set "multi-master" automatically with multiple primaries

By default, named logs a message at level info if a secondary zone receives an update indicating that the serial number has gone backwards. The "multi-master" option was provided to allow this message to be suppressed if a zone was configured with multiple primary servers. That option has now been marked obsolete. The message is now logged at debug level 1 when there are multiple primary server addresses configured for the zone. It is still logged at level info if there is only address.
fix: dev: clean up incorrect logging module names
2024-12-11 11:15:04 -08:00 · 2024-12-11 17:12:18 +00:00 · 2024-12-11 17:11:32 +00:00 · 2024-12-11 13:39:02 +00:00 · 2024-12-11 14:04:37 +01:00 · 2024-12-11 03:39:21 +00:00
1060 changed files with 24386 additions and 48422 deletions
@@ -79,3 +79,5 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
+RemoveParentheses: ReturnStatement
+RemoveSemicolon: true
@@ -78,3 +78,5 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
+RemoveParentheses: ReturnStatement
+RemoveSemicolon: true
@@ -1544,3 +1544,7 @@ b7de2c7cb959fa35099d72c3f9b13938348c74e6
 ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
 # Reformat sources with up-to-date clang-format-19
 ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
+# Remove redundant semicolons after the closing braces of functions
+1a19ce39db12ed4ecf59a3d0f5734656d24999a5
+# Remove redundant parentheses from the return statement
+0258850f202b7a46b52f3e3a4968c3fc68fe9a45
@@ -123,8 +123,8 @@ stages:

 # Alpine Linux

-.alpine-3.20-amd64: &alpine_3_20_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.20-amd64"
+.alpine-3.21-amd64: &alpine_3_21_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.21-amd64"
  <<: *linux_amd64

 # Oracle Linux
@@ -171,16 +171,16 @@ stages:

 # Fedora

-.tsan-fedora-40-amd64: &tsan_fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:tsan-fedora-40-amd64"
+.tsan-fedora-41-amd64: &tsan_fedora_41_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-41-amd64"
  <<: *linux_amd64

-.fedora-40-amd64: &fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-amd64"
+.fedora-41-amd64: &fedora_41_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-41-amd64"
  <<: *linux_amd64

-.fedora-40-arm64: &fedora_40_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-arm64"
+.fedora-41-arm64: &fedora_41_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-41-arm64"
  <<: *linux_arm64

 # Ubuntu
@@ -206,15 +206,15 @@ stages:
 ### QCOW2 Image Templates

 .freebsd-13-amd64: &freebsd_13_amd64_image
-  image: "freebsd-13.3-x86_64"
+  image: "freebsd-13.4-x86_64"
  <<: *libvirt_amd64

 .freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.1-x86_64"
+  image: "freebsd-14.2-x86_64"
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.5-x86_64"
+  image: "openbsd-7.6-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -316,9 +316,7 @@ stages:
    - *configure
    - *check_readline_setup
    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
-    - test -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && CFLAGS="${CFLAGS} -Werror" make -C "${DIR}"; done
    - test -z "${RUN_MAKE_INSTALL}" || make DESTDIR="${INSTALL_PATH}" install
-    - test -z "${RUN_MAKE_INSTALL}" -o -z "${BUILD_CONTRIB}" || for DIR in contrib/dlz/modules/*; do test -f "${DIR}/Makefile" && make -C "${DIR}" DESTDIR="${INSTALL_PATH}" install; done
    - test -z "${RUN_MAKE_INSTALL}" || DESTDIR="${INSTALL_PATH}" sh util/check-make-install
    - if [[ "${CFLAGS}" == *"-fsanitize=address"* ]]; then ( ! grep -F AddressSanitizer config.log ); fi
    - test -z "${CROSS_COMPILATION}" || grep -F -A 1 "checking whether we are cross compiling" config.log | grep -q "result.*yes"
@@ -363,6 +361,7 @@ stages:
  needs:
    - job: ci-variables
      artifacts: true
+  timeout: 2h

 .system_test_common: &system_test_common
  <<: *default_triggering_rules
@@ -528,6 +527,12 @@ black:
    expire_in: "1 week"
    when: on_failure

+vulture:
+  <<: *precheck_job
+  needs: []
+  script:
+    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
+
 ci-variables:
  stage: precheck
  <<: *precheck_job
@@ -715,11 +720,14 @@ cross-version-config-tests:
    # also from the $BIND_BASELINE_VERSION.
    - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
    - cd bin/tests/system
+    # System tests that employ binary drivers will fail on ABI change and
+    # should not be run.
+    - rm -r dlzexternal
+    - rm -r dyndb
    # Run the setup phase of all system tests in the most recently tagged BIND 9
    # release using the binaries built for the current BIND 9 version.  This
    # intends to detect obvious backward compatibility issues with the latter.
-    - >
-      echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
+    - sed -i "s|f\"{AC_VARS\['TOP_BUILDDIR'\]}|\"$CI_PROJECT_DIR|g" isctest/vars/basic.py
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
  needs:
@@ -736,29 +744,41 @@ cross-version-config-tests:
    untracked: true
    expire_in: "1 day"
    when: always
+  # Changes in the January milestone necessitate allowing this job to fail. The
+  # "soft failure" should be reverted when January releases are published.
+  # - #4261 introduced extra artifacts check but missed a file visible only in
+  #   this job. This is fixed in !9815 but present in December releases.
+  #   System test affected: mkeys.
+  # - #4666 removed the "fixed" value for the "rrset-order" option, but the
+  #   value is still present in the December release system test.
+  #   System test affected: rrsetorder.
+  # - #4482 removed the "dnssec-must-be-secure" feature that is still present
+  #   in the December release.
+  #   System tests affected: autosign, dnssec, and dsdigest.
+  allow_failure: true

-# Jobs for regular GCC builds on Alpine Linux 3.20 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.21 (amd64)

-gcc:alpine3.20:amd64:
+gcc:alpine3.21:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_20_amd64_image
+  <<: *alpine_3_21_amd64_image
  <<: *build_job

-system:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+system:gcc:alpine3.21:amd64:
+  <<: *alpine_3_21_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.21:amd64
      artifacts: true

-unit:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+unit:gcc:alpine3.21:amd64:
+  <<: *alpine_3_21_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.21:amd64
      artifacts: true

 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -880,7 +900,6 @@ gcc:tarball:nosphinx:

 gcc:bookworm:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} --coverage -O0"
    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_LIBEDIT}"
@@ -893,6 +912,7 @@ system:gcc:bookworm:amd64:
  <<: *system_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
+    TZ: Australia/Sydney
  needs:
    - job: unit:gcc:bookworm:amd64
      artifacts: true
@@ -912,7 +932,7 @@ gcc:bookworm:rbt:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-zonedb=rbt --with-cachedb=rbt"
+    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_bookworm_amd64_image
  <<: *build_job

@@ -1197,7 +1217,7 @@ unit:gcc:noble:amd64:
    - job: gcc:noble:amd64
      artifacts: true

-# Jobs for ASAN builds on Fedora 40 (amd64)
+# Jobs for ASAN builds on Fedora 41 (amd64)

 gcc:asan:
  variables:
@@ -1205,20 +1225,20 @@ gcc:asan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  <<: *fedora_40_amd64_image
+  <<: *fedora_41_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -1247,7 +1267,7 @@ unit:clang:asan:
    - job: clang:asan
      artifacts: true

-# Jobs for TSAN builds on Fedora 40 (amd64)
+# Jobs for TSAN builds on Fedora 41 (amd64)

 gcc:tsan:
  variables:
@@ -1255,13 +1275,13 @@ gcc:tsan:
    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_41_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_41_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1270,7 +1290,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_41_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1336,7 +1356,6 @@ tsan:stress:

 clang:bookworm:amd64:
  variables:
-    BUILD_CONTRIB: 1
    CC: ${CLANG}
    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion -DOPENSSL_API_COMPAT=10100"
    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
@@ -1414,6 +1433,7 @@ unit:clang:freebsd14:amd64:
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
+  retry: 1  # GL #4924

 # Jobs for Clang builds on OpenBSD (amd64)

@@ -1446,11 +1466,12 @@ release:
    - pushd "${BIND_DIRECTORY}-release"
    - mv "../${BIND_DIRECTORY}.tar.xz" .
    - tar --extract --file="${BIND_DIRECTORY}.tar.xz"
-    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
+    - mv "${BIND_DIRECTORY}"/{COPYRIGHT,LICENSE,README.md,srcid} .
    - rm -rf "${BIND_DIRECTORY}"
    - mv "../doc/arm/_build/html" doc/arm/
    - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_DIRECTORY}.html"
+    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/changelog.html"><title>Redirect</title></html>' > "CHANGELOG-${BIND_DIRECTORY}.html"
    - popd
  needs:
    - job: tarball-create
@@ -1678,8 +1699,8 @@ shotgun:dot:
      - "output/rpz_*"
    when: always

-stress:short:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1690,8 +1711,8 @@ stress:short:authoritative:fedora:40:amd64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1702,8 +1723,8 @@ stress:short:recursive:fedora:40:amd64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:short:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_short_job
  variables:
@@ -1714,8 +1735,8 @@ stress:short:rpz:fedora:40:amd64:
    RATE: 1500
    RUN_TIME: 15

-stress:short:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1726,8 +1747,8 @@ stress:short:authoritative:fedora:40:arm64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1738,8 +1759,8 @@ stress:short:recursive:fedora:40:arm64:
    RATE: 10000
    RUN_TIME: 15

-stress:short:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:short:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_short_job
  variables:
@@ -1783,8 +1804,8 @@ stress:short:rpz:freebsd13:amd64:
    RATE: 1500
    RUN_TIME: 15

-stress:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:authoritative:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1798,8 +1819,8 @@ stress:authoritative:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:recursive:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1813,8 +1834,8 @@ stress:recursive:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:rpz:fedora:41:amd64:
+  <<: *fedora_41_amd64_image
  <<: *linux_amd64
  <<: *stress_test_long_job
  variables:
@@ -1828,8 +1849,8 @@ stress:rpz:fedora:40:amd64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:authoritative:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -1843,8 +1864,8 @@ stress:authoritative:fedora:40:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:recursive:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -1858,8 +1879,8 @@ stress:recursive:fedora:40:arm64:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:rpz:fedora:41:arm64:
+  <<: *fedora_41_arm64_image
  <<: *linux_arm64
  <<: *stress_test_long_job
  variables:
@@ -12,6 +12,17 @@ disable=
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
    C0301, # line-too-long, handled better by black
+    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
+    R0901, # too-many-ancestors
+    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
+    R0904, # too-many-public-methods
+    R0911, # too-many-return-statements
+    R0912, # too-many-branches
+    R0913, # too-many-arguments
+    R0914, # too-many-locals
+    R0915, # too-many-statements
+    R0916, # too-many-boolean-expressions
+    R0917, # too-many-positional-arguments
@@ -6,6 +6,9 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
+  jobs:
+    pre_build:
+      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -13,8 +16,3 @@ sphinx:

 # Build all formats
 formats: all
-
-# Explicitly set the version of Python and its requirements
-python:
-   install:
-   - requirements: doc/arm/requirements.txt
@@ -26,7 +26,6 @@ Files: **/*.after*
       .gitlab/*
       .mailmap
       AUTHORS
-       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -74,6 +73,11 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
+       bin/tests/system/notify/CA/CA.cfg
+       bin/tests/system/notify/CA/README
+       bin/tests/system/notify/CA/index.txt
+       bin/tests/system/notify/CA/index.txt.attr
+       bin/tests/system/notify/CA/serial
       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
@@ -1 +0,0 @@
-doc/arm/changelog.rst
@@ -21,7 +21,6 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
-	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -163,7 +163,7 @@ Additional information on various subjects can be found in other

 #### Bug report identifiers

-Most notes in the CHANGES file include a reference to a bug report or
+Most notes in the ARM Changelog appendix include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -134,14 +134,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return (false);
+		return false;
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static bool
@@ -165,7 +165,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return (answer);
+		return answer;
 	}

 	memset(&hints, 0, sizeof(hints));
@@ -222,7 +222,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -231,7 +231,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}

 	/*
@@ -359,7 +359,7 @@ checkmissing:
 		}
 	}
 	freeaddrinfo(ai);
-	return (answer);
+	return answer;
 }

 static bool
@@ -422,7 +422,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return (answer);
+		return answer;

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -436,7 +436,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -445,7 +445,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}
 }

@@ -509,7 +509,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return (answer);
+		return answer;

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -523,7 +523,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return true;

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -532,7 +532,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return true;
 	}
 }

@@ -544,7 +544,7 @@ setup_logging(FILE *errout) {
 		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
 		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*% load the zone */
@@ -619,7 +619,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return (result);
+	return result;
 }

 /*% dump the zone */
@@ -650,7 +650,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
 	}

@@ -660,5 +660,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return (result);
+	return result;
 }
@@ -83,10 +83,10 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 		cfg_obj_log(obj, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return (result);
+		return result;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
@@ -94,10 +94,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return (false);
+			return false;
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return (true);
+			return true;
 		}
 	}
 }
@@ -113,7 +113,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return (false);
+			return false;
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -122,7 +122,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return (true);
+			return true;
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -136,7 +136,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return (true);
+			return true;
 		}
 	}
 }
@@ -149,23 +149,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	dns_db_detach(&db);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*% configure the zone */
@@ -221,18 +221,18 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -242,12 +242,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -261,12 +261,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return (configure_hint(zfile, zclass, mctx));
+		return configure_hint(zfile, zclass, mctx);
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -279,12 +279,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 	}

 	if (zfile == NULL) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	obj = NULL;
@@ -462,7 +462,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return (result);
+	return result;
 }

 /*% configure a view */
@@ -497,7 +497,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -507,11 +507,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return (dns_rdataclass_fromtext(classp, &r));
+	return dns_rdataclass_fromtext(classp, &r);
 }

 /*% load zones from the configuration */
@@ -569,7 +569,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return (result);
+	return result;
 }

 static void
@@ -762,5 +762,5 @@ cleanup:
 		isc_mem_destroy(&mctx);
 	}

-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -73,7 +73,9 @@ Options

 .. option:: -n

-   Do not error on options that are disabled in this build.
+   Do not print errors when encountering options that are disabled in
+   this build. This allows checking of configuration files for other
+   builds, in which those options are enabled.

 .. option:: -p

@@ -159,7 +159,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:S:T:W:")) != EOF)
+					  "DF:M:R:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -323,6 +323,18 @@ main(int argc, char **argv) {
 			}
 			break;

+		case 'R':
+			if (ARGCMP("fail")) {
+				zone_options |= DNS_ZONEOPT_LOGREPORTS;
+			} else if (ARGCMP("ignore")) {
+				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
+			} else {
+				fprintf(stderr, "invalid argument to -R: %s\n",
+					isc_commandline_argument);
+				exit(EXIT_FAILURE);
+			}
+			break;
+
 		case 's':
 			if (ARGCMP("full")) {
 				outputstyle = &dns_master_style_full;
@@ -565,5 +577,5 @@ main(int argc, char **argv) {
 	destroy();
 	isc_mem_destroy(&mctx);

-	return ((result == ISC_R_SUCCESS) ? 0 : 1);
+	return (result == ISC_R_SUCCESS) ? 0 : 1;
 }
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -166,6 +166,12 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

+.. option:: -R mode
+
+   This option checks whether a TXT wildcard record exists that
+   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
+   Possible modes are ``fail`` and ``ignore`` (the default).
+
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -175,6 +175,12 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn``, and ``ignore`` (the default).

