,6 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)

-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)
@@ -29,8 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/serial.h>
@@ -45,7 +43,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -65,6 +63,7 @@ const char *program = "dnssec-cds";
 /*
 * Infrastructure
 */
+static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;

 /*
@@ -145,6 +144,7 @@ static dns_dbnode_t *parent_node = NULL;
 static dns_db_t *update_db = NULL;
 static dns_dbnode_t *update_node = NULL;
 static dns_dbversion_t *update_version = NULL;
+static bool cleanup_dst = false;
 static bool print_mem_stats = false;

 static void
@@ -178,7 +178,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -395,7 +395,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return buf;
+	return (buf);
 }

 static void
@@ -505,14 +505,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return true;
+			return (true);
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return false;
+			return (false);
 		}
 	}

@@ -521,7 +521,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return false;
+	return (false);
 }

 /*
@@ -575,7 +575,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return keytable;
+	return (keytable);
 }

 static void
@@ -681,7 +681,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return algo;
+	return (algo);
 }

 /*
@@ -698,7 +698,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return ok;
+	return (ok);
 }

 /*
@@ -740,7 +740,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return all_ok;
+	return (all_ok);
 }

 /*
@@ -761,10 +761,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return ISC_R_IGNORE;
+		return (ISC_R_IGNORE);
 	}

-	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
+	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
 }

 static isc_result_t
@@ -777,7 +777,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -785,7 +785,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -816,14 +816,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return result;
+			return (result);
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -868,8 +868,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return dns_rdata_compare((const dns_rdata_t *)rdata1,
-				 (const dns_rdata_t *)rdata2);
+	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
+				  (const dns_rdata_t *)rdata2));
 }

 /*
@@ -950,7 +950,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return match;
+	return (match);
 }

 static void
@@ -1029,7 +1029,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -1071,11 +1071,17 @@ cleanup(void) {
 		free_keytable(&new_key_tbl);
 	}
 	free_all_sets();
+	if (lctx != NULL) {
+		cleanup_logging(&lctx);
+	}
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
 	if (mctx != NULL) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }

@@ -1084,6 +1090,7 @@ main(int argc, char *argv[]) {
 	const char *child_path = NULL;
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
+	isc_result_t result;
 	bool prefer_cdnskey = false;
 	bool nsupdate = false;
 	uint32_t ttl = 0;
@@ -1171,7 +1178,14 @@ main(int argc, char *argv[]) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+	cleanup_dst = true;

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1341,5 +1355,5 @@ cleanup:
 	print_mem_stats = true;
 	cleanup();

-	return 0;
+	return (0);
 }
@@ -22,8 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -35,7 +33,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -67,8 +65,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -140,7 +138,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +153,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return ISC_R_NOSPACE;
+			return (ISC_R_NOSPACE);
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -164,18 +162,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return loadset(filename, rdataset);
+	return (loadset(filename, rdataset));
 }

 static void
@@ -326,7 +324,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -370,6 +368,7 @@ main(int argc, char **argv) {
 	bool usekeyset = false;
 	bool showall = false;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;

@@ -383,7 +382,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -419,6 +418,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;
@@ -487,7 +489,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -540,16 +548,18 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -20,8 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -33,7 +31,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -69,8 +67,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -143,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static void
@@ -264,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -301,6 +299,7 @@ main(int argc, char **argv) {
 	char *endp;
 	int ch;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -409,7 +408,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -453,16 +458,18 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -21,8 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -32,7 +30,7 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -45,9 +43,7 @@

 const char *program = "dnssec-keyfromlabel";

-static uint16_t tag_min = 0, tag_max = 0xffff;
-
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -67,12 +63,13 @@ usage(void) {
 			"        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -115,6 +112,7 @@ main(int argc, char **argv) {
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	char *endp;
 	dst_key_t *key = NULL;
@@ -130,6 +128,7 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	char filename[255];
 	isc_buffer_t buf;
+	isc_log_t *log = NULL;
 	dns_rdataclass_t rdclass;
 	int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char *label = NULL;
@@ -161,7 +160,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -177,7 +176,7 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -208,20 +207,6 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
-		case 'M': {
-			unsigned long ul;
-			tag_min = ul = strtoul(isc_commandline_argument, &endp,
-					       10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -350,7 +335,12 @@ main(int argc, char **argv) {
 		}
 	}

-	setup_logging();
+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
+	setup_logging(mctx, &log);

 	if (predecessor == NULL) {
 		if (label == NULL) {
@@ -367,7 +357,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -605,8 +595,8 @@ main(int argc, char **argv) {
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
-				NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
+				label, NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -696,8 +686,7 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
-	{
+	if (key_collision(key, name, directory, mctx, &exact)) {
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -742,15 +731,17 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -63,12 +63,22 @@ Options
   versions, then the NSEC3 version is used; for example,
   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -l label

   This option specifies the label for a key pair in the crypto hardware.

   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
-   an arbitrary string that identifies a particular key.
+   an arbitrary string that identifies a particular key. It may be
+   preceded by an optional OpenSSL engine name, followed by a colon, as
+   in ``pkcs11:keylabel``.

 .. option:: -n nametype

@@ -123,18 +133,6 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of key tag values
-   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
-   key or the key tag of the revoked version of the new key is
-   outside this range, the new key will be rejected.  This is
-   designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid
-   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
-   default allows all key tag values to be accepted.
-
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -38,9 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
-#include <isc/lib.h>
-#include <isc/log.h>
+#include <isc/fips.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -51,13 +49,18 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"

 const char *program = "dnssec-keygen";
@@ -69,7 +72,9 @@ const char *program = "dnssec-keygen";
 static int min_rsa = 1024;
 static int min_dh = 128;

-ISC_NORETURN static void
+isc_log_t *lctx = NULL;
+
+noreturn static void
 usage(void);

 static void
@@ -86,8 +91,6 @@ struct keygen_ctx {
 	char *type;
 	int protocol;
 	int size;
-	uint16_t tag_min;
-	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
@@ -146,7 +149,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -154,7 +157,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -173,10 +176,11 @@ usage(void) {
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -187,7 +191,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record\n");
+	fprintf(stderr, "       usage | trace | record | size | mctx\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -249,6 +253,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
 	char algstr[DNS_SECALG_FORMATSIZE];
 	uint16_t flags = 0;
+	int param = 0;
 	bool null_key = false;
 	bool conflict = false;
 	bool show_progress = false;
@@ -272,7 +277,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -283,7 +288,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -336,7 +341,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -496,7 +501,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -609,12 +614,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 				ctx->keystore, name, ctx->policy, ctx->rdclass,
 				mctx, ctx->alg, ctx->size, flags, &key);
 		} else if (!ctx->quiet && show_progress) {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       &progress);
 		} else {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       NULL);
@@ -753,9 +758,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
-				  ctx->tag_max, NULL))
-		{
+		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -840,8 +843,13 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t ret;
 	isc_textregion_t r;
+	const char *engine = NULL;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -860,8 +868,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                          \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                        \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -914,7 +922,7 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -950,21 +958,6 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
-		case 'M': {
-			unsigned long ul;
-			ctx.tag_min = ul = strtoul(isc_commandline_argument,
-						   &endp, 10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff ||
-			    ctx.tag_max <= ctx.tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'm':
 			break;
 		case 'p':
@@ -1100,9 +1093,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1129,15 +1120,41 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
 	/*
-	 * The DST subsystem will set FIPS mode if requested at build time.
-	 * The minimum sizes are both raised to 2048.
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);

 	ctx.rdclass = strtoclass(classname);

@@ -1209,8 +1226,6 @@ main(int argc, char **argv) {
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
-			ctx.tag_min = 0;
-			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1219,7 +1234,7 @@ main(int argc, char **argv) {
 			dns_kasp_t *kasp = NULL;
 			dns_kasp_key_t *kaspkey = NULL;

-			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
+			RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) ==
 				      ISC_R_SUCCESS);
 			if (cfg_parse_file(parser, ctx.configfile,
 					   &cfg_type_namedconf,
@@ -1230,8 +1245,8 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       &kasp);
+			kasp_from_conf(config, mctx, lctx, ctx.policy,
+				       ctx.directory, engine, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1259,8 +1274,6 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
-				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
-				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
 				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
 				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
 				{
@@ -1277,14 +1290,24 @@ main(int argc, char **argv) {
 		keygen(&ctx, mctx, argc, argv);
 	}

+	cleanup_logging(&lctx);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -94,6 +94,14 @@ Options
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
   ECDSAP384SHA384, ED25519, and ED448.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
@@ -150,19 +158,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of acceptable key tag values that ``dnssec-keygen``
-   will produce. If the key tag of the new key or the key tag of
-   the revoked version of the new key is outside this range,
-   the new key will be rejected and another new key will be generated.
-   This is designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid values
-   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
-   key tag values to be produced.  This option is ignored when ``-k policy``
-   is specified.
-
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -18,17 +18,14 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/mem.h>

 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -42,7 +39,9 @@ const char *program = "dnssec-ksr";
 /*
 * Infrastructure
 */
+static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
+const char *engine = NULL;
 /*
 * The domain we are working on
 */
@@ -64,19 +63,16 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
-	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
-	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
-	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -126,6 +122,7 @@ usage(int ret) {
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Options:\n");
+	fprintf(stderr, "    -E <engine>: name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -e <date/offset>: end date\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -f: KSR file to sign\n");
@@ -145,15 +142,6 @@ usage(int ret) {
 	exit(ret);
 }

-static isc_stdtime_t
-between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
-	isc_stdtime_t r = end;
-	if (t > 0 && t > start && t < end) {
-		r = t;
-	}
-	return r;
-}
-
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -178,14 +166,15 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;

-	RUNTIME_CHECK(cfg_parser_create(mctx, &parser) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) == ISC_R_SUCCESS);
 	if (cfg_parse_file(parser, ksr->configfile, &cfg_type_namedconf,
 			   &config) != ISC_R_SUCCESS)
 	{
 		fatal("unable to load dnssec-policy '%s' from '%s'",
 		      ksr->policy, ksr->configfile);
 	}
-	kasp_from_conf(config, mctx, ksr->policy, ksr->keydir, kasp);
+	kasp_from_conf(config, mctx, lctx, ksr->policy, ksr->keydir, engine,
+		       kasp);
 	if (*kasp == NULL) {
 		fatal("failed to load dnssec-policy '%s'", ksr->policy);
 	}
@@ -197,19 +186,15 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keyalgtag_cmp(const void *k1, const void *k2) {
+keytag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
-		return -1;
-	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
-		return 1;
-	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
-		return -1;
+	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+		return (-1);
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
-		return 1;
+		return (1);
 	}
-	return 0;
+	return (0);
 }

 static void
@@ -239,7 +224,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -254,7 +239,6 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
-	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -262,7 +246,6 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
-	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -330,9 +313,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
-	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
-	   isc_stdtime_t active, isc_stdtime_t *expiration) {
+create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
+	   isc_stdtime_t inception, isc_stdtime_t active,
+	   isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -344,15 +327,9 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
-	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

-	/* ZSK or KSK? */
-	if (ksr->ksk) {
-		flags |= DNS_KEYFLAG_KSK;
-	}
-
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -362,7 +339,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -443,18 +420,18 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				flags, &key);
+				DNS_KEYOWNER_ZONE, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, &progress);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, NULL);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -463,10 +440,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 		}

 		/* Do not overwrite an existing key. */
-		if (key_collision(key, name, ksr->keydir, mctx,
-				  dns_kasp_key_tagmin(kaspkey),
-				  dns_kasp_key_tagmax(kaspkey), NULL))
-		{
+		if (key_collision(key, name, ksr->keydir, mctx, NULL)) {
 			conflict = true;
 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
@@ -491,28 +465,15 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
-	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_KSK, false);
+	dst_key_setbool(key, DST_BOOL_ZSK, true);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
-	if (ksr->ksk) {
-		dns_keymgr_settime_syncpublish(key, kasp,
-					       (inception == ksr->start));
-	}
-
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove;
-
-		if (ksr->ksk) {
-			remove = ksr->ttlds + ksr->parentpropagation +
-				 ksr->retiresafety;
-			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
-		} else {
-			remove = ksr->ttlsig + ksr->propagation +
-				 ksr->retiresafety + ksr->signdelay;
-		}
+		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
+				       ksr->retiresafety + ksr->signdelay;
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -643,16 +604,15 @@ fail:
 		      namestr, algstr, timestr);
 	}

-	return next_bundle;
+	return (next_bundle);
 }

-static isc_stdtime_t
+static void
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
-	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -696,25 +656,6 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

-		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
-
-		/* Determine next bundle. */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
-		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(act, inception, next_bundle);
-		next_bundle = between(inact, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
-
-		if (act > inception) {
-			continue;
-		}
-		if (inact != 0 && inception >= inact) {
-			continue;
-		}
-
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -736,25 +677,21 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
-
-	return next_bundle;
 }

 /*
 * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
 * listed in 'keys'.
 */
-static isc_stdtime_t
-get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
-		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-		dns_rdataset_t *cdsset) {
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
+static void
+create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
+	   dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
+	   dns_rdataset_t *cdsset) {
 	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	isc_stdtime_t next_bundle = next_inception;
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);

 	dns_rdatalist_init(dnskeylist);
 	dnskeylist->rdclass = dns_rdataclass_in;
@@ -774,73 +711,31 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
-		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
 		dns_rdata_t *rdata;
 		isc_region_t r;
 		isc_region_t rcds;
-		isc_stdtime_t pub = 0, del = 0;
 		unsigned char kskbuf[DST_KEY_MAXSIZE];
 		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

 		/* KSK */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
+		newbuf = NULL;
+		rdata = isc_mem_get(mctx, sizeof(*rdata));
+		dns_rdata_init(rdata);

-		if (pub > inception) {
-			published = false;
-		}
-		if (del != 0 && inception >= del) {
-			published = false;
-		}
-
-		if (published) {
-			newbuf = NULL;
-			rdata = isc_mem_get(mctx, sizeof(*rdata));
-			dns_rdata_init(rdata);
-
-			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-			CHECK(dst_key_todns(dk->key, &buf));
-			isc_buffer_usedregion(&buf, &r);
-			isc_buffer_allocate(mctx, &newbuf, r.length);
-			isc_buffer_putmem(newbuf, r.base, r.length);
-			isc_buffer_usedregion(newbuf, &r);
-			dns_rdata_fromregion(rdata, dns_rdataclass_in,
-					     dns_rdatatype_dnskey, &r);
-			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-			ISC_LIST_APPEND(cleanup_list, newbuf, link);
-			isc_buffer_clear(newbuf);
-		}
-
-		published = true;
-		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
-			pub = 0;
-			del = 0;
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
-					      &pub);
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
-					      &del);
-
-			next_bundle = between(pub, inception, next_bundle);
-			next_bundle = between(del, inception, next_bundle);
-
-			if (pub != 0 && pub > inception) {
-				published = false;
-			}
-			if (del != 0 && inception >= del) {
-				published = false;
-			}
-		} else {
-			published = false;
-		}
-
-		if (!published) {
-			continue;
-		}
+		isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
+		CHECK(dst_key_todns(dk->key, &buf));
+		isc_buffer_usedregion(&buf, &r);
+		isc_buffer_allocate(mctx, &newbuf, r.length);
+		isc_buffer_putmem(newbuf, r.base, r.length);
+		isc_buffer_usedregion(newbuf, &r);
+		dns_rdata_fromregion(rdata, dns_rdataclass_in,
+				     dns_rdatatype_dnskey, &r);
+		ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
+		ISC_LIST_APPEND(cleanup_list, newbuf, link);
+		isc_buffer_clear(newbuf);

