look for name that generated 0FEH552TRKV2I9QUNQ8KQ23MFH2IJGAK

extra logging
Merge branch '710-fix-socket-test' into 'master'
2018-11-21 20:28:16 +11:00 · 2018-11-21 18:27:24 +11:00 · 2018-11-19 12:02:41 -05:00 · 2018-11-19 17:40:34 +01:00 · 2018-11-19 17:40:34 +01:00 · 2018-11-19 17:40:34 +01:00
594 changed files with 11451 additions and 133793 deletions
@@ -27,35 +27,6 @@ gen.dSYM/
 .deps/
 .dirstamp
 .libs/
-unit/atf-src/atf-c++/atf-c++.pc
-unit/atf-src/atf-c/atf-c.pc
-unit/atf-src/atf-c/defs.h
-unit/atf-src/atf-c/detail/process_helpers
-unit/atf-src/atf-config/atf-config
-unit/atf-src/atf-report/atf-report
-unit/atf-src/atf-report/fail_helper
-unit/atf-src/atf-report/misc_helpers
-unit/atf-src/atf-report/pass_helper
-unit/atf-src/atf-run/atf-run
-unit/atf-src/atf-run/bad_metadata_helper
-unit/atf-src/atf-run/expect_helpers
-unit/atf-src/atf-run/misc_helpers
-unit/atf-src/atf-run/pass_helper
-unit/atf-src/atf-run/several_tcs_helper
-unit/atf-src/atf-run/zero_tcs_helper
-unit/atf-src/atf-sh/atf-check
-unit/atf-src/atf-sh/atf-sh
-unit/atf-src/atf-sh/misc_helpers
-unit/atf-src/atf-version/atf-version
-unit/atf-src/atf-version/revision.h
-unit/atf-src/atf-version/revision.h.stamp
-unit/atf-src/bconfig.h
-unit/atf-src/bootstrap/atconfig
-unit/atf-src/doc/atf.7
-unit/atf-src/stamp-h1
-unit/atf-src/test-programs/c_helpers
-unit/atf-src/test-programs/cpp_helpers
-unit/atf-src/test-programs/sh_helpers
 # ccc-analyzer store its results in .plist directories
 *.plist/
 *~
@@ -116,7 +116,7 @@ stages:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
 #    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
+    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
  artifacts:
    paths:
@@ -156,7 +156,6 @@ stages:
    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
  artifacts:
    paths:
-    - atf.out
    - kyua.log
    - kyua.results
    - kyua_html/
@@ -276,6 +275,15 @@ build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

+build:asan:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
+    LDFLAGS: "-fsanitize=address,undefined"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
 build:clang:debian:stretch:i386:
  variables:
    CC: clang
@@ -321,6 +329,12 @@ unittest:debian:sid:amd64:
  dependencies:
    - build:debian:sid:amd64

+unittest:asan:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:asan:debian:sid:amd64
+
 unittest:clang:debian:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
@@ -363,6 +377,12 @@ systemtest:debian:sid:amd64:
  dependencies:
    - build:debian:sid:amd64

+systemtest:asan:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - build:asan:debian:sid:amd64
+
 systemtest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
@@ -394,3 +414,23 @@ pkcs11:systemtest:debian:sid:amd64:
  <<: *system_test_job
  dependencies:
    - pkcs11:build:debian:sid:amd64
+
+noassert:build:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+noassert:unittest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - noassert:build:debian:sid:amd64
+
+noassert:systemtest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - noassert:build:debian:sid:amd64
@@ -1,5 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: lib
@@ -1,3 +1,57 @@
+5098.	[func]		Failed memory allocations are now fatal. [GL #674]
+
+5097.	[cleanup]	Remove embedded ATF unit testing framework
+			from BIND source distribution.  [GL !875]
+
+5096.	[func]		Use multiple event loops in socket code, and
+			make network threads CPU-affinitive.  This
+			significantly improves performance on large
+			systems. [GL #666]
+
+5095.	[test]		Converted all unit tests from ATF to CMocka;
+			removed the source code for the ATF libraries.
+			Build with "configure --with-cmocka" to enable
+			unit testing. [GL #620]
+
+5094.	[func]		Add 'dig -r' to disable reading of .digrc. [GL !970]
+
+5093.	[bug]		Log lame qname-minimization servers only if they're
+			really lame. [GL #671]
+
+5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
+			GSS-TSIG. [GL #558]
+
+5091.	[func]		Two new global and per-view options min-cache-ttl
+			and min-ncache-ttl [GL #613]
+
+5090.	[bug]		dig and mdig failed to properly preparse dash value
+			pairs when value was a seperate argument and started
+			with a dash. [GL #584]
+
+5089.	[bug]		Restore localhost fallback in dig and host which is
+			used when no nameserver addresses present in
+			/etc/resolv.conf are usable due to the requested
+			address family restrictions. [GL #433]
+
+5088.	[bug]		dig/host/nslookup could crash when interrupted close to
+			a query timeout. [GL #599]
+
+5087.	[test]		Check that result tables are complete. [GL #676]
+
+5086.	[func]		Log of RPZ now includes the QTYPE and QCLASS. [GL #623]
+
+5085.	[bug]		win32: Restore looking up nameservers, search list,
+			etc. [GL #186]
+
+5084.	[placeholder]
+
+5083.	[func]		Add autoconf macro AX_POSIX_SHELL, so we
+			can use POSIX-compatible shell features
+			in the scripts.
+
+5082.	[bug]		Fixed a race that could cause a crash in
+			dig/host/nslookup. [GL #650]
+
 5081.	[func]		Use per-worker queues in task manager, make task
 			runners CPU-affine. [GL #659]

@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@

 VERSION=@BIND9_VERSION@

-SUBDIRS =	make unit lib fuzz bin doc
+SUBDIRS =	make lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h

@@ -289,8 +289,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF). To run
-them, use configure --with-atf, then run make test or make unit.
+Unit tests are implemented using the CMocka unit testing framework. To
+build them, use configure --with-cmocka. Execution of tests is done by the
+Kyua test execution engine; if the kyua command is available, then unit
+tests can be run via make test or make unit.

 Documentation

@@ -307,9 +307,10 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.

-Unit tests are implemented using Automated Testing Framework (ATF).
-To run them, use `configure --with-atf`, then run `make test` or
-`make unit`.
+Unit tests are implemented using the CMocka unit testing framework.
+To build them, use `configure --with-cmocka`. Execution of tests is done
+by the Kyua test execution engine; if the `kyua` command is available,
+then unit tests can be run via `make test` or `make unit`.

 ### <a name="doc"/> Documentation

@@ -289,6 +289,7 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR

 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
@@ -282,8 +282,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -300,8 +302,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -327,8 +331,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -345,8 +351,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -366,8 +374,10 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -383,8 +393,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -394,14 +406,16 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -139,12 +139,14 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)

-	if (PROGCMP("named-checkzone"))
+	if (PROGCMP("named-checkzone")) {
 		progmode = progmode_check;
-	else if (PROGCMP("named-compilezone"))
+	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
@@ -125,10 +125,12 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
 		quiet = true;
-	} else if (PROGCMP("ddns-confgen"))
+	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	isc_commandline_errprint = false;

@@ -765,7 +765,14 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);

+
 cleanup:
+	if (bindkeys != NULL) {
+		cfg_obj_destroy(parser, &bindkeys);
+	}
+	if (parser != NULL) {
+		cfg_parser_destroy(&parser);
+	}
 	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
@@ -1167,6 +1174,8 @@ plus_option(char *option) {
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
 static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";
+
 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
 	char opt, *value;
@@ -1224,6 +1233,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
@@ -1367,8 +1377,10 @@ preparse_args(int argc, char **argv) {
 	char *option;

 	for (argc--, argv++; argc > 0; argc--, argv++) {
-		if (argv[0][0] != '-')
+		if (argv[0][0] != '-') {
 			continue;
+		}
+
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
@@ -1391,6 +1403,27 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+
+		if (strlen(option) == 0U) {
+			continue;
+		}
+
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U)
+		{
+			/* Error or value in option. */
+			continue;
+		}
+
+		/* Dash value is next argument so we need to skip it. */
+		argc--;
+		argv++;
+
+		/* Handle missing argument */
+		if (argc == 0) {
+			break;
+		}
 	}
 }

@@ -66,7 +66,7 @@ static char hexcookie[81];

 static bool short_form = false, printcmd = true,
 	plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false;
+	ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

 /*% opcode text */
@@ -157,6 +157,7 @@ help(void) {
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
+"                 -r                  (do not read ~/.digrc)\n"
 "                 -t type             (specify query type)\n"
 "                 -u                  (display times in usec instead of msec)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
@@ -1543,8 +1544,8 @@ plus_option(char *option, bool is_batchfile,
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dhimnuv";
-static const char *dash_opts = "46bcdfhikmnptvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone,
@@ -1615,6 +1616,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case 'n':
 			/* deprecated */
 			break;
+		case 'r':
+			debug("digrc (late)");
+			digrc = false;
+			break;
 		case 'u':
 			(*lookup)->use_usec = true;
 			break;
@@ -1841,11 +1846,23 @@ preparse_args(int argc, char **argv) {
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
+			case 'd':
+				/* For debugging early startup */
+				debugging = true;
+				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
+			case 'r':
+				/*
+				 * Must be done early, because ~/.digrc
+				 * is read before command line parsing
+				 */
+				debug("digrc (early)");
+				digrc = false;
+				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
@@ -1859,6 +1876,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }

@@ -1925,8 +1956,9 @@ parse_args(bool is_batchfile, bool config_only,
 		 */
 		INSIST(batchfp == NULL);
 		homedir = getenv("HOME");
-		if (homedir != NULL) {
+		if (homedir != NULL && digrc) {
 			unsigned int n;
+			debug("digrc (open)");
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
 			if (n < sizeof(rcfile)) {
@@ -131,9 +131,10 @@