+.. option:: -R mode
+
+   This option checks whether a TXT wildcard record exists that
+   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
+   Possible modes are ``fail`` and ``ignore`` (the default).
+
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return (DST_ALG_HMACMD5);
+		return DST_ALG_HMACMD5;
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return (DST_ALG_HMACSHA1);
+		return DST_ALG_HMACSHA1;
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return (DST_ALG_HMACSHA224);
+		return DST_ALG_HMACSHA224;
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return (DST_ALG_HMACSHA256);
+		return DST_ALG_HMACSHA256;
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return (DST_ALG_HMACSHA384);
+		return DST_ALG_HMACSHA384;
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return (DST_ALG_HMACSHA512);
+		return DST_ALG_HMACSHA512;
 	}
-	return (DST_ALG_UNKNOWN);
+	return DST_ALG_UNKNOWN;
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return (128);
+		return 128;
 	case DST_ALG_HMACSHA1:
-		return (160);
+		return 160;
 	case DST_ALG_HMACSHA224:
-		return (224);
+		return 224;
 	case DST_ALG_HMACSHA256:
-		return (256);
+		return 256;
 	case DST_ALG_HMACSHA384:
-		return (384);
+		return 384;
 	case DST_ALG_HMACSHA512:
-		return (512);
+		return 512;
 	default:
-		return (0);
+		return 0;
 	}
 }

@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return (-1);
+		return -1;
 	}
-	return (fchown(fileno(fd), pw->pw_uid, -1));
+	return fchown(fileno(fd), pw->pw_uid, -1);
 }
@@ -290,5 +290,5 @@ options {\n\

 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -296,5 +296,5 @@ nsupdate -k <keyfile>\n");

 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -5,7 +5,8 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)
+	$(LIBISCCFG_CFLAGS)		\
+	$(OPENSSL_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -19,4 +20,5 @@ delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
 	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)
+	$(LIBISCCFG_LIBS)		\
+	$(OPENSSL_LIBS)
@@ -25,10 +25,17 @@
 #include <sys/types.h>
 #include <unistd.h>

+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
+#include <isc/fips.h>
 #include <isc/hex.h>
 #include <isc/log.h>
 #include <isc/managers.h>
@@ -86,7 +93,8 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  32
+#define MAX_QUERIES  50
+#define MAX_TOTAL    200
 #define MAX_RESTARTS 11

 /* Variables used internally by delv. */
@@ -131,6 +139,7 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    yaml = false, fulltrace = false;

 static uint32_t maxqueries = MAX_QUERIES;
+static uint32_t maxtotal = MAX_TOTAL;
 static uint32_t restarts = MAX_RESTARTS;

 static bool resolve_trace = false, validator_trace = false,
@@ -156,6 +165,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors */
 static char anchortext[] = TRUST_ANCHORS;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*
 * Static function prototypes
 */
@@ -566,7 +579,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -587,11 +600,11 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return (result);
+		return result;
 	}

 	*name = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -624,7 +637,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (anchor_name) {
@@ -632,11 +645,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -655,7 +668,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	if (cfg_obj_isvoid(obj)) {
 		/*
 		 * "anchortype" is not defined, this must be a static-key
-		 * configured with trusted-keys.
+		 * configured with trust-anchors.
 		 */
 		anchortype = STATIC_KEY;
 	} else {
@@ -789,7 +802,7 @@ cleanup:
 		result = ISC_R_FAILURE;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -814,20 +827,18 @@ cleanup:
 	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
 setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
-	const cfg_obj_t *trusted_keys = NULL;
-	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (trust_anchor == NULL) {
@@ -864,16 +875,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	}

 	INSIST(bindkeys != NULL);
-	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
-	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
-
-	if (trusted_keys != NULL) {
-		CHECK(load_keys(trusted_keys, client, toview));
-	}
-	if (managed_keys != NULL) {
-		CHECK(load_keys(managed_keys, client, toview));
-	}
 	if (trust_anchors != NULL) {
 		CHECK(load_keys(trust_anchors, client, toview));
 	}
@@ -894,7 +896,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -941,7 +943,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		result = ISC_R_SUCCESS;
@@ -977,7 +979,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -1046,7 +1048,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -1059,10 +1061,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return (result);
+		return result;
 	}
 	*uip = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -1157,22 +1159,46 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a': /* maxqueries */
-			FULLCHECK("maxqueries");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
+		case 'a':
+			switch (cmd[3]) {
+			case 'q': /* maxqueries */
+				FULLCHECK("maxqueries");
+				if (value == NULL) {
+					goto need_value;
+				}
+				if (!state) {
+					goto invalid_option;
+				}
+				result = parse_uint(&maxqueries, value,
+						    UINT_MAX, "maxqueries");
+				if (result != ISC_R_SUCCESS) {
+					fatal("Couldn't parse maxqueries");
+				}
+				if (maxqueries == 0) {
+					fatal("maxqueries must be nonzero");
+				}
+				break;
+			case 't': /* maxtotalqueries */
+				FULLCHECK("maxtotalqueries");
+				if (value == NULL) {
+					goto need_value;
+				}
+				if (!state) {
+					goto invalid_option;
+				}
+				result = parse_uint(&maxtotal, value, UINT_MAX,
+						    "maxtotalqueries");
+				if (result != ISC_R_SUCCESS) {
+					fatal("Couldn't parse maxtotalqueries");
+				}
+				if (maxtotal == 0) {
+					fatal("maxtotalqueries must be "
+					      "nonzero");
+				}
+				break;
+			default:
 				goto invalid_option;
 			}
-			result = parse_uint(&maxqueries, value, UINT_MAX,
-					    "maxqueries");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse maxqueries");
-			}
-			if (maxqueries == 0) {
-				fatal("maxqueries must be nonzero");
-			}
 			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
@@ -1379,8 +1405,8 @@ plus_option(char *option) {
 /*
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
-static const char *single_dash_opts = "46himv";
-static const char *dash_opts = "46abcdhimpqtvx";
+static const char *single_dash_opts = "46Fhimv";
+static const char *dash_opts = "46abcdFhimpqtvx";

 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
@@ -1423,6 +1449,9 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				use_ipv4 = false;
 			}
 			break;
+		case 'F': /* FIPS */
+			/* handled in preparse_args() */
+			break;
 		case 'h':
 			usage();
 			exit(EXIT_SUCCESS);
@@ -1442,7 +1471,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return (false);
+			return false;
 		}
 	}
 	opt = option[0];
@@ -1459,7 +1488,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return (value_from_next);
+		return value_from_next;
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1496,7 +1525,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1514,28 +1543,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return (value_from_next);
+		return value_from_next;
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return (value_from_next);
+		return value_from_next;
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1556,7 +1585,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1574,14 +1603,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return (value_from_next);
+		return value_from_next;
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return (false);
+	return false;
 }

 /*
@@ -1601,6 +1630,28 @@ preparse_args(int argc, char **argv) {
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'F':
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+					fatal("setting FIPS mode failed");
+				}
+				break;
 			case 'm':
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 						    ISC_MEM_DEBUGRECORD;
@@ -1748,11 +1799,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -1763,17 +1814,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return (append_str(in, len, p, end));
+	return append_str(in, len, p, end);
 }

 static isc_result_t
@@ -1792,10 +1843,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1808,17 +1859,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return (DNS_R_BADDOTTEDQUAD);
+			return DNS_R_BADDOTTEDQUAD;
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -1895,6 +1946,7 @@ run_resolve(void *arg) {
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
 	dns_client_setmaxrestarts(client, restarts);
+	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2055,7 +2107,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return (result);
+	return result;
 }

 static void
@@ -2130,7 +2182,7 @@ matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,

 	*viewp = view;
 	*viewpatchresultp = ISC_R_SUCCESS;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -2153,13 +2205,14 @@ run_server(void *arg) {
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
 				     NULL, &interfacemgr));

-	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
-			      &view));
+	CHECK(dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
+			      "_default", &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
 	dns_view_setmaxrestarts(view, restarts);
+	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2262,5 +2315,14 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return (0);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
+	return 0;
 }
@@ -21,7 +21,7 @@ delv - DNS lookup and validation utility
 Synopsis
 ~~~~~~~~

-:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]
+:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-F**] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]

 :program:`delv` [**-h**]

@@ -138,6 +138,10 @@ Options
   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
   additional debugging details.

+.. option:: -F
+
+   This option enables FIPS mode if supported by the cryptographic library in use.
+
 .. option:: -h

   This option displays the :program:`delv` help usage output and exits.
@@ -347,7 +351,12 @@ assign values to options like the timeout interval. They have the form
 .. option:: +maxqueries

   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 32.
+   a name before giving up. The default is 50.
+
+.. option:: +maxtotalqueries
+
+   This option specifies the maximum number of queries to send to resolve
+   a client request before giving up. The default is 200.

 .. option:: +trust, +notrust

@@ -5,13 +5,16 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)
+	$(OPENSSL_CFLAGS)	\
+	$(LIBUV_CFLAGS)		\
+	$(OPENSSL_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
+	$(OPENSSL_LIBS)		\
 	$(LIBIDN2_LIBS)

 noinst_LTLIBRARIES = libdighost.la
@@ -21,6 +21,7 @@

 #include <isc/attributes.h>
 #include <isc/dir.h>
+#include <isc/fips.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -69,6 +70,16 @@ static bool short_form = false, printcmd = true, plusquest = false,
 	    pluscomm = false, ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

+#include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 /*% opcode text */
 static const char *const opcodetext[] = {
 	"QUERY",      "IQUERY",	    "STATUS",	  "RESERVED3",
@@ -89,9 +100,9 @@ rcode_totext(dns_rcode_t rcode) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
 		buf[0] = '?';
-		return (buf);
+		return buf;
 	}
-	return (buf + 1);
+	return buf + 1;
 }

 /*% print usage */
@@ -473,7 +484,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		ADD_STRING(buf, " ");
 	}
@@ -494,7 +505,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
-		return (result);
+		return result;
 	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
@@ -511,7 +522,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -535,14 +546,14 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 				      dns_rdatatype_aaaa, dns_rdatatype_none,
 				      NULL, &rdataset);
 	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_dns64_findprefix(rdataset, prefix, &count);
 	if (result == ISC_R_NOTFOUND) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	if (count > 10) {
 		count = 10;
@@ -550,15 +561,15 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -578,9 +589,9 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	for (;;) {
@@ -595,7 +606,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdataset_current(rdataset, &rdata);
 				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE) {
-					return (result);
+					return result;
 				}
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
@@ -606,11 +617,11 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
@@ -628,10 +639,10 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local)) {
-			return (true);
+			return true;
 		}
 	}
-	return (false);
+	return false;
 }

 /*
@@ -1024,7 +1035,7 @@ repopulate_buffer:

 	dig_idnsetup(query->lookup, false);

-	return (result);
+	return result;
 }

 /*%
@@ -1193,7 +1204,7 @@ proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
 		}
 	}

-	return (result);
+	return result;
 }

 static bool
@@ -1213,7 +1224,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	/* start syntax analysis and verification */
 	if (!rule_proxy_addrs(&st)) {
 		warn("PROXY source and destination addresses cannot be parsed");
-		return (false);
+		return false;
 	}

 	/* get port numeric values */
@@ -1240,7 +1251,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY source address: %s",
 		     isc_result_totext(result));
-		return (false);
+		return false;
 	}

 	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
@@ -1248,26 +1259,26 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY destination address: %s",
 		     isc_result_totext(result));
-		return (false);
+		return false;
 	}

 	/* addresses should be of the same type */
 	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
 		warn("PROXY source and destination addresses must be of the "
 		     "same type");
-		return (false);
+		return false;
 	}

 	*psrc = src;
 	*pdst = dst;

-	return (true);
+	return true;
 }

 static bool
 rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	if (!rule_addr(st)) {
-		return (false);
+		return false;
 	}

 	st->src_addr_start = st->last_addr_start;
@@ -1276,13 +1287,13 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->src_port_len = st->last_port_len;

 	if (!MATCH('-')) {
-		return (false);
+		return false;
 	}

 	ADVANCE();

 	if (!rule_addr(st)) {
-		return (false);
+		return false;
 	}

 	st->dst_addr_start = st->last_addr_start;
@@ -1291,17 +1302,17 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->dst_port_len = st->last_port_len;

 	if (!MATCH('\0')) {
-		return (false);
+		return false;
 	}

-	return (true);
+	return true;
 }

 static bool
 rule_addr(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!rule_addr_char(st)) {
-		return (false);
+		return false;
 	}

 	while (rule_addr_char(st)) {
@@ -1315,18 +1326,18 @@ rule_addr(isc_proxy_addrs_parser_state_t *st) {
 		ADVANCE();

 		if (!rule_port(st)) {
-			return (false);
+			return false;
 		}
 	}

-	return (true);
+	return true;
 }

 static bool
 rule_port(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!MATCH_DIGIT()) {
-		return (false);
+		return false;
 	}

 	ADVANCE();
@@ -1338,18 +1349,18 @@ rule_port(isc_proxy_addrs_parser_state_t *st) {
 	st->last_port_start = start;
 	st->last_port_len = GETP() - start;

-	return (true);
+	return true;
 }

 static bool
 rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
 	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return (false);
+		return false;
 	}

 	ADVANCE();

-	return (true);
+	return true;
 }

 #undef GETP
@@ -1366,20 +1377,20 @@ plus_proxy_handle_addresses(const char *value, const bool state,
 		 * We are not interested in the option value in that
 		 * case
 		 */
-		return (true);
+		return true;
 	}

 	if (value == NULL || *value == '\0') {
 		lookup->proxy_local = true;
-		return (true);
+		return true;
 	}

 	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
 				   &lookup->proxy_dst_addr))
 	{
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static bool
@@ -1402,10 +1413,10 @@ plus_proxy_options(const char *cmd, const char *value, const bool state,
 	default:
 		goto invalid_option;
 	}
-	return (true);
+	return true;

 invalid_option:
-	return (false);
+	return false;
 }

 static bool
@@ -1525,7 +1536,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return (lookup);
+		return lookup;
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1824,9 +1835,12 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "\0",
+						extra = strtok_r(NULL, "",
 								 &last);
 						save_opt(lookup, code, extra);
+						if (extra != NULL) {
+							extra[-1] = ':';
+						}
 						break;
 					default:
 						goto invalid_option;
@@ -2555,7 +2569,10 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	return (lookup);
+	if (value != NULL) {
+		value[-1] = '=';
+	}
+	return lookup;

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2567,8 +2584,8 @@ exit_or_usage:
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dhimnruv";
-static const char *dash_opts = "46bcdfhikmnpqrtvyx";
+static const char *single_dash_opts = "46dFhimnruv";
+static const char *dash_opts = "46bcdFfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone, bool config_only, int argc,
@@ -2601,7 +2618,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv4 networking");
 				UNREACHABLE();
-				return (false);
+				return false;
 			}
 			break;
 		case '6':
@@ -2611,7 +2628,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv6 networking");
 				UNREACHABLE();
-				return (false);
+				return false;
 			}
 			break;
 		case 'd':
@@ -2620,11 +2637,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				cmd = option;
 				FULLCHECK("debug");
 				debugging = true;
-				return (false);
+				return false;
 			} else {
 				debugging = true;
 			}
 			break;
+		case 'F': /* FIPS */
+			/* FIPS is handled in preparse_args() */
+			break;
 		case 'h':
 			help();
 			exit(EXIT_SUCCESS);
@@ -2651,7 +2671,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return (false);
+			return false;
 		}
 	}
 	opt = option[0];
@@ -2695,7 +2715,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*hash = '#';
 		}
 		specified_source = true;
-		return (value_from_next);
+		return value_from_next;
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
@@ -2714,13 +2734,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid class %s\n",
 				value);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'f':
 		batchname = value;
-		return (value_from_next);
+		return value_from_next;
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
-		return (value_from_next);
+		return value_from_next;
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS) {
@@ -2728,7 +2748,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		port = num;
 		port_set = true;
-		return (value_from_next);
+		return value_from_next;
 	case 'q':
 		if (!config_only) {
 			if (*need_clone) {
@@ -2747,7 +2767,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 't':
 		*open_type_class = false;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
@@ -2805,7 +2825,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid type %s\n",
 				value);
 		}
-		return (value_from_next);
+		return value_from_next;
 	case 'y':
 		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
@@ -2814,8 +2834,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
-								    * NULL */
+		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
+								   * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2826,7 +2846,11 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		return (value_from_next);
+		if (ptr3 != NULL) {
+			ptr[-1] = ':';
+		}
+		ptr2[-1] = ':';
+		return value_from_next;
 	case 'x':
 		if (*need_clone) {
 			*lookup = clone_lookup(default_lookup, true);
@@ -2856,14 +2880,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return (value_from_next);
+		return value_from_next;
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return (false);
+	return false;
 }

 /*%
@@ -2894,6 +2918,28 @@ preparse_args(int argc, char **argv) {
 				/* For debugging early startup */
 				debugging = true;
 				break;
+			case 'F':
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+				fips = OSSL_PROVIDER_load(NULL, "fips");
+				if (fips == NULL) {
+					ERR_clear_error();
+					fatal("Failed to load FIPS provider");
+				}
+				base = OSSL_PROVIDER_load(NULL, "base");
+				if (base == NULL) {
+					OSSL_PROVIDER_unload(fips);
+					ERR_clear_error();
+					fatal("Failed to load base provider");
+				}
+#endif
+				/* Already in FIPS mode?  */
+				if (isc_fips_mode()) {
+					break;
+				}
+				if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+					fatal("setting FIPS mode failed");
+				}
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
@@ -2957,7 +3003,7 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 	{
 		debug("%s %d: %s", msg, bargc, bargv[bargc]);
 	}
-	return (bargc);
+	return bargc;
 }

 static void
@@ -3418,5 +3464,14 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-	return (exitcode);
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
+	return exitcode;
 }
@@ -20,7 +20,7 @@ dig - DNS lookup utility

 Synopsis
 ~~~~~~~~
-:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]
+:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-F**] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]

 :program:`dig` [**-h**]

@@ -126,6 +126,10 @@ Options
   same way it would be presented as a query to :program:`dig` using the
   command-line interface.