 		/* CDNSKEY */
 		newbuf = NULL;
@@ -894,98 +789,35 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-
-	return next_bundle;
+	return;

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
-	return 0;
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
+sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
+	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 	    dns_dnsseckeylist_t *keys) {
-	isc_stdtime_t expiration = inception + ksr->sigvalidity;
-	isc_stdtime_t next_bundle = next_inception;
-	dns_rdataset_t zsk;
-
-	dns_rdataset_init(&zsk);
-	dns_rdatalist_tordataset(zsklist, &zsk);
+	dns_rdataset_t rrset = DNS_RDATASET_INIT;
+	isc_stdtime_t expiration;

+	dns_rdataset_init(&rrset);
+	dns_rdatalist_tordataset(rdatalist, &rrset);
+	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		isc_stdtime_t next_time = next_bundle;
-
-		/* DNSKEY RRset */
-		dns_rdatalist_t *dnskeylist;
-		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
-		dns_rdatalist_init(dnskeylist);
-		dnskeylist->rdclass = dns_rdataclass_in;
-		dnskeylist->type = dns_rdatatype_dnskey;
-		dnskeylist->ttl = ksr->ttl;
-
-		dns_rdataset_t ksk, cdnskey, cds, rrset;
-		dns_rdataset_init(&ksk);
-		dns_rdataset_init(&cdnskey);
-		dns_rdataset_init(&cds);
-		dns_rdataset_init(&rrset);
-		next_time = get_keymaterial(ksr, kasp, inception, next_time,
-					    keys, &ksk, &cdnskey, &cds);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
+		sign_rrset(ksr, inception, expiration, &rrset, keys);
+		if (dns_rdataset_count(cdnskey) > 0) {
+			sign_rrset(ksr, inception, expiration, cdnskey, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&ksk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&ksk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		if (dns_rdataset_count(cds) > 0) {
+			sign_rrset(ksr, inception, expiration, cds, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&zsk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&zsk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
-		}
-
-		dns_rdatalist_tordataset(dnskeylist, &rrset);
-		next_time = sign_rrset(ksr, inception, expiration, &rrset,
-				       keys);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
-		}
-		freerrset(&ksk);
-		freerrset(&rrset);
-
-		/* CDNSKEY */
-		if (dns_rdataset_count(&cdnskey) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
-					 keys);
-		}
-		freerrset(&cdnskey);
-
-		/* CDS */
-		if (dns_rdataset_count(&cds) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cds,
-					 keys);
-		}
-		freerrset(&cds);
-
-		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
-		if (inception > next_bundle) {
-			inception = next_bundle;
-		}
 		expiration = inception + ksr->sigvalidity;
-		next_bundle = expiration;
 	}
-
-	freerrset(&zsk);
+	freerrset(&rrset);
 }

 static isc_result_t
@@ -1008,12 +840,12 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	dname = dns_fixedname_initname(&dfname);
 	isc_buffer_init(&b, owner, strlen(owner));
 	isc_buffer_add(&b, strlen(owner));
-	ret = dns_name_fromtext(dname, &b, dns_rootname, 0);
+	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
-		return ret;
+		return (ret);
 	}
 	if (dns_name_compare(dname, name) != 0) {
-		return DNS_R_BADOWNERNAME;
+		return (DNS_R_BADOWNERNAME);
 	}
 	isc_buffer_clear(&b);

@@ -1051,7 +883,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {

 cleanup:
 	isc_lex_setcomments(lex, 0);
-	return ret;
+	return (ret);
 }

 static void
@@ -1072,12 +904,9 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
+		if (dns_kasp_key_ksk(kk)) {
 			/* only ZSKs allowed */
 			continue;
-		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
-			/* only KSKs allowed */
-			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -1088,7 +917,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_key(ksr, kasp, kk, &keys, inception, act, &act);
+			create_zsk(ksr, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -1096,7 +925,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("no keys created for policy '%s'", ksr->policy);
+		fatal("policy '%s' has no zsks", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1175,6 +1004,9 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
+	dns_rdataset_t ksk = DNS_RDATASET_INIT;
+	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
+	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1207,6 +1039,9 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

+	/* KSK, CDS and CDNSKEY */
+	create_ksk(ksr, kasp, &keys, &ksk, &cdnskey, &cds);
+
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1256,8 +1091,8 @@ sign(ksr_ctx_t *ksr) {

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, kasp, inception,
-					    next_inception, rdatalist, &keys);
+				sign_bundle(ksr, inception, next_inception,
+					    rdatalist, &cds, &cdnskey, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1267,7 +1102,15 @@ sign(ksr_ctx_t *ksr) {
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
 			rdatalist->ttl = ksr->ttl;
-
+			for (isc_result_t r = dns_rdatalist_first(&ksk);
+			     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
+			{
+				dns_rdata_t *clone =
+					isc_mem_get(mctx, sizeof(*clone));
+				dns_rdata_init(clone);
+				dns_rdatalist_current(&ksk, clone);
+				ISC_LIST_APPEND(rdatalist->rdata, clone, link);
+			}
 			inception = next_inception;
 			have_bundle = true;

@@ -1326,7 +1169,8 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
+		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
+			    &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1338,6 +1182,11 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
+	/* Clean up */
+	freerrset(&ksk);
+	freerrset(&cdnskey);
+	freerrset(&cds);
+
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1348,6 +1197,10 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1356,20 +1209,18 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'e':
 			ksr.end = strtotime(isc_commandline_argument, ksr.now,
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1395,9 +1246,6 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
-		case 'o':
-			ksr.ksk = true;
-			break;
 		case 'V':
 			version(program);
 			break;
@@ -1419,22 +1267,46 @@ main(int argc, char *argv[]) {
 		fatal("must provide a command and zone name");
 	}

+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
 	/*
-	 * The DST subsystem will set FIPS mode if requested at build time.
-	 * The minimum sizes are both raised to 2048.
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);
+
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}

 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, argv[1], strlen(argv[1]));
 	isc_buffer_add(&buf, strlen(argv[1]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("invalid zone name %s: %s", argv[1],
 		      isc_result_totext(ret));
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -40,6 +40,14 @@ server.
 Options
 ~~~~~~~

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -e date/offset

   This option sets the end date for which keys or SKRs need to be generated
@@ -51,10 +59,6 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

-.. option:: -f
-
-   This option sets the SKR file to be signed when issuing a ``sign`` command.
-
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -80,11 +84,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

-.. option:: -o
-
-   Normally when pregenerating keys, ZSKs are created. When this option is
-   set, create KSKs instead.
-
 .. option:: -V

   This option prints version information.
@@ -107,8 +106,9 @@ Commands

 .. option:: keygen

-  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
-  number of generated keys depends on the interval and the key lifetime.
+  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
+  an interval. The number of generated keys depends on the interval and the
+  ZSK lifetime.

 .. option:: request

@@ -131,7 +131,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate ZSKs for the zone "example.com" for the next year,
+When you need to generate keys for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -144,8 +144,7 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to
-the KSK.
+Typically you would now transfer the KSR to the system that has access to the KSK.

 Signing the KSR created above can be done with:

@@ -153,8 +152,7 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those
-in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -23,14 +23,12 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -40,7 +38,7 @@ const char *program = "dnssec-revoke";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -48,6 +46,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
+	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -65,6 +64,7 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -89,7 +89,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -159,6 +159,12 @@ main(int argc, char **argv) {
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	result = dst_key_fromnamedfile(
 		filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
 	if (result != ISC_R_SUCCESS) {
@@ -242,13 +248,14 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-revoke - set the REVOKED bit on a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-f**] [**-R**] {keyfile}
+:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-E** engine] [**-f**] [**-R**] {keyfile}

 Description
 ~~~~~~~~~~~
@@ -53,6 +53,14 @@ Options

   This option prints version information.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
@@ -25,8 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -34,7 +32,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>

 #include <dst/dst.h>

@@ -44,7 +42,7 @@ const char *program = "dnssec-settime";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -53,6 +51,7 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
+	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -187,6 +186,7 @@ writekey(dst_key_t *key, const char *directory, bool write_state) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	const char *filename = NULL;
 	char *directory = NULL;
 	char keystr[DST_KEY_FORMATSIZE];
@@ -228,6 +228,7 @@ main(int argc, char **argv) {
 	bool epoch = false;
 	bool changed = false;
 	bool write_state = false;
+	isc_log_t *log = NULL;
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
@@ -246,7 +247,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	setup_logging();
+	setup_logging(mctx, &log);

 	isc_commandline_errprint = false;

@@ -313,7 +314,7 @@ main(int argc, char **argv) {
 					   &setdstime);
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -554,6 +555,12 @@ main(int argc, char **argv) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	if (predecessor != NULL) {
 		int major, minor;

@@ -945,11 +952,13 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
+	cleanup_logging(&log);
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]

 Description
 ~~~~~~~~~~~
@@ -97,6 +97,14 @@ Options

   This option sets the debugging level.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 Timing Options
 ~~~~~~~~~~~~~~

@@ -42,10 +42,9 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -71,7 +70,7 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -89,6 +88,10 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif

 #include "dnssectool.h"

@@ -137,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
-static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
+static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
+static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock;
+static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -179,9 +182,11 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)                               \
-	if (printstats) {                              \
-		atomic_fetch_add_relaxed(&counter, 1); \
+#define INCSTAT(counter)            \
+	if (printstats) {           \
+		LOCK(&statslock);   \
+		counter++;          \
+		UNLOCK(&statslock); \
 	}

 /*%
@@ -194,7 +199,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return result;
+	return (result);
 }

 static void
@@ -315,35 +320,36 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	}

 	tuple = NULL;
-	dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &trdata,
-			     &tuple);
+	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+				      &trdata, &tuple);
+	check_result(result, "dns_difftuple_create");
 	dns_diff_append(add, &tuple);
 }

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return key->force_sign || key->hint_sign;
+	return (key->force_sign || key->hint_sign);
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return (key->force_publish || key->hint_publish) && !key->hint_remove;
+	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return dns_name_equal(dst_key_name(key->key), gorigin) &&
-	       dst_key_iszonekey(key->key);
+	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
+		dst_key_iszonekey(key->key));
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return key->ksk;
+	return (key->ksk);
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return ignore_kskflag || !key->ksk;
+	return (ignore_kskflag || !key->ksk);
 }

 /*%
@@ -363,10 +369,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return key;
+			return (key);
 		}
 	}
-	return NULL;
+	return (NULL);
 }

 /*%
@@ -383,7 +389,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return key;
+		return (key);
 	}

 	/*
@@ -397,7 +403,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return key;
+		return (key);
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -405,7 +411,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return NULL;
+		return (NULL);
 	}

 	result = dst_key_fromfile(
@@ -416,14 +422,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}

+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return key;
+	return (key);
 }

 /*%
@@ -445,11 +452,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return true;
+		return (true);
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return false;
+		return (false);
 	default:
 		break;
 	}
@@ -457,7 +464,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return false; /* removes a warning */
+	return (false); /* removes a warning */
 }

 static bool
@@ -467,10 +474,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return true;
+		return (true);
 	} else {
 		INCSTAT(nverifyfailed);
-		return false;
+		return (false);
 	}
 }

@@ -536,7 +543,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;

 		dns_rdataset_current(&sigset, &sigrdata);
@@ -547,10 +554,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -579,21 +584,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -606,32 +605,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}

 		if (keep) {
@@ -642,20 +634,24 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, sigset.ttl,
-						     &sigrdata, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					sigset.ttl, &sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, ttl, &sigrdata,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+					&sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "\tremoving signature by %s\n", sigstr);
-			dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN, name,
-					     sigset.ttl, &sigrdata, &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
+				&sigrdata, &tuple);
+			check_result(result, "dns_difftuple_create");
 			dns_diff_append(del, &tuple);
 			INCSTAT(ndropped);
 		}
@@ -684,10 +680,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
-		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
-			continue;
-		}
-
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -870,7 +862,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return memcmp(a, b, hash_length + 1);
+	return (memcmp(a, b, hash_length + 1));
 }

 static void
@@ -902,11 +894,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return true;
+			return (true);
 		}
 		current = next;
 	}
-	return false;
+	return (false);
 }

 static const unsigned char *
@@ -928,16 +920,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return next;
+	return (next);
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return true;
+		return (true);
 	} else {
-		return false;
+		return (false);
 	}
 }

@@ -954,7 +946,7 @@ addnowildcardhash(hashlist_t *l,

 	wild = dns_fixedname_initname(&fixed);

-	result = dns_name_concatenate(dns_wildcardname, name, wild);
+	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -1046,7 +1038,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return result;
+				return (result);
 			}
 		}
 		dns_db_detach(&db);
@@ -1055,13 +1047,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&keyset);
@@ -1070,7 +1062,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1088,8 +1080,9 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");

-		dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &ds,
-				     &tuple);
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					      ttl, &ds, &tuple);
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -1106,7 +1099,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 static bool
@@ -1115,7 +1108,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&dsset);
@@ -1125,7 +1118,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return (result == ISC_R_SUCCESS);
 }

 static bool
@@ -1135,7 +1128,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&nsset);
@@ -1148,7 +1141,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1167,7 +1160,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1385,7 +1378,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return active;
+	return (active);
 }

 /*%
@@ -1434,7 +1427,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&rdataset);
@@ -1508,7 +1501,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return result;
+	return (result);
 }

 /*%
@@ -2029,7 +2022,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);

-	dns_name_downcase(name, name);
+	dns_name_downcase(name, name, NULL);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2208,9 +2201,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 			} else if (set_maxttl && rdataset->ttl > maxttl) {
 				vbprintf(2,
@@ -2218,14 +2212,16 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 					 "from %d to %d\n",
 					 namestr, typestr, rdataset->ttl,
 					 maxttl);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, maxttl, &rdata2,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name,
+					maxttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		}
@@ -2397,7 +2393,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name);
+		dns_name_downcase(name, name, NULL);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2407,7 +2403,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname);
+		dns_name_downcase(nextname, nextname, NULL);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2574,7 +2570,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -3158,13 +3154,15 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						   DNS_DSDIGEST_SHA256, dsbuf,
 						   &ds);
 			check_result(result, "dns_ds_buildrdata");
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
-					     0, &ds, &tuple);
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, 0, &ds, &tuple);
 		} else {
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-					     gorigin, zone_soa_min_ttl, &rdata,
-					     &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_ADDRESIGN, gorigin,
+				zone_soa_min_ttl, &rdata, &tuple);
 		}
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -3214,7 +3212,7 @@ print_version(FILE *fp) {
 	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -3276,6 +3274,8 @@ usage(void) {
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3322,24 +3322,21 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
-		atomic_load(&nsigned));
-	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
-		atomic_load(&nretained));
-	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
-		atomic_load(&ndropped));
-	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
-		atomic_load(&nverified));
-	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
-		atomic_load(&nverifyfailed));
+	fprintf(out, "Signatures generated:               %10u\n", nsigned);
+	fprintf(out, "Signatures retained:                %10u\n", nretained);
+	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
+	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
+	fprintf(out,
+		"Signatures unsuccessfully "
+		"verified: %10u\n",
+		nverifyfailed);

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
-			 time_us;
+		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -3366,6 +3363,8 @@ main(int argc, char *argv[]) {
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3375,16 +3374,17 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);

-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"

 	/*
@@ -3472,7 +3472,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'e':
@@ -3558,6 +3558,10 @@ main(int argc, char *argv[]) {
 			}
 			break;

+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;
@@ -3663,9 +3667,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;

 		case '?':
@@ -3736,7 +3738,34 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

-	setup_logging();
+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -4018,6 +4047,10 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}
+
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4103,18 +4136,30 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

-	return vresult == ISC_R_SUCCESS ? 0 : 1;
+	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -62,6 +62,15 @@ Options
   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
   or serial-number updating.