    <para>
      It is possible to set per-user defaults for <command>dig</command> via
-      <filename>${HOME}/.digrc</filename>.  This file is read and
-      any options in it
-      are applied before the command line arguments.
+      <filename>${HOME}/.digrc</filename>. This file is read and any
+      options in it are applied before the command line arguments.
+      The <option>-r</option> option disables this feature, for
+      scripts that need predictable behaviour.
    </para>

    <para>
@@ -323,6 +324,16 @@
 	</listitem>
      </varlistentry>

+      <varlistentry>
+	<term>-r</term>
+	<listitem>
+	  <para>
+	    Do not read options from <filename>${HOME}/.digrc</filename>.
+	    This is useful for scripts that need predictable behaviour.
+	  </para>
+	</listitem>
+      </varlistentry>
+
      <varlistentry>
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
@@ -1227,6 +1227,19 @@ create_search_list(irs_resconf_t *resconf) {
 	}
 }

+/*%
+ * Append 'addr' to the list of servers to be queried.  This function is only
+ * called when no server addresses are explicitly specified and either libirs
+ * returns an empty list of servers to use or none of the addresses returned by
+ * libirs are usable due to the specified address family restrictions.
+ */
+static void
+add_fallback_nameserver(const char *addr) {
+	dig_server_t *server = make_server(addr, addr);
+	ISC_LINK_INIT(server, link);
+	ISC_LIST_APPEND(server_list, server, link);
+}
+
 /*%
 * Setup the system as a whole, reading key information and resolv.conf
 * settings.
@@ -1272,6 +1285,16 @@ setup_system(bool ipv4only, bool ipv6only) {
 		get_server_list(resconf);
 	}

+	/* If we don't find a nameserver fall back to localhost */
+	if (ISC_LIST_EMPTY(server_list)) {
+		if (have_ipv6) {
+			add_fallback_nameserver("::1");
+		}
+		if (have_ipv4) {
+			add_fallback_nameserver("127.0.0.1");
+		}
+	}
+
 	irs_resconf_destroy(&resconf);

 #ifdef HAVE_SETLOCALE
@@ -1519,17 +1542,21 @@ clear_query(dig_query_t *query) {

 	debug("clear_query(%p)", query);

-	if (query->timer != NULL)
+	if (query->timer != NULL) {
 		isc_timer_detach(&query->timer);
+	}
 	lookup = query->lookup;

-	if (lookup->current_query == query)
+	if (lookup->current_query == query) {
 		lookup->current_query = NULL;
+	}

-	if (ISC_LINK_LINKED(query, link))
+	if (ISC_LINK_LINKED(query, link)) {
 		ISC_LIST_UNLINK(lookup->q, query, link);
-	if (ISC_LINK_LINKED(query, clink))
+	}
+	if (ISC_LINK_LINKED(query, clink)) {
 		ISC_LIST_UNLINK(lookup->connecting, query, clink);
+	}
 	INSIST(query->recvspace != NULL);

 	if (query->sock != NULL) {
@@ -1541,10 +1568,13 @@ clear_query(dig_query_t *query) {
 	isc_mempool_put(commctx, query->tmpsendspace);
 	isc_buffer_invalidate(&query->recvbuf);
 	isc_buffer_invalidate(&query->lengthbuf);
-	if (query->waiting_senddone)
+
+	if (query->waiting_senddone) {
 		query->pending_free = true;
-	else
+	} else {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}
 }

 /*%
@@ -2284,7 +2314,7 @@ setup_lookup(dig_lookup_t *lookup) {

 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
@@ -2341,6 +2371,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}

 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
@@ -2452,13 +2483,14 @@ setup_lookup(dig_lookup_t *lookup) {

 	for (serv = ISC_LIST_HEAD(lookup->my_server_list);
 	     serv != NULL;
-	     serv = ISC_LIST_NEXT(serv, link)) {
+	     serv = ISC_LIST_NEXT(serv, link))
+	{
 		query = isc_mem_allocate(mctx, sizeof(dig_query_t));
-		if (query == NULL)
+		if (query == NULL) {
 			fatal("memory allocation failure in %s:%d",
 			      __FILE__, __LINE__);
-		debug("create query %p linked to lookup %p",
-		       query, lookup);
+		}
+		debug("create query %p linked to lookup %p", query, lookup);
 		query->lookup = lookup;
 		query->timer = NULL;
 		query->waiting_connect = false;
@@ -2482,16 +2514,21 @@ setup_lookup(dig_lookup_t *lookup) {
 		query->sock = NULL;
 		query->recvspace = isc_mempool_get(commctx);
 		query->tmpsendspace = isc_mempool_get(commctx);
-		if (query->recvspace == NULL)
+		if (query->recvspace == NULL) {
 			fatal("memory allocation failure");
+		}

 		isc_buffer_init(&query->recvbuf, query->recvspace, COMMSIZE);
 		isc_buffer_init(&query->lengthbuf, query->lengthspace, 2);
-		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace, COMMSIZE);
+		isc_buffer_init(&query->tmpsendbuf, query->tmpsendspace,
+				COMMSIZE);
 		query->sendbuf = lookup->renderbuf;

 		ISC_LINK_INIT(query, clink);
 		ISC_LINK_INIT(query, link);
+
+		query->magic = DIG_QUERY_MAGIC;
+
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

@@ -2500,9 +2537,10 @@ setup_lookup(dig_lookup_t *lookup) {
 		extrabytes = 0;
 		dighost_printmessage(ISC_LIST_HEAD(lookup->q),
 				     lookup->sendmsg, true);
-		if (lookup->stats)
+		if (lookup->stats) {
 			printf(";; QUERY SIZE: %u\n\n",
 			       isc_buffer_usedlength(&lookup->renderbuf));
+		}
 	}
 	return (true);
 }
@@ -2528,20 +2566,26 @@ send_done(isc_task_t *_task, isc_event_t *event) {
 	INSIST(sendcount >= 0);

 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	query->waiting_senddone = false;
 	l = query->lookup;

-	if (l->ns_search_only && !l->trace_root && !l->tcp_mode) {
+	if (!query->pending_free && l->ns_search_only &&
+	    !l->trace_root && !l->tcp_mode)
+	{
 		debug("sending next, since searching");
 		next = ISC_LIST_NEXT(query, link);
-		if (next != NULL)
+		if (next != NULL) {
 			send_udp(next);
+		}
 	}

 	isc_event_free(&event);

-	if (query->pending_free)
+	if (query->pending_free) {
+		query->magic = 0;
 		isc_mem_free(mctx, query);
+	}

 	check_if_done();
 	UNLOCK_LOOKUP;
@@ -2559,6 +2603,7 @@ cancel_lookup(dig_lookup_t *lookup) {
 	debug("cancel_lookup()");
 	query = ISC_LIST_HEAD(lookup->q);
 	while (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		next = ISC_LIST_NEXT(query, link);
 		if (query->sock != NULL) {
 			isc_socket_cancel(query->sock, global_task,
@@ -2578,6 +2623,7 @@ bringup_timer(dig_query_t *query, unsigned int default_timeout) {
 	dig_lookup_t *l;
 	unsigned int local_timeout;
 	isc_result_t result;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("bringup_timer()");
 	/*
@@ -2642,6 +2688,7 @@ send_tcp_connect(dig_query_t *query) {
 	isc_result_t result;
 	dig_query_t *next;
 	dig_lookup_t *l;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("send_tcp_connect(%p)", query);

@@ -2770,6 +2817,7 @@ send_udp(dig_query_t *query) {
 	dig_query_t *next;
 	isc_region_t r;
 	isc_socketevent_t *sevent;
+	REQUIRE(DIG_VALID_QUERY(query));

 	debug("send_udp(%p)", query);

@@ -2871,11 +2919,17 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {

 	LOCK_LOOKUP;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));
 	l = query->lookup;
 	isc_event_free(&event);

 	INSIST(!free_now);

+	if (cancel_now) {
+		UNLOCK_LOOKUP;
+		return;
+	}
+
 	if ((query != NULL) && (query->lookup->current_query != NULL) &&
 	    ISC_LINK_LINKED(query->lookup->current_query, link) &&
 	    (ISC_LIST_NEXT(query->lookup->current_query, link) != NULL)) {
@@ -2957,6 +3011,7 @@ tcp_length_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = event->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));

 	recvcount--;
 	INSIST(recvcount >= 0);
@@ -3031,6 +3086,7 @@ launch_next_query(dig_query_t *query, bool include_question) {
 	isc_result_t result;
 	dig_lookup_t *l;
 	isc_region_t r;
+	REQUIRE(DIG_VALID_QUERY(query));

 	INSIST(!free_now);

@@ -3103,6 +3159,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 	LOCK_LOOKUP;
 	sevent = (isc_socketevent_t *)event;
 	query = sevent->ev_arg;
+	REQUIRE(DIG_VALID_QUERY(query));

 	INSIST(query->waiting_connect);

@@ -3994,6 +4051,7 @@ do_lookup(dig_lookup_t *lookup) {
 	lookup->pending = true;
 	query = ISC_LIST_HEAD(lookup->q);
 	if (query != NULL) {
+		REQUIRE(DIG_VALID_QUERY(query));
 		if (lookup->tcp_mode)
 			send_tcp_connect(query);
 		else
@@ -26,6 +26,7 @@
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
+#include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/sockaddr.h>
@@ -81,6 +82,11 @@ typedef struct dig_server dig_server_t;
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;

+#define DIG_QUERY_MAGIC		ISC_MAGIC('D','i','g','q')
+
+#define DIG_VALID_QUERY(x)	ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)
+
+
 /*% The dig_lookup structure */
 struct dig_lookup {
 	bool
@@ -184,6 +190,7 @@ struct dig_lookup {