+.. option:: -F
+
+   This option enables FIPS mode if supported by the cryptographic library in use.
+
 .. option:: -h

   Print a usage summary.
@@ -36,6 +36,7 @@
 #endif /* HAVE_LIBIDN2 */

 #include <isc/base64.h>
+#include <isc/crypto.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
@@ -233,7 +234,7 @@ count_dots(char *string) {
 		}
 		s++;
 	}
-	return (i);
+	return i;
 }

 static void
@@ -281,11 +282,11 @@ hex_dump(isc_buffer_t *b) {
 static isc_result_t
 append(const char *text, size_t len, char **p, char *end) {
 	if (*p + len > end) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -296,17 +297,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		len = (int)(dot - in);
 	} else {
 		len = (int)strlen(in);
 	}
-	return (append(in, len, p, end));
+	return append(in, len, p, end);
 }

 isc_result_t
@@ -325,10 +326,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -341,18 +342,18 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return (DNS_R_BADDOTTEDQUAD);
+			return DNS_R_BADDOTTEDQUAD;
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		/* Append .in-addr.arpa. and a terminating NUL. */
 		result = append(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -453,7 +454,7 @@ make_server(const char *servname, const char *userarg) {
 	strlcpy(srv->servername, servname, MXNAME);
 	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
-	return (srv);
+	return srv;
 }

 /*%
@@ -629,7 +630,7 @@ make_empty_lookup(void) {
 	debug("make_empty_lookup() = %p->references = %" PRIuFAST32, looknew,
 	      isc_refcount_current(&looknew->references));

-	return (looknew);
+	return looknew;
 }

 #define EDNSOPT_OPTIONS 100U
@@ -820,7 +821,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {

 	looknew->magic = DIG_LOOKUP_MAGIC;

-	return (looknew);
+	return looknew;
 }

 /*%
@@ -850,7 +851,7 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 	ISC_LIST_PREPEND(lookup_list, looknew, link);
 	debug("after insertion, init -> %p, new = %p, new -> %p", lookold,
 	      looknew, looknew->link.next);
-	return (looknew);
+	return looknew;
 }

 void
@@ -911,20 +912,20 @@ parse_uint_helper(uint32_t *uip, const char *value, uint32_t max,
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return (result);
+		return result;
 	}
 	*uip = n;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 isc_result_t
 parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return (parse_uint_helper(uip, value, max, desc, 10));
+	return parse_uint_helper(uip, value, max, desc, 10);
 }

 isc_result_t
 parse_xint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return (parse_uint_helper(uip, value, max, desc, 0));
+	return parse_uint_helper(uip, value, max, desc, 0);
 }

 static uint32_t
@@ -937,7 +938,7 @@ parse_bits(char *arg, const char *desc, uint32_t max) {
 		fatal("couldn't parse digest bits");
 	}
 	tmp = (tmp + 7) & ~0x7U;
-	return (tmp);
+	return tmp;
 }

 isc_result_t
@@ -1015,7 +1016,7 @@ done:
 	sa->length = prefix_length;
 	*sap = sa;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*
@@ -1091,7 +1092,7 @@ read_confkey(void) {
 	isc_result_t result;

 	if (!isc_file_exists(keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

 	result = cfg_parser_create(mctx, &pctx);
@@ -1132,7 +1133,7 @@ cleanup:
 		cfg_parser_destroy(&pctx);
 	}

-	return (result);
+	return result;
 }

 void
@@ -1202,7 +1203,7 @@ make_searchlist_entry(char *domain) {
 	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME - 1] = 0;
 	ISC_LINK_INIT(search, link);
-	return (search);
+	return search;
 }

 static void
@@ -1376,24 +1377,27 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
-	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
-	{ 3, "NSID" },	       /* RFC 5001 */
-	{ 5, "DAU" },	       /* RFC 6975 */
-	{ 6, "DHU" },	       /* RFC 6975 */
-	{ 7, "N3U" },	       /* RFC 6975 */
-	{ 8, "ECS" },	       /* RFC 7871 */
-	{ 9, "EXPIRE" },       /* RFC 7314 */
-	{ 10, "COOKIE" },      /* RFC 7873 */
-	{ 11, "KEEPALIVE" },   /* RFC 7828 */
-	{ 12, "PADDING" },     /* RFC 7830 */
-	{ 12, "PAD" },	       /* shorthand */
-	{ 13, "CHAIN" },       /* RFC 7901 */
-	{ 14, "KEY-TAG" },     /* RFC 8145 */
-	{ 15, "EDE" },	       /* ietf-dnsop-extended-error-16 */
-	{ 16, "CLIENT-TAG" },  /* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },  /* draft-bellis-dnsop-edns-tags */
-	{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
+	{ 1, "LLQ" },		  /* draft-sekar-dns-llq */
+	{ 2, "UL" },		  /* draft-ietf-dnssd-update-lease */
+	{ 3, "NSID" },		  /* RFC 5001 */
+	{ 5, "DAU" },		  /* RFC 6975 */
+	{ 6, "DHU" },		  /* RFC 6975 */
+	{ 7, "N3U" },		  /* RFC 6975 */
+	{ 8, "ECS" },		  /* RFC 7871 */
+	{ 9, "EXPIRE" },	  /* RFC 7314 */
+	{ 10, "COOKIE" },	  /* RFC 7873 */
+	{ 11, "KEEPALIVE" },	  /* RFC 7828 */
+	{ 12, "PADDING" },	  /* RFC 7830 */
+	{ 12, "PAD" },		  /* shorthand */
+	{ 13, "CHAIN" },	  /* RFC 7901 */
+	{ 14, "KEY-TAG" },	  /* RFC 8145 */
+	{ 15, "EDE" },		  /* ietf-dnsop-extended-error-16 */
+	{ 16, "CLIENT-TAG" },	  /* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },	  /* draft-bellis-dnsop-edns-tags */
+	{ 18, "REPORT-CHANNEL" }, /* RFC 9567 */
+	{ 18, "RC" },		  /* shorthand */
+	{ 19, "ZONEVERSION" },	  /* RFC 9660 */
+	{ 26946, "DEVICEID" },	  /* Brian Hartvigsen */
 };

 #define N_EDNS_OPTNAMES (sizeof(optnames) / sizeof(optnames[0]))
@@ -1539,13 +1543,13 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
-				return (false);
+				return false;
 			}
 		}
 		q = ISC_LIST_NEXT(q, link);
 	}

-	return (true);
+	return true;
 }

 static void
@@ -1855,7 +1859,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			result = dns_message_findtype(name, dns_rdatatype_soa,
 						      0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
-				return (0);
+				return 0;
 			}
 		}
 		rdataset = NULL;
@@ -1958,7 +1962,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	if (lookup == NULL && section == DNS_SECTION_ANSWER &&
 	    (query->lookup->trace || query->lookup->ns_search_only))
 	{
-		return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
+		return followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
 	}

 	/*
@@ -1990,7 +1994,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				    link);
 	}

-	return (numLookups);
+	return numLookups;
 }

 /*%
@@ -2017,7 +2021,7 @@ next_origin(dig_lookup_t *oldlookup) {
 		 * We're not using a search list, so don't even think
 		 * about finding the next entry.
 		 */
-		return (false);
+		return false;
 	}

 	/*
@@ -2029,14 +2033,14 @@ next_origin(dig_lookup_t *oldlookup) {
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 	{
-		return (false);
+		return false;
 	}

 	if (oldlookup->origin == NULL && !oldlookup->need_search) {
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		return (false);
+		return false;
 	}
 	if (oldlookup->origin == NULL && oldlookup->need_search) {
 		newlookup = requeue_lookup(oldlookup, true);
@@ -2045,13 +2049,13 @@ next_origin(dig_lookup_t *oldlookup) {
 	} else {
 		search = ISC_LIST_NEXT(oldlookup->origin, link);
 		if (search == NULL && oldlookup->done_as_is) {
-			return (false);
+			return false;
 		}
 		newlookup = requeue_lookup(oldlookup, true);
 		newlookup->origin = search;
 	}
 	cancel_lookup(oldlookup);
-	return (true);
+	return true;
 }

 /*%
@@ -2154,7 +2158,7 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	ISC_LINK_INIT(query, link);

 	query->magic = DIG_QUERY_MAGIC;
-	return (query);
+	return query;
 }

 /*%
@@ -2288,7 +2292,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
 				if (result == DNS_R_NAMETOOLONG) {
-					return (false);
+					return false;
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
@@ -2315,7 +2319,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
 				clear_current_lookup();
-				return (false);
+				return false;
 #else  /* if TARGET_OS_IPHONE */
 				cleanup_openssl_refs();
 				digexit();
@@ -2648,7 +2652,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	return (true);
+	return true;
 }

 /*%
@@ -2793,7 +2797,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,

 	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
 	{
-		return (NULL);
+		return NULL;
 	}

 	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
@@ -2872,7 +2876,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 			INSIST(*psess_cache == NULL);
 			*psess_cache = sess_cache;
 		}
-		return (ctx);
+		return ctx;
 	}

 	if (psess_cache != NULL) {
@@ -2881,7 +2885,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 	}

 	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
-	return (found_ctx);
+	return found_ctx;
 failure:
 	if (ctx != NULL) {
 		isc_tlsctx_free(&ctx);
@@ -2896,7 +2900,7 @@ failure:
 	if (store != NULL && store != found_store) {
 		isc_tls_cert_store_free(&store);
 	}
-	return (NULL);
+	return NULL;
 }

 static void
@@ -3278,6 +3282,10 @@ start_udp(dig_query_t *query) {
 		return;
 	}

+	if (!port_set) {
+		port = 53;
+	}
+
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -3346,12 +3354,12 @@ try_next_server(dig_lookup_t *lookup) {

 	current_query = lookup->current_query;
 	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
-		return (false);
+		return false;
 	}

 	next_query = ISC_LIST_NEXT(current_query, link);
 	if (next_query == NULL) {
-		return (false);
+		return false;
 	}

 	debug("trying next server...");
@@ -3362,7 +3370,7 @@ try_next_server(dig_lookup_t *lookup) {
 		start_udp(next_query);
 	}

-	return (true);
+	return true;
 }

 static void
@@ -3701,7 +3709,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result != ISC_R_SUCCESS) {
 		puts("; Transfer failed.");
-		return (true);
+		return true;
 	}
 	do {
 		dns_name_t *name;
@@ -3727,7 +3735,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
-					return (true);
+					return true;
 				}
 				if ((!query->second_rr_rcvd) &&
 				    (rdata.type != dns_rdatatype_soa))
@@ -3807,10 +3815,10 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
-	return (false);
+	return false;
 doexit:
 	dighost_received(len, peer, query);
-	return (true);
+	return true;
 }

 static void
@@ -3904,7 +3912,7 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {

 static int
 ednsvers(dns_rdataset_t *opt) {
-	return ((opt->ttl >> 16) & 0xff);
+	return (opt->ttl >> 16) & 0xff;
 }

 /*%
@@ -4118,8 +4126,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if ((!query->first_soa_rcvd || query->warn_id))
-				{
+				if (!query->first_soa_rcvd || query->warn_id) {
 					dighost_warning("%s: ID mismatch: "
 							"expected ID %u, got "
 							"%u",
@@ -4575,12 +4582,12 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	INSIST(count == 1);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 int
@@ -4602,7 +4609,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 			fatal("couldn't get address for '%s': %s", host,
 			      isc_result_totext(result));
 		}
-		return (0);
+		return 0;
 	}

 	for (i = 0; i < count; i++) {
@@ -4612,7 +4619,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 	}

-	return (count);
+	return count;
 }

 /*%
@@ -4750,7 +4757,7 @@ destroy_libs(void) {
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
+	isc__crypto_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -4785,7 +4792,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/*
@@ -4793,14 +4800,14 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

 	idn2_free(dst);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -4866,8 +4873,8 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup) {
 	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
-		return (true);
+		return true;
 	}

-	return (false);
+	return false;
 }
@@ -96,7 +96,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return (totext.deconsttext);
+	return totext.deconsttext;
 }

 ISC_NORETURN static void
@@ -222,9 +222,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	for (;;) {
@@ -262,7 +262,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return (result);
+					return result;
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -317,11 +317,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -341,12 +341,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -423,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -517,7 +517,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -527,7 +527,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}

@@ -538,7 +538,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -548,7 +548,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -556,7 +556,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
 	if (!short_form) {
@@ -574,7 +574,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return (result);
+	return result;
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -917,5 +917,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return ((seen_error == 0) ? 0 : 1);
+	return (seen_error == 0) ? 0 : 1;
 }
@@ -128,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return (totext.deconsttext);
+	return totext.deconsttext;
 }

 static void
@@ -210,9 +210,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	for (;;) {
 		name = NULL;
@@ -256,10 +256,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -294,9 +294,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	for (;;) {
 		name = NULL;
@@ -338,10 +338,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -424,7 +424,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -478,7 +478,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -537,10 +537,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return (false);
+		return false;
 	}
 }

@@ -554,10 +554,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return (true);
+		return true;
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return (false);
+		return false;
 	}
 }

@@ -975,5 +975,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (query_error | print_error);
+	return query_error | print_error;
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return (NULL);
+		return NULL;
 	}
-	return (buf);
-};
+	return buf;
+}

 #define add_history(line)

@@ -393,7 +393,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return (buf);
+	return buf;
 }

 static void
@@ -503,14 +503,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return (true);
+			return true;
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return (false);
+			return false;
 		}
 	}

@@ -519,7 +519,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return (false);
+	return false;
 }

 /*
@@ -573,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return (keytable);
+	return keytable;
 }

 static void
@@ -679,7 +679,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return (algo);
+	return algo;
 }

 /*
@@ -696,7 +696,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return (ok);
+	return ok;
 }

 /*
@@ -738,7 +738,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return (all_ok);
+	return all_ok;
 }

 /*
@@ -759,10 +759,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return (ISC_R_IGNORE);
+		return ISC_R_IGNORE;
 	}

-	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
+	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
 }

 static isc_result_t
@@ -775,7 +775,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -783,7 +783,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -814,14 +814,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return (result);
+			return result;
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -866,8 +866,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
-				  (const dns_rdata_t *)rdata2));
+	return dns_rdata_compare((const dns_rdata_t *)rdata1,
+				 (const dns_rdata_t *)rdata2);
 }

 /*
@@ -948,7 +948,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return (match);
+	return match;
 }

 static void
@@ -1339,5 +1339,5 @@ cleanup:
 	print_mem_stats = true;
 	cleanup();

-	return (0);
+	return 0;
 }
@@ -66,7 +66,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return (result);
+	return result;
 }

 static void
@@ -138,7 +138,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -153,7 +153,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return (ISC_R_NOSPACE);
+			return ISC_R_NOSPACE;
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -162,18 +162,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return (loadset(filename, rdataset));
+	return loadset(filename, rdataset);
 }

 static void
@@ -549,8 +549,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return (1);
+		return 1;
 	} else {
-		return (0);
+		return 0;
 	}
 }
@@ -68,7 +68,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return (result);
+	return result;
 }

 static void
@@ -141,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return (result);
+	return result;
 }

 static void
@@ -459,8 +459,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return (1);
+		return 1;
 	} else {
-		return (0);
+		return 0;
 	}
 }
@@ -750,5 +750,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return (0);
+	return 0;
 }
@@ -190,7 +190,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record | size | mctx\n");
+	fprintf(stderr, "       usage | trace | record\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -1320,5 +1320,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return (0);
+	return 0;
 }
@@ -25,6 +25,7 @@
 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -61,16 +62,19 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
+	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
+	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
+	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -139,6 +143,15 @@ usage(int ret) {
 	exit(ret);
 }

+static isc_stdtime_t
+between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
+	isc_stdtime_t r = end;
+	if (t > 0 && t > start && t < end) {
+		r = t;
+	}
+	return r;
+}
+
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -182,15 +195,19 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keytag_cmp(const void *k1, const void *k2) {
+keyalgtag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
-		return (-1);
+	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
+		return -1;
+	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
+		return 1;
+	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+		return -1;
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
-		return (1);
+		return 1;
 	}
-	return (0);
+	return 0;
 }

 static void
@@ -220,7 +237,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -235,6 +252,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
+	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -242,6 +260,7 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
+	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -309,9 +328,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
-	   isc_stdtime_t inception, isc_stdtime_t active,
-	   isc_stdtime_t *expiration) {
+create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
+	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
+	   isc_stdtime_t active, isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -323,9 +342,15 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
+	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

+	/* ZSK or KSK? */
+	if (ksr->ksk) {
+		flags |= DNS_KEYFLAG_KSK;
+	}
+
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -416,18 +441,18 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				DNS_KEYOWNER_ZONE, &key);
+				flags, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(
-				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
-				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
-				mctx, &key, &progress);
+			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
+					       flags, DNS_KEYPROTO_DNSSEC,
+					       dns_rdataclass_in, NULL, mctx,
+					       &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(
-				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
-				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
-				mctx, &key, NULL);
+			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
+					       flags, DNS_KEYPROTO_DNSSEC,
+					       dns_rdataclass_in, NULL, mctx,
+					       &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -464,15 +489,28 @@ create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, false);
-	dst_key_setbool(key, DST_BOOL_ZSK, true);
+	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
+	if (ksr->ksk) {
+		dns_keymgr_settime_syncpublish(key, kasp,
+					       (inception == ksr->start));
+	}
+
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
-				       ksr->retiresafety + ksr->signdelay;
+		isc_stdtime_t remove;
+
+		if (ksr->ksk) {
+			remove = ksr->ttlds + ksr->parentpropagation +
+				 ksr->retiresafety;
+			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
+		} else {
+			remove = ksr->ttlsig + ksr->propagation +
+				 ksr->retiresafety + ksr->signdelay;
+		}
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -603,15 +641,16 @@ fail:
 		      namestr, algstr, timestr);
 	}

-	return (next_bundle);
+	return next_bundle;
 }

-static void
+static isc_stdtime_t
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
+	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -655,6 +694,25 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

+		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
+
+		/* Determine next bundle. */
+		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
+		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
+		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
+		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
+		next_bundle = between(pub, inception, next_bundle);
+		next_bundle = between(act, inception, next_bundle);
+		next_bundle = between(inact, inception, next_bundle);
+		next_bundle = between(del, inception, next_bundle);
+
+		if (act > inception) {
+			continue;
+		}
+		if (inact != 0 && inception >= inact) {
+			continue;
+		}
+
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -676,21 +734,25 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
+
+	return next_bundle;
 }

 /*
 * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
 * listed in 'keys'.
 */
-static void
-create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
-	   dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-	   dns_rdataset_t *cdsset) {
+static isc_stdtime_t
+get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
+		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
+		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
+		dns_rdataset_t *cdsset) {
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
 	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
+	isc_stdtime_t next_bundle = next_inception;

 	dns_rdatalist_init(dnskeylist);
 	dnskeylist->rdclass = dns_rdataclass_in;
@@ -710,31 +772,73 @@ create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
+		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
 		dns_rdata_t *rdata;
 		isc_region_t r;
 		isc_region_t rcds;
+		isc_stdtime_t pub = 0, del = 0;
 		unsigned char kskbuf[DST_KEY_MAXSIZE];
 		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

 		/* KSK */
-		newbuf = NULL;
-		rdata = isc_mem_get(mctx, sizeof(*rdata));
-		dns_rdata_init(rdata);
+		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
+		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
+		next_bundle = between(pub, inception, next_bundle);
+		next_bundle = between(del, inception, next_bundle);

-		isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-		CHECK(dst_key_todns(dk->key, &buf));
-		isc_buffer_usedregion(&buf, &r);
-		isc_buffer_allocate(mctx, &newbuf, r.length);
-		isc_buffer_putmem(newbuf, r.base, r.length);
-		isc_buffer_usedregion(newbuf, &r);
-		dns_rdata_fromregion(rdata, dns_rdataclass_in,
-				     dns_rdatatype_dnskey, &r);
-		ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-		ISC_LIST_APPEND(cleanup_list, newbuf, link);
-		isc_buffer_clear(newbuf);
+		if (pub > inception) {
+			published = false;
+		}
+		if (del != 0 && inception >= del) {
+			published = false;
+		}
+
+		if (published) {
+			newbuf = NULL;
+			rdata = isc_mem_get(mctx, sizeof(*rdata));
+			dns_rdata_init(rdata);
+
+			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
+			CHECK(dst_key_todns(dk->key, &buf));
+			isc_buffer_usedregion(&buf, &r);
+			isc_buffer_allocate(mctx, &newbuf, r.length);
+			isc_buffer_putmem(newbuf, r.base, r.length);
+			isc_buffer_usedregion(newbuf, &r);
+			dns_rdata_fromregion(rdata, dns_rdataclass_in,
+					     dns_rdatatype_dnskey, &r);
+			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
+			ISC_LIST_APPEND(cleanup_list, newbuf, link);
+			isc_buffer_clear(newbuf);
+		}
+
+		published = true;
+		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
+			pub = 0;
+			del = 0;
+			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
+					      &pub);
+			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
+					      &del);
+
+			next_bundle = between(pub, inception, next_bundle);
+			next_bundle = between(del, inception, next_bundle);
+
+			if (pub != 0 && pub > inception) {
+				published = false;
+			}
+			if (del != 0 && inception >= del) {
+				published = false;
+			}
+		} else {
+			published = false;
+		}
+
+		if (!published) {
+			continue;
+		}