+.. option:: -E engine
+
+   This option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -F

   This options turns on FIPS (US Federal Information Processing Standards)
@@ -80,11 +89,6 @@ Options
   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
   Only works in combination with smart signing (``-S``).

-.. option:: -J filename
-
-   This option tells :program:`dnssec-signzone` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -K directory

   This option specifies the directory to search for DNSSEC keys. If not
@@ -174,11 +178,6 @@ Options
   days. Therefore, if any existing RRSIG records are due to expire in
   less than 7.5 days, they are replaced.

-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are
@@ -274,7 +273,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -291,7 +290,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -23,8 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -44,7 +42,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -105,7 +103,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -138,7 +136,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -159,6 +157,8 @@ usage(void) {
 	fprintf(stderr, "\t-I format:\n");
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
@@ -170,6 +170,8 @@ main(int argc, char *argv[]) {
 	char *origin = NULL, *file = NULL;
 	char *inputformatstr = NULL;
 	isc_result_t result;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -213,7 +215,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'I':
@@ -273,11 +275,17 @@ main(int argc, char *argv[]) {
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	now = isc_stdtime_now();

 	rdclass = strtoclass(classname);

-	setup_logging();
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -327,10 +335,12 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, false);
 	dns_db_detach(&gdb);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -37,6 +37,14 @@ Options

   This option specifies the DNS class of the zone.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are ``text``
@@ -45,11 +53,6 @@ Options
   format containing updates can be verified independently.
   This option is not useful for non-dynamic zones.

-.. option:: -J filename
-
-   This option tells :program:`dnssec-verify` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -o origin

   This option indicates the zone origin. If not specified, the name of the zone file is
@@ -29,7 +29,6 @@
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -44,6 +43,7 @@
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -128,8 +128,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }

 void
-setup_logging(void) {
+setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
+	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;
 	int level;

 	if (verbose < 0) {
@@ -151,8 +153,10 @@ setup_logging(void) {
 		break;
 	}

-	logconfig = isc_logconfig_get();
-
+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
 	isc_log_settag(logconfig, program);

 	/*
@@ -161,11 +165,36 @@ setup_logging(void) {
 	 *  - the program name and logging level are printed
 	 *  - no time stamp is printed
 	 */
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, level,
-		ISC_LOGDESTINATION_STDERR,
-		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
+			      &destination,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
+}
+
+void
+cleanup_logging(isc_log_t **logp) {
+	isc_log_t *log;
+
+	REQUIRE(logp != NULL);
+
+	log = *logp;
+	*logp = NULL;
+
+	if (log == NULL) {
+		return;
+	}
+
+	isc_log_destroy(&log);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
 }

 static isc_stdtime_t
@@ -173,16 +202,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return offset * (365 * 24 * 3600);
+		return (offset * (365 * 24 * 3600));
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return offset * (30 * 24 * 3600);
+			return (offset * (30 * 24 * 3600));
 		case 'I':
 		case 'i':
-			return offset * 60;
+			return (offset * 60);
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -194,29 +223,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return offset * (7 * 24 * 3600);
+		return (offset * (7 * 24 * 3600));
 	case 'D':
 	case 'd':
-		return offset * (24 * 3600);
+		return (offset * (24 * 3600));
 	case 'H':
 	case 'h':
-		return offset * 3600;
+		return (offset * 3600);
 	case 'S':
 	case 's':
 	case '\0':
-		return offset;
+		return (offset);
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return 0; /* silence compiler warning */
+	return (0); /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return (strcasecmp(str, "none") == 0) ||
-	       (strcasecmp(str, "never") == 0) ||
-	       (strcasecmp(str, "unset") == 0);
+	return ((strcasecmp(str, "none") == 0) ||
+		(strcasecmp(str, "never") == 0) ||
+		(strcasecmp(str, "unset") == 0));
 }

 dns_ttl_t
@@ -226,7 +255,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return (dns_ttl_t)0;
+		return ((dns_ttl_t)0);
 	}

 	ttl = strtol(str, &endp, 0);
@@ -234,19 +263,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return ttl;
+	return (ttl);
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return DST_KEY_STATE_NA;
+		return (DST_KEY_STATE_NA);
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return (dst_key_state_t)i;
+			return ((dst_key_state_t)i);
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -263,13 +292,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	/*
@@ -318,7 +347,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return (isc_stdtime_t)base;
+		return ((isc_stdtime_t)base);
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -331,7 +360,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return (isc_stdtime_t)val;
+	return ((isc_stdtime_t)val);
 }

 dns_rdataclass_t
@@ -341,7 +370,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return dns_rdataclass_in;
+		return (dns_rdataclass_in);
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -349,7 +378,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return rdclass;
+	return (rdclass);
 }

 unsigned int
@@ -364,14 +393,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return alg;
+	return (alg);
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return a - b;
+	return (a - b);
 }

 void
@@ -403,7 +432,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -450,7 +479,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+	      isc_mem_t *mctx, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -460,32 +489,19 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

-	if (min != max) {
-		if (id < min || id > max) {
-			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
-				min, max);
-			return true;
-		}
-		if (rid < min || rid > max) {
-			fprintf(stderr,
-				"Revoked Key ID %d (for tag %d) outside of "
-				"[%u..%u]\n",
-				rid, id, min, max);
-			return true;
-		}
-	}
-
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return false;
+		return (false);
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -529,7 +545,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return conflict;
+	return (conflict);
 }

 bool
@@ -544,9 +560,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 void
@@ -588,8 +604,9 @@ cleanup:
 }

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp) {
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
@@ -608,7 +625,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
+		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
+						 &kslist, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure key-store '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -617,7 +635,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	}
 	/* Default key-directory key store. */
 	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
+	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
 	INSIST(ks != NULL);
 	if (keydir != NULL) {
 		/* '-K keydir' takes priority */
@@ -637,8 +655,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, &kslist,
-					     &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
+					     &kslist, &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -54,7 +54,7 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -66,7 +66,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

-ISC_NORETURN void
+noreturn void
 version(const char *program);

 void
@@ -75,7 +75,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))

 void
-setup_logging(void);
+setup_logging(isc_mem_t *mctx, isc_log_t **logp);
+
+void
+cleanup_logging(isc_log_t **logp);

 dns_ttl_t
 strtottl(const char *str);
@@ -106,7 +109,7 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);
+	      isc_mem_t *mctx, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
@@ -115,5 +118,6 @@ void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp);
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp);
@@ -931,7 +931,6 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -960,7 +959,6 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return DNS_R_BADTTL;
+		return (DNS_R_BADTTL);
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return result;
+	return (result);
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
-	return putrr(node, "SOA", DEFAULT_TTL, str);
+	return (putrr(node, "SOA", DEFAULT_TTL, str));
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
+	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return j + 14;
+	return (j + 14);
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				sizeof(ipv4only));
+		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				 sizeof(ipv4only)));
 	}

-	return putrdata(node, dns_rdatatype_cname, 600, rdata,
-			(unsigned int)len);
+	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
+			 (unsigned int)len));
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->length == 0) {
-		return bdb->lookup(node);
+	if (name->labels == 0 && name->length == 0) {
+		return (bdb->lookup(node));
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return dns64_cname(&bdb->common.origin, name, node);
+		return (dns64_cname(&bdb->common.origin, name, node));
 	} else {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->version);
+			return (puttxt(node, named_g_server->version));
 		}
 	} else {
-		return puttxt(node, PACKAGE_VERSION);
+		return (puttxt(node, PACKAGE_VERSION));
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->hostname);
+			return (puttxt(node, named_g_server->hostname));
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	}
 }

@@ -546,16 +546,16 @@ authors_lookup(bdbnode_t *node) {
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -563,13 +563,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return puttxt(node, named_g_server->sctx->server_id);
+		return (puttxt(node, named_g_server->sctx->server_id));
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -577,7 +577,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -588,10 +588,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -600,7 +600,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return result;
+	return (result);
 }

 /*
@@ -670,10 +670,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -682,9 +682,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -787,7 +787,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -839,28 +839,28 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);

-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -881,32 +881,32 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);

 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return result;
+			return (result);
 		}
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -925,10 +925,10 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == (void *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return DNS_R_NXDOMAIN;
+		return (DNS_R_NXDOMAIN);
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +954,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return DNS_R_BADDB;
+				return (DNS_R_BADDB);
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}

 		/*
@@ -1015,7 +1015,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode((bdbnode_t *)node);
+			destroynode(node);
 			node = NULL;
 			continue;
 		}
@@ -1069,7 +1069,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return result;
+	return (result);
 }

 static void
@@ -1117,7 +1117,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1128,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	new_rdataset(list, db, node, rdataset);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1142,7 +1142,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == &dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -1158,7 +1158,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1186,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1197,8 +1197,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin);
-	dns_name_dup(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin, NULL);
+	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);

 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {
@@ -1241,7 +1241,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1253,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return result;
+	return (result);
 }

 /*
@@ -1269,17 +1269,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -63,6 +63,7 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
+	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
@@ -95,12 +96,10 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
-#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	resolver-query-timeout 10;\n\
-#	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -110,9 +109,6 @@ options {\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
-	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -154,6 +150,9 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
+#ifdef USE_DNSRPS
+			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -170,9 +169,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 50;\n\
-	max-query-count 200;\n\
-	max-query-restarts 11;\n\
+	max-recursion-queries 100;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -191,10 +188,10 @@ options {\n\
 	recursion true;\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
-	request-ixfr-max-diffs 0;\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -217,6 +214,7 @@ options {\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
+	dialup no;\n\
 	dnssec-loadkeys-interval 60;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -224,22 +222,18 @@ options {\n\
 	ixfr-from-differences false;\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
-	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
-	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
-	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -301,8 +295,6 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
-	manual-mode no;\n\
-	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -320,7 +312,6 @@ dnssec-policy \"insecure\" {\n\
 	max-zone-ttl 0; \n\
 	keys { };\n\
 	inline-signing yes;\n\
-	manual-mode no;\n\
 };\n\
 \n\
 "
@@ -336,7 +327,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -360,15 +351,13 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					CFG_PCTX_NOEXPERIMENTAL,
-				conf);
+	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				 CFG_PCTX_NODEPRECATED, conf));
 }

 const char *
 named_config_getdefault(void) {
-	return defaultconf;
+	return (defaultconf);
 }

 isc_result_t
@@ -378,10 +367,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 isc_result_t
@@ -407,7 +396,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return ISC_R_SUCCESS;
+				return (ISC_R_SUCCESS);
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -421,13 +410,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return ISC_R_SUCCESS;
+						return (ISC_R_SUCCESS);
 					}
 				}
 			}
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 int
@@ -439,7 +428,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return i;
+	return (i);
 }

 isc_result_t
@@ -450,16 +439,16 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
-			    r.base);
+		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown class '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -470,16 +459,16 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
-			    r.base);
+		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown type '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 dns_zonetype_t
@@ -505,12 +494,12 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return ztype;
+	return (ztype);
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -521,7 +510,7 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -530,11 +519,28 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			       name) == 0)
 		{
 			*ret = obj;
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		elt = cfg_list_next(elt);
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
+}
+
+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return (getremotesdef(cctx, list, name, ret));
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return (result);
+	}
+	return (ISC_R_NOTFOUND);
 }

 static isc_result_t
@@ -549,26 +555,26 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep);
+	dns_name_init(*namep, NULL);

 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0);
+				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return result;
+		return (result);
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -585,12 +591,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -653,7 +657,7 @@ newlist:
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
 		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, ISC_LOG_ERROR,
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
 			goto cleanup;
@@ -673,6 +677,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -703,22 +709,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
-				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -821,7 +822,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (addrs != NULL) {
@@ -860,7 +861,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -883,12 +884,13 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
+		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+			    "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return ISC_R_RANGE;
+		return (ISC_R_RANGE);
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 struct keyalgorithms {
@@ -932,15 +934,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		if (bits > algorithms[i].size) {
-			return ISC_R_RANGE;
+			return (ISC_R_RANGE);
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -949,5 +951,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
@@ -16,7 +16,6 @@
 #include <stdbool.h>

 #include <isc/lex.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -44,23 +43,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	*cmdp = token.value.as_textregion.base;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return strcasecmp(str, command) == 0;
+	return (strcasecmp(str, command) == 0);
 }

 /*%
@@ -86,7 +85,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -94,7 +93,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return result;
+		return (result);
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -135,7 +134,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	    !command_compare(command, NAMED_COMMAND_TESTGEN) &&
 	    !command_compare(command, NAMED_COMMAND_ZONESTATUS))
 	{
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, log_level,
 			      "rejecting restricted control channel "
 			      "command '%s'",
@@ -144,9 +143,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		goto cleanup;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      log_level, "received control channel command '%s'",
-		      cmdline);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, log_level,
+		      "received control channel command '%s'", cmdline);