 /*% The dig_query structure */
 struct dig_query {
+	unsigned int magic;
 	dig_lookup_t *lookup;
 	bool waiting_connect,
 		pending_free,
@@ -163,8 +163,8 @@ verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	if (verbose < 3) {
 		vbprintf(level, "%s %s\n", msg, timestr);
 	} else {
-		vbprintf(level, "%s %s (%lld)\n",
-			 msg, timestr, (long long)time);
+		vbprintf(level, "%s %s (%" PRIu32 ")\n",
+			 msg, timestr, time);
 	}
 }

@@ -533,8 +533,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		arraysize += dns_rdataset_count(&sigset);
 	wassignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
 	nowsignedby = isc_mem_get(mctx, arraysize * sizeof(bool));
-	if (wassignedby == NULL || nowsignedby == NULL)
-		fatal("out of memory");

 	for (i = 0; i < arraysize; i++)
 		wassignedby[i] = nowsignedby[i] = false;
@@ -174,6 +174,8 @@ options {\n\
 	max-recursion-queries 75;\n\
 	max-stale-ttl 604800; /* 1 week */\n\
 	message-compression yes;\n\
+	min-ncache-ttl 0; /* 0 hours */\n\
+	min-cache-ttl 0; /* 0 seconds */\n\
 #	min-roots <obsolete>;\n\
 	minimal-any false;\n\
 	minimal-responses no-auth-recursive;\n\
@@ -457,6 +459,7 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 		ztype = dns_zone_redirect;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (ztype);
 }
@@ -1029,6 +1032,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 	if (typep != NULL)
@@ -157,6 +157,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		type = ISC_LOG_TOFILE;
@@ -793,10 +793,7 @@ create_managers(void) {
 	named_g_udpdisp = 1;
 #else
 	if (named_g_udpdisp == 0) {
-		if (named_g_cpus_detected == 1)
-			named_g_udpdisp = 1;
-		else
-			named_g_udpdisp = named_g_cpus_detected - 1;
+		named_g_udpdisp = named_g_cpus_detected;
 	}
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
@@ -824,7 +821,7 @@ create_managers(void) {
 	}

 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
-				       maxsocks);
+				       maxsocks, named_g_cpus);
 	if (result != ISC_R_SUCCESS) {
 		UNEXPECTED_ERROR(__FILE__, __LINE__,
 				 "isc_socketmgr_create() failed: %s",
@@ -1068,14 +1065,20 @@ setup(void) {
 	/*
 	 * Get the initial resource limits.
 	 */
-	(void)isc_resource_getlimit(isc_resource_stacksize,
-				    &named_g_initstacksize);
-	(void)isc_resource_getlimit(isc_resource_datasize,
-				    &named_g_initdatasize);
-	(void)isc_resource_getlimit(isc_resource_coresize,
-				    &named_g_initcoresize);
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+#ifndef WIN32
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize)
+		      == ISC_R_SUCCESS);
+#endif
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);

 	/*
 	 * System resources cannot effectively be tuned on some systems.
@@ -1083,8 +1086,9 @@ setup(void) {
 	 */
 	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 	if (old_openfiles != named_g_initopenfiles) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -337,6 +337,8 @@ options {
 	memstatistics <replaceable>boolean</replaceable>;
 	memstatistics-file <replaceable>quoted_string</replaceable>;
 	message-compression <replaceable>boolean</replaceable>;
+	min-cache-ttl <replaceable>ttlval</replaceable>;
+	min-ncache-ttl <replaceable>ttlval</replaceable>;
 	min-refresh-time <replaceable>integer</replaceable>;
 	min-retry-time <replaceable>integer</replaceable>;
 	minimal-any <replaceable>boolean</replaceable>;
@@ -305,6 +305,13 @@ typedef struct catz_chgzone_event {
 	bool mod;
 } catz_chgzone_event_t;

+typedef struct {
+	unsigned int magic;
+#define DZARG_MAGIC		ISC_MAGIC('D', 'z', 'a', 'r')
+	isc_buffer_t **text;
+	isc_result_t result;
+} ns_dzarg_t;
+
 /*
 * These zones should not leak onto the Internet.
 */
@@ -1145,6 +1152,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	sa = *(cfg_obj_assockaddr(obj));
@@ -1166,6 +1174,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	if (result != ISC_R_SUCCESS)
 		return (ISC_R_SUCCESS);
@@ -1273,20 +1282,22 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	obj = cfg_tuple_get(ent, "ordering");
 	INSIST(cfg_obj_isstring(obj));
 	str = cfg_obj_asstring(obj);
-	if (!strcasecmp(str, "fixed"))
+	if (!strcasecmp(str, "fixed")) {
 #if DNS_RDATASET_FIXED
 		mode = DNS_RDATASETATTR_FIXEDORDER;
 #else
 		mode = DNS_RDATASETATTR_CYCLIC;
 #endif /* DNS_RDATASET_FIXED */
-	else if (!strcasecmp(str, "random"))
+	} else if (!strcasecmp(str, "random")) {
 		mode = DNS_RDATASETATTR_RANDOMIZE;
-	else if (!strcasecmp(str, "cyclic"))
+	} else if (!strcasecmp(str, "cyclic")) {
 		mode = DNS_RDATASETATTR_CYCLIC;
-	else if (!strcasecmp(str, "none"))
+	} else if (!strcasecmp(str, "none")) {
 		mode = DNS_RDATASETATTR_NONE;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/*
 	 * "*" should match everything including the root (BIND 8 compat).
@@ -1418,14 +1429,16 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	(void)cfg_map_get(cpeer, "transfer-format", &obj);
 	if (obj != NULL) {
 		str = cfg_obj_asstring(obj);
-		if (strcasecmp(str, "many-answers") == 0)
+		if (strcasecmp(str, "many-answers") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_many_answers));
-		else if (strcasecmp(str, "one-answer") == 0)
+		} else if (strcasecmp(str, "one-answer") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_one_answer));
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -2718,7 +2731,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	catz_chgzone_event_t *event;
 	isc_task_t *task;
 	isc_result_t result;
-	isc_taskaction_t action;
+	isc_taskaction_t action = NULL;

 	switch (type) {
 	case DNS_EVENT_CATZADDZONE:
@@ -3943,8 +3956,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		view->checknames = false;
 	} else if (strcasecmp(str, "ignore") == 0) {
 		view->checknames = false;
-	} else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	obj = NULL;
 	result = named_config_get(maps, "zero-no-soa-ttl-cache", &obj);
@@ -4109,8 +4124,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = named_config_get(maps, "max-ncache-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	view->maxncachettl = cfg_obj_asuint32(obj);
-	if (view->maxncachettl > 7 * 24 * 3600)
-		view->maxncachettl = 7 * 24 * 3600;
+
+	obj = NULL;
+	result = named_config_get(maps, "min-cache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->mincachettl = cfg_obj_asuint32(obj);
+
+	obj = NULL;
+	result = named_config_get(maps, "min-ncache-ttl", &obj);
+	INSIST(result == ISC_R_SUCCESS);
+	view->minncachettl = cfg_obj_asuint32(obj);

 	obj = NULL;
 	result = named_config_get(maps, "synth-from-dnssec", &obj);
@@ -4356,14 +4379,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj2 = cfg_tuple_get(obj, "response");
 		if (!cfg_obj_isvoid(obj2)) {
 			const char *resp = cfg_obj_asstring(obj2);
-			isc_result_t r;
+			isc_result_t r = DNS_R_SERVFAIL;

-			if (strcasecmp(resp, "drop") == 0)
+			if (strcasecmp(resp, "drop") == 0) {
 				r = DNS_R_DROP;
-			else if (strcasecmp(resp, "fail") == 0)
+			} else if (strcasecmp(resp, "fail") == 0) {
 				r = DNS_R_SERVFAIL;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}

 			dns_resolver_setquotaresponse(view->resolver,
 						      dns_quotatype_server, r);
@@ -4709,20 +4734,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->minimalresponses = dns_minimal_noauth;
 		} else if (strcasecmp(str, "no-auth-recursive") == 0) {
 			view->minimalresponses = dns_minimal_noauthrec;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
 	result = named_config_get(maps, "transfer-format", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	str = cfg_obj_asstring(obj);
-	if (strcasecmp(str, "many-answers") == 0)
+	if (strcasecmp(str, "many-answers") == 0) {
 		view->transfer_format = dns_many_answers;
-	else if (strcasecmp(str, "one-answer") == 0)
+	} else if (strcasecmp(str, "one-answer") == 0) {
 		view->transfer_format = dns_one_answer;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	obj = NULL;
 	result = named_config_get(maps, "trust-anchor-telemetry", &obj);
@@ -5036,14 +5065,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj2 = cfg_tuple_get(obj, "response");
 	if (!cfg_obj_isvoid(obj2)) {
 		const char *resp = cfg_obj_asstring(obj2);
-		isc_result_t r;
+		isc_result_t r = DNS_R_SERVFAIL;

-		if (strcasecmp(resp, "drop") == 0)
+		if (strcasecmp(resp, "drop") == 0) {
 			r = DNS_R_DROP;
-		else if (strcasecmp(resp, "fail") == 0)
+		} else if (strcasecmp(resp, "fail") == 0) {
 			r = DNS_R_SERVFAIL;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}

 		dns_resolver_setquotaresponse(view->resolver,
 					      dns_quotatype_zone, r);
@@ -5059,10 +5090,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v4_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
 			view->v4_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -5075,10 +5108,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v6_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
 			view->v6_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	CHECK(configure_view_acl(vconfig, config, named_g_config,
@@ -5281,7 +5316,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *empty_dbtype[4] =
 				    { "_builtin", "empty", NULL, NULL };
 		int empty_dbtypec = 4;
-		dns_zonestat_level_t statlevel;
+		dns_zonestat_level_t statlevel = dns_zonestat_none;

 		name = dns_fixedname_initname(&fixed);