 		/* CDNSKEY */
 		newbuf = NULL;
@@ -788,35 +892,98 @@ create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
 	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-	return;
+
+	return next_bundle;

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
+	return 0;
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
-	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
+sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
 	    dns_dnsseckeylist_t *keys) {
-	dns_rdataset_t rrset = DNS_RDATASET_INIT;
-	isc_stdtime_t expiration;
+	isc_stdtime_t expiration = inception + ksr->sigvalidity;
+	isc_stdtime_t next_bundle = next_inception;
+	dns_rdataset_t zsk;
+
+	dns_rdataset_init(&zsk);
+	dns_rdatalist_tordataset(zsklist, &zsk);

-	dns_rdataset_init(&rrset);
-	dns_rdatalist_tordataset(rdatalist, &rrset);
-	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		sign_rrset(ksr, inception, expiration, &rrset, keys);
-		if (dns_rdataset_count(cdnskey) > 0) {
-			sign_rrset(ksr, inception, expiration, cdnskey, keys);
+		isc_stdtime_t next_time = next_bundle;
+
+		/* DNSKEY RRset */
+		dns_rdatalist_t *dnskeylist;
+		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
+		dns_rdatalist_init(dnskeylist);
+		dnskeylist->rdclass = dns_rdataclass_in;
+		dnskeylist->type = dns_rdatatype_dnskey;
+		dnskeylist->ttl = ksr->ttl;
+
+		dns_rdataset_t ksk, cdnskey, cds, rrset;
+		dns_rdataset_init(&ksk);
+		dns_rdataset_init(&cdnskey);
+		dns_rdataset_init(&cds);
+		dns_rdataset_init(&rrset);
+		next_time = get_keymaterial(ksr, kasp, inception, next_time,
+					    keys, &ksk, &cdnskey, &cds);
+		if (next_bundle > next_time) {
+			next_bundle = next_time;
 		}
-		if (dns_rdataset_count(cds) > 0) {
-			sign_rrset(ksr, inception, expiration, cds, keys);
+
+		for (isc_result_t r = dns_rdatalist_first(&ksk);
+		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
+		{
+			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
+			dns_rdata_init(clone);
+			dns_rdatalist_current(&ksk, clone);
+			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
 		}
+
+		for (isc_result_t r = dns_rdatalist_first(&zsk);
+		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
+		{
+			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
+			dns_rdata_init(clone);
+			dns_rdatalist_current(&zsk, clone);
+			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		}
+
+		dns_rdatalist_tordataset(dnskeylist, &rrset);
+		next_time = sign_rrset(ksr, inception, expiration, &rrset,
+				       keys);
+		if (next_bundle > next_time) {
+			next_bundle = next_time;
+		}
+		freerrset(&ksk);
+		freerrset(&rrset);
+
+		/* CDNSKEY */
+		if (dns_rdataset_count(&cdnskey) > 0) {
+			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
+					 keys);
+		}
+		freerrset(&cdnskey);
+
+		/* CDS */
+		if (dns_rdataset_count(&cds) > 0) {
+			(void)sign_rrset(ksr, inception, expiration, &cds,
+					 keys);
+		}
+		freerrset(&cds);
+
+		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
+		if (inception > next_bundle) {
+			inception = next_bundle;
+		}
 		expiration = inception + ksr->sigvalidity;
+		next_bundle = expiration;
 	}
-	freerrset(&rrset);
+
+	freerrset(&zsk);
 }

 static isc_result_t
@@ -841,10 +1008,10 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	isc_buffer_add(&b, strlen(owner));
 	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
-		return (ret);
+		return ret;
 	}
 	if (dns_name_compare(dname, name) != 0) {
-		return (DNS_R_BADOWNERNAME);
+		return DNS_R_BADOWNERNAME;
 	}
 	isc_buffer_clear(&b);

@@ -882,7 +1049,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {

 cleanup:
 	isc_lex_setcomments(lex, 0);
-	return (ret);
+	return ret;
 }

 static void
@@ -903,9 +1070,12 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk)) {
+		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
 			/* only ZSKs allowed */
 			continue;
+		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
+			/* only KSKs allowed */
+			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -916,7 +1086,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_zsk(ksr, kk, &keys, inception, act, &act);
+			create_key(ksr, kasp, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -924,7 +1094,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("policy '%s' has no zsks", ksr->policy);
+		fatal("no keys created for policy '%s'", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1003,9 +1173,6 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
-	dns_rdataset_t ksk = DNS_RDATASET_INIT;
-	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
-	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1038,9 +1205,6 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

-	/* KSK, CDS and CDNSKEY */
-	create_ksk(ksr, kasp, &keys, &ksk, &cdnskey, &cds);
-
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1090,8 +1254,8 @@ sign(ksr_ctx_t *ksr) {

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, inception, next_inception,
-					    rdatalist, &cds, &cdnskey, &keys);
+				sign_bundle(ksr, kasp, inception,
+					    next_inception, rdatalist, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1101,15 +1265,7 @@ sign(ksr_ctx_t *ksr) {
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
 			rdatalist->ttl = ksr->ttl;
-			for (isc_result_t r = dns_rdatalist_first(&ksk);
-			     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-			{
-				dns_rdata_t *clone =
-					isc_mem_get(mctx, sizeof(*clone));
-				dns_rdata_init(clone);
-				dns_rdatalist_current(&ksk, clone);
-				ISC_LIST_APPEND(rdatalist->rdata, clone, link);
-			}
+
 			inception = next_inception;
 			have_bundle = true;

@@ -1168,8 +1324,7 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
-			    &keys);
+		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1181,11 +1336,6 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
-	/* Clean up */
-	freerrset(&ksk);
-	freerrset(&cdnskey);
-	freerrset(&cds);
-
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1208,7 +1358,7 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
@@ -1245,6 +1395,9 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
+		case 'o':
+			ksr.ksk = true;
+			break;
 		case 'V':
 			version(program);
 			break;
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -51,6 +51,10 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

+.. option:: -f
+
+   This option sets the SKR file to be signed when issuing a ``sign`` command.
+
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -76,6 +80,11 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

+.. option:: -o
+
+   Normally when pregenerating keys, ZSKs are created. When this option is
+   set, create KSKs instead.
+
 .. option:: -V

   This option prints version information.
@@ -98,9 +107,8 @@ Commands

 .. option:: keygen

-  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
-  an interval. The number of generated keys depends on the interval and the
-  ZSK lifetime.
+  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
+  number of generated keys depends on the interval and the key lifetime.

 .. option:: request

@@ -123,7 +131,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate keys for the zone "example.com" for the next year,
+When you need to generate ZSKs for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -136,7 +144,8 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to the KSK.
+Typically you would now transfer the KSR to the system that has access to
+the KSK.

 Signing the KSR created above can be done with:

@@ -144,7 +153,8 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those
+in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -248,5 +248,5 @@ cleanup:
 	}
 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -949,5 +949,5 @@ main(int argc, char **argv) {
 	isc_mem_free(mctx, directory);
 	isc_mem_destroy(&mctx);

-	return (0);
+	return 0;
 }
@@ -197,7 +197,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return (result);
+	return result;
 }

 static void
@@ -325,28 +325,28 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return (key->force_sign || key->hint_sign);
+	return key->force_sign || key->hint_sign;
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
+	return (key->force_publish || key->hint_publish) && !key->hint_remove;
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
-		dst_key_iszonekey(key->key));
+	return dns_name_equal(dst_key_name(key->key), gorigin) &&
+	       dst_key_iszonekey(key->key);
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return (key->ksk);
+	return key->ksk;
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return (ignore_kskflag || !key->ksk);
+	return ignore_kskflag || !key->ksk;
 }

 /*%
@@ -366,10 +366,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return (key);
+			return key;
 		}
 	}
-	return (NULL);
+	return NULL;
 }

 /*%
@@ -386,7 +386,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return (key);
+		return key;
 	}

 	/*
@@ -400,7 +400,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return (key);
+		return key;
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -408,7 +408,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return (NULL);
+		return NULL;
 	}

 	result = dst_key_fromfile(
@@ -427,7 +427,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return (key);
+	return key;
 }

 /*%
@@ -449,11 +449,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return (true);
+		return true;
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return (false);
+		return false;
 	default:
 		break;
 	}
@@ -461,7 +461,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return (false); /* removes a warning */
+	return false; /* removes a warning */
 }

 static bool
@@ -471,10 +471,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return (true);
+		return true;
 	} else {
 		INCSTAT(nverifyfailed);
-		return (false);
+		return false;
 	}
 }

@@ -673,6 +673,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
+		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
+			continue;
+		}
+
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -855,7 +859,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return (memcmp(a, b, hash_length + 1));
+	return memcmp(a, b, hash_length + 1);
 }

 static void
@@ -887,11 +891,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return (true);
+			return true;
 		}
 		current = next;
 	}
-	return (false);
+	return false;
 }

 static const unsigned char *
@@ -913,16 +917,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return (next);
+	return next;
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return (true);
+		return true;
 	} else {
-		return (false);
+		return false;
 	}
 }

@@ -1031,7 +1035,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return (result);
+				return result;
 			}
 		}
 		dns_db_detach(&db);
@@ -1040,13 +1044,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return (result);
+		return result;
 	}

 	dns_rdataset_init(&keyset);
@@ -1055,7 +1059,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return (result);
+		return result;
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1091,7 +1095,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return (result);
+	return result;
 }

 static bool
@@ -1100,7 +1104,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return (false);
+		return false;
 	}

 	dns_rdataset_init(&dsset);
@@ -1110,7 +1114,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return (result == ISC_R_SUCCESS);
+	return result == ISC_R_SUCCESS;
 }

 static bool
@@ -1120,7 +1124,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return (false);
+		return false;
 	}

 	dns_rdataset_init(&nsset);
@@ -1133,7 +1137,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return ((result == ISC_R_SUCCESS));
+	return result == ISC_R_SUCCESS;
 }

 /*%
@@ -1152,7 +1156,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return ((result == ISC_R_SUCCESS));
+	return result == ISC_R_SUCCESS;
 }

 /*%
@@ -1370,7 +1374,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return (active);
+	return active;
 }

 /*%
@@ -1419,7 +1423,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	dns_rdataset_init(&rdataset);
@@ -1493,7 +1497,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return (result);
+	return result;
 }

 /*%
@@ -4134,5 +4138,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mutex_destroy(&namelock);

-	return (vresult == ISC_R_SUCCESS ? 0 : 1);
+	return vresult == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -330,5 +330,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS ? 0 : 1);
+	return result == ISC_R_SUCCESS ? 0 : 1;
 }
@@ -173,16 +173,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return (offset * (365 * 24 * 3600));
+		return offset * (365 * 24 * 3600);
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return (offset * (30 * 24 * 3600));
+			return offset * (30 * 24 * 3600);
 		case 'I':
 		case 'i':
-			return (offset * 60);
+			return offset * 60;
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -194,29 +194,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return (offset * (7 * 24 * 3600));
+		return offset * (7 * 24 * 3600);
 	case 'D':
 	case 'd':
-		return (offset * (24 * 3600));
+		return offset * (24 * 3600);
 	case 'H':
 	case 'h':
-		return (offset * 3600);
+		return offset * 3600;
 	case 'S':
 	case 's':
 	case '\0':
-		return (offset);
+		return offset;
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return (0); /* silence compiler warning */
+	return 0; /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return ((strcasecmp(str, "none") == 0) ||
-		(strcasecmp(str, "never") == 0) ||
-		(strcasecmp(str, "unset") == 0));
+	return (strcasecmp(str, "none") == 0) ||
+	       (strcasecmp(str, "never") == 0) ||
+	       (strcasecmp(str, "unset") == 0);
 }

 dns_ttl_t
@@ -226,7 +226,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return ((dns_ttl_t)0);
+		return (dns_ttl_t)0;
 	}

 	ttl = strtol(str, &endp, 0);
@@ -234,19 +234,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return (ttl);
+	return ttl;
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return (DST_KEY_STATE_NA);
+		return DST_KEY_STATE_NA;
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return ((dst_key_state_t)i);
+			return (dst_key_state_t)i;
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -263,13 +263,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return ((isc_stdtime_t)0);
+		return (isc_stdtime_t)0;
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return ((isc_stdtime_t)0);
+		return (isc_stdtime_t)0;
 	}

 	/*
@@ -318,7 +318,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return ((isc_stdtime_t)base);
+		return (isc_stdtime_t)base;
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -331,7 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return ((isc_stdtime_t)val);
+	return (isc_stdtime_t)val;
 }

 dns_rdataclass_t
@@ -341,7 +341,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return (dns_rdataclass_in);
+		return dns_rdataclass_in;
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -349,7 +349,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return (rdclass);
+	return rdclass;
 }

 unsigned int
@@ -364,14 +364,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return (alg);
+	return alg;
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return (a - b);
+	return a - b;
 }

 void
@@ -403,7 +403,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -472,14 +472,14 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		if (id < min || id > max) {
 			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
 				min, max);
-			return (true);
+			return true;
 		}
 		if (rid < min || rid > max) {
 			fprintf(stderr,
 				"Revoked Key ID %d (for tag %d) outside of "
 				"[%u..%u]\n",
 				rid, id, min, max);
-			return (true);
+			return true;
 		}
 	}

@@ -487,7 +487,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return (false);
+		return false;
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -531,7 +531,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return (conflict);
+	return conflict;
 }

 bool
@@ -546,9 +546,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 void
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return (DNS_R_BADTTL);
+		return DNS_R_BADTTL;
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return (result);
+	return result;
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return (ISC_R_NOSPACE);
+		return ISC_R_NOSPACE;
 	}
-	return (putrr(node, "SOA", DEFAULT_TTL, str));
+	return putrr(node, "SOA", DEFAULT_TTL, str);
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
+	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return (j + 14);
+	return j + 14;
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return (ISC_R_NOTFOUND);
+			return ISC_R_NOTFOUND;
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				 sizeof(ipv4only)));
+		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				sizeof(ipv4only));
 	}

-	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
-			 (unsigned int)len));
+	return putrdata(node, dns_rdatatype_cname, 600, rdata,
+			(unsigned int)len);
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
 	if (name->labels == 0 && name->length == 0) {
-		return (bdb->lookup(node));
+		return bdb->lookup(node);
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return (dns64_cname(&bdb->common.origin, name, node));
+		return dns64_cname(&bdb->common.origin, name, node);
 	} else {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		} else {
-			return (puttxt(node, named_g_server->version));
+			return puttxt(node, named_g_server->version);
 		}
 	} else {
-		return (puttxt(node, PACKAGE_VERSION));
+		return puttxt(node, PACKAGE_VERSION);
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		} else {
-			return (puttxt(node, named_g_server->hostname));
+			return puttxt(node, named_g_server->hostname);
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
-		return (puttxt(node, buf));
+		return puttxt(node, buf);
 	}
 }

@@ -546,16 +546,16 @@ authors_lookup(bdbnode_t *node) {
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -563,13 +563,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
-		return (puttxt(node, buf));
+		return puttxt(node, buf);
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return (puttxt(node, named_g_server->sctx->server_id));
+		return puttxt(node, named_g_server->sctx->server_id);
 	} else {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -577,7 +577,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -588,10 +588,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -600,7 +600,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return (result);
+	return result;
 }

 /*
@@ -670,10 +670,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return (ISC_R_NOMORE);
+		return ISC_R_NOMORE;
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -682,9 +682,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return (ISC_R_NOMORE);
+		return ISC_R_NOMORE;
 	} else {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 }

@@ -787,7 +787,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -844,23 +844,23 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return (result);
+		return result;
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return (result);
+		return result;
 	}

-	*nodep = node;
-	return (ISC_R_SUCCESS);
+	*nodep = (dns_dbnode_t *)node;
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -887,26 +887,26 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return (result);
+		return result;
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return (result);
+			return result;
 		}
 	}

-	*nodep = node;
-	return (ISC_R_SUCCESS);
+	*nodep = (dns_dbnode_t *)node;
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -925,10 +925,10 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (void *)&dummy);
+	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return (DNS_R_NXDOMAIN);
+		return DNS_R_NXDOMAIN;
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +954,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return (DNS_R_BADDB);
+				return DNS_R_BADDB;
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}

 		/*
@@ -1015,7 +1015,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode(node);
+			destroynode((bdbnode_t *)node);
 			node = NULL;
 			continue;
 		}
@@ -1069,7 +1069,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return (result);
+	return result;
 }

 static void
@@ -1117,7 +1117,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1128,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}

 	new_rdataset(list, db, node, rdataset);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static isc_result_t
@@ -1142,7 +1142,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == &dummy);
+	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -1158,7 +1158,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1186,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1241,7 +1241,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1253,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return (result);
+	return result;
 }