 	/*
 	 * After the lengthy "halt" and "stop", the commands are
@@ -202,9 +201,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_MODZONE))
 	{
 		result = named_server_changezone(named_g_server, cmdline, text);
-	} else if (command_compare(command, NAMED_COMMAND_CLOSELOGS)) {
-		isc_log_closefilelogs();
-		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
 		result = named_server_delzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DNSSEC)) {
@@ -214,7 +210,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		result = named_server_dumpdb(named_g_server, lex, text);
+		named_server_dumpdb(named_g_server, lex, text);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -227,30 +224,24 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
-		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
 		result = named_server_notifycommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
 		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
 		result = named_server_nta(named_g_server, lex, readonly, text);
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "query logging",
-						  NS_SERVER_LOGQUERIES, lex);
+		result = named_server_togglequerylog(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -259,10 +250,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "response logging",
-						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -296,7 +283,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
 		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "unknown control channel command '%s'", command);
 		result = DNS_R_UNKNOWNCOMMAND;
@@ -307,5 +294,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return result;
+	return (result);
 }
@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>

 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>

 #include <isccfg/check.h>
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };

 static isc_result_t
@@ -225,9 +225,9 @@ shutdown_listener(controllistener_t *listener) {

 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "stopping command channel on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+		      "stopping command channel on %s", socktext);

 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -246,7 +246,7 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return result == ISC_R_SUCCESS && match > 0;
+	return (result == ISC_R_SUCCESS && match > 0);
 }

 static void
@@ -272,7 +272,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
@@ -291,8 +291,9 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);

 	isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_ERROR, "invalid command from %s: %s", socktext,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_ERROR,
+		      "invalid command from %s: %s", socktext,
 		      isc_result_totext(result));
 }

@@ -489,7 +490,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = DNS_R_CLOCKSKEW;
+			result = ISCCC_R_CLOCKSKEW;
 			goto cleanup;
 		}
 	} else {
@@ -503,7 +504,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = DNS_R_EXPIRED;
+		result = ISCCC_R_EXPIRED;
 		goto cleanup;
 	}

@@ -587,8 +588,9 @@ conn_free(controlconnection_t *conn) {
 	}
 #endif /* ifdef ENABLE_AFL */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "freeing control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "freeing control connection");

 	isc_mem_put(listener->mctx, conn, sizeof(*conn));

@@ -599,7 +601,7 @@ static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Don't create new connection if we are shutting down */
 	if (listener->shuttingdown) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 			      "rejected new control connection: %s",
 			      isc_result_totext(ISC_R_SHUTTINGDOWN));
@@ -607,8 +609,9 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	}

 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "allocate new control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "allocate new control connection");

 	*conn = (controlconnection_t){
 		.alg = DST_ALG_UNKNOWN,
@@ -638,22 +641,22 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return result;
+		return (result);
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
 	if (!address_ok(&peeraddr, listener)) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	newconnection(listener, handle);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -707,11 +710,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -757,7 +760,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't find key '%s' for use with "
 				    "command channel %s",
 				    keyid->keyname, socktext);
@@ -780,7 +783,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = named_config_getkeyalgorithm(algstr, &algtype,
 							      NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(control, ISC_LOG_WARNING,
+				cfg_obj_log(control, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "unsupported algorithm '%s' in "
 					    "key '%s' for use with command "
 					    "channel %s",
@@ -795,7 +799,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = isc_base64_decodestring(secretstr, &b);

 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(keydef, ISC_LOG_WARNING,
+				cfg_obj_log(keydef, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "secret for key '%s' on "
 					    "command channel %s: %s",
 					    keyid->keyname, socktext,
@@ -829,27 +834,30 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	unsigned int algtype;
 	isc_buffer_t b;

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_INFO, "configuring command channel from '%s'",
-		      named_g_keyfile);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
+		      "configuring command channel from '%s'", named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

-	CHECK(cfg_parser_create(mctx, &pctx));
+	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
 	CHECK(cfg_parse_file(pctx, named_g_keyfile, &cfg_type_rndckey,
 			     &config));
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	*keyid = (controlkey_t){
-		.algorithm = DST_ALG_UNKNOWN,
-		.link = ISC_LINK_INITIALIZER,
-	};
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
+	keyid->secret.base = NULL;
+	keyid->secret.length = 0;
+	keyid->algorithm = DST_ALG_UNKNOWN;
+	ISC_LINK_INIT(keyid, link);
+	if (keyid->keyname == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

-	CHECK(isccfg_check_key(key));
+	CHECK(isccfg_check_key(key, named_g_lctx));

 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -860,7 +868,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

 	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
 			    "key '%s' for use with command "
 			    "channel",
@@ -873,7 +881,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	result = isc_base64_decodestring(secretstr, &b);

 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
 		goto cleanup;
@@ -896,7 +904,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1001,12 +1009,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		 * sake of avoiding this message would be too much trouble.
 		 */
 		if (control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install new keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
 		} else {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 				      "couldn't install new keys for "
 				      "command channel %s: %s",
@@ -1019,8 +1027,9 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	 */
 	if (control != NULL && type == isc_socktype_tcp) {
 		allow = cfg_tuple_get(control, "allow");
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -1040,12 +1049,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		dns_acl_detach(&new_acl);
 		/* XXXDCL say the old acl is still used? */
 	} else if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "couldn't install new acl for "
 			      "command channel %s: %s",
@@ -1092,8 +1101,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *readonly = NULL;

 		allow = cfg_tuple_get(control, "allow");
-		CHECK(cfg_acl_fromconfig(allow, config, aclconfctx, mctx, 0,
-					 &new_acl));
+		CHECK(cfg_acl_fromconfig(allow, config, named_g_lctx,
+					 aclconfctx, mctx, 0, &new_acl));

 		readonly = cfg_tuple_get(control, "read-only");
 		if (!cfg_obj_isvoid(readonly)) {
@@ -1119,7 +1128,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	} else {
 		result = get_rndckey(mctx, &listener->keys);
 		if (result != ISC_R_SUCCESS && control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
@@ -1137,9 +1146,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "command channel listening on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+		      "command channel listening on %s", socktext);
 	*listenerp = listener;
 	return;

@@ -1150,11 +1159,11 @@ cleanup:

 shuttingdown:
 	if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
 			    isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "couldn't add command channel %s: %s", socktext,
 			      isc_result_totext(result));
@@ -1199,10 +1208,11 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,

 			(void)cfg_map_get(controls, "unix", &unixcontrols);
 			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, ISC_LOG_ERROR,
+				cfg_obj_log(controls, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return ISC_R_FAILURE;
+				return (ISC_R_FAILURE);
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1235,7 +1245,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_CONTROL,
 					      ISC_LOG_DEBUG(9),
 					      "processing control channel %s",
@@ -1330,12 +1341,13 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));

 	*controls = (named_controls_t){
@@ -1346,11 +1358,16 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);

+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return (result);
+	}
 	*ctrlsp = controls;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -1362,7 +1379,7 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));

 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
@@ -17,13 +17,13 @@
 #include <stdlib.h>
 #include <string.h>

-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>

 #include <dns/dlz_dlopen.h>
+#include <dns/log.h>

 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -80,7 +80,7 @@ static void
 dlopen_log(int level, const char *fmt, ...) {
 	va_list ap;
 	va_start(ap, fmt);
-	isc_log_vwrite(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
 		       ISC_LOG_DEBUG(level), fmt, ap);
 	va_end(ap);
 }
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return ptr;
+	return (ptr);
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return result;
+	return (result);
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return false;
+		return (false);
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return ret;
+	return (ret);
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 /*
@@ -25,12 +25,14 @@
 #include <string.h>
 #include <unistd.h>

-#include <isc/log.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
@@ -125,7 +127,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -159,7 +161,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 /*
@@ -373,7 +375,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			continue;
@@ -585,7 +587,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return NULL;
+	return (NULL);
 }

 /*
@@ -716,7 +718,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 #endif /* ENABLE_AFL */
@@ -39,27 +39,27 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
 	if (n >= sizeof(pathbuf)) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return NULL;
+		return (NULL);
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
 	if (ret == MMDB_SUCCESS) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
-			      pathbuf);
-		return mmdb;
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "opened GeoIP2 database '%s'", pathbuf);
+		return (mmdb);
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_DEBUG(1),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return NULL;
+	return (NULL);
 }
 #endif /* HAVE_GEOIP2 */

@@ -79,9 +79,9 @@ named_geoip_load(char *dir) {
 #if defined(HAVE_GEOIP2)
 	REQUIRE(dir != NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "looking for GeoIP2 databases in '%s'",
-		      dir);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "looking for GeoIP2 databases in '%s'", dir);

 	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
 					     &geoip_country);
@@ -17,6 +17,7 @@

 #include <inttypes.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/clientinfo.h>
@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -28,52 +28,48 @@

 #define NAMED_CONTROL_PORT 953

-#define NAMED_COMMAND_ADDZONE	   "addzone"
-#define NAMED_COMMAND_CLOSELOGS	   "closelogs"
-#define NAMED_COMMAND_DELZONE	   "delzone"
-#define NAMED_COMMAND_DNSSEC	   "dnssec"
-#define NAMED_COMMAND_DNSTAP	   "dnstap"
-#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
-#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_STOP	   "stop"
+#define NAMED_COMMAND_HALT	   "halt"
+#define NAMED_COMMAND_RELOAD	   "reload"
+#define NAMED_COMMAND_RECONFIG	   "reconfig"
+#define NAMED_COMMAND_REFRESH	   "refresh"
+#define NAMED_COMMAND_RETRANSFER   "retransfer"
 #define NAMED_COMMAND_DUMPSTATS	   "stats"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
+#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_SECROOTS	   "secroots"
+#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_NOTRACE	   "notrace"
 #define NAMED_COMMAND_FLUSH	   "flush"
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
-#define NAMED_COMMAND_FREEZE	   "freeze"
-#define NAMED_COMMAND_HALT	   "halt"
-#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
-#define NAMED_COMMAND_MKEYS	   "managed-keys"
-#define NAMED_COMMAND_MODZONE	   "modzone"
-#define NAMED_COMMAND_NOTIFY	   "notify"
-#define NAMED_COMMAND_NOTRACE	   "notrace"
-#define NAMED_COMMAND_NTA	   "nta"
-#define NAMED_COMMAND_NULL	   "null"
-#define NAMED_COMMAND_QUERYLOG	   "querylog"
-#define NAMED_COMMAND_RECONFIG	   "reconfig"
-#define NAMED_COMMAND_RECURSING	   "recursing"
-#define NAMED_COMMAND_REFRESH	   "refresh"
-#define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RESPONSELOG  "responselog"
-#define NAMED_COMMAND_RETRANSFER   "retransfer"
-#define NAMED_COMMAND_SCAN	   "scan"
-#define NAMED_COMMAND_SECROOTS	   "secroots"
-#define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_SHOWZONE	   "showzone"
-#define NAMED_COMMAND_SIGN	   "sign"
-#define NAMED_COMMAND_SIGNING	   "signing"
-#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_STATUS	   "status"
-#define NAMED_COMMAND_STOP	   "stop"
-#define NAMED_COMMAND_SYNC	   "sync"
-#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
-#define NAMED_COMMAND_TESTGEN	   "testgen"
-#define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
+#define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_RECURSING	   "recursing"
+#define NAMED_COMMAND_NULL	   "null"
+#define NAMED_COMMAND_NOTIFY	   "notify"
 #define NAMED_COMMAND_VALIDATION   "validation"
+#define NAMED_COMMAND_SCAN	   "scan"
+#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
+#define NAMED_COMMAND_ADDZONE	   "addzone"
+#define NAMED_COMMAND_MODZONE	   "modzone"
+#define NAMED_COMMAND_DELZONE	   "delzone"
+#define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SYNC	   "sync"
+#define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_DNSSEC	   "dnssec"
 #define NAMED_COMMAND_ZONESTATUS   "zonestatus"
+#define NAMED_COMMAND_NTA	   "nta"
+#define NAMED_COMMAND_TESTGEN	   "testgen"
+#define NAMED_COMMAND_MKEYS	   "managed-keys"
+#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
+#define NAMED_COMMAND_DNSTAP	   "dnstap"
+#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_SERVESTALE   "serve-stale"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -86,7 +86,10 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN unsigned int named_g_debuglevel INIT(0);
+EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
+EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
+EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
+EXTERN unsigned int named_g_debuglevel	     INIT(0);

 /*
 * Current configuration information.
@@ -97,6 +100,8 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -108,7 +113,6 @@ EXTERN const char *named_g_chrootdir INIT(NULL);
 EXTERN bool named_g_foreground	     INIT(false);
 EXTERN bool named_g_logstderr	     INIT(false);
 EXTERN bool named_g_nosyslog	     INIT(false);
-EXTERN unsigned int named_g_logflags INIT(0);
 EXTERN const char *named_g_logfile   INIT(NULL);

 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
@@ -125,6 +129,8 @@ EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"

 EXTERN const char *named_g_username INIT(NULL);

+EXTERN const char *named_g_engine INIT(NULL);
+
 EXTERN isc_time_t		  named_g_boottime;
 EXTERN isc_time_t		  named_g_configtime;
 EXTERN bool named_g_memstatistics INIT(false);
@@ -18,8 +18,22 @@
 #include <isc/log.h>
 #include <isc/types.h>

+#include <dns/log.h>
+
 #include <named/globals.h> /* Required for named_g_(categories|modules). */

+/* Unused slot 0. */
+#define NAMED_LOGCATEGORY_UNMATCHED (&named_g_categories[1])
+
+/*
+ * Backwards compatibility.
+ */
+#define NAMED_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
+
+#define NAMED_LOGMODULE_MAIN	(&named_g_modules[0])
+#define NAMED_LOGMODULE_SERVER	(&named_g_modules[1])
+#define NAMED_LOGMODULE_CONTROL (&named_g_modules[2])
+
 isc_result_t
 named_log_init(bool safe);
 /*%
@@ -65,3 +79,6 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 /*%
 * Set up "category unmatched" to go to the right places.
 */
+
+void
+named_log_shutdown(void);
@@ -26,7 +26,7 @@
 */
 #define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"

-ISC_NORETURN void
+noreturn void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -39,13 +39,10 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(bool permanent);
-
-void
-named_os_restoreuser(void);
+named_os_changeuser(void);

 uid_t
-named_os_uid(void);
+ns_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -56,6 +56,9 @@ struct named_server {
 	char *version;	    /*%< User-specified version */
 	bool  hostname_set; /*%< User has set hostname */
 	char *hostname;	    /*%< User-specified hostname */
+#ifdef USE_DNSRPS
+	char *dnsrpslib;
+#endif /* ifdef USE_DNSRPS */

 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
@@ -72,6 +75,7 @@ struct named_server {
 	isc_timer_t *tat_timer;

 	uint32_t interface_interval;
+	uint32_t heartbeat_interval;

 	atomic_int reload_status;