@@ -5319,14 +5354,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				statlevel = dns_zonestat_none;
 		} else {
 			const char *levelstr = cfg_obj_asstring(obj);
-			if (strcasecmp(levelstr, "full") == 0)
+			if (strcasecmp(levelstr, "full") == 0) {
 				statlevel = dns_zonestat_full;
-			else if (strcasecmp(levelstr, "terse") == 0)
+			} else if (strcasecmp(levelstr, "terse") == 0) {
 				statlevel = dns_zonestat_terse;
-			else if (strcasecmp(levelstr, "none") == 0)
+			} else if (strcasecmp(levelstr, "none") == 0) {
 				statlevel = dns_zonestat_none;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}

 		for (empty = empty_zones[empty_zone];
@@ -5686,16 +5723,18 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 				    "forwarding");
 		fwdpolicy = dns_fwdpolicy_none;
 	} else {
-		if (forwardtype == NULL)
+		if (forwardtype == NULL) {
 			fwdpolicy = dns_fwdpolicy_first;
-		else {
+		} else {
 			const char *forwardstr = cfg_obj_asstring(forwardtype);
-			if (strcasecmp(forwardstr, "first") == 0)
+			if (strcasecmp(forwardstr, "first") == 0) {
 				fwdpolicy = dns_fwdpolicy_first;
-			else if (strcasecmp(forwardstr, "only") == 0)
+			} else if (strcasecmp(forwardstr, "only") == 0) {
 				fwdpolicy = dns_fwdpolicy_only;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 	}

@@ -7577,11 +7616,11 @@ data_to_cfg(dns_view_t *view, MDB_val *key, MDB_val *data,
 		goto cleanup;
 	}

-	putstr(text, "zone ");
-	putmem(text, (const void *) zone_name, zone_name_len);
-	putstr(text, " ");
-	putmem(text, (const void *) zone_config, zone_config_len);
-	putstr(text, ";\n");
+	CHECK(putstr(text, "zone "));
+	CHECK(putmem(text, (const void *) zone_name, zone_name_len));
+	CHECK(putstr(text, " "));
+	CHECK(putmem(text, (const void *) zone_config, zone_config_len));
+	CHECK(putstr(text, ";\n"));

 	cfg_parser_reset(named_g_addparser);
 	result = cfg_parse_buffer3(named_g_addparser, *text, zone_name, 0,
@@ -8906,7 +8945,7 @@ load_configuration(const char *filename, named_server_t *server,
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
 		named_g_memstatistics =
-			(isc_mem_debugging & ISC_MEM_DEBUGRECORD);
+			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
 	}

 	obj = NULL;
@@ -9001,6 +9040,7 @@ load_configuration(const char *filename, named_server_t *server,
 		server->sctx->cookiealg = ns_cookiealg_sha256;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	obj = NULL;
@@ -9920,7 +9960,7 @@ static void
 named_server_reload(isc_task_t *task, isc_event_t *event) {
 	named_server_t *server = (named_server_t *)event->ev_arg;

-	INSIST(task = server->task);
+	INSIST(task == server->task);
 	UNUSED(task);

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -10790,10 +10830,10 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 	}
 	if (ptr != NULL) {
 		if (!found) {
-			putstr(text, "view '");
-			putstr(text, ptr);
-			putstr(text, "' not found");
-			putnull(text);
+			CHECK(putstr(text, "view '"));
+			CHECK(putstr(text, ptr));
+			CHECK(putstr(text, "' not found"));
+			CHECK(putnull(text));
 			result = ISC_R_NOTFOUND;
 			dumpdone(dctx, result);
 			return (result);
@@ -12081,9 +12121,15 @@ nzd_setkey(MDB_val *key, dns_name_t *name, char *namebuf, size_t buflen) {

 static void
 dumpzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **text = arg;
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;

-	putmem(text, buf, len);
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }

 static isc_result_t
@@ -12097,6 +12143,7 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 	isc_buffer_t *text = NULL;
 	char namebuf[1024];
 	MDB_val key, data;
+	ns_dzarg_t dzarg;

 	view = dns_zone_getview(zone);

@@ -12148,7 +12195,21 @@ nzd_save(MDB_txn **txnp, MDB_dbi dbi, dns_zone_t *zone,
 			goto cleanup;
 		}

-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx,
+				      NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in nzd_save(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}

 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -12427,6 +12488,7 @@ migrate_nzf(dns_view_t *view) {
 	MDB_txn *txn = NULL;
 	MDB_dbi dbi;
 	MDB_val key, data;
+	ns_dzarg_t dzarg;

 	/*
 	 * If NZF file doesn't exist, or NZD DB exists and already
@@ -12516,7 +12578,21 @@ migrate_nzf(dns_view_t *view) {
 		}

 		isc_buffer_clear(text);
-		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &text);
+		dzarg.magic = DZARG_MAGIC;
+		dzarg.text = &text;
+		dzarg.result = ISC_R_SUCCESS;
+		cfg_printx(zoptions, CFG_PRINTER_ONELINE, dumpzone, &dzarg);
+		if (dzarg.result != ISC_R_SUCCESS) {
+			isc_log_write(named_g_lctx,
+				      NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER,
+				      ISC_LOG_ERROR,
+				      "Error writing zone config to "
+				      "buffer in migrate_nzf(): %s",
+				      isc_result_totext(result));
+			result = dzarg.result;
+			goto cleanup;
+		}

 		data.mv_data = isc_buffer_base(text);
 		data.mv_size = isc_buffer_usedlength(text);
@@ -12586,7 +12662,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	const char *viewname = NULL;
 	dns_rdataclass_t rdclass;
 	dns_view_t *view = NULL;
-	const char *bn;
+	const char *bn = NULL;

 	REQUIRE(viewp != NULL && *viewp == NULL);
 	REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
@@ -12597,12 +12673,14 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
 	isc_buffer_add(&argbuf, strlen(command));

-	if (strncasecmp(command, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0) {
 		bn = "addzone";
-	else if (strncasecmp(command, "mod", 3) == 0)
+	} else if (strncasecmp(command, "mod", 3) == 0) {
 		bn = "modzone";
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}

 	/*
 	 * Convert the "addzone" or "modzone" to just "zone", for
@@ -13618,8 +13696,14 @@ find_name_in_list_from_map(const cfg_obj_t *config,

 static void
 emitzone(void *arg, const char *buf, int len) {
-	isc_buffer_t **tpp = arg;
-	putmem(tpp, buf, len);
+	ns_dzarg_t *dzarg = arg;
+	isc_result_t result;
+
+	REQUIRE(dzarg != NULL && ISC_MAGIC_VALID(dzarg, DZARG_MAGIC));
+	result = putmem(dzarg->text, buf, len);
+	if (result != ISC_R_SUCCESS && dzarg->result == ISC_R_SUCCESS) {
+		dzarg->result = result;
+	}
 }

 /*
@@ -13641,6 +13725,7 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	cfg_obj_t *nzconfig = NULL;
 #endif /* HAVE_LMDB */
 	bool added, redirect;
+	ns_dzarg_t dzarg;

 	/* Parse parameters */
 	CHECK(zone_from_args(server, lex, NULL, &zone, zonename,
@@ -13700,9 +13785,14 @@ named_server_showzone(named_server_t *server, isc_lex_t *lex,
 	if (zconfig == NULL)
 		CHECK(ISC_R_NOTFOUND);

-	putstr(text, "zone ");
-	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, text);
-	putstr(text, ";");
+	CHECK(putstr(text, "zone "));
+	dzarg.magic = DZARG_MAGIC;
+	dzarg.text = text;
+	dzarg.result = ISC_R_SUCCESS;
+	cfg_printx(zconfig, CFG_PRINTER_ONELINE, emitzone, &dzarg);
+	CHECK(dzarg.result);
+
+	CHECK(putstr(text, ";"));

 	result = ISC_R_SUCCESS;

@@ -14096,8 +14186,8 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,

 	/* Security */
 	secure = dns_db_issecure(db);
-	allow = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW);
-	maintain = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN);
+	allow = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW) != 0);
+	maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);

 	/* Master files */
 	file = dns_zone_getfile(mayberaw);
@@ -14326,6 +14416,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	bool ttlset = false, excl = false, viewfound = false;
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
 	bool first = true;
+	bool is_option = true;

 	UNUSED(force);

@@ -14338,7 +14429,6 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	}

 	for (;;) {
-		bool opts = true;

 		/* Check for options */
 		ptr = next_token(lex, text);
@@ -14346,16 +14436,16 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			return (ISC_R_UNEXPECTEDEND);
 		}

-		if (!opts) {
+		if (!is_option) {
 			nametext = ptr;
 		} else if (strcmp(ptr, "--") == 0) {
-			opts = false;
+			is_option = false;
 		} else if (argcheck(ptr, "dump")) {
 			dump = true;
 		} else if (argcheck(ptr, "remove")) {
 			ntattl = 0;
 			ttlset = true;
-		} else if (opts && argcheck(ptr, "force")) {
+		} else if (argcheck(ptr, "force")) {
 			force = true;
 			continue;
 		} else if (argcheck(ptr, "lifetime")) {
@@ -14798,7 +14888,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			snprintf(buf, sizeof(buf), "\n\talgorithm: %s", alg);
 			CHECK(putstr(text, buf));