 /*
@@ -1269,17 +1269,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return (result);
+		return result;
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -168,7 +168,8 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 32;\n\
+	max-recursion-queries 50;\n\
+	max-query-count 200;\n\
 	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
@@ -236,6 +237,7 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
+	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -354,15 +356,15 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				 CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					 CFG_PCTX_NOEXPERIMENTAL,
-				 conf));
+	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
+					CFG_PCTX_NOEXPERIMENTAL,
+				conf);
 }

 const char *
 named_config_getdefault(void) {
-	return (defaultconf);
+	return defaultconf;
 }

 isc_result_t
@@ -372,10 +374,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 isc_result_t
@@ -401,7 +403,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return (ISC_R_SUCCESS);
+				return ISC_R_SUCCESS;
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -415,13 +417,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return (ISC_R_SUCCESS);
+						return ISC_R_SUCCESS;
 					}
 				}
 			}
 		}
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 int
@@ -433,7 +435,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return (i);
+	return i;
 }

 isc_result_t
@@ -444,7 +446,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
@@ -453,7 +455,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
 			    r.base);
 	}
-	return (result);
+	return result;
 }

 isc_result_t
@@ -464,7 +466,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
@@ -473,7 +475,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
 			    r.base);
 	}
-	return (result);
+	return result;
 }

 dns_zonetype_t
@@ -499,7 +501,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return (ztype);
+	return ztype;
 }

 static isc_result_t
@@ -515,7 +517,7 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -524,11 +526,11 @@ getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
 			       name) == 0)
 		{
 			*ret = obj;
-			return (ISC_R_SUCCESS);
+			return ISC_R_SUCCESS;
 		}
 		elt = cfg_list_next(elt);
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 isc_result_t
@@ -537,15 +539,15 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 	isc_result_t result;

 	if (strcmp(list, "parental-agents") == 0) {
-		return (getremotesdef(cctx, list, name, ret));
+		return getremotesdef(cctx, list, name, ret);
 	} else if (strcmp(list, "primaries") == 0) {
 		result = getremotesdef(cctx, list, name, ret);
 		if (result != ISC_R_SUCCESS) {
 			result = getremotesdef(cctx, "masters", name, ret);
 		}
-		return (result);
+		return result;
 	}
-	return (ISC_R_NOTFOUND);
+	return ISC_R_NOTFOUND;
 }

 static isc_result_t
@@ -560,7 +562,7 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
@@ -575,11 +577,11 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return (result);
+		return result;
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -827,7 +829,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (addrs != NULL) {
@@ -866,7 +868,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return (result);
+	return result;
 }

 isc_result_t
@@ -891,10 +893,10 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
 		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return (ISC_R_RANGE);
+		return ISC_R_RANGE;
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 struct keyalgorithms {
@@ -938,15 +940,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		if (bits > algorithms[i].size) {
-			return (ISC_R_RANGE);
+			return ISC_R_RANGE;
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -955,5 +957,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
@@ -44,23 +44,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	*cmdp = token.value.as_textregion.base;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return (strcasecmp(str, command) == 0);
+	return strcasecmp(str, command) == 0;
 }

 /*%
@@ -86,7 +86,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -94,7 +94,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return (result);
+		return result;
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -305,5 +305,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return (result);
+	return result;
 }
@@ -246,7 +246,7 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return (result == ISC_R_SUCCESS && match > 0);
+	return result == ISC_R_SUCCESS && match > 0;
 }

 static void
@@ -638,7 +638,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return (result);
+		return result;
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
@@ -649,11 +649,11 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	newconnection(listener, handle);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -707,11 +707,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return (ISC_R_NOTFOUND);
+		return ISC_R_NOTFOUND;
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -833,7 +833,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		      ISC_LOG_INFO, "configuring command channel from '%s'",
 		      named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

 	CHECK(cfg_parser_create(mctx, &pctx));
@@ -899,7 +899,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -1205,7 +1205,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				cfg_obj_log(controls, ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return (ISC_R_FAILURE);
+				return ISC_R_FAILURE;
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1333,7 +1333,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 isc_result_t
@@ -1356,10 +1356,10 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	if (result != ISC_R_SUCCESS) {
 		isc_mutex_destroy(&controls->symtab_lock);
 		isc_mem_put(server->mctx, controls, sizeof(*controls));
-		return (result);
+		return result;
 	}
 	*ctrlsp = controls;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return (ISC_R_NOPERM);
+		return ISC_R_NOPERM;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return (ISC_R_NOPERM);
+		return ISC_R_NOPERM;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return (ptr);
+	return ptr;
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return (result);
+	return result;
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return (result);
+	return result;
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return (false);
+		return false;
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return (ret);
+	return ret;
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return (ISC_R_NOTIMPLEMENTED);
+		return ISC_R_NOTIMPLEMENTED;
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return (result);
+	return result;
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 /*
@@ -126,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return (NULL);
+				return NULL;
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -160,7 +160,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return (NULL);
+	return NULL;
 }

 /*
@@ -374,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return (NULL);
+				return NULL;
 			}
 			raise(SIGSTOP);
 			continue;
@@ -586,7 +586,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return (NULL);
+	return NULL;
 }

 /*
@@ -717,7 +717,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return (NULL);
+	return NULL;
 }

 #endif /* ENABLE_AFL */
@@ -43,7 +43,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 			      ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return (NULL);
+		return NULL;
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
@@ -51,7 +51,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
 			      pathbuf);
-		return (mmdb);
+		return mmdb;
 	}

 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
@@ -59,7 +59,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return (NULL);
+	return NULL;
 }
 #endif /* HAVE_GEOIP2 */

@@ -98,8 +98,6 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

-EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
-EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -54,12 +54,12 @@ named_log_init(bool safe) {

 	named_g_logging = true;

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	rcu_read_unlock();

-	return (result);
+	return result;
 }

 void
@@ -219,7 +219,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	}

 cleanup:
-	return (result);
+	return result;
 }

 isc_result_t
@@ -228,5 +228,5 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
 				    ISC_LOGMODULE_DEFAULT);
-	return (result);
+	return result;
 }
@@ -55,11 +55,11 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (logconfig == NULL) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	destinations = cfg_tuple_get(ccat, "destinations");
@@ -76,10 +76,10 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return (result);
+			return result;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -127,7 +127,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	type = ISC_LOG_TONULL;
@@ -308,7 +308,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return (result);
+	return result;
 }

 isc_result_t
@@ -363,8 +363,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
-	return (result);
+	return result;
 }
@@ -27,6 +27,7 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
+#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/fips.h>
@@ -308,7 +309,7 @@ usage(void) {
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record|size|mctx}]\n"
+			"{usage|trace|record}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -401,7 +402,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return (tmp);
+	return tmp;
 }

 static struct flag_def {
@@ -1024,7 +1025,7 @@ create_managers(void) {

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 static void
@@ -1392,7 +1393,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1401,7 +1402,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1410,7 +1411,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
@@ -1418,7 +1419,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	if (scf_myname(h, instance, namelen + 1) == -1) {
@@ -1428,12 +1429,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return (ISC_R_FAILURE);
+		return ISC_R_FAILURE;
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
 #endif /* HAVE_LIBSCF */

@@ -1565,7 +1566,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__tls_setdestroycheck(true);
+	isc__crypto_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -1591,5 +1592,5 @@ main(int argc, char *argv[]) {
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return (0);
+	return 0;
 }
@@ -108,7 +108,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
+   ``trace`` and ``record``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -400,15 +400,15 @@ named_os_closedevnull(void) {
 static bool
 all_digits(const char *s) {
 	if (*s == '\0') {
-		return (false);
+		return false;
 	}
 	while (*s != '\0') {
 		if (!isdigit((unsigned char)(*s))) {
-			return (false);
+			return false;
 		}
 		s++;
 	}
-	return (true);
+	return true;
 }

 void
@@ -521,9 +521,9 @@ named_os_changeuser(bool permanent) {
 uid_t
 named_os_uid(void) {
 	if (runas_pw == NULL) {
-		return (0);
+		return 0;
 	}
-	return (runas_pw->pw_uid);
+	return runas_pw->pw_uid;
 }

 void
@@ -587,22 +587,22 @@ safe_open(const char *filename, mode_t mode, bool append) {

 	if (stat(filename, &sb) == -1) {
 		if (errno != ENOENT) {
-			return (-1);
+			return -1;
 		}
 	} else if ((sb.st_mode & S_IFREG) == 0) {
 		errno = EOPNOTSUPP;
-		return (-1);
+		return -1;
 	}

 	if (append) {
 		fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, mode);
 	} else {
 		if (unlink(filename) < 0 && errno != ENOENT) {
-			return (-1);
+			return -1;
 		}
 		fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
 	}
-	return (fd);
+	return fd;
 }

 static void
@@ -650,7 +650,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			    !strcmp(slash + 1, ".."))
 			{
 				*slash = '/';
-				return (0);
+				return 0;
 			}
 			mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
 			mode |= S_IRGRP | S_IXGRP;	    /* g=rx */
@@ -672,11 +672,11 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 		}
 		*slash = '/';
 	}
-	return (0);
+	return 0;

 error:
 	*slash = '/';
-	return (-1);
+	return -1;
 }

 FILE *
@@ -693,11 +693,11 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s", filename,
 					strbuf);
-		return (NULL);
+		return NULL;
 	}
 	if (mkdirpath(f, named_main_earlywarning) == -1) {
 		free(f);
-		return (NULL);
+		return NULL;
 	}
 	free(f);

@@ -737,7 +737,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
-		return (NULL);
+		return NULL;
 	}

 	fp = fdopen(fd, "w");
@@ -747,7 +747,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 					filename, strbuf);
 	}

-	return (fp);
+	return fp;
 }

 void
@@ -863,5 +863,5 @@ named_os_uname(void) {
 	if (unamep == NULL) {
 		getuname();
 	}
-	return (unamep);
+	return unamep;
 }
@@ -126,19 +126,19 @@ user_zonetype(dns_zone_t *zone) {
 	const struct zt *tp;

 	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0) {
-		return ("builtin");
+		return "builtin";
 	}

 	view = dns_zone_getview(zone);
 	if (view != NULL && strcmp(view->name, "_bind") == 0) {
-		return ("builtin");
+		return "builtin";
 	}

 	ztype = dns_zone_gettype(zone);
 	for (tp = typemap; tp->string != NULL && tp->type != ztype; tp++) {
 		/* empty */
 	}
-	return (tp->string);
+	return tp->string;
 }
 #endif /* ifdef EXTENDED_STATS */

@@ -251,7 +251,7 @@ get_histo_desc(const char *prefix, int i, int inf, bool ext) {
 	}
 	INSIST(0 < len && (size_t)len < space);
 	used += len + 1;
-	return (desc);
+	return desc;
 }

 static void
@@ -339,6 +339,21 @@ init_desc(void) {
 		       "RPZRewrites");
 	SET_NSSTATDESC(udp, "UDP queries received", "QryUDP");
 	SET_NSSTATDESC(tcp, "TCP queries received", "QryTCP");
+	SET_NSSTATDESC(dot, "DoT queries received", "QryDoT");
+	SET_NSSTATDESC(doh, "DoH queries received", "QryDoH");
+	SET_NSSTATDESC(dohplain, "DoH-Plain queries received", "QryDoHPlain");
+	SET_NSSTATDESC(proxyudp, "PROXYv2 UDP queries received", "QryProxyUDP");
+	SET_NSSTATDESC(proxytcp, "PROXYv2 TCP queries received", "QryProxyTCP");
+	SET_NSSTATDESC(proxydot, "PROXYv2 DoT queries received", "QryProxyDoT");
+	SET_NSSTATDESC(proxydoh, "PROXYv2 DoH queries received", "QryProxyDoH");
+	SET_NSSTATDESC(proxydohplain, "PROXYv2/DoH-Plain queries received",
+		       "QryProxyDoHPlain");
+	SET_NSSTATDESC(encryptedproxydot,
+		       "Encrypted PROXYv2 DoT queries received",
+		       "QryEncryptedProxyDoT");
+	SET_NSSTATDESC(encryptedproxydoh,
+		       "Encrypted PROXYv2 DoH queries received",
+		       "QryEncryptedProxyDoH");
 	SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
@@ -816,8 +831,8 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-	return (dump_counters(type, arg, category, desc, ncounters, indices,
-			      values, options));
+	return dump_counters(type, arg, category, desc, ncounters, indices,
+			     values, options);
 }

 #if defined(EXTENDED_STATS)
@@ -833,8 +848,8 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	}
 	isc_histo_destroy(&hg);

-	return (dump_counters(type, arg, category, desc, ncounters, indices,
-			      values, options));
+	return dump_counters(type, arg, category, desc, ncounters, indices,
+			     values, options);
 }
 #endif /* defined(EXTENDED_STATS) */

@@ -863,7 +878,7 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 		if (category != NULL) {
 			cat = json_object_new_object();
 			if (cat == NULL) {
-				return (ISC_R_NOMEMORY);
+				return ISC_R_NOMEMORY;
 			}
 			json_object_object_add(job, category, cat);
 		}
@@ -928,19 +943,19 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 #ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL) {
-				return (ISC_R_NOMEMORY);
+				return ISC_R_NOMEMORY;
 			}
 			json_object_object_add(cat, desc[idx], counter);
 #endif /* ifdef HAVE_JSON_C */
 			break;
 		}
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 #ifdef HAVE_LIBXML2
 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "failed at dump_counters()");
-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }

@@ -1009,7 +1024,7 @@ cleanup:

 static bool
 rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr) {
-	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
+	return (DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0;
 }

 static void
@@ -1289,7 +1304,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dumparg.type = isc_statsformat_xml;
@@ -1446,11 +1461,11 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 }

 static isc_result_t
@@ -1476,7 +1491,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
@@ -1488,7 +1503,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		 * (if any), but we still want to continue generating the
 		 * remaining parts of the output.
 		 */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (!is_running && !is_deferred && !is_presoa && !is_pending &&
@@ -1498,12 +1513,12 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_xfrin_detach(&xfr);
 		}
 		/* No ongoing/queued transfer. */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (is_running && xfr == NULL) {
 		/* The transfer is finished, and it's shutting down. */
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
@@ -1713,7 +1728,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		dns_xfrin_detach(&xfr);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (xfr != NULL) {
@@ -1723,7 +1738,7 @@ cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");

-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 }

 static isc_result_t
@@ -2125,7 +2140,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
@@ -2136,7 +2151,7 @@ cleanup:
 	if (doc != NULL) {
 		xmlFreeDoc(doc);
 	}
-	return (ISC_R_FAILURE);
+	return ISC_R_FAILURE;
 }

 static void
@@ -2170,7 +2185,7 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 			      ISC_LOG_ERROR, "failed at rendering XML()");
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2180,8 +2195,8 @@ render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2191,8 +2206,8 @@ render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2202,8 +2217,8 @@ render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2213,8 +2228,8 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2224,8 +2239,8 @@ render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2235,8 +2250,8 @@ render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2246,8 +2261,8 @@ render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 static isc_result_t
@@ -2257,8 +2272,8 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args));
+	return render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			  freecb, freecb_args);
 }

 #endif /* HAVE_LIBXML2 */
@@ -2298,7 +2313,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 	json_object *node = json_object_new_object();

 	if (node == NULL) {
-		return (NULL);
+		return NULL;
 	}

 	json_object_object_add(node, "name", json_object_new_string(name));
@@ -2312,7 +2327,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 		json_object_object_add(node, "type",
 				       json_object_new_string(ztype));
 	}
-	return (node);
+	return node;
 }

 static isc_result_t
@@ -2331,7 +2346,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2350,7 +2365,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (zoneobj == NULL) {
-		return (ISC_R_NOMEMORY);
+		return ISC_R_NOMEMORY;
 	}

 	/*
@@ -2518,7 +2533,7 @@ cleanup:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2547,7 +2562,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2772,7 +2787,7 @@ cleanup:
 	if (xfrinobj != NULL) {
 		json_object_put(xfrinobj);
 	}
-	return (result);
+	return result;
 }

 static isc_result_t
@@ -2810,7 +2825,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	bindstats = json_object_new_object();
 	if (bindstats == NULL) {
-		return (ISC_R_NOMEMORY);
+		return ISC_R_NOMEMORY;
 	}

 	/*
@@ -3343,7 +3358,7 @@ cleanup:
 		json_object_put(bindstats);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -3372,7 +3387,7 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 			      ISC_LOG_ERROR, "failed at rendering JSON()");
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -3382,8 +3397,8 @@ render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3393,8 +3408,8 @@ render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3404,8 +3419,8 @@ render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3415,8 +3430,8 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3426,8 +3441,8 @@ render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3437,8 +3452,8 @@ render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3448,8 +3463,8 @@ render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			    freecb, freecb_args));
+	return render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args);
 }

 static isc_result_t
@@ -3459,8 +3474,8 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			    b, freecb, freecb_args));
+	return render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			   b, freecb, freecb_args);
 }

 #endif /* HAVE_JSON_C */
@@ -3523,7 +3538,7 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }
 #endif

@@ -3558,7 +3573,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	    match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return (true);
+		return true;
 	}
 	UNLOCK(&listener->lock);

@@ -3567,7 +3582,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 		      ISC_LOG_WARNING, "rejected statistics connection from %s",
 		      socktext);

-	return (false);
+	return false;
 }
 #endif

@@ -3601,7 +3616,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	UNUSED(aclconfctx);
 	UNUSED(socktext);

-	return (ISC_R_NOTIMPLEMENTED);
+	return ISC_R_NOTIMPLEMENTED;
 #else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
@@ -3704,7 +3719,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 		      ISC_LOG_NOTICE, "statistics channel listening on %s",
 		      socktext);

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 cleanup:
 	if (listener->acl != NULL) {
@@ -3713,7 +3728,7 @@ cleanup:
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

-	return (result);
+	return result;
 #endif
 }

@@ -3906,7 +3921,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	}

 	ISC_LIST_APPENDLIST(server->statschannels, new_listeners, link);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 void
@@ -4144,5 +4159,5 @@ named_stats_dump(named_server_t *server, FILE *fp) {

 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

-	return (ISC_R_SUCCESS); /* this function currently always succeeds */
+	return ISC_R_SUCCESS; /* this function currently always succeeds */
 }
@@ -55,7 +55,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,

 	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}

 	obj = NULL;
@@ -91,9 +91,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	}

 	*tctxp = tctx;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	dns_tkeyctx_destroy(&tctx);
-	return (result);
+	return result;
 }
@@ -131,12 +131,12 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
 	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -184,12 +184,12 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
 	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

-	return (result);
+	return result;
 }

 #define CHECK(f)                             \
@@ -216,7 +216,7 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 		obj = NULL;
 	}