@@ -104,7 +108,6 @@ struct named_server {
 	isc_tlsctx_cache_t *tlsctx_client_cache;

 	isc_signal_t *sighup;
-	isc_signal_t *sigusr1;
 };

 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -181,20 +184,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex);
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
 /*%<
- * Enable/disable, or toggle, a server option via the command channel.
- * 'option' is the option value to be changed (for example,
- * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
- * option's human-readable name for logging purposes ("query logging"
- * or "response logging").
- *
- * If an explicit argument to enable the option was provided
- * (i.e., "on", "enable", "true", or "yes") or an explicit argument
- * to disable it ("off", "disable", "false", or "no"), it will be used.
- *
- * If no argument is provided, the option's current state will be reversed.
+ * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
+ * but can also be used as a toggle for backward comptibility.)
 */

 /*%
@@ -382,21 +375,3 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Import SKR file for offline KSK signing.
- */
-isc_result_t
-named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);
@@ -15,10 +15,13 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -34,5 +37,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
- *\li		return codes from dns_name_fromtext()
+ *\li		ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -15,12 +15,15 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/transport.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	'listp' is not NULL, and '*listp' is NULL
 *
 */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,11 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -32,6 +35,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *
 *	Returns:
 *	\li	ISC_R_SUCCESS
- *	\li	DNS_R_BADALG
- *	\li	return codes from dns_name_fromtext()
+ *	\li	ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -17,11 +17,14 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 * \li	'rdclass' to be a valid rdataclass
 * \li	'name' to be a valid zone origin name
 */
+
+ISC_LANG_ENDDECLS
@@ -15,29 +15,67 @@

 #include <stdlib.h>

-#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include <named/log.h>

 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
 #endif /* ifndef ISC_FACILITY */

+/*%
+ * When adding a new category, be sure to add the appropriate
+ * \#define to <named/log.h> and to update the list in
+ * bin/check/check-tool.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
+/*%
+ * When adding a new module, be sure to add the appropriate
+ * \#define to <dns/log.h>.
+ */
+static isc_logmodule_t modules[] = {
+	{ "main", 0 }, { "server", 0 }, { "control", 0 }, { NULL, 0 }
+};
+
 isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *log_mctx = NULL;
+
+	named_g_categories = categories;
+	named_g_modules = modules;

 	/*
-	 * This is not technically needed, as we are calling named_log_init()
-	 * only at the start of named process.  But since the named binary is
-	 * the only place that also calls isc_logconfig_set(), this is a good
-	 * hygiene.
+	 * Setup a logging context.
 	 */
-	rcu_read_lock();
-	lcfg = isc_logconfig_get();
+	isc_mem_create(&log_mctx);
+	isc_mem_setname(log_mctx, "named_log");
+	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
+	isc_mem_detach(&log_mctx);
+
+	/*
+	 * named-checktool.c:setup_logging() needs to be kept in sync.
+	 */
+	isc_log_registercategories(named_g_lctx, named_g_categories);
+	isc_log_registermodules(named_g_lctx, named_g_modules);
+	isc_log_setcontext(named_g_lctx);
+	dns_log_init(named_g_lctx);
+	dns_log_setcontext(named_g_lctx);
+	cfg_log_init(named_g_lctx);
+	ns_log_init(named_g_lctx);
+	ns_log_setcontext(named_g_lctx);
+
 	if (safe) {
 		named_log_setsafechannels(lcfg);
 	} else {
@@ -50,14 +88,15 @@ named_log_init(bool safe) {
 	}

 	named_log_setdefaultsslkeylogfile(lcfg);
-	rcu_read_unlock();

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	rcu_read_unlock();
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);

-	return result;
+	return (result);
 }

 void
@@ -77,16 +116,6 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
 				      ISC_LOG_DYNAMIC, &destination,
 				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
 	}

 	if (named_g_logfile != NULL) {
@@ -110,7 +139,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 	/*
 	 * Set the initial debug level.
 	 */
-	isc_log_setdebuglevel(named_g_debuglevel);
+	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 }

 void
@@ -125,19 +154,9 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * Setting the debug level to zero should get the output
 		 * discarded a bit faster.
 		 */
-		isc_log_setdebuglevel(0);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
+		isc_log_setdebuglevel(named_g_lctx, 0);
 	} else {
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 	}

 	if (named_g_logfile != NULL) {
@@ -180,6 +199,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 			.maximum_size = 100 * 1024 * 1024,
 		},
 	};
+	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
 	    strcmp(sslkeylogfile_path, "config") == 0)
@@ -187,10 +207,11 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 		return;
 	}

-	isc_log_createandusechannel(lcfg, "default_sslkeylogfile",
-				    ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
-				    0, ISC_LOGCATEGORY_SSLKEYLOG,
-				    ISC_LOGMODULE_DEFAULT);
+	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
+			      ISC_LOG_INFO, &destination, 0);
+	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }

 isc_result_t
@@ -198,8 +219,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;

 	result = isc_log_usechannel(lcfg, "default_debug",
-				    ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -208,16 +228,16 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 		if (named_g_logfile != NULL) {
 			result = isc_log_usechannel(lcfg, "default_logfile",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		} else if (!named_g_nosyslog) {
 			result = isc_log_usechannel(lcfg, "default_syslog",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		}
 	}

 cleanup:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -225,6 +245,13 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
-				    ISC_LOGMODULE_DEFAULT);
-	return result;
+				    NULL);
+	return (result);
+}
+
+void
+named_log_shutdown(void) {
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
 }
@@ -24,6 +24,7 @@
 #include <isc/util.h>

 #include <isccfg/cfg.h>
+#include <isccfg/log.h>

 #include <named/log.h>
 #include <named/logconf.h>
@@ -43,25 +44,28 @@ static isc_result_t
 category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
-	isc_logcategory_t category;
+	isc_logcategory_t *category;
+	isc_logmodule_t *module;
 	const cfg_obj_t *destinations = NULL;
 	const cfg_listelt_t *element = NULL;

 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
-	category = isc_log_categorybyname(catname);
-	if (category == ISC_LOGCATEGORY_INVALID) {
-		cfg_obj_log(ccat, ISC_LOG_ERROR,
+	category = isc_log_categorybyname(named_g_lctx, catname);
+	if (category == NULL) {
+		cfg_obj_log(ccat, named_g_lctx, ISC_LOG_ERROR,
 			    "unknown logging category '%s' ignored", catname);
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (logconfig == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

+	module = NULL;
+
 	destinations = cfg_tuple_get(ccat, "destinations");
 	for (element = cfg_list_first(destinations); element != NULL;
 	     element = cfg_list_next(element))
@@ -70,16 +74,16 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		const char *channelname = cfg_obj_asstring(channel);

 		result = isc_log_usechannel(logconfig, channelname, category,
-					    ISC_LOGMODULE_DEFAULT);
+					    module);
 		if (result != ISC_R_SUCCESS) {
-			isc_log_write(CFG_LOGCATEGORY_CONFIG,
+			isc_log_write(named_g_lctx, CFG_LOGCATEGORY_CONFIG,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -123,11 +127,11 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 	if (i != 1) {
-		cfg_obj_log(channel, ISC_LOG_ERROR,
+		cfg_obj_log(channel, named_g_lctx, ISC_LOG_ERROR,
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	type = ISC_LOG_TONULL;
@@ -239,8 +243,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				flags |= ISC_LOG_ISO8601;
 			} else if (strcasecmp(s, "iso8601-utc") == 0) {
 				flags |= ISC_LOG_ISO8601 | ISC_LOG_UTC;
-			} else if (strcasecmp(s, "iso8601-tzinfo") == 0) {
-				flags |= ISC_LOG_ISO8601 | ISC_LOG_TZINFO;
 			}
 		}
 	}
@@ -308,7 +310,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -363,8 +365,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	return result;
+	return (result);
 }
@@ -27,12 +27,11 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -47,7 +46,6 @@

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -90,6 +88,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -150,13 +152,25 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING, format,
+			       args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }

@@ -165,16 +179,25 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);

 	_exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);

@@ -185,19 +208,27 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_lctx != NULL) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "%s:%d: %s(%s) failed", file, line,
+			      isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -205,7 +236,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	_exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 library_fatal_error(const char *file, int line, const char *func,
 		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);

@@ -216,20 +247,28 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_lctx != NULL) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -249,23 +288,32 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_lctx != NULL) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
+			       args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }

 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment]\n"
+			"[-D comment] [-E engine]\n"
 			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record}]\n"
+			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -358,7 +406,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return tmp;
+	return (tmp);
 }

 static struct flag_def {
@@ -462,8 +510,9 @@ list_hmac_algorithms(isc_buffer_t *b) {

 static void
 logit(isc_buffer_t *b) {
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "%.*s", (int)isc_buffer_usedlength(b),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
+		      (int)isc_buffer_usedlength(b),
 		      (char *)isc_buffer_base(b));
 }

@@ -507,6 +556,8 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
+	isc_mem_t *mctx = NULL;
+	isc_result_t result;
 	isc_buffer_t b;
 	char buf[512];
 #if defined(HAVE_GEOIP2)
@@ -539,8 +590,16 @@ printversion(bool verbose) {
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
 	printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT);
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to OpenSSL version: %s\n",
 	       OpenSSL_version(OPENSSL_VERSION));
+
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	printf("linked to OpenSSL version: %s\n",
+	       SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
@@ -580,9 +639,17 @@ printversion(bool verbose) {
 #endif /* if defined(HAVE_DNSTAP) */
 	printf("threads support is enabled\n");

-	isc_buffer_init(&b, buf, sizeof(buf));
-	format_supported_algorithms(printit);
-	printf("\n");
+	isc_mem_create(&mctx);
+	result = dst_lib_init(mctx, named_g_engine);
+	if (result == ISC_R_SUCCESS) {
+		isc_buffer_init(&b, buf, sizeof(buf));
+		format_supported_algorithms(printit);
+		printf("\n");
+		dst_lib_destroy();
+	} else {
+		printf("DST initialization failure: %s\n",
+		       isc_result_totext(result));
+	}

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -606,9 +673,7 @@ printversion(bool verbose) {
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_t *mctx = NULL;
-	isc_mem_create(&mctx);
-	RTC(cfg_parser_create(mctx, &parser));
+	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
@@ -837,8 +902,7 @@ parse_command_line(int argc, char *argv[]) {
 			/* Descriptive comment for 'ps'. */
 			break;
 		case 'E':
-			named_main_earlyfatal(
-				"%s", isc_result_totext(DST_R_NOENGINE));
+			named_g_engine = isc_commandline_argument;
 			break;
 		case 'f':
 			named_g_foreground = true;
@@ -846,8 +910,6 @@ parse_command_line(int argc, char *argv[]) {
 		case 'g':
 			named_g_foreground = true;
 			named_g_logstderr = true;
-			named_g_logflags = ISC_LOG_PRINTTIME | ISC_LOG_ISO8601 |
-					   ISC_LOG_TZINFO;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -906,7 +968,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -952,18 +1032,18 @@ create_managers(void) {
 		named_g_cpus = named_g_cpus_detected;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		      named_g_cpus_detected,
-		      named_g_cpus_detected == 1 ? "" : "s", named_g_cpus,
-		      named_g_cpus == 1 ? "" : "s");
+	isc_log_write(
+		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
+		named_g_cpus, named_g_cpus == 1 ? "" : "s");

 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
 			    &named_g_netmgr);

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1036,129 +1116,150 @@ setup(void) {
 		named_os_daemonize();
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "starting %s%s <id:%s>", PACKAGE_STRING,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "starting %s%s <id:%s>", PACKAGE_STRING,
 		      PACKAGE_DESCRIPTION, PACKAGE_SRCID);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running on %s", named_os_uname());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
+		      named_os_uname());

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "built with %s", PACKAGE_CONFIGARGS);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
+		      PACKAGE_CONFIGARGS);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running as: %s%s%s", program_name,
-		      saved_command_line, ellipsis);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "running as: %s%s%s", program_name, saved_command_line,
+		      ellipsis);
 #ifdef __clang__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by CLANG %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by CLANG %s", __VERSION__);
 #else /* ifdef __clang__ */
 #if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by ICC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by ICC %s", __VERSION__);
 #else /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #ifdef __GNUC__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by GCC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by GCC %s", __VERSION__);
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
 #ifdef __SUNPRO_C
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by Solaris Studio %x",
-		      __SUNPRO_C);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with OpenSSL version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with OpenSSL version: %s",
 		      OPENSSL_VERSION_TEXT);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to OpenSSL version: %s",
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
 		      OpenSSL_version(OPENSSL_VERSION));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libuv version: %d.%d.%d",
-		      UV_VERSION_MAJOR, UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libuv version: %s",
-		      uv_version_string());
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with %s version: %s",
-		      RCU_FLAVOR, RCU_VERSION);
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
+		      SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
+		      UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libuv version: %s", uv_version_string());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
 #if defined(JEMALLOC_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with jemalloc version: %u.%u.%u",
 		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
 		      JEMALLOC_VERSION_BUGFIX);
 #elif defined(M_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with system jemalloc version: %u", M_VERSION);
 #endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libnghttp2 version: %s",
-		      NGHTTP2_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libnghttp2 version: %s",
-		      nginfo->version_str);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libnghttp2 version: %s", nginfo->version_str);
 #endif
 #ifdef HAVE_LIBXML2
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libxml2 version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libxml2 version: %s",
 		      LIBXML_DOTTED_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libxml2 version: %s",
-		      xmlParserVersion);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libxml2 version: %s", xmlParserVersion);
 #endif /* ifdef HAVE_LIBXML2 */
 #if defined(HAVE_JSON_C)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with json-c version: %s",
-		      JSON_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to json-c version: %s",
-		      json_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with json-c version: %s", JSON_C_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to json-c version: %s", json_c_version());
 #endif /* if defined(HAVE_JSON_C) */
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with zlib version: %s",
-		      ZLIB_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to zlib version: %s",
-		      zlibVersion());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with zlib version: %s", ZLIB_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to zlib version: %s", zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to maxminddb version: %s",
-		      MMDB_lib_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to maxminddb version: %s", MMDB_lib_version());
 #endif /* if defined(HAVE_GEOIP2) */
 #if defined(HAVE_DNSTAP)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with protobuf-c version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with protobuf-c version: %s",
 		      PROTOBUF_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to protobuf-c version: %s",
-		      protobuf_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to protobuf-c version: %s", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "BIND 9 is maintained by Internet Systems Consortium,");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "corporation.  Support and training for BIND 9 are ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "available at https://www.isc.org/support");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

 	/*
@@ -1215,6 +1316,10 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

+	/*
+	 * Report supported algorithms now that dst_lib_init() has
+	 * been called via named_server_create().
+	 */
 	format_supported_algorithms(logit);

 	/*
@@ -1290,8 +1395,9 @@ cleanup(void) {
 	 */
 	dlz_dlopen_clear();

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "exiting");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "exiting");
+	named_log_shutdown();
 }

 static char *memstats = NULL;
@@ -1331,7 +1437,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1340,7 +1446,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1349,10 +1455,17 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
+	}
+
+	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
+				 "allocation failed: %s",
+				 isc_result_totext(ISC_R_NOMEMORY));
+		scf_handle_destroy(h);
+		return (ISC_R_FAILURE);
 	}

-	instance = isc_mem_allocate(mctx, namelen + 1);
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
 			UNEXPECTED_ERROR("scf_myname() failed: %s",
@@ -1360,12 +1473,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 #endif /* HAVE_LIBSCF */

@@ -1454,7 +1567,6 @@ main(int argc, char *argv[]) {
 	 * Start things running
 	 */
 	isc_signal_start(named_g_server->sighup);
-	isc_signal_start(named_g_server->sigusr1);

 	/*
 	 * Pause the loop manager in fatal.
@@ -1497,7 +1609,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -1510,9 +1622,18 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -73,6 +73,15 @@ Options
   This option specifies a string that is used to identify a instance of :program:`named`
   in a process listing. The contents of ``string`` are not examined.