-			revoked = (kd.flags & DNS_KEYFLAG_REVOKE);
+			revoked = ((kd.flags & DNS_KEYFLAG_REVOKE) != 0);
 			snprintf(buf, sizeof(buf), "\n\tflags:%s%s%s",
 				 revoked ? " REVOKE" : "",
 				 ((kd.flags & DNS_KEYFLAG_KSK) != 0)
@@ -14988,6 +15078,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		if (viewtxt != NULL) {
@@ -125,7 +125,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		break;
 	    default:
 		INSIST(0);
-		return (ISC_R_FAILURE);
+		ISC_UNREACHABLE();
 	}

 	/* First check to see if ACL is defined within the zone */
@@ -231,12 +231,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		unsigned int i, n;

 		str = cfg_obj_asstring(mode);
-		if (strcasecmp(str, "grant") == 0)
+		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
-		else if (strcasecmp(str, "deny") == 0)
+		} else if (strcasecmp(str, "deny") == 0) {
 			grant = false;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -764,6 +766,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	result = named_checknames_get(maps, zone, objp);
 	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
@@ -903,7 +906,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
 	dns_stats_t *rcvquerystats;
-	dns_zonestat_level_t statlevel;
+	dns_zonestat_level_t statlevel = dns_zonestat_none;
 	int seconds;
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
 	isc_dscp_t dscp;
@@ -1027,14 +1030,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		const char *masterformatstr = cfg_obj_asstring(obj);

-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -1050,12 +1055,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			return (ISC_R_FAILURE);
 		}

-		if (strcasecmp(masterstylestr, "full") == 0)
+		if (strcasecmp(masterstylestr, "full") == 0) {
 			masterstyle = &dns_master_style_full;
-		else if (strcasecmp(masterstylestr, "relative") == 0)
+		} else if (strcasecmp(masterstylestr, "relative") == 0) {
 			masterstyle = &dns_master_style_default;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	obj = NULL;
@@ -1141,16 +1148,18 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dialup = dns_dialuptype_no;
 	} else {
 		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0)
+		if (strcasecmp(dialupstr, "notify") == 0) {
 			dialup = dns_dialuptype_notify;
-		else if (strcasecmp(dialupstr, "notify-passive") == 0)
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
 			dialup = dns_dialuptype_notifypassive;
-		else if (strcasecmp(dialupstr, "refresh") == 0)
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
 			dialup = dns_dialuptype_refresh;
-		else if (strcasecmp(dialupstr, "passive") == 0)
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
 			dialup = dns_dialuptype_passive;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	if (raw != NULL)
 		dns_zone_setdialup(raw, dialup);
@@ -1166,14 +1175,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			statlevel = dns_zonestat_none;
 	} else {
 		const char *levelstr = cfg_obj_asstring(obj);
-		if (strcasecmp(levelstr, "full") == 0)
+		if (strcasecmp(levelstr, "full") == 0) {
 			statlevel = dns_zonestat_full;
-		else if (strcasecmp(levelstr, "terse") == 0)
+		} else if (strcasecmp(levelstr, "terse") == 0) {
 			statlevel = dns_zonestat_terse;
-		else if (strcasecmp(levelstr, "none") == 0)
+		} else if (strcasecmp(levelstr, "none") == 0) {
 			statlevel = dns_zonestat_none;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	dns_zone_setstatlevel(zone, statlevel);

@@ -1211,12 +1222,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				notifytype = dns_notifytype_no;
 		} else {
 			const char *notifystr = cfg_obj_asstring(obj);
-			if (strcasecmp(notifystr, "explicit") == 0)
+			if (strcasecmp(notifystr, "explicit") == 0) {
 				notifytype = dns_notifytype_explicit;
-			else if (strcasecmp(notifystr, "master-only") == 0)
+			} else if (strcasecmp(notifystr, "master-only") == 0) {
 				notifytype = dns_notifytype_masteronly;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 		notifytype = process_notifytype(notifytype, ztype, zname,
 						nodefault);
@@ -1374,8 +1387,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES,
 					   check);
@@ -1410,8 +1425,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);

 		obj = NULL;
@@ -1562,14 +1579,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "allow") == 0)
+			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				allow = maint = true;
-			else if (strcasecmp(arg, "off") == 0)
+			} else if (strcasecmp(arg, "off") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
@@ -1622,8 +1641,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);

@@ -1637,8 +1658,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);

@@ -1674,8 +1697,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);

@@ -1689,8 +1714,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
@@ -1706,13 +1733,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "no-resign") == 0)
+			if (strcasecmp(arg, "no-resign") == 0) {
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
 						   true);
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}

 		obj = NULL;
@@ -144,8 +144,8 @@ static dns_fixedname_t fuserzone;
 static dns_fixedname_t fzname;
 static dns_name_t *userzone = NULL;
 static dns_name_t *zname = NULL;
-static dns_name_t tmpzonename;
-static dns_name_t restart_master;
+static dns_name_t tmpzonename = DNS_NAME_INITEMPTY;
+static dns_name_t restart_master = DNS_NAME_INITEMPTY;
 static dns_tsig_keyring_t *gssring = NULL;
 static dns_tsigkey_t *tsigkey = NULL;
 static dst_key_t *sig0key = NULL;
@@ -2354,6 +2354,8 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	if (usegsstsig) {
 		dns_name_free(&tmpzonename, gmctx);
 		dns_name_free(&restart_master, gmctx);
+		dns_name_init(&tmpzonename, 0);
+		dns_name_init(&restart_master, 0);
 	}
 	isc_event_free(&event);
 	done_update();
@@ -2769,6 +2771,8 @@ failed_gssrequest() {

 	dns_name_free(&tmpzonename, gmctx);
 	dns_name_free(&restart_master, gmctx);
+	dns_name_init(&tmpzonename, NULL);
+	dns_name_init(&restart_master, NULL);

 	done_update();
 }
@@ -3178,6 +3182,12 @@ cleanup(void) {
 		isc_mem_free(gmctx, realm);
 		realm = NULL;
 	}
+	if (dns_name_dynamic(&tmpzonename)) {
+		dns_name_free(&tmpzonename, gmctx);
+	}
+	if (dns_name_dynamic(&restart_master)) {
+		dns_name_free(&restart_master, gmctx);
+	}
 #endif

 	if (sig0key != NULL)
@@ -46,6 +46,7 @@ options {
 	memstatistics-file "named.memstats";	// _PATH_MEMSTATS

 	max-cache-ttl 999;
+	min-cache-ttl 66;
 	auth-nxdomain yes;		// always set AA on NXDOMAIN.
 					// don't set this to 'no' unless
 					// you know what you're doing -- older
@@ -148,6 +149,7 @@ options {
 	min-refresh-time 777;

 	max-ncache-ttl 333;
+	min-ncache-ttl 22;
 	min-roots 15;
 	serial-queries 34;

@@ -69,7 +69,7 @@ PARALLEL = rpzrecurse serve-stale dnssec \
 	   rrchecker rrl rrsetorder rsabigexponent runtime \
 	   sfcache smartsign sortlist \
 	   spf staticstub statistics statschannel stub synthfromdnssec \
-	   tcp tools tsig tsiggss \
+	   tcp tools tsig tsiggss ttl \
 	   unknown upforwd verify views wildcard \
 	   xfer xferquota zero zonechecks

@@ -15,8 +15,8 @@ SYSTEMTESTTOP=../..
 SYSTESTDIR=autosign

 dumpit () {
-	echo "D:${debug}: dumping ${1}"
-	cat "${1}" | sed 's/^/D:/'
+	echo_d "${debug}: dumping ${1}"
+	cat "${1}" | cat_d
 }

 setup () {
@@ -236,7 +236,7 @@ status=`expr $status + $ret`

 echo_i "checking for nsec3param signing record ($n)"
 ret=0
-$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1 | sed 's/^/ns3 /' | cat_i
+$RNDCCMD 10.53.0.3 signing -list autonsec3.example. > signing.out.test$n 2>&1
 grep "Pending NSEC3 chain 1 0 20 DEAF" signing.out.test$n > /dev/null || ret=1
 n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "failed"; fi
@@ -42,7 +42,8 @@ tac() {
 }

 convert() {
-	local key=$1 n=$2
+	key=$1
+	n=$2
 	$DSFROMKEY $key >DS.$n
 	grep ' 8 1 ' DS.$n >DS.$n-1
 	grep ' 8 2 ' DS.$n >DS.$n-2
@@ -33,7 +33,7 @@ testcase() {
 	check_stdout
 	check_stderr
 	if [ "$expect" -ne "$result" ]; then
-                echo "D:exit status does not match $expect"
+                echo_d "exit status does not match $expect"
 		fail
 	fi
        unset name err out
@@ -45,19 +45,19 @@ check_stderr() {
 	else
 		[ -s err.$n ] || return 0
 	fi
-	echo "D:stderr did not match '$err'"
-	sed 's/^/D:/' err.$n
+	echo_d "stderr did not match '$err'"
+	cat err.$n | cat_d
 	fail
 }

 check_stdout() {
 	cmp out.$n "${out:-empty}" >/dev/null && return
-	echo "D:stdout did not match '$out'"
+	echo_d "stdout did not match '$out'"
 	(	echo "wanted"
 		cat "$out"
 		echo "got"
 		cat out.$n
-	) | sed 's/^/D:/'
+	) | cat_d
 	fail
 }

@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view two {
+	max-ncache-ttl 604801;
+};
@@ -0,0 +1,17 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view three {
+	max-ncache-ttl 4000000000;
+};
+view four {
+	max-ncache-ttl -1;
+};
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view four {
+	max-ncache-ttl -1;
+};
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-cache-ttl 1x;
+};
@@ -0,0 +1,14 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-ncache-ttl 1x;
+};
@@ -16,7 +16,7 @@ view two {
 	max-ncache-ttl 86400;
 };
 view three {
-	max-ncache-ttl 4000000000;
+	max-ncache-ttl 604800;
 };
 view four {
 	max-ncache-ttl 3600s;
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-cache-ttl 0;
+};
+view two {
+	min-cache-ttl 30;
+};
+view three {
+	min-cache-ttl 60;
+};
+view four {
+	min-cache-ttl 90s;
+};
+view five {
+	min-cache-ttl 1m;
+};
@@ -0,0 +1,26 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+view one {
+	min-ncache-ttl 0;
+};
+view two {
+	min-ncache-ttl 30;
+};
+view three {
+	min-ncache-ttl 60;
+};
+view four {
+	min-ncache-ttl 90s;
+};
+view five {
+	min-ncache-ttl 1m;
+};
@@ -15,10 +15,7 @@
 #