-	return (result);
+	return result;
 }

 static void
@@ -258,8 +258,8 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*listp = list;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 failure:
 	dns_transport_list_detach(&list);
-	return (result);
+	return result;
 }
@@ -123,7 +123,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		dns_tsigkey_detach(&tsigkey);
 	}

-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	if (secret != NULL) {
@@ -131,7 +131,7 @@ failure:
 	}
 	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
 		    isc_result_totext(ret));
-	return (ret);
+	return ret;
 }

 isc_result_t
@@ -172,9 +172,9 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*ringp = ring;
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;

 failure:
 	dns_tsigkeyring_detach(&ring);
-	return (result);
+	return result;
 }
@@ -61,13 +61,6 @@ typedef enum {
 	allow_update_forwarding
 } acl_type_t;

-#define RETERR(x)                        \
-	do {                             \
-		isc_result_t _r = (x);   \
-		if (_r != ISC_R_SUCCESS) \
-			return ((_r));   \
-	} while (0)
-
 #define CHECK(x)                             \
 	do {                                 \
 		result = (x);                \
@@ -148,7 +141,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/* Check for default ACLs that haven't been parsed yet */
@@ -171,14 +164,14 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	(void)named_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
 				    &acl);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	(*setzacl)(zone, acl);

@@ -188,7 +181,7 @@ parse_acl:
 	}

 	dns_acl_detach(&acl);
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -203,12 +196,17 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
 	isc_result_t result = ISC_R_SUCCESS;
+	char debug[1024];
+	isc_buffer_t dbuf;
+
+	isc_buffer_init(&dbuf, debug, sizeof(debug));
+	isc_buffer_setmctx(&dbuf, mctx);

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

 	if (updatepolicy == NULL) {
 		dns_zone_setssutable(zone, NULL);
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isstring(updatepolicy) &&
@@ -237,7 +235,9 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_t b;
 		dns_ssuruletype_t *types;
 		unsigned int i, n;
+		char namebuf[DNS_NAME_FORMATSIZE];

+		isc_buffer_clear(&dbuf);
 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
@@ -246,14 +246,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else {
 			UNREACHABLE();
 		}
-
-		str = cfg_obj_asstring(matchtype);
-		CHECK(dns_ssu_mtypefromstring(str, &mtype));
-		if (mtype == dns_ssumatchtype_subdomain &&
-		    strcasecmp(str, "zonesub") == 0)
-		{
-			usezone = true;
-		}
+		isc_buffer_putstr(&dbuf, str);

 		dns_fixedname_init(&fident);
 		str = cfg_obj_asstring(identity);
@@ -266,6 +259,20 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "'%s' is not a valid name", str);
 			goto cleanup;
 		}
+		dns_name_format(dns_fixedname_name(&fident), namebuf,
+				sizeof(namebuf));
+		isc_buffer_putstr(&dbuf, " ");
+		isc_buffer_putstr(&dbuf, namebuf);
+
+		str = cfg_obj_asstring(matchtype);
+		CHECK(dns_ssu_mtypefromstring(str, &mtype));
+		if (mtype == dns_ssumatchtype_subdomain &&
+		    strcasecmp(str, "zonesub") == 0)
+		{
+			usezone = true;
+		}
+		isc_buffer_putstr(&dbuf, " ");
+		isc_buffer_putstr(&dbuf, str);

 		dns_fixedname_init(&fname);
 		if (usezone) {
@@ -282,6 +289,10 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
+			dns_name_format(dns_fixedname_name(&fname), namebuf,
+					sizeof(namebuf));
+			isc_buffer_putstr(&dbuf, " ");
+			isc_buffer_putstr(&dbuf, namebuf);
 		}

 		n = named_config_listcount(typelist);
@@ -305,6 +316,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
 			r.base = UNCONST(str);
+			isc_buffer_putstr(&dbuf, " ");
+			isc_buffer_putstr(&dbuf, str);

 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -337,9 +350,10 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

+		isc_buffer_putuint8(&dbuf, '\0');
 		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
 				     mtype, dns_fixedname_name(&fname), n,
-				     types);
+				     types, isc_buffer_base(&dbuf));
 		if (types != NULL) {
 			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
@@ -363,17 +377,18 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		dns_ssutable_addrule(table, true,
-				     named_g_server->session_keyname,
-				     dns_ssumatchtype_local,
-				     dns_zone_getorigin(zone), 1, &any);
+		dns_ssutable_addrule(
+			table, true, named_g_server->session_keyname,
+			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
+			&any, "local");
 	}

 	dns_zone_setssutable(zone, table);

 cleanup:
+	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
-	return (result);
+	return result;
 }

 /*
@@ -415,7 +430,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
@@ -423,7 +438,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		switch (na.family) {
@@ -454,7 +469,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
 	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
 	{
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	/* Add to the list an apex NS with the ns name being the origin name */
@@ -468,7 +483,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			     &region);
 	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

-	return (result);
+	return result;
 }

 /*%
@@ -509,14 +524,14 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
-			return (result);
+			return result;
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
-			return (ISC_R_FAILURE);
+			return ISC_R_FAILURE;
 		}

 		dns_name_toregion(nsname, &sregion);
@@ -530,7 +545,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	}

-	return (result);
+	return result;
 }

 /*%
@@ -555,9 +570,12 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_region_t region;

 	/* Create the DB beforehand */
-	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
-			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
-			     &db));
+	result = dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
+			       dns_dbtype_stub, dns_zone_getclass(zone), 0,
+			       NULL, &db);
+	if (result != ISC_R_SUCCESS) {
+		return result;
+	}

 	dns_rdataset_init(&rdataset);

@@ -670,7 +688,7 @@ cleanup:

 	INSIST(dbversion == NULL);

-	return (result);
+	return result;
 }

 /*%
@@ -683,7 +701,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {

 	result = cfg_map_get(map, "type", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	return (named_config_getzonetype(obj));
+	return named_config_getzonetype(obj);
 }

 /*%
@@ -714,11 +732,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,

 		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 		if (result != ISC_R_SUCCESS) {
-			return (result);
+			return result;
 		}
 		(*argvp)[n] = s;
 	}
-	return (ISC_R_SUCCESS);
+	return ISC_R_SUCCESS;
 }

 /*%
@@ -730,7 +748,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 */
 static isc_result_t
 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
-	return (strtoargvsub(mctx, s, argcp, argvp, 0));
+	return strtoargvsub(mctx, s, argcp, argvp, 0);
 }

 static const char *const primary_synonyms[] = { "primary", "master", NULL };
@@ -777,12 +795,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,

 	/* interfacemgr can be destroyed only in exclusive mode. */
 	if (named_g_server->interfacemgr == NULL) {
-		return (true);
+		return true;
 	}

 	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
 	{
-		return (false);
+		return false;
 	}

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
@@ -825,7 +843,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			break;
 		}
 	}
-	return (view == myview);
+	return view == myview;
 }

 /*%
@@ -843,7 +861,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * zone is configured with something else than "notify yes;".
 	 */
 	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return (ntype);
+		return ntype;
 	}

 	/*
@@ -857,7 +875,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 			    zname);
 	}

-	return (dns_notifytype_explicit);
+	return dns_notifytype_explicit;
 }

 isc_result_t
@@ -879,7 +897,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *dupcheck;
 	dns_checkdstype_t checkdstype = dns_checkdstype_yes;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = ZONEDB_DEFAULT;
@@ -889,7 +906,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
-	bool multi;
 	dns_kasp_t *kasp = NULL;
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
@@ -1186,6 +1202,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
+		bool logreports = false;
+
 		/* Make a reference to the default policy. */
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
@@ -1459,6 +1477,51 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
+
+		obj = NULL;
+		result = cfg_map_get(zoptions, "log-report-channel", &obj);
+		if (result == ISC_R_SUCCESS) {
+			logreports = cfg_obj_asboolean(obj);
+			dns_zone_setoption(zone, DNS_ZONEOPT_LOGREPORTS,
+					   logreports);
+		}
+		obj = NULL;
+		result = named_config_get(maps, "send-report-channel", &obj);
+		if (result == ISC_R_SUCCESS && obj != NULL) {
+			dns_fixedname_t fixed;
+			dns_name_t *rad = dns_fixedname_initname(&fixed);
+			const char *adstr = cfg_obj_asstring(obj);
+			dns_name_t *zn = dns_zone_getorigin(zone);
+
+			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
+						  mctx));
+			if (logreports || dns_name_equal(rad, dns_rootname)) {
+				/* Disable RC for error-logging zones or root */
+				dns_zone_setrad(zone, NULL);
+			} else if (dns_name_equal(rad, zn)) {
+				/*
+				 * It's illegal to set a matching agent
+				 * domain at the zone level, but it could
+				 * be set in options/view. If so, and the
+				 * matching zone doesn't log reports, warn.
+				 */
+				cfg_obj_log(obj, ISC_LOG_WARNING,
+					    "send-report-channel is set to "
+					    "'%s' but that zone does not have "
+					    "log-report-channel set",
+					    zname);
+				dns_zone_setrad(zone, NULL);
+			} else if (dns_name_issubdomain(rad, zn)) {
+				cfg_obj_log(obj, ISC_LOG_WARNING,
+					    "send-report-channel '%s' ignored "
+					    "for zone '%s' because it is a "
+					    "subdomain of the zone",
+					    adstr, zname);
+				dns_zone_setrad(zone, NULL);
+			} else {
+				dns_zone_setrad(zone, rad);
+			}
+		}
 	} else if (ztype == dns_zone_redirect) {
 		dns_zone_setnotifytype(zone, dns_notifytype_no);

@@ -1773,7 +1836,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	case dns_zone_secondary:
 	case dns_zone_stub:
 	case dns_zone_redirect:
-		count = 0;
 		obj = NULL;
 		(void)cfg_map_get(zoptions, "primaries", &obj);
 		if (obj == NULL) {
@@ -1801,22 +1863,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
-			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 		} else {
 			dns_zone_setprimaries(mayberaw, NULL, NULL, NULL, NULL,
 					      0);
 		}

-		multi = false;
-		if (count > 1) {
-			obj = NULL;
-			result = named_config_get(maps, "multi-master", &obj);
-			INSIST(result == ISC_R_SUCCESS && obj != NULL);
-			multi = cfg_obj_asboolean(obj);
-		}
-		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1884,7 +1936,7 @@ cleanup:
 	if (kasp != NULL) {
 		dns_kasp_detach(&kasp);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -1899,11 +1951,11 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
-		return (result);
+		return result;
 	}
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
-	return (result);
+	return result;
 }

 bool
@@ -1927,7 +1979,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return (false);
+		return false;
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -1948,17 +2000,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return (false);
+		return false;
 	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return (false);
+		return false;
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return (false);
+		return false;
 	}

 	obj = NULL;
@@ -1974,10 +2026,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return (false);
+		return false;
 	}

-	return (true);
+	return true;
 }

 bool
@@ -2011,13 +2063,13 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	if (res != ISC_R_SUCCESS ||
 	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		return (false);
+		return false;
 	}

 	/* Lookup the policy. */
 	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
 	if (res != ISC_R_SUCCESS) {
-		return (false);
+		return false;
 	}

 	inline_signing = dns_kasp_inlinesigning(kasp);
@@ -2030,8 +2082,8 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	 */
 	res = cfg_map_get(maps[0], "inline-signing", &signing);
 	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
-		return (cfg_obj_asboolean(signing));
+		return cfg_obj_asboolean(signing);
 	}

-	return (inline_signing);
+	return inline_signing;
 }
@@ -253,7 +253,7 @@ getzoneclass(void) {
 	if (zoneclass == dns_rdataclass_none) {
 		zoneclass = defaultclass;
 	}
-	return (zoneclass);
+	return zoneclass;
 }

 static bool
@@ -263,9 +263,9 @@ setzoneclass(dns_rdataclass_t rdclass) {
 		zoneclass = rdclass;
 	}
 	if (zoneclass != rdclass) {
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static void
@@ -329,7 +329,7 @@ nsu_strsep(char **stringp, const char *delim) {
 	char sc, dc;

 	if (string == NULL) {
-		return (NULL);
+		return NULL;
 	}

 	for (; *string != '\0'; string++) {
@@ -350,11 +350,11 @@ nsu_strsep(char **stringp, const char *delim) {
 			if (sc == dc) {
 				*s++ = '\0';
 				*stringp = s;
-				return (string);
+				return string;
 			}
 		}
 	}
-	return (string);
+	return string;
 }

 static void
@@ -390,7 +390,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,

 	if (len >= sizeof(buf)) {
 		error("unknown key type '%.*s'", (int)(len), hmacstr);
-		return (false);
+		return false;
 	}

 	/* Copy len bytes and NUL terminate. */
@@ -403,7 +403,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
 			error("digest-bits out of range [0..128]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
@@ -413,7 +413,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[10], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 160) {
 			error("digest-bits out of range [0..160]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
@@ -423,7 +423,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 224) {
 			error("digest-bits out of range [0..224]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
@@ -433,7 +433,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 256) {
 			error("digest-bits out of range [0..256]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
@@ -443,7 +443,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 384) {
 			error("digest-bits out of range [0..384]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
@@ -453,14 +453,14 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 512) {
 			error("digest-bits out of range [0..512]");
-			return (false);
+			return false;
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else {
 		error("unknown key type '%s'", buf);
-		return (false);
+		return false;
 	}
-	return (true);
+	return true;
 }

 static int
@@ -474,7 +474,7 @@ basenamelen(const char *file) {
 	} else if (len > 4 && strcmp(file + len - 4, ".key") == 0) {
 		len -= 4;
 	}
-	return (len);
+	return len;
 }

 static void
@@ -570,7 +570,7 @@ read_sessionkey(isc_mem_t *mctx) {
 	int len;

 	if (!isc_file_exists(keyfile)) {
-		return (ISC_R_FILENOTFOUND);
+		return ISC_R_FILENOTFOUND;
 	}

 	result = cfg_parser_create(mctx, &pctx);
@@ -616,7 +616,7 @@ cleanup:
 		isc_mem_free(mctx, keystr);
 	}

-	return (result);
+	return result;
 }

 static void
@@ -794,8 +794,8 @@ create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
 	isc_buffer_add(&namesrc, strlen(str));
 	isc_buffer_init(&namebuf, namedata, len);

-	return (dns_name_fromtext(name, &namesrc, dns_rootname,
-				  DNS_NAME_DOWNCASE, &namebuf));
+	return dns_name_fromtext(name, &namesrc, dns_rootname,
+				 DNS_NAME_DOWNCASE, &namebuf);
 }

 static void
@@ -993,7 +993,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 		error("couldn't get address for '%s': %s", host,
 		      isc_result_totext(result));
 	}
-	return (count);
+	return count;
 }

 #define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
@@ -1303,7 +1303,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	word = nsu_strsep(cmdlinep, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read owner name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	dns_message_gettempname(msg, namep);
@@ -1314,10 +1314,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
 		dns_message_puttempname(msg, namep);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	isc_buffer_invalidate(&source);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1332,7 +1332,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,

 	if (cmdline == NULL) {
 		rdata->flags = DNS_RDATA_UPDATE;
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	while (*cmdline != 0 && isspace((unsigned char)*cmdline)) {
@@ -1363,13 +1363,13 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 			fprintf(stderr, "invalid rdata format: %s\n",
 				isc_result_totext(result));
 			isc_buffer_free(&buf);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	} else {
 		rdata->flags = DNS_RDATA_UPDATE;
 	}
 	*cmdlinep = cmdline;
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1392,7 +1392,7 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return (retval);
+		return retval;
 	}

 	/*
@@ -1472,13 +1472,13 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_PREREQUISITE);
-	return (STATUS_MORE);
+	return STATUS_MORE;

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -1490,7 +1490,7 @@ evaluate_prereq(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
 		ispositive = false;
@@ -1506,9 +1506,9 @@ evaluate_prereq(char *cmdline) {
 		isrrset = true;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (make_prereq(cmdline, ispositive, isrrset));
+	return make_prereq(cmdline, ispositive, isrrset);
 }

 static void
@@ -1554,7 +1554,7 @@ evaluate_lease(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (!strcasecmp(word, "none")) {
@@ -1563,12 +1563,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&value1, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
@@ -1578,12 +1578,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&value2, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	lease = value1;
@@ -1592,7 +1592,7 @@ evaluate_lease(char *cmdline) {
 	keylease_set = true;
 	updateopt();

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1602,13 +1602,13 @@ evaluate_server(char *cmdline) {

 	if (local_only) {
 		fprintf(stderr, "cannot reset server in localhost-only mode\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	server = word;

@@ -1620,13 +1620,13 @@ evaluate_server(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	}

@@ -1644,10 +1644,10 @@ evaluate_server(char *cmdline) {
 	servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1660,7 +1660,7 @@ evaluate_local(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	local = word;

@@ -1672,13 +1672,13 @@ evaluate_local(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 	}

@@ -1694,10 +1694,10 @@ evaluate_local(char *cmdline) {
 		isc_sockaddr_fromin(localaddr4, &in4, (in_port_t)port);
 	} else {
 		fprintf(stderr, "invalid address %s", local);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1718,7 +1718,7 @@ evaluate_key(char *cmdline) {
 	namestr = nsu_strsep(&cmdline, " \t\r\n");
 	if (namestr == NULL || *namestr == 0) {
 		fprintf(stderr, "could not read key name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	mykeyname = dns_fixedname_initname(&fkeyname);
@@ -1726,7 +1726,7 @@ evaluate_key(char *cmdline) {
 	n = strchr(namestr, ':');
 	if (n != NULL) {
 		if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
-			return (STATUS_SYNTAX);
+			return STATUS_SYNTAX;
 		}
 		namestr = n + 1;
 	} else {
@@ -1738,13 +1738,13 @@ evaluate_key(char *cmdline) {
 	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	secretstr = nsu_strsep(&cmdline, "\r\n");
 	if (secretstr == NULL || *secretstr == 0) {
 		fprintf(stderr, "could not read key secret\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	secretlen = strlen(secretstr) * 3 / 4;
 	secret = isc_mem_allocate(gmctx, secretlen);
@@ -1755,7 +1755,7 @@ evaluate_key(char *cmdline) {
 		fprintf(stderr, "could not create key from %s: %s\n", secretstr,
 			isc_result_totext(result));
 		isc_mem_free(gmctx, secret);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	secretlen = isc_buffer_usedlength(&secretbuf);