+.. option:: -E engine-name
+
+   When applicable, this option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option runs the server in the foreground (i.e., do not daemonize).
@@ -108,7 +117,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace`` and ``record``. These correspond to the
+   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -61,9 +61,6 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

-static uid_t saved_uid = (uid_t)-1;
-static gid_t saved_gid = (gid_t)-1;
-
 #if HAVE_LIBCAP

 static bool non_root = false;
@@ -252,6 +249,115 @@ linux_keepcaps(void) {

 #endif /* HAVE_LIBCAP */

+/*
+ * First define compatibility shims if {set,get}res{uid,gid} are not available
+ */
+
+#if !HAVE_GETRESGID
+static int
+getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
+	*rgid = -1;
+	*egid = getegid();
+	*sgid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESGID */
+
+#if !HAVE_SETRESGID
+static int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
+	REQUIRE(rgid == (gid_t)-1);
+	REQUIRE(sgid == (gid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(rgid, egid));
+#else  /* HAVE_SETREGID */
+	return (setegid(egid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESGID */
+
+#if !HAVE_GETRESUID
+static int
+getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
+	*ruid = -1;
+	*euid = geteuid();
+	*suid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESUID */
+
+#if !HAVE_SETRESUID
+static int
+setresuid(uid_t ruid, uid_t euid, uid_t suid) {
+	REQUIRE(ruid == (uid_t)-1);
+	REQUIRE(suid == (uid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(ruid, euid));
+#else  /* HAVE_SETREGID */
+	return (setegid(euid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESUID */
+
+static int
+set_effective_gid(gid_t gid) {
+	gid_t oldgid;
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid == gid) {
+		return (0);
+	}
+
+	if (setresgid(-1, gid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid != gid) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+set_effective_uid(uid_t uid) {
+	uid_t olduid;
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid == uid) {
+		return (0);
+	}
+
+	if (setresuid(-1, uid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid != uid) {
+		return (-1);
+	}
+
+	/* Success */
+	return (0);
+}
+
 static void
 setperms(uid_t uid, gid_t gid) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -260,13 +366,13 @@ setperms(uid_t uid, gid_t gid) {
 	 * Drop the gid privilege first, because in some cases the gid privilege
 	 * cannot be dropped after the uid privilege has been dropped.
 	 */
-	if (setegid(gid) == -1) {
+	if (set_effective_gid(gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective gid to %d: %s",
 					gid, strbuf);
 	}

-	if (seteuid(uid) == -1) {
+	if (set_effective_uid(uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective uid to %d: %s",
 					uid, strbuf);
@@ -400,15 +506,15 @@ named_os_closedevnull(void) {
 static bool
 all_digits(const char *s) {
 	if (*s == '\0') {
-		return false;
+		return (false);
 	}
 	while (*s != '\0') {
 		if (!isdigit((unsigned char)(*s))) {
-			return false;
+			return (false);
 		}
 		s++;
 	}
-	return true;
+	return (true);
 }

 void
@@ -464,41 +570,20 @@ named_os_inituserinfo(const char *username) {
 }

 void
-named_os_restoreuser(void) {
-	if (runas_pw == NULL || done_setuid) {
-		return;
-	}
-
-	REQUIRE(saved_uid != (uid_t)-1);
-	REQUIRE(saved_gid != (gid_t)-1);
-
-	setperms(saved_uid, saved_gid);
-}
-
-void
-named_os_changeuser(bool permanent) {
+named_os_changeuser(void) {
 	char strbuf[ISC_STRERRORSIZE];
 	if (runas_pw == NULL || done_setuid) {
 		return;
 	}

-	if (!permanent) {
-		saved_uid = getuid();
-		saved_gid = getgid();
-
-		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
-		return;
-	}
-
 	done_setuid = true;

-	if (setgid(runas_pw->pw_gid) == -1) {
+	if (setgid(runas_pw->pw_gid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

-	if (setuid(runas_pw->pw_uid) == -1) {
+	if (setuid(runas_pw->pw_uid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
@@ -519,11 +604,11 @@ named_os_changeuser(bool permanent) {
 }

 uid_t
-named_os_uid(void) {
+ns_os_uid(void) {
 	if (runas_pw == NULL) {
-		return 0;
+		return (0);
 	}
-	return runas_pw->pw_uid;
+	return (runas_pw->pw_uid);
 }

 void
@@ -541,8 +626,8 @@ named_os_adjustnofile(void) {
 	rlim_old = rl.rlim_cur;

 	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_NOTICE,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 			      "the limit on open files is already at the "
 			      "maximum allowed value: "
 			      "%" PRIu64,
@@ -556,8 +641,8 @@ named_os_adjustnofile(void) {
 		goto fail;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "adjusted limit on open files from "
 		      "%" PRIu64 " to "
 		      "%" PRIu64,
@@ -575,7 +660,7 @@ void
 named_os_minprivs(void) {
 #if HAVE_LIBCAP
 	linux_keepcaps();
-	named_os_changeuser(true);
+	named_os_changeuser();
 	linux_minprivs();
 #endif /* HAVE_LIBCAP */
 }
@@ -587,22 +672,22 @@ safe_open(const char *filename, mode_t mode, bool append) {

 	if (stat(filename, &sb) == -1) {
 		if (errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 	} else if ((sb.st_mode & S_IFREG) == 0) {
 		errno = EOPNOTSUPP;
-		return -1;
+		return (-1);
 	}

 	if (append) {
 		fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, mode);
 	} else {
 		if (unlink(filename) < 0 && errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 		fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
 	}
-	return fd;
+	return (fd);
 }

 static void
@@ -650,7 +735,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			    !strcmp(slash + 1, ".."))
 			{
 				*slash = '/';
-				return 0;
+				return (0);
 			}
 			mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
 			mode |= S_IRGRP | S_IXGRP;	    /* g=rx */
@@ -672,11 +757,11 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 		}
 		*slash = '/';
 	}
-	return 0;
+	return (0);

 error:
 	*slash = '/';
-	return -1;
+	return (-1);
 }

 FILE *
@@ -693,25 +778,28 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s", filename,
 					strbuf);
-		return NULL;
+		return (NULL);
 	}
 	if (mkdirpath(f, named_main_earlywarning) == -1) {
 		free(f);
-		return NULL;
+		return (NULL);
 	}
 	free(f);

 	if (switch_user && runas_pw != NULL) {
+		uid_t olduid = getuid();
+		gid_t oldgid = getgid();
+
 		/*
-		 * Temporarily set UID/GID to the one we'll be running with
+		 * Set UID/GID to the one we'll be running with
 		 * eventually.
 		 */
-		named_os_changeuser(false);
+		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

 		fd = safe_open(filename, mode, false);

 		/* Restore UID/GID to previous uid/gid */
-		named_os_restoreuser();
+		setperms(olduid, oldgid);

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -737,7 +825,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
-		return NULL;
+		return (NULL);
 	}

 	fp = fdopen(fd, "w");
@@ -747,7 +835,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 					filename, strbuf);
 	}

-	return fp;
+	return (fp);
 }

 void
@@ -863,5 +951,5 @@ named_os_uname(void) {
 	if (unamep == NULL) {
 		getuname();
 	}
-	return unamep;
+	return (unamep);
 }
@@ -97,7 +97,7 @@ typedef struct stats_dumparg {
 	isc_result_t result;
 } stats_dumparg_t;

-static isc_once_t once = ISC_ONCE_INITIALIZER;
+static isc_once_t once = ISC_ONCE_INIT;

 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
@@ -126,19 +126,19 @@ user_zonetype(dns_zone_t *zone) {
 	const struct zt *tp;

 	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	view = dns_zone_getview(zone);
 	if (view != NULL && strcmp(view->name, "_bind") == 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	ztype = dns_zone_gettype(zone);
 	for (tp = typemap; tp->string != NULL && tp->type != ztype; tp++) {
 		/* empty */
 	}
-	return tp->string;
+	return (tp->string);
 }
 #endif /* ifdef EXTENDED_STATS */

@@ -251,7 +251,7 @@ get_histo_desc(const char *prefix, int i, int inf, bool ext) {
 	}
 	INSIST(0 < len && (size_t)len < space);
 	used += len + 1;
-	return desc;
+	return (desc);
 }

 static void
@@ -339,21 +339,6 @@ init_desc(void) {
 		       "RPZRewrites");
 	SET_NSSTATDESC(udp, "UDP queries received", "QryUDP");
 	SET_NSSTATDESC(tcp, "TCP queries received", "QryTCP");
-	SET_NSSTATDESC(dot, "DoT queries received", "QryDoT");
-	SET_NSSTATDESC(doh, "DoH queries received", "QryDoH");
-	SET_NSSTATDESC(dohplain, "DoH-Plain queries received", "QryDoHPlain");
-	SET_NSSTATDESC(proxyudp, "PROXYv2 UDP queries received", "QryProxyUDP");
-	SET_NSSTATDESC(proxytcp, "PROXYv2 TCP queries received", "QryProxyTCP");
-	SET_NSSTATDESC(proxydot, "PROXYv2 DoT queries received", "QryProxyDoT");
-	SET_NSSTATDESC(proxydoh, "PROXYv2 DoH queries received", "QryProxyDoH");
-	SET_NSSTATDESC(proxydohplain, "PROXYv2/DoH-Plain queries received",
-		       "QryProxyDoHPlain");
-	SET_NSSTATDESC(encryptedproxydot,
-		       "Encrypted PROXYv2 DoT queries received",
-		       "QryEncryptedProxyDoT");
-	SET_NSSTATDESC(encryptedproxydoh,
-		       "Encrypted PROXYv2 DoH queries received",
-		       "QryEncryptedProxyDoH");
 	SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
@@ -487,8 +472,6 @@ init_desc(void) {
 			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
-	SET_RESSTATDESC(forwardonlyfail, "all forwarders failed",
-			"ForwardOnlyFail");

 	INSIST(i == dns_resstatscounter_max);

@@ -831,8 +814,8 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }

 #if defined(EXTENDED_STATS)
@@ -848,8 +831,8 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	}
 	isc_histo_destroy(&hg);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }
 #endif /* defined(EXTENDED_STATS) */

@@ -878,7 +861,7 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 		if (category != NULL) {
 			cat = json_object_new_object();
 			if (cat == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(job, category, cat);
 		}
@@ -943,19 +926,20 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 #ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(cat, desc[idx], counter);
 #endif /* ifdef HAVE_JSON_C */
 			break;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at dump_counters()");
-	return ISC_R_FAILURE;
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at dump_counters()");
+	return (ISC_R_FAILURE);
 #endif /* ifdef HAVE_LIBXML2 */
 }

@@ -1015,8 +999,9 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rdtypestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rdtypestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1024,7 +1009,7 @@ cleanup:

 static bool
 rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr) {
-	return (DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0;
+	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
 }

 static void
@@ -1103,8 +1088,9 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rdatasetstats_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rdatasetstats_dump()");
 	dumparg->result = ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -1157,8 +1143,9 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at opcodestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at opcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1212,8 +1199,9 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rcodestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1268,8 +1256,9 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at dnssecsignstat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at dnssecsignstat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1304,7 +1293,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dumparg.type = isc_statsformat_xml;
@@ -1461,11 +1450,12 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
-	return ISC_R_FAILURE;
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "Failed at zone_xmlrender()");
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -1488,11 +1478,10 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
@@ -1504,7 +1493,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		 * (if any), but we still want to continue generating the
 		 * remaining parts of the output.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!is_running && !is_deferred && !is_presoa && !is_pending &&
@@ -1514,12 +1503,12 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_xfrin_detach(&xfr);
 		}
 		/* No ongoing/queued transfer. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (is_running && xfr == NULL) {
 		/* The transfer is finished, and it's shutting down. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
@@ -1617,13 +1606,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -1706,7 +1691,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1717,9 +1702,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
-	TRY0(xmlTextWriterEndElement(writer));

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -1736,17 +1718,18 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		dns_xfrin_detach(&xfr);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (xfr != NULL) {
 		dns_xfrin_detach(&xfr);
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "Failed at xfrin_xmlrender()");

-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -2148,18 +2131,19 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed generating XML response");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed generating XML response");
 	if (writer != NULL) {
 		xmlFreeTextWriter(writer);
 	}
 	if (doc != NULL) {
 		xmlFreeDoc(doc);
 	}
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static void
@@ -2189,11 +2173,12 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_xmlfree;
 		*freecb_args = NULL;
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "failed at rendering XML()");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "failed at rendering XML()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2203,8 +2188,8 @@ render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2214,8 +2199,8 @@ render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2225,8 +2210,8 @@ render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2236,8 +2221,8 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2247,8 +2232,8 @@ render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2258,8 +2243,8 @@ render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2269,8 +2254,8 @@ render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2280,8 +2265,8 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 #endif /* HAVE_LIBXML2 */
@@ -2321,7 +2306,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 	json_object *node = json_object_new_object();

 	if (node == NULL) {
-		return NULL;
+		return (NULL);
 	}

 	json_object_object_add(node, "name", json_object_new_string(name));
@@ -2335,7 +2320,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 		json_object_object_add(node, "type",
 				       json_object_new_string(ztype));
 	}
-	return node;
+	return (node);
 }

 static isc_result_t
@@ -2354,7 +2339,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2373,7 +2358,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (zoneobj == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -2541,7 +2526,7 @@ cleanup:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2567,11 +2552,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2675,15 +2659,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -2770,7 +2749,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2780,10 +2759,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
-	json_object_object_add(xfrinobj, "rate",
-			       json_object_new_int64(rate > INT64_MAX
-							     ? INT64_MAX
-							     : (int64_t)rate));

 	if (is_running && is_first_data_received) {
 		json_object_object_add(
@@ -2805,7 +2780,7 @@ cleanup:
 	if (xfrinobj != NULL) {
 		json_object_put(xfrinobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2843,7 +2818,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	bindstats = json_object_new_object();
 	if (bindstats == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -3376,7 +3351,7 @@ cleanup:
 		json_object_put(bindstats);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3401,11 +3376,12 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_jsonfree;
 		*freecb_args = bindstats;
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "failed at rendering JSON()");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "failed at rendering JSON()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3415,8 +3391,8 @@ render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3426,8 +3402,8 @@ render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3437,8 +3413,8 @@ render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3448,8 +3424,8 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3459,8 +3435,8 @@ render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3470,8 +3446,8 @@ render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3481,8 +3457,8 @@ render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3492,17 +3468,12 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			   b, freecb, freecb_args);
+	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 #endif /* HAVE_JSON_C */