 # Find the top of the BIND9 tree.
-TOP=${SYSTEMTESTTOP:=.}/../../..
-
-# Make it absolute so that it continues to work after we cd.
-TOP=`cd $TOP && pwd`
+TOP=@abs_top_builddir@

 # Default algorithm for testing
 DEFAULT_ALGORITHM=ECDSAP256SHA256
@@ -105,7 +102,7 @@ PARALLELDIRS="acl additional addzone allow-query auth autosign \
 	rrchecker rrl rrsetorder rsabigexponent runtime \
 	serve-stale sfcache smartsign sortlist \
 	spf staticstub statistics statschannel stub synthfromdnssec \
-	tcp tools tsig tsiggss \
+	tcp tools tsig tsiggss ttl \
 	unknown upforwd verify views wildcard \
 	xfer xferquota zero zonechecks"

@@ -226,23 +223,36 @@ fi
 SYSTESTDIR="`basename $PWD`"

 echo_i() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
    done
 }

 echo_ic() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
    done
 }

 cat_i() {
-    while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
    done
 }

+echo_d() {
+    echo "$@" | while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+cat_d() {
+    while read __LINE ; do
+       echoinfo "D:$SYSTESTDIR:$__LINE"
+    done
+}
+
+
 digcomp() {
    output=`$PERL $SYSTEMTESTTOP/digcomp.pl "$@"`
    result=$?
@@ -100,7 +100,7 @@ SEQUENTIALDIRS="acl additional addzone autosign builtin \
 	 reclimit redirect resolver rndc rpz rrchecker rrl \
 	 rrsetorder rsabigexponent runtime sfcache smartsign sortlist \
 	 spf staticstub statistics statschannel stub tcp tkey tsig \
-	 tsiggss unknown upforwd verify views wildcard xfer xferquota \
+	 tsiggss ttl unknown upforwd verify views wildcard xfer xferquota \
 	 zero zonechecks"

 # List of tests that use unique ports (other than 5300 and 9953). These
@@ -203,20 +203,20 @@ echoend () {
 SYSTESTDIR="`basename $PWD`"

 echo_i() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
    done
 }

 echo_ic() {
-    echo "$@" | while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:  $LINE"
+    echo "$@" | while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:  $__LINE"
    done
 }

 cat_i() {
-    while read LINE ; do
-       echoinfo "I:$SYSTESTDIR:$LINE"
+    while read __LINE ; do
+       echoinfo "I:$SYSTESTDIR:$__LINE"
    done
 }

@@ -495,6 +495,14 @@ if [ -x ${DIG} ] ; then
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`

+  n=`expr $n + 1`
+  echo_i "check that dig -q -m works ($n)"
+  ret=0
+  $DIG $DIGOPTS @10.53.0.3 -q -m > dig.out.test$n 2>&1
+  grep '^;-m\..*IN.*A$' dig.out.test$n > /dev/null || ret=1
+  grep "Dump of all outstanding memory allocations" dig.out.test$n > /dev/null && ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
 else
  echo_i "$DIG is needed, so skipping these dig tests"
 fi
@@ -694,6 +702,24 @@ if [ -x ${DELV} ] ; then
  grep "a.example." < delv.out.test$n > /dev/null || ret=1
  if [ $ret != 0 ]; then echo_i "failed"; fi
  status=`expr $status + $ret`
+
+  n=`expr $n + 1`
+  echo_i "checking delv H is ignored, and treated like IN ($n)"
+  ret=0
+  $DELV $DELVOPTS @10.53.0.3 -c CH -t a a.example > delv.out.test$n || ret=1
+  grep "a.example." < delv.out.test$n > /dev/null || ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
+
+  n=`expr $n + 1`
+  echo_i "check that delv -q -m works ($n)"
+  ret=0
+  $DELV $DELVOPTS @10.53.0.3 -q -m > delv.out.test$n 2>&1
+  grep '^; -m\..*[0-9]*.*IN.*ANY.*;' delv.out.test$n > /dev/null || ret=1
+  grep "^add " delv.out.test$n > /dev/null && ret=1
+  grep "^del " delv.out.test$n > /dev/null && ret=1
+  if [ $ret != 0 ]; then echo_i "failed"; fi
+  status=`expr $status + $ret`
 else
  echo_i "$DELV is needed, so skipping these delv tests"
 fi
@@ -157,7 +157,7 @@ status=`expr $status + $ret`
 copy_setports ns3/named3.conf.in ns3/named.conf
 $RNDCCMD reconfig 2>&1 | sed 's/^/ns3 /' | cat_i

-echo_i "checking lame server clients are dropped at the soft limit"
+echo_i "checking lame server clients are dropped near the soft limit"
 ret=0
 fail=0
 exceeded=0
@@ -234,6 +234,13 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`
 $RNDCCMD 10.53.0.7 flush

+n=`expr $n + 1`
+echo_i "information that minimization was unsuccessful for .ugly is logged ($n)"
+ret=0
+grep "success resolving 'icky.icky.icky.ptang.zoop.boing.ugly/A' after disabling qname minimization due to 'FORMERR'" ns7/named.run > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 n=`expr $n + 1`
 echo_i "query for .slow is properly minimized when qname-minimization is on ($n)"
 ret=0
@@ -82,10 +82,11 @@ main(int argc, char **argv) {
 			}
 #ifdef USE_DNSRPS
 			printf("%s\n", librpz->dnsrpzd_path);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);

 		case 'n':
 			if (!link_dnsrps(&emsg)) {
@@ -132,10 +133,11 @@ main(int argc, char **argv) {
 			librpz->rsp_detach(&rsp);
 			librpz->client_detach(&client);
 			printf("%u\n", serial);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);

 		case 'w':
 			seconds = strtod(optarg, &p);
@@ -413,15 +413,15 @@ for mode in native dnsrps; do
  $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.4 > dig.out.${t}
  $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.3 >> dig.out.${t}
  $DIG $DIGOPTS l2.l1.l0 a @10.53.0.2 -p ${PORT} -b 10.53.0.2 >> dig.out.${t}
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.4.0.53.10.rpz-client-ip.log1" > /dev/null && {
    echo_i " failed: unexpected rewrite message for policy zone log1 was logged"
    status=1
  }
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.3.0.53.10.rpz-client-ip.log2" > /dev/null || {
    echo_i " failed: expected rewrite message for policy zone log2 was not logged"
    status=1
  }
-  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0 via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || {
+  sed -n "$cur,"'$p' < ns2/named.run | grep "view recursive: rpz CLIENT-IP Local-Data rewrite l2.l1.l0/A/IN via 32.2.0.53.10.rpz-client-ip.log3" > /dev/null || {
    echo_i " failed: expected rewrite message for policy zone log3 was not logged"
    status=1
  }
@@ -24,28 +24,6 @@ grep "another named process" ns2/named.run > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-if [ ! "$CYGWIN" ]; then
-    n=`expr $n + 1`
-    echo_i "verifying that named checks for conflicting listeners ($n)"
-    ret=0
-    (cd ns2; $NAMED -c named-alt1.conf -D ns2-extra-1 -X other.lock -m record,size,mctx -d 99 -g -U 4 >> named2.run 2>&1 & )
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-        grep "unable to listen on any configured interface" ns2/named2.run > /dev/null && break
-        sleep 1
-    done
-    grep "unable to listen on any configured interface" ns2/named2.run > /dev/null || ret=1
-    for i in 1 2 3 4 5 6 7 8 9
-    do
-	grep "exiting (due to fatal error)" ns2/named2.run > /dev/null && break
-	sleep 1
-    done
-    pid=`cat ns2/named2.pid 2>/dev/null`
-    test "${pid:+set}" = set && $KILL -15 ${pid} >/dev/null 2>&1
-    if [ $ret != 0 ]; then echo_i "failed"; fi
-    status=`expr $status + $ret`
-fi
-
 n=`expr $n + 1`
 echo_i "verifying that named checks for conflicting named processes ($n)"
 ret=0
@@ -0,0 +1,12 @@
+#!/bin/sh
+
+. ../conf.sh
+
+rm -f ./dig.out.*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./*/named.run
+rm -f ./ns*/named.lock
+rm -f ./ns*/_default.nzf
+rm -f ./ns*/_default.nzd*
+rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
@@ -0,0 +1,9 @@
+max-example.	1209600	IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				1209600    ; minimum (2 weeks)
+				)
+max-example.	1209600	IN NS	ns.max-example.
+ns.max-example.	1209600	IN A	10.53.0.1
@@ -0,0 +1,9 @@
+min-example.	0	IN SOA	ns root (
+				2000082401 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				0          ; minimum (0 seconds)
+				)
+min-example.	0	IN NS	ns.min-example.
+ns.min-example.	0	IN A	10.53.0.1
@@ -0,0 +1,46 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.1 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+options {
+	query-source address 10.53.0.1;
+	notify-source 10.53.0.1;
+	transfer-source 10.53.0.1;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.1; };
+	listen-on-v6 { none; };
+	recursion no;
+	check-integrity no;
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
+
+zone "min-example" {
+	type master;
+	file "min-example.db";
+};
+
+zone "max-example" {
+	type master;
+	file "max-example.db";
+};
@@ -0,0 +1,2 @@
+. 60 IN NS ns.nil.
+ns.nil. 60 IN A 10.53.0.1
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	directory ".";
+	query-source address 10.53.0.2;
+	notify-source 10.53.0.2;
+	transfer-source 10.53.0.2;
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.2; };
+	listen-on-v6 { none; };
+	servfail-ttl 0;
+	max-recursion-depth 12;
+	recursion yes;
+	dnssec-validation no;
+	min-cache-ttl 60;
+	min-ncache-ttl 30;
+	max-cache-ttl 120;
+	max-ncache-ttl 60;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." { type hint; file "hints.db"; };
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+. ../conf.sh
+
+$SHELL clean.sh
+copy_setports ns1/named.conf.in ns1/named.conf
+copy_setports ns2/named.conf.in ns2/named.conf
@@ -0,0 +1,35 @@
+#!/bin/sh
+
+. ../conf.sh
+
+dig_with_options() { "$DIG" +noadd +nosea +nostat +noquest +nocomm +nocmd -p "${PORT}" "$@"; }
+
+status=0
+t=0
+
+echo_i "testing min-cache-ttl"
+t=$((t+1))
+dig_with_options IN SOA min-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 60 ] || status=$((status+1))
+
+echo_i "testing min-ncache-ttl"
+t=$((t+1))
+dig_with_options IN MX min-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 30 ] || status=$((status+1))
+
+echo_i "testing max-cache-ttl"
+t=$((t+1))
+dig_with_options IN SOA max-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 120 ] || status=$((status+1))
+
+echo_i "testing max-ncache-ttl"
+t=$((t+1))
+dig_with_options IN MX max-example. @10.53.0.2 > dig.out.${t}
+TTL=$(< dig.out.${t} awk '{ print $2; }')
+[ "$TTL" -eq 60 ] || status=$((status+1))
+
+echo_i "exit status: $status"
+[ $status -eq 0 ] || exit 1
@@ -13,8 +13,8 @@ SYSTEMTESTTOP=../..
 SYSTESTDIR=verify