@@ -1768,10 +1768,10 @@ evaluate_key(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s %s: %s\n",
 			namestr, secretstr, isc_result_totext(result));
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	dst_key_setbits(tsigkey->key, digestbits);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1783,7 +1783,7 @@ evaluate_zone(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read zone name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	userzone = dns_fixedname_initname(&fuserzone);
@@ -1793,10 +1793,10 @@ evaluate_zone(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1813,19 +1813,19 @@ evaluate_realm(char *cmdline) {

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	n = snprintf(buf, sizeof(buf), "@%s", word);
 	if (n < 0 || (size_t)n >= sizeof(buf)) {
 		error("realm is too long");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	realm = isc_mem_strdup(gmctx, buf);
-	return (STATUS_MORE);
+	return STATUS_MORE;
 #else  /* HAVE_GSSAPI */
 	UNUSED(cmdline);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 #endif /* HAVE_GSSAPI */
 }

@@ -1838,29 +1838,29 @@ evaluate_ttl(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (!strcasecmp(word, "none")) {
 		default_ttl = 0;
 		default_ttl_set = false;
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}

 	result = isc_parse_uint32(&ttl, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	if (ttl > TTL_MAX) {
 		fprintf(stderr, "ttl '%s' is out of range (0 to %u)\n", word,
 			TTL_MAX);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	default_ttl = ttl;
 	default_ttl_set = true;

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1873,7 +1873,7 @@ evaluate_class(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read class name\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}

 	r.base = word;
@@ -1881,19 +1881,19 @@ evaluate_class(char *cmdline) {
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse class name: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	switch (rdclass) {
 	case dns_rdataclass_none:
 	case dns_rdataclass_any:
 	case dns_rdataclass_reserved0:
 		fprintf(stderr, "bad default class: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	default:
 		defaultclass = rdclass;
 	}

-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -1917,7 +1917,7 @@ update_addordelete(char *cmdline, bool isdelete) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return (retval);
+		return retval;
 	}

 	dns_message_gettemprdata(updatemsg, &rdata);
@@ -2103,14 +2103,14 @@ doneparsing:
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_UPDATE);
-	return (STATUS_MORE);
+	return STATUS_MORE;

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
 	dns_message_puttemprdata(updatemsg, &rdata);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -2122,7 +2122,7 @@ evaluate_update(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "delete") == 0) {
 		isdelete = true;
@@ -2132,9 +2132,9 @@ evaluate_update(char *cmdline) {
 		isdelete = false;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (update_addordelete(cmdline, isdelete));
+	return update_addordelete(cmdline, isdelete);
 }

 static uint16_t
@@ -2145,7 +2145,7 @@ evaluate_checknames(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-names directive\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2158,9 +2158,9 @@ evaluate_checknames(char *cmdline) {
 		checknames = false;
 	} else {
 		fprintf(stderr, "incorrect check-names directive: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static uint16_t
@@ -2171,7 +2171,7 @@ evaluate_checksvcb(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-svcb directive\n");
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2184,9 +2184,9 @@ evaluate_checksvcb(char *cmdline) {
 		checksvcb = false;
 	} else {
 		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
-		return (STATUS_SYNTAX);
+		return STATUS_SYNTAX;
 	}
-	return (STATUS_MORE);
+	return STATUS_MORE;
 }

 static void
@@ -2264,58 +2264,58 @@ do_next_command(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");

 	if (word == NULL || *word == 0) {
-		return (STATUS_SEND);
+		return STATUS_SEND;
 	}
 	if (word[0] == ';') {
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "quit") == 0) {
-		return (STATUS_QUIT);
+		return STATUS_QUIT;
 	}
 	if (strcasecmp(word, "prereq") == 0) {
-		return (evaluate_prereq(cmdline));
+		return evaluate_prereq(cmdline);
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
-		return (make_prereq(cmdline, false, false));
+		return make_prereq(cmdline, false, false);
 	}
 	if (strcasecmp(word, "yxdomain") == 0) {
-		return (make_prereq(cmdline, true, false));
+		return make_prereq(cmdline, true, false);
 	}
 	if (strcasecmp(word, "nxrrset") == 0) {
-		return (make_prereq(cmdline, false, true));
+		return make_prereq(cmdline, false, true);
 	}
 	if (strcasecmp(word, "yxrrset") == 0) {
-		return (make_prereq(cmdline, true, true));
+		return make_prereq(cmdline, true, true);
 	}
 	if (strcasecmp(word, "update") == 0) {
-		return (evaluate_update(cmdline));
+		return evaluate_update(cmdline);
 	}
 	if (strcasecmp(word, "delete") == 0) {
-		return (update_addordelete(cmdline, true));
+		return update_addordelete(cmdline, true);
 	}
 	if (strcasecmp(word, "del") == 0) {
-		return (update_addordelete(cmdline, true));
+		return update_addordelete(cmdline, true);
 	}
 	if (strcasecmp(word, "add") == 0) {
-		return (update_addordelete(cmdline, false));
+		return update_addordelete(cmdline, false);
 	}
 	if (strcasecmp(word, "lease") == 0) {
-		return (evaluate_lease(cmdline));
+		return evaluate_lease(cmdline);
 	}
 	if (strcasecmp(word, "server") == 0) {
-		return (evaluate_server(cmdline));
+		return evaluate_server(cmdline);
 	}
 	if (strcasecmp(word, "local") == 0) {
-		return (evaluate_local(cmdline));
+		return evaluate_local(cmdline);
 	}
 	if (strcasecmp(word, "zone") == 0) {
-		return (evaluate_zone(cmdline));
+		return evaluate_zone(cmdline);
 	}
 	if (strcasecmp(word, "class") == 0) {
-		return (evaluate_class(cmdline));
+		return evaluate_class(cmdline);
 	}
 	if (strcasecmp(word, "send") == 0) {
-		return (STATUS_SEND);
+		return STATUS_SEND;
 	}
 	if (strcasecmp(word, "debug") == 0) {
 		if (debugging) {
@@ -2323,14 +2323,14 @@ do_next_command(char *cmdline) {
 		} else {
 			debugging = true;
 		}
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "ttl") == 0) {
-		return (evaluate_ttl(cmdline));
+		return evaluate_ttl(cmdline);
 	}
 	if (strcasecmp(word, "show") == 0) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "answer") == 0) {
 		LOCK(&answer_lock);
@@ -2338,24 +2338,24 @@ do_next_command(char *cmdline) {
 			show_message(stdout, answer, "Answer:");
 		}
 		UNLOCK(&answer_lock);
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "key") == 0) {
 		usegsstsig = false;
-		return (evaluate_key(cmdline));
+		return evaluate_key(cmdline);
 	}
 	if (strcasecmp(word, "realm") == 0) {
-		return (evaluate_realm(cmdline));
+		return evaluate_realm(cmdline);
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
 	    strcasecmp(word, "checknames") == 0)
 	{
-		return (evaluate_checknames(cmdline));
+		return evaluate_checknames(cmdline);
 	}
 	if (strcasecmp(word, "check-svcb") == 0 ||
 	    strcasecmp(word, "checksvcb") == 0)
 	{
-		return (evaluate_checksvcb(cmdline));
+		return evaluate_checksvcb(cmdline);
 	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2363,7 +2363,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "oldgsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2371,7 +2371,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "help") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION ":\n"
@@ -2411,14 +2411,14 @@ do_next_command(char *cmdline) {
 				"record to the zone)\n"
 				"[update] del[ete] ....    (remove the given "
 				"record(s) from the zone)\n");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	if (strcasecmp(word, "version") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION "\n");
-		return (STATUS_MORE);
+		return STATUS_MORE;
 	}
 	fprintf(stderr, "incorrect section name: %s\n", word);
-	return (STATUS_SYNTAX);
+	return STATUS_SYNTAX;
 }

 static uint16_t
@@ -2450,7 +2450,7 @@ get_next_command(void) {
 		free(ptr);
 	}

-	return (result);
+	return result;
 }

 static bool
@@ -2465,9 +2465,9 @@ user_interaction(void) {
 		}
 	}
 	if (result == STATUS_SEND) {
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static void
@@ -2512,10 +2512,10 @@ next_primary(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 	fprintf(stderr, "; Communication with %s failed: %s\n", addrbuf,
 		isc_result_totext(eresult));
 	if (++primary_inuse >= primary_total) {
-		return (false);
+		return false;
 	}
 	ddebug("%s: trying next server", caller);
-	return (true);
+	return true;
 }

 static void
@@ -3556,8 +3556,8 @@ main(int argc, char **argv) {
 	cleanup();

 	if (seenerror) {
-		return (2);
+		return 2;
 	}

-	return (0);
+	return 0;
 }
@@ -177,7 +177,7 @@ static const char *filter_a_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
 }

 static void
@@ -210,7 +210,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -225,7 +225,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -237,7 +237,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
-		return (result);
+		return result;
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
@@ -265,7 +265,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -306,7 +306,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /**
@@ -358,7 +358,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return (result);
+	return result;
 }

 isc_result_t
@@ -385,7 +385,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -415,7 +415,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return (NS_PLUGIN_VERSION);
+	return NS_PLUGIN_VERSION;
 }

 /**
@@ -440,14 +440,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return (true);
+		return true;
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 /*
@@ -458,9 +458,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static filter_data_t *
@@ -473,7 +473,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return (result == ISC_R_SUCCESS ? client_state : NULL);
+	return result == ISC_R_SUCCESS ? client_state : NULL;
 }

 static void
@@ -569,7 +569,7 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return (modified);
+	return modified;
 }

 /*%
@@ -640,7 +640,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -658,7 +658,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
@@ -675,7 +675,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -695,7 +695,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -703,7 +703,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (qctx->qtype == dns_rdatatype_a) {
@@ -776,11 +776,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return (NS_HOOK_RETURN);
+		return NS_HOOK_RETURN;
 	}

 	*resp = result;
-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -813,7 +813,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -850,7 +850,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -865,10 +865,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	client_state_destroy(qctx, inst);

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }
@@ -177,7 +177,7 @@ static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
+	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
 }

 static void
@@ -211,7 +211,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_SUCCESS);
+		return ISC_R_SUCCESS;
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -226,7 +226,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -238,7 +238,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-aaaa", &aclobj);
 	if (aclobj == NULL) {
-		return (result);
+		return result;
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
@@ -266,7 +266,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return (result);
+	return result;
 }

 static isc_result_t
@@ -309,7 +309,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /**
@@ -362,7 +362,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return (result);
+	return result;
 }

 isc_result_t
@@ -389,7 +389,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return (result);
+	return result;
 }

 /*
@@ -419,7 +419,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return (NS_PLUGIN_VERSION);
+	return NS_PLUGIN_VERSION;
 }

 /**
@@ -444,14 +444,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return (true);
+		return true;
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 /*
@@ -462,9 +462,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return (true);
+		return true;
 	}
-	return (false);
+	return false;
 }

 static filter_data_t *
@@ -477,7 +477,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return (result == ISC_R_SUCCESS ? client_state : NULL);
+	return result == ISC_R_SUCCESS ? client_state : NULL;
 }

 static void
@@ -573,7 +573,7 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return (modified);
+	return modified;
 }

 /*%
@@ -644,7 +644,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -662,7 +662,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
@@ -679,7 +679,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -699,7 +699,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -707,7 +707,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	if (qctx->qtype == dns_rdatatype_aaaa) {
@@ -779,11 +779,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return (NS_HOOK_RETURN);
+		return NS_HOOK_RETURN;
 	}

 	*resp = result;
-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -816,7 +816,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -853,7 +853,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }

 /*
@@ -868,10 +868,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return (NS_HOOK_CONTINUE);
+		return NS_HOOK_CONTINUE;
 	}

 	client_state_destroy(qctx, inst);

-	return (NS_HOOK_CONTINUE);
+	return NS_HOOK_CONTINUE;
 }
@@ -1013,8 +1013,8 @@ main(int argc, char **argv) {
 	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);

 	if (failed) {
-		return (1);
+		return 1;
 	}

-	return (0);
+	return 0;
 }
@@ -429,8 +429,10 @@ Currently supported commands are:

   The first list includes all unique clients that are waiting for
   recursion to complete, including the query that is awaiting a
-   response and the timestamp (seconds since the Unix epoch) of
-   when named started processing this client query.
+   response, the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query, the client's
+   address, and the transport over which the the query was received
+   (UDP, TCP, TLS, or HTTP).

   The second list comprises of domains for which there are active
   (or recently active) fetches in progress.  It reports the number
@@ -489,9 +491,8 @@ Currently supported commands are:
 .. option:: secroots [-] [view ...]

   This command dumps the security roots (i.e., trust anchors configured via
-   ``trust-anchors``, or the ``managed-keys`` or ``trusted-keys`` statements
-   [both deprecated], or ``dnssec-validation auto``) and negative trust anchors
-   for the specified views. If no view is specified, all views are
+   ``trust-anchors`` statement, or ``dnssec-validation auto``) and negative
+   trust anchors for the specified views. If no view is specified, all views are
   dumped. Security roots indicate whether they are configured as trusted
   keys, managed keys, or initializing managed keys (managed keys that have not
   yet been updated by a successful key refresh query).
@@ -16,6 +16,7 @@ named.run
 /*.trs
 /*.xml
 /resolve
+/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
@@ -71,6 +71,7 @@ TESTS =				\
 	autosign		\
 	builtin			\
 	cacheclean		\
+	camp			\
 	case			\
 	catz			\
 	cds			\
@@ -134,6 +135,7 @@ TESTS =				\
 	proxy			\
 	pipelined		\
 	qmin			\
+	query-source		\
 	reclimit		\
 	redirect		\
 	resolver		\
@@ -51,6 +51,7 @@ To run system tests, make sure you have the following dependencies installed:
 - perl
 - dnspython
 - pytest-xdist (for parallel execution)
+- python-jinja2 (for tests which use jinja templates)

 Individual system tests might also require additional dependencies. If those
 are missing, the affected tests will be skipped and should produce a message
@@ -154,9 +155,17 @@ system test directories may contain the following standard files:
 - `tests_*.py`: These python files are picked up by pytest as modules. If they
  contain any test functions, they're added to the test suite.

- `setup.sh`: This sets up the preconditions for the tests. Although optional,
-  virtually all tests will require such a file to set up the ports they should
-  use for the test.
+- `*.j2`: These jinja2 templates can be used for configuration files or any
+  other files which require certain variables filled in, e.g. ports from the
+  environment variables. During test setup, the pytest runner will automatically
+  fill those in and strip the filename extension .j2, e.g. `ns1/named.conf.j2`
+  becomes `ns1/named.conf`. When using advanced templating to conditionally
+  include/omit entire sections or when filling in custom variables used for the
+  test, ensure the templates always include the defaults. If you don't need the
+  file to be auto-templated during test setup, use `.j2.manual` instead and then
+  no defaults are needed.
+
+- `setup.sh`: This sets up the preconditions for the tests.

 - `tests.sh`: Any shell-based tests are located within this file. Runs the
  actual tests.
@@ -19,3 +19,9 @@ key rndc_key {
 	algorithm       hmac-sha256;
 	secret          "1234abcd8765";
 };
+
+/* Regresssion test for [GL #4991] */
+server example.com {
+	key rndc-key;
+	addresses { localhost; 127.0.0.1; ::1; };
+};
@@ -1,25 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after zone transfer tests.
-#
-
-rm -f dig.out.*
-rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run
-rm -f ns*/_default.nzf
-rm -f ns*/_default.nzd*
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -13,7 +13,6 @@

 . ../conf.sh

-$SHELL clean.sh
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/example.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/tsigzone.db
 copy_setports ns2/named1.conf.in ns2/named.conf
@@ -9,6 +9,18 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out*",
+        "ns*/_default.nzd*",
+        "ns*/_default.nzf*",
+        "ns2/example.db",
+        "ns2/tsigzone.db",
+    ]
+)
+

 def test_acl(run_tests_sh):
    run_tests_sh()
@@ -1,22 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after tests.
-#
-
-rm -f dig.out.*
-rm -f */named.memstats
-rm -f */named.conf
-rm -f */named.run
-rm -f ns*/managed-keys.bind*
@@ -13,7 +13,6 @@

 . ../conf.sh

-$SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -9,6 +9,14 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+    ]
+)
+

 def test_additional(run_tests_sh):
    run_tests_sh()
@@ -1,43 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ./dig.out.*
-rm -f ./rndc.out*
-rm -f ./showzone.out*
-rm -f ./zonestatus.out*
-rm -f ./*/named.conf
-rm -f ./*/named.memstats
-rm -f ./ns1/*.nzf ./ns1/*.nzf~
-rm -f ./ns1/*.nzd ./ns1/*.nzd-lock
-rm -f ./ns2/*.nzf ./ns2/*.nzf~
-rm -f ./ns2/*.nzd ./ns2/*.nzd-lock
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ./ns3/*.nzd-lock
-rm -f ./ns2/core*
-rm -f ./ns2/inline.db.jbk
-rm -f ./ns2/inline.db.signed
-rm -f ./ns2/inlinesec.bk*
-rm -rf ./ns2/new-zones
-rm -f ./ns*/named.run ./ns*/named.run.prev
-rm -f ./ns2/nzf-*
-rm -f ./ns3/named.conf
-rm -f ./ns3/*.nzf ./ns3/*.nzf~
-rm -f ./ns3/*.nzd ns3/*.nzd-lock
-rm -f ./ns3/inlinesec.db
-rm -f ./ns1/redirect.db
-rm -f ./ns2/redirect.db
-rm -f ./ns2/redirect.bk
-rm -f ./ns3/redirect.db
-rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
-rm -f ./nzd2nzf.out.*
-rm -f ./wait_for_message.*
@@ -12,8 +12,21 @@
 import concurrent.futures
 import time