-#if HAVE_LIBXML2
-/*
- * This is only needed if we have libxml2 and was confusingly returned if
- * neither of libxml2 or json-c is configured.
- */
 static isc_result_t
 render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
 	   unsigned int *retcode, const char **retmsg, const char **mimetype,
@@ -3556,22 +3527,20 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
-#endif

 static void
 shutdown_listener(named_statschannel_t *listener) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_NOTICE, "stopping statistics channel on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+		      "stopping statistics channel on %s", socktext);

 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static bool
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
@@ -3591,20 +3560,18 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	    match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return true;
+		return (true);
 	}
 	UNLOCK(&listener->lock);

 	isc_sockaddr_format(fromaddr, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_WARNING, "rejected statistics connection from %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		      "rejected statistics connection from %s", socktext);

-	return false;
+	return (false);
 }
-#endif

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static void
 destroy_listener(void *arg) {
 	named_statschannel_t *listener = (named_statschannel_t *)arg;
@@ -3618,24 +3585,12 @@ destroy_listener(void *arg) {
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
-#endif

 static isc_result_t
 add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     const cfg_obj_t *listen_params, const cfg_obj_t *config,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
-#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON_C)
-	UNUSED(server);
-	UNUSED(listenerp);
-	UNUSED(listen_params);
-	UNUSED(config);
-	UNUSED(addr);
-	UNUSED(aclconfctx);
-	UNUSED(socktext);
-
-	return ISC_R_NOTIMPLEMENTED;
-#else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
@@ -3650,8 +3605,9 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,

 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3700,8 +3656,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
@@ -3731,13 +3685,15 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
+	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			    server);

 	*listenerp = listener;
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_NOTICE, "statistics channel listening on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+		      "statistics channel listening on %s", socktext);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (listener->acl != NULL) {
@@ -3746,8 +3702,7 @@ cleanup:
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

-	return result;
-#endif
+	return (result);
 }

 static void
@@ -3778,8 +3733,9 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 	 */
 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3793,7 +3749,7 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,

 		UNLOCK(&listener->lock);
 	} else {
-		cfg_obj_log(listen_params, ISC_LOG_WARNING,
+		cfg_obj_log(listen_params, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "statistics channel %s: %s",
 			    socktext, isc_result_totext(result));
@@ -3830,20 +3786,20 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	 */
 	if (statschannellist != NULL) {
 #ifndef EXTENDED_STATS
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels specified but not effective "
 			      "due to missing XML and/or JSON library");
 #else /* EXTENDED_STATS */
 #ifndef HAVE_LIBXML2
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels: XML library missing, "
 			      "only JSON stats will be available");
 #endif /* !HAVE_LIBXML2 */
 #ifndef HAVE_JSON_C
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels: JSON library missing, "
 			      "only XML stats will be available");
 #endif /* !HAVE_JSON_C */
@@ -3882,7 +3838,8 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
 					      ISC_LOG_DEBUG(9),
 					      "processing statistics "
@@ -3913,6 +3870,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 					if (r != ISC_R_SUCCESS) {
 						cfg_obj_log(
 							listen_params,
+							named_g_lctx,
 							ISC_LOG_WARNING,
 							"couldn't allocate "
 							"statistics channel"
@@ -3939,7 +3897,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	}

 	ISC_LIST_APPENDLIST(server->statschannels, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -4177,5 +4135,5 @@ named_stats_dump(named_server_t *server, FILE *fp) {

 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

-	return ISC_R_SUCCESS; /* this function currently always succeeds */
+	return (ISC_R_SUCCESS); /* this function currently always succeeds */
 }
@@ -38,9 +38,9 @@
 	} while (0)

 #include <named/log.h>
-#define LOG(msg)                                                         \
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER, \
-		      ISC_LOG_ERROR, "%s", msg)
+#define LOG(msg)                                               \
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, \
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, "%s", msg)

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
@@ -53,7 +53,10 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_buffer_t b;
 	const cfg_obj_t *obj;

-	dns_tkeyctx_create(mctx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}

 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);
@@ -62,9 +65,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tctx->domain);
+		dns_name_init(tctx->domain, NULL);
 		dns_name_dup(name, mctx, tctx->domain);
 	}

@@ -76,7 +79,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
 	}

@@ -88,9 +91,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	}

 	*tctxp = tctx;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tkeyctx_destroy(&tctx);
-	return result;
+	return (result);
 }
@@ -27,16 +27,17 @@
 #include <named/log.h>
 #include <named/transportconf.h>

-#define create_name(id, name)                                     \
-	isc_buffer_t namesrc;                                     \
-	dns_fixedname_t _fn;                                      \
-	name = dns_fixedname_initname(&_fn);                      \
-	isc_buffer_constinit(&namesrc, id, strlen(id));           \
-	isc_buffer_add(&namesrc, strlen(id));                     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname, \
-				    DNS_NAME_DOWNCASE));          \
-	if (result != ISC_R_SUCCESS) {                            \
-		goto failure;                                     \
+#define create_name(id, name)                                      \
+	isc_buffer_t namesrc, namebuf;                             \
+	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
+	dns_name_init(name, NULL);                                 \
+	isc_buffer_constinit(&namesrc, id, strlen(id));            \
+	isc_buffer_add(&namesrc, strlen(id));                      \
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
+				    DNS_NAME_DOWNCASE, &namebuf)); \
+	if (result != ISC_R_SUCCESS) {                             \
+		goto failure;                                      \
 	}

 #define parse_transport_option(map, transport, name, setter)      \
@@ -99,15 +100,15 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *dohname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t dohname;
+		dns_transport_t *transport;

 		doh = cfg_listelt_value(element);
 		dohid = cfg_obj_asstring(cfg_map_getname(doh));

-		create_name(dohid, dohname);
+		create_name(dohid, &dohname);

-		transport = dns_transport_new(dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
 					      list);

 		dns_transport_set_tlsname(transport, dohid);
@@ -130,12 +131,13 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
+	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -147,8 +149,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *tlsname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t tlsname;
+		dns_transport_t *transport;

 		tls = cfg_listelt_value(element);
 		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
@@ -158,9 +160,10 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 			goto failure;
 		}

-		create_name(tlsid, tlsname);
+		create_name(tlsid, &tlsname);

-		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      list);

 		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
@@ -182,12 +185,13 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
+	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 #define CHECK(f)                             \
@@ -214,18 +218,18 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 		obj = NULL;
 	}

-	return result;
+	return (result);
 }

 static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
-	dns_name_t *tlsname = NULL;
+	dns_name_t tlsname;
 	dns_transport_t *transport;

-	create_name("ephemeral", tlsname);
+	create_name("ephemeral", &tlsname);

-	transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
 	dns_transport_set_tlsname(transport, "ephemeral");

 	return;
@@ -256,8 +260,8 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*listp = list;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	dns_transport_list_detach(&list);
-	return result;
+	return (result);
 }
@@ -46,11 +46,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	{
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
-		dns_fixedname_t fkey;
-		dns_name_t *keyname = dns_fixedname_initname(&fkey);
+		dns_name_t keyname;
 		dst_algorithm_t alg = DST_ALG_UNKNOWN;
 		const char *algstr = NULL;
-		isc_buffer_t keynamesrc;
+		char keynamedata[1024];
+		isc_buffer_t keynamesrc, keynamebuf;
 		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
 		int secretlen = 0;
@@ -68,10 +68,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		/*
 		 * Create the key name.
 		 */
+		dns_name_init(&keyname, NULL);
 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
-		ret = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
-					DNS_NAME_DOWNCASE);
+		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
+		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
+					DNS_NAME_DOWNCASE, &keynamebuf);
 		if (ret != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -83,7 +85,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
 		    ISC_R_SUCCESS)
 		{
-			cfg_obj_log(algobj, ISC_LOG_ERROR,
+			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
 				    keyid, algstr);
@@ -101,7 +103,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);

-		ret = dns_tsigkey_create(keyname, alg, secret, secretlen, mctx,
+		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
@@ -121,15 +123,15 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		dns_tsigkey_detach(&tsigkey);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
-	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
-		    isc_result_totext(ret));
-	return ret;
+	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
+	return (ret);
 }

 isc_result_t
@@ -170,9 +172,9 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*ringp = ring;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tsigkeyring_detach(&ring);
-	return result;
+	return (result);
 }
@@ -16,7 +16,6 @@

 #include <isc/buffer.h>
 #include <isc/file.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/stats.h>
@@ -29,6 +28,7 @@
 #include <dns/ipkeylist.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
 #include <dns/nsec3.h>
@@ -61,6 +61,13 @@ typedef enum {
 	allow_update_forwarding
 } acl_type_t;

+#define RETERR(x)                        \
+	do {                             \
+		isc_result_t _r = (x);   \
+		if (_r != ISC_R_SUCCESS) \
+			return ((_r));   \
+	} while (0)
+
 #define CHECK(x)                             \
 	do {                                 \
 		result = (x);                \
@@ -141,7 +148,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Check for default ACLs that haven't been parsed yet */
@@ -164,14 +171,14 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	(void)named_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 parse_acl:
-	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
-				    &acl);
+	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
+				    named_g_mctx, 0, &acl);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	(*setzacl)(zone, acl);

@@ -181,7 +188,7 @@ parse_acl:
 	}

 	dns_acl_detach(&acl);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -196,17 +203,12 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
 	isc_result_t result = ISC_R_SUCCESS;
-	char debug[1024];
-	isc_buffer_t dbuf;
-
-	isc_buffer_init(&dbuf, debug, sizeof(debug));
-	isc_buffer_setmctx(&dbuf, mctx);

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

 	if (updatepolicy == NULL) {
 		dns_zone_setssutable(zone, NULL);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isstring(updatepolicy) &&
@@ -235,9 +237,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_t b;
 		dns_ssuruletype_t *types;
 		unsigned int i, n;
-		char namebuf[DNS_NAME_FORMATSIZE];

-		isc_buffer_clear(&dbuf);
 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
@@ -246,23 +246,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else {
 			UNREACHABLE();
 		}
-		isc_buffer_putstr(&dbuf, str);
-
-		dns_fixedname_init(&fident);
-		str = cfg_obj_asstring(identity);
-		isc_buffer_constinit(&b, str, strlen(str));
-		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0);
-		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(identity, ISC_LOG_ERROR,
-				    "'%s' is not a valid name", str);
-			goto cleanup;
-		}
-		dns_name_format(dns_fixedname_name(&fident), namebuf,
-				sizeof(namebuf));
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, namebuf);

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -271,8 +254,18 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		{
 			usezone = true;
 		}
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, str);
+
+		dns_fixedname_init(&fident);
+		str = cfg_obj_asstring(identity);
+		isc_buffer_constinit(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
+					   dns_rootname, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR,
+				    "'%s' is not a valid name", str);
+			goto cleanup;
+		}

 		dns_fixedname_init(&fname);
 		if (usezone) {
@@ -283,16 +276,13 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
-						   &b, dns_rootname, 0);
+						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, ISC_LOG_ERROR,
+				cfg_obj_log(identity, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
-			dns_name_format(dns_fixedname_name(&fname), namebuf,
-					sizeof(namebuf));
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, namebuf);
 		}

 		n = named_config_listcount(typelist);
@@ -316,8 +306,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
 			r.base = UNCONST(str);
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, str);

 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -327,7 +315,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
 				    end[1] != 0)
 				{
-					cfg_obj_log(identity, ISC_LOG_ERROR,
+					cfg_obj_log(identity, named_g_lctx,
+						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
 						    bracket);
 					isc_mem_cput(mctx, types, n,
@@ -341,7 +330,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 			result = dns_rdatatype_fromtext(&types[i++].type, &r);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, ISC_LOG_ERROR,
+				cfg_obj_log(identity, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
 				isc_mem_cput(mctx, types, n, sizeof(*types));
@@ -350,10 +340,9 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

-		isc_buffer_putuint8(&dbuf, '\0');
 		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
 				     mtype, dns_fixedname_name(&fname), n,
-				     types, isc_buffer_base(&dbuf));
+				     types);
 		if (types != NULL) {
 			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
@@ -368,7 +357,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		dns_ssuruletype_t any = { dns_rdatatype_any, 0 };

 		if (named_g_server->session_keyname == NULL) {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "failed to enable auto DDNS policy "
 				      "for zone %s: session key not found",
@@ -377,18 +366,17 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		dns_ssutable_addrule(
-			table, true, named_g_server->session_keyname,
-			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
-			&any, "local");
+		dns_ssutable_addrule(table, true,
+				     named_g_server->session_keyname,
+				     dns_ssumatchtype_local,
+				     dns_zone_getorigin(zone), 1, &any);
 	}

 	dns_zone_setssutable(zone, table);

 cleanup:
-	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
-	return result;
+	return (result);
 }

 /*
@@ -427,18 +415,18 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		sa = cfg_obj_assockaddr(address);
 		if (isc_sockaddr_getport(sa) != 0) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		switch (na.family) {
@@ -469,7 +457,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
 	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Add to the list an apex NS with the ns name being the origin name */
@@ -483,7 +471,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			     &region);
 	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

-	return result;
+	return (result);
 }

 /*%
@@ -518,20 +506,20 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(nsname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
-			return result;
+			return (result);
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		dns_name_toregion(nsname, &sregion);
@@ -545,7 +533,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	}

-	return result;
+	return (result);
 }

 /*%
@@ -570,12 +558,9 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_region_t region;

 	/* Create the DB beforehand */
-	result = dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
-			       dns_dbtype_stub, dns_zone_getclass(zone), 0,
-			       NULL, &db);
-	if (result != ISC_R_SUCCESS) {
-		return result;
-	}
+	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
+			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
+			     &db));

 	dns_rdataset_init(&rdataset);