 dumpit () {
-	echo "D:${debug}: dumping ${1}"
-	cat "${1}" | sed 's/^/D:/'
+	echo_d "${debug}: dumping ${1}"
+	cat "${1}" | cat_d
 }
 setup () {
 	echo_i "setting up $2 zone: $1"
@@ -1535,7 +1535,7 @@ plus_option(char *option, struct query *query, bool global)
 * #true returned if value was used
 */
 static const char *single_dash_opts = "46himv";
-/*static const char *dash_opts = "46bcfhiptvx";*/
+static const char *dash_opts = "46bcfhiptvx";
 static bool
 dash_option(const char *option, char *next, struct query *query,
 	    bool global, bool *setname)
@@ -1755,6 +1755,20 @@ preparse_args(int argc, char **argv) {
 			}
 			option = &option[1];
 		}
+		if (strlen(option) == 0U) {
+			continue;
+		}
+		/* Look for dash value option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
+			continue;
+		}
+		/* Dash value is next argument so we need to skip it. */
+		rc--, rv++;
+		/* Handle missing argument */
+		if (rc == 0)
+			break;
 	}
 }

@@ -6,9 +6,6 @@
 /* Use AES for Client Cookie generation */
 #undef AES_CC

-/* define if ATF unit tests are to be built. */
-#undef ATF_TEST
-
 /* Define if you cannot bind() before connect() for TCP sockets. */
 #undef BROKEN_TCP_BIND_BEFORE_CONNECT

@@ -60,6 +57,9 @@
 /* Define to 1 if the compiler supports __builtin_expect. */
 #undef HAVE_BUILTIN_EXPECT

+/* define if the compiler supports __builtin_unreachable(). */
+#undef HAVE_BUILTIN_UNREACHABLE
+
 /* Define to 1 if you have the `catgets' function. */
 #undef HAVE_CATGETS

@@ -75,7 +75,7 @@
 /* Define to 1 if you have the <cmocka.h> header file. */
 #undef HAVE_CMOCKA_H

-/* Define to 1 if you have the `cpuset_setaffinty' function. */
+/* Define to 1 if you have the `cpuset_setaffinity' function. */
 #undef HAVE_CPUSET_SETAFFINITY

 /* Define to 1 if you have the `CRYPTO_zalloc' function. */
@@ -411,9 +411,6 @@
 /* Define to 1 if you have the <sys/param.h> header file. */
 #undef HAVE_SYS_PARAM_H

-/* Define to 1 if you have the <sys/prctl.h> header file. */
-#undef HAVE_SYS_PRCTL_H
-
 /* Define to 1 if you have the <sys/procset.h> header file. */
 #undef HAVE_SYS_PROCSET_H

@@ -349,6 +349,36 @@ typedef __int64 off_t;
 /* Verbose query trace logging */
@WANT_QUERYTRACE@

+/* Define to 1 if you have the `CRYPTO_zalloc' function. */
+@HAVE_CRYPTO_ZALLOC@
+
+/* Define to 1 if you have the `EVP_CIPHER_CTX_free' function. */
+@HAVE_EVP_CIPHER_CTX_FREE@
+
+/* Define to 1 if you have the `EVP_CIPHER_CTX_new' function. */
+@HAVE_EVP_CIPHER_CTX_NEW@
+
+/* Define to 1 if you have the `EVP_MD_CTX_free' function. */
+@HAVE_EVP_MD_CTX_FREE@
+
+/* Define to 1 if you have the `EVP_MD_CTX_new' function. */
+@HAVE_EVP_MD_CTX_NEW@
+
+/* Define to 1 if you have the `EVP_MD_CTX_reset' function. */
+@HAVE_EVP_MD_CTX_RESET@
+
+/* Define to 1 if you have the `HMAC_CTX_free' function. */
+@HAVE_HMAC_CTX_FREE@
+
+/* Define to 1 if you have the `HMAC_CTX_get_md' function. */
+@HAVE_HMAC_CTX_GET_MD@
+
+/* Define to 1 if you have the `HMAC_CTX_new' function. */
+@HAVE_HMAC_CTX_NEW@
+
+/* Define to 1 if you have the `HMAC_CTX_reset' function. */
+@HAVE_HMAC_CTX_RESET@
+
 /*
 * Define to nothing if C supports flexible array members, and to 1 if it does
 * not. That way, with a declaration like `struct s { int n; double
@@ -669,11 +669,9 @@ BIND9_ISCCFG_BUILDINCLUDE
 BIND9_ISCCC_BUILDINCLUDE
 BIND9_ISC_BUILDINCLUDE
 BIND9_TOP_BUILDDIR
-UNITTESTS
-ATFLIBS
-ATFBIN
-ATFBUILD
 LD_WRAP_TESTS
+KYUA
+UNITTESTS
 CMOCKA_LIBS
 CMOCKA_CFLAGS
 LIBIDN2_LDFLAGS
@@ -844,7 +842,6 @@ infodir
 docdir
 oldincludedir
 includedir
-runstatedir
 localstatedir
 sharedstatedir
 sysconfdir
@@ -928,7 +925,6 @@ with_libfstrm
 with_docbook_xsl
 with_libidn2
 with_cmocka
-with_atf
 with_tuning
 enable_querytrace
 enable_auto_validation
@@ -965,7 +961,8 @@ OPENSSL_LIBS
 LIBIDN2_CFLAGS
 LIBIDN2_LIBS
 CMOCKA_CFLAGS
-CMOCKA_LIBS'
+CMOCKA_LIBS
+KYUA'


 # Initialize some variables set by options.
@@ -1004,7 +1001,6 @@ datadir='${datarootdir}'
 sysconfdir='${prefix}/etc'
 sharedstatedir='${prefix}/com'
 localstatedir='${prefix}/var'
-runstatedir='${localstatedir}/run'
 includedir='${prefix}/include'
 oldincludedir='/usr/include'
 docdir='${datarootdir}/doc/${PACKAGE_TARNAME}'
@@ -1257,15 +1253,6 @@ do
  | -silent | --silent | --silen | --sile | --sil)
    silent=yes ;;

-  -runstatedir | --runstatedir | --runstatedi | --runstated \
-  | --runstate | --runstat | --runsta | --runst | --runs \
-  | --run | --ru | --r)
-    ac_prev=runstatedir ;;
-  -runstatedir=* | --runstatedir=* | --runstatedi=* | --runstated=* \
-  | --runstate=* | --runstat=* | --runsta=* | --runst=* | --runs=* \
-  | --run=* | --ru=* | --r=*)
-    runstatedir=$ac_optarg ;;
-
  -sbindir | --sbindir | --sbindi | --sbind | --sbin | --sbi | --sb)
    ac_prev=sbindir ;;
  -sbindir=* | --sbindir=* | --sbindi=* | --sbind=* | --sbin=* \
@@ -1403,7 +1390,7 @@ fi
 for ac_var in	exec_prefix prefix bindir sbindir libexecdir datarootdir \
 		datadir sysconfdir sharedstatedir localstatedir includedir \
 		oldincludedir docdir infodir htmldir dvidir pdfdir psdir \
-		libdir localedir mandir runstatedir
+		libdir localedir mandir
 do
  eval ac_val=\$$ac_var
  # Remove trailing slashes.
@@ -1556,7 +1543,6 @@ Fine tuning of the installation directories:
  --sysconfdir=DIR        read-only single-machine data [PREFIX/etc]
  --sharedstatedir=DIR    modifiable architecture-independent data [PREFIX/com]
  --localstatedir=DIR     modifiable single-machine data [PREFIX/var]
-  --runstatedir=DIR       modifiable per-process data [LOCALSTATEDIR/run]
  --libdir=DIR            object code libraries [EPREFIX/lib]
  --includedir=DIR        C header files [PREFIX/include]
  --oldincludedir=DIR     C header files for non-gcc [/usr/include]
@@ -1670,7 +1656,6 @@ Optional Packages:
  --with-libidn2=PATH     enable IDN support using GNU libidn2
                          [yes|no(default)|path]
  --with-cmocka=no        enable cmocka based tests (default is no)
-  --with-atf              support Automated Test Framework
  --with-tuning=ARG       Specify server tuning (large or default)
  --with-dlopen=ARG       support dynamically loadable DLZ and DYNDB drivers
  --with-dnsrps-libname   DNSRPS provider library name (librpz.so)
@@ -1720,6 +1705,7 @@ Some influential environment variables:
  CMOCKA_CFLAGS
              C compiler flags for CMOCKA, overriding pkg-config
  CMOCKA_LIBS linker flags for CMOCKA, overriding pkg-config
+  KYUA        path to kyua execution engine