+import pytest
+
 import isctest

+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "ns*/*.nzf*",
+        "ns*/*.nzd*",
+        "ns1/redirect.db",
+        "ns2/new-zones",
+        "ns2/redirect.db",
+        "ns3/redirect.db",
+    ]
+)
+

 def rndc_loop(test_state, domain, ns3):
    """
@@ -9,6 +9,35 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+        "rndc.out*",
+        "showzone.out.*",
+        "zonestatus.out.*",
+        "ns*/*.nzd*",
+        "ns*/*.nzf*",
+        "ns1/redirect.db",
+        "nzd2nzf.out.*",
+        "ns2/*.nzf~",
+        "ns2/K*.key",
+        "ns2/K*.private",
+        "ns2/K*.state",
+        "ns2/external.nzd",
+        "ns2/extra.nzd",
+        "ns2/inline.db.jbk",
+        "ns2/inline.db.signed",
+        "ns2/inline.db.signed.jnl",
+        "ns2/inlinesec.bk.jbk",
+        "ns2/new-zones",
+        "ns2/redirect.bk",
+        "ns2/redirect.db",
+        "ns3/redirect.db",
+    ]
+)
+

 def test_addzone(run_tests_sh):
    run_tests_sh()
@@ -1,23 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after allow query tests.
-#
-
-rm -f dig.out.*
-rm -f ns*/named.conf
-rm -f ns2/controls.conf
-rm -f */named.memstats
-rm -f ns*/named.run ns*/named.run.prev
-rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -9,6 +9,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+        "ns2/controls.conf",
+    ]
+)
+

 def test_allow_query(run_tests_sh):
    run_tests_sh()
@@ -1,20 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f dig.out.test*
-rm -f ns2/example.com.bk
-rm -f ns2/example.net.bk
-rm -f ns*/managed-keys.bind* ns*/*mkeys*
@@ -0,0 +1,23 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300        ; 5 minutes
+@                       IN SOA  ns root (
+				2018010100 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS      ns
+ns                      A       10.53.0.1
+server			A	10.53.0.100
+*._er                   TXT     "Report received"
@@ -22,6 +22,7 @@ options {
 	recursion no;
 	notify yes;
 	dnssec-validation no;
+	send-report-channel "example.rad";
 };

 view main in {
@@ -35,6 +36,18 @@ view main in {
 	zone example.com {
 		type primary;
 		file "example.com.db";
+		send-report-channel "rad.example.net";
+	};
+
+	zone rad {
+		type primary;
+		file "rad.db";
+	};
+
+	zone example.rad {
+		type primary;
+		file "example.rad.db";
+		log-report-channel yes;
 	};
 };

@@ -0,0 +1,24 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300        ; 5 minutes
+@                       IN SOA  ns root (
+				2018010100 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS      ns
+ns                      A       10.53.0.1
+server			A	10.53.0.100
+
+example			NS	ns
@@ -186,5 +186,57 @@ lines=$(wc -l <dig.out.test$n)
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

+n=$((n + 1))
+echo_i "check that a Report-Channel EDNS option is added to responses ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 example.net >dig.out.test$n
+grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that Report-Channel option is omitted for names in error-logging zones ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 example.rad >dig.out.test$n
+grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that Report-Channel option is omitted for zones above the agent-domain ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 rad >dig.out.test$n
+grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that a zone-level Report-Channel EDNS option is added to responses ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 example.com >dig.out.test$n
+grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that error report queries are logged and no Report-Channel option is present in the response ($n)"
+ret=0
+nextpart ns1/named.run >/dev/null
+$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.rad TXT >dig.out.test$n
+nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.rad/IN'" >/dev/null || ret=1
+grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
+n=$((n + 1))
+echo_i "check that error report queries to non-logging zones are not logged ($n)"
+ret=0
+nextpart ns1/named.run >/dev/null
+$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.com TXT >dig.out.test$n
+nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.com/IN'" >/dev/null && ret=1
+grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=$((status + ret))
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -9,6 +9,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.test*",
+        "ns*/example.*.bk",
+    ]
+)
+

 def test_auth(run_tests_sh):
    run_tests_sh()
@@ -1,76 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ./dsset-*
-rm -f */K* */dsset-* */*.signed */tmp* */*.jnl */*.bk
-rm -f */core
-rm -f */example.bk
-rm -f */named.conf
-rm -f */named.memstats
-rm -f */named.run*
-rm -f */trusted.conf */private.conf
-rm -f dig.out.*
-rm -f digcomp.out.test*
-rm -f activate-now-publish-1day.key prepub.key
-rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
-rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
-rm -f noksk-ksk.key nozsk-ksk.key nozsk-zsk.key inaczsk-zsk.key inaczsk-ksk.key
-rm -f nopriv.key vanishing.key del1.key del2.key
-rm -rf ns*/inactive
-rm -f ns*/managed-keys.bind*
-rm -f ns1/root.db ns1/root.db.1 ns1/root.db.2 ns1/root.db.3
-rm -f ns1/signing.out
-rm -f ns2/bar.db
-rm -f ns2/child.nsec3.example.db
-rm -f ns2/child.optout.example.db
-rm -f ns2/example.db
-rm -f ns2/insecure.secure.example.db
-rm -f ns2/nsec3-with-ent.db
-rm -f ns2/private.secure.example.db
-rm -f ns2/signing.*
-rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
-rm -f ns3/*.nzf
-rm -f ns3/*.jbk
-rm -f ns3/autonsec3.example.db
-rm -f ns3/delay.example.db ns3/delay.example.1 ns3/delay.example.2
-rm -f ns3/delzsk.example.db
-rm -f ns3/dname-at-apex-nsec3.example.db
-rm -f ns3/inaczsk2.example.db
-rm -f ns3/jitter.nsec3.example.db
-rm -f ns3/kg.out ns3/s.out ns3/st.out
-rm -f ns3/kskonly.example.db
-rm -f ns3/named.ns3.prev
-rm -f ns3/noksk.example.db
-rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
-rm -f ns3/nsec-only.example.db
-rm -f ns3/nsec3-to-nsec.example.db
-rm -f ns3/nsec3.example.db
-rm -f ns3/nsec3.nsec3.example.db
-rm -f ns3/nsec3.optout.example.db
-rm -f ns3/oldsigs.example.db ns3/oldsigs.example.db.bak
-rm -f ns3/optout.example.db
-rm -f ns3/optout.nsec3.example.db
-rm -f ns3/optout.optout.example.db
-rm -f ns3/prepub.example.db
-rm -f ns3/reconf.example.db
-rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
-rm -f ns3/secure.example.db
-rm -f ns3/secure.nsec3.example.db
-rm -f ns3/secure.optout.example.db
-rm -f ns3/settime.out.*
-rm -f ns3/sync.example.db
-rm -f ns3/ttl*.db
-rm -f nsupdate.out.test*
-rm -f settime.out.*
-rm -f signing.*
-rm -f sync.key
@@ -52,10 +52,6 @@ ns.secure		A	10.53.0.3
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.3

-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
 z			A	10.0.0.26

 nsec3			NS	ns.nsec3
@@ -52,10 +52,6 @@ ns.secure		A	10.53.0.3
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.3

-; A insecure subdomain
-mustbesecure		NS	ns.mustbesecure
-ns.mustbesecure		A	10.53.0.3
-
 z			A	10.0.0.26

 nsec3			NS	ns.nsec3
@@ -23,7 +23,6 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	dnssec-validation yes;
-	dnssec-must-be-secure mustbesecure.example yes;
 };

 zone "." {
@@ -9,9 +9,147 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest

 import isctest.mark

+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "active.key",
+        "activate-now-publish-1day.key",
+        "autoksk.key",
+        "autozsk.key",
+        "del.key",
+        "delayksk.key",
+        "delayzsk.key",
+        "delzsk.key",
+        "dig.out.*",
+        "dsset-.",
+        "dsset-bar.",
+        "dsset-delay.example.",
+        "inact.key",
+        "inaczsk-ksk.key",
+        "inaczsk-zsk.key",
+        "noksk-ksk.key",
+        "nopriv.key",
+        "nozsk-ksk.key",
+        "nozsk-zsk.key",
+        "nsupdate.out.*",
+        "prepub.key",
+        "rev.key",
+        "settime.out.*",
+        "signing.*out*",
+        "standby.key",
+        "sync.key",
+        "unpub.key",
+        "vanishing.key",
+        "*/K*",
+        "*/dsset-*",
+        "*/*.signed",
+        "*/*.jnl",
+        "*/*.bk",
+        "ns*/_default.nzf*",
+        "ns*/_default.nzd*",
+        "ns1/root.db",
+        "ns1/root.db.1",
+        "ns1/root.db.2",
+        "ns1/root.db.3",
+        "ns1/signing.out",
+        "ns1/trusted.conf",
+        "ns2/bar.db",
+        "ns2/child.nsec3.example.db",
+        "ns2/child.optout.example.db",
+        "ns2/dsset-dname-at-apex-nsec3.example.",
+        "ns2/dsset-example.",
+        "ns2/dsset-nsec3-to-nsec.example.",
+        "ns2/dsset-nsec3.example.",
+        "ns2/dsset-oldsigs.example.",
+        "ns2/dsset-optout.example.",
+        "ns2/dsset-private.secure.example.",
+        "ns2/dsset-rsasha256.example.",
+        "ns2/dsset-rsasha512.example.",
+        "ns2/dsset-secure.example.",
+        "ns2/example.db",
+        "ns2/insecure.secure.example.db",
+        "ns2/nsec3-with-ent.db",
+        "ns2/private.conf",
+        "ns2/private.secure.example.db",
+        "ns2/signing.bar.out",
+        "ns2/signing.privsec.out",
+        "ns2/trusted.conf",
+        "ns3/autonsec3.example.db",
+        "ns3/delay.example.1",
+        "ns3/delay.example.2",
+        "ns3/delay.example.db",
+        "ns3/delzsk.example.db",
+        "ns3/dname-at-apex-nsec3.example.db",
+        "ns3/dsset-autonsec3.example.",
+        "ns3/dsset-dname-at-apex-nsec3.example.",
+        "ns3/dsset-inaczsk.example.",
+        "ns3/dsset-inaczsk2.example.",
+        "ns3/dsset-kskonly.example.",
+        "ns3/dsset-noksk.example.",
+        "ns3/dsset-nozsk.example.",
+        "ns3/dsset-nsec-only.example.",
+        "ns3/dsset-nsec3-to-nsec.example.",
+        "ns3/dsset-nsec3-to-nsec3.example.",
+        "ns3/dsset-nsec3.example.",
+        "ns3/dsset-nsec3.nsec3.example.",
+        "ns3/dsset-nsec3.optout.example.",
+        "ns3/dsset-oldsigs.example.",
+        "ns3/dsset-optout.example.",
+        "ns3/dsset-optout.nsec3.example.",
+        "ns3/dsset-optout.optout.example.",
+        "ns3/dsset-prepub.example.",
+        "ns3/dsset-rsasha256.example.",
+        "ns3/dsset-rsasha512.example.",
+        "ns3/dsset-secure.example.",
+        "ns3/dsset-secure.nsec3.example.",
+        "ns3/dsset-secure.optout.example.",
+        "ns3/dsset-sync.example.",
+        "ns3/inactive",
+        "ns3/inaczsk.example.db",
+        "ns3/inaczsk2.example.db",
+        "ns3/jitter.nsec3.example.db",
+        "ns3/kg.out",
+        "ns3/kskonly.example.db",
+        "ns3/kskonly.example.db.jbk",
+        "ns3/noksk.example.db",
+        "ns3/nozsk.example.db",
+        "ns3/nsec-only.example.db",
+        "ns3/nsec3-to-nsec.example.db",
+        "ns3/nsec3-to-nsec3.example.db",
+        "ns3/nsec3.example.db",
+        "ns3/nsec3.nsec3.example.db",
+        "ns3/nsec3.optout.example.db",
+        "ns3/oldsigs.example.db",
+        "ns3/oldsigs.example.db.bak",
+        "ns3/optout.example.db",
+        "ns3/optout.example.db.jbk",
+        "ns3/optout.nsec3.example.db",
+        "ns3/optout.optout.example.db",
+        "ns3/prepub.example.db",
+        "ns3/reconf.example.db",
+        "ns3/reconf.example.db.jbk",
+        "ns3/rsasha256.example.db",
+        "ns3/rsasha512.example.db",
+        "ns3/s.out",
+        "ns3/secure.example.db",
+        "ns3/secure.nsec3.example.db",
+        "ns3/secure.optout.example.db",
+        "ns3/st.out",
+        "ns3/sync.example.db",
+        "ns3/trusted.conf",
+        "ns3/ttl1.example.db",
+        "ns3/ttl2.example.db",
+        "ns3/ttl3.example.db",
+        "ns3/ttl4.example.db",
+        "ns4/private.conf",
+        "ns4/trusted.conf",
+        "ns5/trusted.conf",
+    ]
+)
+

@isctest.mark.flaky(max_runs=2)
 def test_autosign(run_tests_sh):
@@ -1,19 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-rm -f ns?/named.run
-rm -f ns?/named.memstats
-rm -f ns?/named.conf
-rm -f rndc.status.ns*
-rm -f dig.out.ns*
-rm -f ns*/managed-keys.bind*
@@ -9,6 +9,15 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+        "rndc.status.ns*",
+    ]
+)
+

 def test_builtin(run_tests_sh):
    run_tests_sh()
@@ -1,26 +0,0 @@
-#!/bin/sh
-
-# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-#
-# SPDX-License-Identifier: MPL-2.0
-#
-# This Source Code Form is subject to the terms of the Mozilla Public
-# License, v. 2.0.  If a copy of the MPL was not distributed with this
-# file, you can obtain one at https://mozilla.org/MPL/2.0/.
-#
-# See the COPYRIGHT file distributed with this work for additional
-# information regarding copyright ownership.
-
-#
-# Clean up after cache cleaner tests.
-#
-
-rm -f dig.out.ns2
-rm -f dig.out.expire
-rm -f rndc.out.*
-rm -f sed.out.*
-rm -f */named.memstats
-rm -f */named.run
-rm -f */named.conf
-rm -f ns2/named_dump.db.*
-rm -f ns*/managed-keys.bind*
@@ -9,6 +9,17 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

+import pytest
+
+pytestmark = pytest.mark.extra_artifacts(
+    [
+        "dig.out.*",
+        "rndc.out.*",
+        "sed.out.*",
+        "ns2/named_dump.db.*",
+    ]
+)
+

 def test_cacheclean(run_tests_sh):
    run_tests_sh()
@@ -11,16 +11,21 @@
 * information regarding copyright ownership.
 */

+// NS1
+
 options {
-	port 5300;
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
 	pid-file "named.pid";
-	session-keyfile "session.key";
-	listen-on { 127.0.0.1; };
+	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
 	recursion no;
-	notify no;
+	notify yes;
 };

-dlz "perl zone" {
-	database "dlopen ../dlz_perl_driver.so dlz_perl_example.pm dlz_perl_example";
+zone "." {
+	type primary;
+	file "root.db";
 };
@@ -0,0 +1,51 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; SPDX-License-Identifier: MPL-2.0
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0.  If a copy of the MPL was not distributed with this
+; file, you can obtain one at https://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300
+.			IN SOA	gson.nominum.com. a.root.servers.nil. (
+				2000042100	; serial
+				600		; refresh
+				600		; retry
+				1200		; expire
+				600		; minimum
+				)
+.			NS	a.root-servers.nil.
+a.root-servers.nil.	A	10.53.0.1
+
+tld0.			NS	ns.tld0.
+ns.tld0.		A	10.53.0.2
+
+tld1.			NS	ns.tld1.
+ns.tld1.		A	10.53.0.2
+
+tld2.			NS	ns.tld2.
+ns.tld2.		A	10.53.0.2
+
+tld3.			NS	ns.tld3.
+ns.tld3.		A	10.53.0.2
+
+tld4.			NS	ns.tld4.
+ns.tld4.		A	10.53.0.2
+
+tld5.			NS	ns.tld5.
+ns.tld5.		A	10.53.0.2
+
+tld6.			NS	ns.tld6.
+ns.tld6.		A	10.53.0.2
+
+tld7.			NS	ns.tld7.
+ns.tld7.		A	10.53.0.2
+
+tld8.			NS	ns.tld8.
+ns.tld8.		A	10.53.0.2
+
+tld9.			NS	ns.tld9.
+ns.tld9.		A	10.53.0.2
@@ -0,0 +1,31 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0.  If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+// NS2
+
+options {
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	recursion no;
+	notify yes;
+};
+
+zone "tld0" {
+	type primary;
+	file "tld0.db";
+};
@@ -0,0 +1,57 @@
+#!/bin/sh -e
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+# shellcheck source=conf.sh
+. ../../conf.sh
+
+echo_i "ns2/setup.sh"
+
+cp template.db.in tld0.db
+echo "final.tld0. IN NS ns.final.tld0." >>tld0.db
+echo "ns.final.tld0. IN A 10.53.0.3" >>tld0.db
+
+DEPTH=5
+
+tld=1
+while [ $tld -le $DEPTH ]; do
+
+  cat >>"named.conf" <<EOF
+zone "tld${tld}" {
+        type primary;
+        file "tld${tld}.db";
+};
+EOF
+
+  cp template.db.in tld${tld}.db
+
+  label=0
+  while [ $label -le $DEPTH ]; do
+    echo "label${label}.tld${tld}. IN NS ns.label${label}.tld${tld}." >>tld${tld}.db
+    echo "ns.label${label}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db
+    echo "" >>tld${tld}.db
+
+    label=$((label + 1))
+  done
+
+  tld=$((tld + 1))
+done
+
+goto=1
+tld=1
+while [ $goto -le $DEPTH ]; do
+  echo "goto${goto}.tld${tld}. IN NS ns.goto${goto}.tld${tld}." >>tld${tld}.db
+  echo "ns.goto${goto}.tld${tld}. IN A 10.53.0.3" >>tld${tld}.db
+  echo "" >>tld${tld}.db
+
+  goto=$((goto + 1))
+done
--- a/Show More
+++ b/Show More