@@ -617,8 +602,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * to trigger delegation.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "No NS record is configured for a "
 			      "static-stub zone '%s'",
 			      zname);
@@ -633,7 +618,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 */
 	CHECK(dns_db_newversion(db, &dbversion));

-	dns_name_init(&apexname);
+	dns_name_init(&apexname, NULL);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

@@ -688,7 +673,7 @@ cleanup:

 	INSIST(dbversion == NULL);

-	return result;
+	return (result);
 }

 /*%
@@ -701,7 +686,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {

 	result = cfg_map_get(map, "type", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	return named_config_getzonetype(obj);
+	return (named_config_getzonetype(obj));
 }

 /*%
@@ -732,11 +717,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,

 		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		(*argvp)[n] = s;
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -748,7 +733,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 */
 static isc_result_t
 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
-	return strtoargvsub(mctx, s, argcp, argvp, 0);
+	return (strtoargvsub(mctx, s, argcp, argvp, 0));
 }

 static const char *const primary_synonyms[] = { "primary", "master", NULL };
@@ -795,12 +780,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,

 	/* interfacemgr can be destroyed only in exclusive mode. */
 	if (named_g_server->interfacemgr == NULL) {
-		return true;
+		return (true);
 	}

 	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
 	{
-		return false;
+		return (false);
 	}

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
@@ -843,7 +828,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			break;
 		}
 	}
-	return view == myview;
+	return (view == myview);
 }

 /*%
@@ -861,7 +846,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * zone is configured with something else than "notify yes;".
 	 */
 	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return ntype;
+		return (ntype);
 	}

 	/*
@@ -869,13 +854,13 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * hierarchy supplied in 'maps'.
 	 */
 	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, ISC_LOG_INFO,
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
 			    "'notify explicit;' will be used for mirror zone "
 			    "'%s'",
 			    zname);
 	}

-	return dns_notifytype_explicit;
+	return (dns_notifytype_explicit);
 }

 isc_result_t
@@ -904,6 +889,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	static char dlz_dbtype[] = "dlz";
 	char *cpval = default_dbtype;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
+	dns_dialuptype_t dialup = dns_dialuptype_no;
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
@@ -978,6 +964,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
+	if (cpval == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "dlz", &obj);
@@ -986,7 +975,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t len;

 		if (cpval != default_dbtype) {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
@@ -1029,9 +1018,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
 	    filename == NULL)
 	{
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "zone '%s': 'file' not specified",
-			      zname);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "zone '%s': 'file' not specified", zname);
 		CHECK(ISC_R_FAILURE);
 	}

@@ -1060,7 +1049,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		const char *masterstylestr = cfg_obj_asstring(obj);

 		if (masterformat != dns_masterformat_text) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
+			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 				    "zone '%s': 'masterfile-style' "
 				    "can only be used with "
 				    "'masterfile-format text'",
@@ -1085,41 +1074,29 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setmaxrecords(zone, 0);
 	}

-	obj = NULL;
-	result = named_config_get(maps, "max-records-per-type", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxrrperset(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxrrperset(zone, 0);
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-types-per-name", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxtypepername(zone, 0);
-	}
-
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;

-		dns_zone_setfile(raw, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);

 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		dns_zone_setfile(zone, signedname, dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
+		CHECK(result);
 	} else {
-		dns_zone_setfile(zone, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}

 	/*
@@ -1142,6 +1119,34 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				 zone, dns_zone_setqueryonacl,
 				 dns_zone_clearqueryonacl));

+	obj = NULL;
+	result = named_config_get(maps, "dialup", &obj);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
+	if (cfg_obj_isboolean(obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			dialup = dns_dialuptype_yes;
+		} else {
+			dialup = dns_dialuptype_no;
+		}
+	} else {
+		const char *dialupstr = cfg_obj_asstring(obj);
+		if (strcasecmp(dialupstr, "notify") == 0) {
+			dialup = dns_dialuptype_notify;
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
+			dialup = dns_dialuptype_notifypassive;
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
+			dialup = dns_dialuptype_refresh;
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
+			dialup = dns_dialuptype_passive;
+		} else {
+			UNREACHABLE();
+		}
+	}
+	if (raw != NULL) {
+		dns_zone_setdialup(raw, dialup);
+	}
+	dns_zone_setdialup(zone, dialup);
+
 	obj = NULL;
 	result = named_config_get(maps, "zone-statistics", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1197,8 +1202,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
-		bool logreports = false;
-
 		/* Make a reference to the default policy. */
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
@@ -1214,7 +1217,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 							   &kasp);
 				if (result != ISC_R_SUCCESS) {
 					cfg_obj_log(
-						obj, ISC_LOG_ERROR,
+						obj, named_g_lctx,
+						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
 					CHECK(result);
@@ -1266,8 +1270,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1340,7 +1344,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, ISC_LOG_ERROR,
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1402,11 +1406,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS);
 		dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj));

-		obj = NULL;
-		result = named_config_get(maps, "request-ixfr-max-diffs", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setrequestixfrmaxdiffs(zone, cfg_obj_asuint32(obj));
-
 		obj = NULL;
 		checknames(ztype, maps, &obj);
 		INSIST(obj != NULL);
@@ -1472,51 +1471,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
-
-		obj = NULL;
-		result = cfg_map_get(zoptions, "log-report-channel", &obj);
-		if (result == ISC_R_SUCCESS) {
-			logreports = cfg_obj_asboolean(obj);
-			dns_zone_setoption(zone, DNS_ZONEOPT_LOGREPORTS,
-					   logreports);
-		}
-		obj = NULL;
-		result = named_config_get(maps, "send-report-channel", &obj);
-		if (result == ISC_R_SUCCESS && obj != NULL) {
-			dns_fixedname_t fixed;
-			dns_name_t *rad = dns_fixedname_initname(&fixed);
-			const char *adstr = cfg_obj_asstring(obj);
-			dns_name_t *zn = dns_zone_getorigin(zone);
-
-			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
-						  mctx));
-			if (logreports || dns_name_equal(rad, dns_rootname)) {
-				/* Disable RC for error-logging zones or root */
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_equal(rad, zn)) {
-				/*
-				 * It's illegal to set a matching agent
-				 * domain at the zone level, but it could
-				 * be set in options/view. If so, and the
-				 * matching zone doesn't log reports, warn.
-				 */
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel is set to "
-					    "'%s' but that zone does not have "
-					    "log-report-channel set",
-					    zname);
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_issubdomain(rad, zn)) {
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel '%s' ignored "
-					    "for zone '%s' because it is a "
-					    "subdomain of the zone",
-					    adstr, zname);
-				dns_zone_setrad(zone, NULL);
-			} else {
-				dns_zone_setrad(zone, rad);
-			}
-		}
 	} else if (ztype == dns_zone_redirect) {
 		dns_zone_setnotifytype(zone, dns_notifytype_no);

@@ -1535,7 +1489,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, ISC_LOG_ERROR,
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1576,7 +1530,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
-			isc_log_write(DNS_LOGCATEGORY_SECURITY,
+			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "zone '%s' allows unsigned updates "
 				      "from remote hosts, which is insecure",
@@ -1620,7 +1574,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			dns_zone_setkeydirectory(zone, filename);
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 		/* Also save a reference to the keystore list. */
 		dns_zone_setkeystores(zone, keystorelist);
@@ -1672,8 +1626,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1845,7 +1800,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1853,8 +1808,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
@@ -1874,33 +1829,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

-		obj = NULL;
-		result = named_config_get(maps, "min-transfer-rate-in", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		uint32_t traffic_bytes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
-		uint32_t time_minutes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
-		if (traffic_bytes == 0) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' bytes"
-				    "value can not be '0'",
-				    zname);
-			CHECK(ISC_R_FAILURE);
-		}
-		/* Max. 28 days (in minutes). */
-		const unsigned int time_minutes_max = 28 * 24 * 60;
-		if (time_minutes < 1 || time_minutes > time_minutes_max) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' minutes"
-				    "value is out of range (1..%u)",
-				    zname, time_minutes_max);
-			CHECK(ISC_R_FAILURE);
-		}
-		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
-					 transferinsecs ? time_minutes
-							: time_minutes * 60);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1968,7 +1896,7 @@ cleanup:
 	if (kasp != NULL) {
 		dns_kasp_detach(&kasp);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1983,11 +1911,11 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 bool
@@ -2011,7 +1939,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return false;
+		return (false);
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -2032,17 +1960,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return false;
+		return (false);
 	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return false;
+		return (false);
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return false;
+		return (false);
 	}

 	obj = NULL;
@@ -2058,10 +1986,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 bool
@@ -2095,13 +2023,13 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	if (res != ISC_R_SUCCESS ||
 	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		return false;
+		return (false);
 	}

 	/* Lookup the policy. */
 	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
 	if (res != ISC_R_SUCCESS) {
-		return false;
+		return (false);
 	}

 	inline_signing = dns_kasp_inlinesigning(kasp);
@@ -2114,8 +2042,8 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	 */
 	res = cfg_map_get(maps[0], "inline-signing", &signing);
 	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
-		return cfg_obj_asboolean(signing);
+		return (cfg_obj_asboolean(signing));
 	}

-	return inline_signing;
+	return (inline_signing);
 }
@@ -32,6 +32,7 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -43,6 +44,7 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
+#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -177,7 +179,7 @@ static const char *filter_a_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -210,7 +212,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -225,11 +227,12 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -237,23 +240,23 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is 'none;' but "
 			    "either filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is set but "
 			    "neither filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
@@ -265,34 +268,34 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, void *actx) {
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));

 	result = cfg_map_get(param_obj, "filter-a", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->a_acl));
 	} else {
@@ -306,7 +309,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -324,12 +327,13 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
-		ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO,
 		      "registering 'filter-a' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -340,7 +344,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, actx));
+				       cfg_line, mctx, lctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -358,25 +362,26 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -385,7 +390,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -415,7 +420,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -440,14 +445,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -458,9 +463,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -473,7 +478,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -569,7 +574,7 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -640,7 +645,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -658,7 +663,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
@@ -675,7 +680,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -695,7 +700,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -703,7 +708,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_a) {
@@ -776,11 +781,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -813,7 +818,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -850,7 +855,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -865,10 +870,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -32,6 +32,7 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -43,6 +44,7 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
+#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -177,7 +179,7 @@ static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -211,7 +213,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -226,11 +228,12 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -238,23 +241,23 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-aaaa", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is 'none;' but "
 			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is set but "
 			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
@@ -266,27 +269,27 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, void *actx) {
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
 				   &inst->v4_aaaa));
@@ -295,7 +298,7 @@ parse_parameters(filter_instance_t *inst, const char *parameters,

 	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->aaaa_acl));
 	} else {
@@ -309,7 +312,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -327,12 +330,13 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
-		ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO,
 		      "registering 'filter-aaaa' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -344,7 +348,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, actx));
+				       cfg_line, mctx, lctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -362,25 +366,26 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -389,7 +394,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -419,7 +424,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -444,14 +449,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -462,9 +467,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -477,7 +482,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -573,7 +578,7 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -644,7 +649,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -662,7 +667,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
@@ -679,7 +684,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -699,7 +704,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -707,7 +712,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_aaaa) {
@@ -779,11 +784,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -816,7 +821,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -853,7 +858,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -868,10 +873,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -37,7 +36,6 @@
 #include <isc/thread.h>
 #include <isc/util.h>

-#include <dns/lib.h>
 #include <dns/name.h>

 #include <isccc/alist.h>
@@ -89,7 +87,7 @@ static int32_t timeout = RNDC_TIMEOUT;
 static void
 rndc_startconnect(isc_sockaddr_t *addr);

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -134,9 +132,6 @@ command is one of the following:\n\
  halt		Stop the server without saving pending updates.\n\
  halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
-  skr -import file zone [class [view]]\n\
-		Import a SKR file for the specified zone, for offline KSK\n\
-		signing.\n\
  loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
  managed-keys refresh [class [view]]\n\
@@ -145,10 +140,6 @@ command is one of the following:\n\
 		Display RFC 5011 managed keys information\n\
  managed-keys sync [class [view]]\n\
 		Write RFC 5011 managed keys to disk\n\
-  memprof [ on | off | dump ]\n\
-		Enable / disable memory profiling or dump the profile.\n\
-		Requires named to built with jemalloc and run with the relevant\n\
-		MALLOC_CONF environment variables.\n\
  modzone zone [class [view]] { zone-options }\n\
 		Modify a zone's configuration.\n\
 		Requires allow-new-zones option.\n\
@@ -535,8 +526,8 @@ rndc_start(void *arg) {
 }

 static void
-parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
-	     cfg_obj_t **configp) {
+parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
+	     cfg_parser_t **pctxp, cfg_obj_t **configp) {
 	isc_result_t result;
 	const char *conffile = admin_conffile;
 	const cfg_obj_t *addresses = NULL;
@@ -579,7 +570,7 @@ parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
 			admin_keyfile, admin_conffile);
 	}

-	DO("create parser", cfg_parser_create(mctx, pctxp));
+	DO("create parser", cfg_parser_create(mctx, log, pctxp));

 	/*
 	 * The parser will output its own errors, so DO() is not used.
@@ -815,7 +806,9 @@ int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool show_final_mem = false;
+	isc_log_t *log = NULL;
 	isc_logconfig_t *logconfig = NULL;
+	isc_logdestination_t logdest;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *config = NULL;
 	const char *keyname = NULL;
@@ -961,15 +954,20 @@ main(int argc, char **argv) {

 	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);

-	logconfig = isc_logconfig_get();
+	isc_log_create(rndc_mctx, &log, &logconfig);
+	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, ISC_LOG_INFO,
-		ISC_LOGDESTINATION_STDERR,
-		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	logdest.file.stream = stderr;
+	logdest.file.name = NULL;
+	logdest.file.versions = ISC_LOG_ROLLNEVER;
+	logdest.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_INFO, &logdest,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+	DO("enabling log channel",
+	   isc_log_usechannel(logconfig, "stderr", NULL, NULL));

-	parse_config(rndc_mctx, keyname, &pctx, &config);
+	parse_config(rndc_mctx, log, keyname, &pctx, &config);

 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

@@ -1005,6 +1003,9 @@ main(int argc, char **argv) {

 	isccc_ccmsg_invalidate(&rndc_ccmsg);

+	isc_log_destroy(&log);
+	isc_log_setcontext(NULL);
+
 	cfg_obj_destroy(pctx, &config);
 	cfg_parser_destroy(&pctx);

@@ -1019,8 +1020,8 @@ main(int argc, char **argv) {
 	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);

 	if (failed) {
-		return 1;
+		return (1);
 	}

-	return 0;
+	return (0);
 }
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Nicki Křížek	8e2e0cd2d7	WIP use user+net namespace	2024-06-24 16:31:21 +02:00
Nicki Křížek	14a3012171	WIP namespaces.py	2024-06-24 16:30:09 +02:00