 Use these variables to override the choices made by `configure' or to help
 it to find libraries and programs with nonstandard names/locations.
@@ -11697,6 +11683,44 @@ else
 $as_echo "no, using $LN_S" >&6; }
 fi

+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for a POSIX-compatible shell" >&5
+$as_echo_n "checking for a POSIX-compatible shell... " >&6; }
+if ${ac_cv_prog_shell+:} false; then :
+  $as_echo_n "(cached) " >&6
+else
+  ac_test_shell_script='
+			  test "$(expr 1 + 1)" = "2" &&
+			  test "$(( 1 + 1 ))" = "2"
+			  '
+
+			  for ac_cv_prog_shell in \
+			    "$CONFIG_SHELL" "$SHELL" /bin/sh /bin/bash /bin/ksh /bin/sh5 no; do
+			    case $ac_cv_prog_shell in #(
+  /*) :
+
+				      if "$ac_cv_prog_shell" -c "$ac_test_shell_script" 2>/dev/null; then :
+  ac_cv_path_shell=$SHELL
+fi
+				     ;; #(
+  *) :
+     ;;
+esac
+			  done
+
+fi
+{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_prog_shell" >&5
+$as_echo "$ac_cv_prog_shell" >&6; }
+	  if test "$ac_cv_prog_shell" = "no"; then :
+  SHELL=/bin/sh
+		 { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: using $SHELL, even though it does not conform to POSIX" >&5
+$as_echo "$as_me: WARNING: using $SHELL, even though it does not conform to POSIX" >&2;}
+
+else
+  SHELL="$ac_cv_prog_shell"
+
+fi
+
+



@@ -11883,7 +11907,6 @@ yes)
 	STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DNS_HOOKS_ENABLE=1"
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
-	test "${with_atf+set}" = set || with_atf=yes
 	test "${with_cmocka+set}" = set || with_cmocka=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
@@ -18123,6 +18146,38 @@ fi
 done


+#
+# Check for __builtin_unreachable
+#
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for __builtin_unreachable()" >&5
+$as_echo_n "checking compiler support for __builtin_unreachable()... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+__builtin_unreachable();
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define HAVE_BUILTIN_UNREACHABLE 1" >>confdefs.h
+
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
 #
 # Check for __builtin_expect
 #
@@ -19627,6 +19682,7 @@ case $with_cmocka in #(
    : ;; #(
  yes) :

+
 pkg_failed=no
 { $as_echo "$as_me:${as_lineno-$LINENO}: checking for cmocka >= 1.0.0" >&5
 $as_echo_n "checking for cmocka >= 1.0.0... " >&6; }
@@ -19718,7 +19774,9 @@ $as_echo "yes" >&6; }

 $as_echo "#define HAVE_CMOCKA 1" >>confdefs.h

-fi ;; #(
+fi
+            UNITTESTS=tests
+             ;; #(
  *) :

 	    save_CFLAGS="$CFLAGS"
@@ -19799,6 +19857,7 @@ if test "$ac_res" != no; then :

 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"
+                               UNITTESTS=tests

 $as_echo "#define HAVE_CMOCKA 1" >>confdefs.h

@@ -19814,169 +19873,110 @@ esac



-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for linker support for --wrap option" >&5
-$as_echo_n "checking for linker support for --wrap option... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdio.h>
-int
-main ()
-{
-__wrap_printf("success"); return (0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-
-$as_echo "#define LD_WRAP 1" >>confdefs.h
-
-     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-
-
-LDFLAGS=$save_LDFLAGS

 #
-# Check for -Wl,--wrap= support
+# Check for kyua execution engine if CMocka was requested
+# and bail out if execution engine was not found
 #

-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for linker support for --wrap option" >&5
-$as_echo_n "checking for linker support for --wrap option... " >&6; }
-cat confdefs.h - <<_ACEOF >conftest.$ac_ext
-/* end confdefs.h.  */
-#include <stdio.h>
-int
-main ()
-{
-__wrap_printf("success"); return (0);
-  ;
-  return 0;
-}
-_ACEOF
-if ac_fn_c_try_link "$LINENO"; then :
-  enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-
-$as_echo "#define LD_WRAP 1" >>confdefs.h
-
-     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-else
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
-$as_echo "no" >&6; }
-fi
-rm -f core conftest.err conftest.$ac_objext \
-    conftest$ac_exeext conftest.$ac_ext
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-
-
-LDFLAGS=$save_LDFLAGS
-
-#
-# Check whether to build Automated Test Framework unit tests
-#
-
-# Check whether --with-atf was given.
-if test "${with_atf+set}" = set; then :
-  withval=$with_atf; atf="$withval"
-else
-  atf="no"
-fi
-
-if test "yes" = "$atf"; then
-	atf=`pwd`/unit/atf
-	ATFBUILD=atf-src
-
-	ac_config_commands="$ac_config_commands atf-config"
-
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: building ATF from bind9/unit/atf-src" >&5
-$as_echo "building ATF from bind9/unit/atf-src" >&6; }
-fi
-
-ATFLIBS=
-if test "no" != "$atf"; then
-
-$as_echo "#define ATF_TEST 1" >>confdefs.h
-
-	STD_CINCLUDES="$STD_CINCLUDES -I$atf/include"
-	STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
-	ATFBIN="$atf/bin"
-	ATFLIBS="-L$atf/lib -latf-c"
-	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for exp in -lm" >&5
-$as_echo_n "checking for exp in -lm... " >&6; }
-if ${ac_cv_lib_m_exp+:} false; then :
+if test "$with_cmocka" != "no"; then :
+  for ac_prog in kyua
+do
+  # Extract the first word of "$ac_prog", so it can be a program name with args.
+set dummy $ac_prog; ac_word=$2
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for $ac_word" >&5
+$as_echo_n "checking for $ac_word... " >&6; }
+if ${ac_cv_path_KYUA+:} false; then :
  $as_echo_n "(cached) " >&6
 else
-  ac_check_lib_save_LIBS=$LIBS
-LIBS="-lm  $LIBS"
+  case $KYUA in
+  [\\/]* | ?:[\\/]*)
+  ac_cv_path_KYUA="$KYUA" # Let the user override the test with a path.
+  ;;
+  *)
+  as_save_IFS=$IFS; IFS=$PATH_SEPARATOR
+for as_dir in $PATH
+do
+  IFS=$as_save_IFS
+  test -z "$as_dir" && as_dir=.
+    for ac_exec_ext in '' $ac_executable_extensions; do
+  if as_fn_executable_p "$as_dir/$ac_word$ac_exec_ext"; then
+    ac_cv_path_KYUA="$as_dir/$ac_word$ac_exec_ext"
+    $as_echo "$as_me:${as_lineno-$LINENO}: found $as_dir/$ac_word$ac_exec_ext" >&5
+    break 2
+  fi
+done
+  done
+IFS=$as_save_IFS
+
+  ;;
+esac
+fi
+KYUA=$ac_cv_path_KYUA
+if test -n "$KYUA"; then
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: $KYUA" >&5
+$as_echo "$KYUA" >&6; }
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+fi
+
+
+  test -n "$KYUA" && break
+done
+
+       if test -z "$KYUA"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: kyua test execution engine not found" >&5
+$as_echo "$as_me: WARNING: kyua test execution engine not found" >&2;}
+fi
+fi
+
+
+
+#
+# Check for -Wl,--wrap= support
+#
+
+save_LDFLAGS=$LDFLAGS
+LDFLAGS="--wrap=printf"
+
+LD_WRAP_TESTS=false
+enable_ld_wrap=no
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for linker support for --wrap option" >&5
+$as_echo_n "checking for linker support for --wrap option... " >&6; }
 cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 /* end confdefs.h.  */
-
-/* Override any GCC internal prototype to avoid an error.
-   Use char because int might match the return type of a GCC
-   builtin and then its argument prototype would still apply.  */
-#ifdef __cplusplus
-extern "C"
-#endif
-char exp ();
+#include <stdio.h>
 int
 main ()
 {
-return exp ();
+__wrap_printf("success"); return (0);
  ;
  return 0;
 }
 _ACEOF
 if ac_fn_c_try_link "$LINENO"; then :
-  ac_cv_lib_m_exp=yes
+  enable_ld_wrap=yes
+     LD_WRAP_TESTS=true
+
+$as_echo "#define LD_WRAP 1" >>confdefs.h
+
+     { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
 else
-  ac_cv_lib_m_exp=no
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
 fi
 rm -f core conftest.err conftest.$ac_objext \
    conftest$ac_exeext conftest.$ac_ext
-LIBS=$ac_check_lib_save_LIBS
-fi
-{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $ac_cv_lib_m_exp" >&5
-$as_echo "$ac_cv_lib_m_exp" >&6; }
-if test "x$ac_cv_lib_m_exp" = xyes; then :
-  libm=yes
-else
-  libm=no
-fi
-
-	if test "yes" = "$libm"; then
-		ATFLIBS="$ATFLIBS -lm"
-	fi
-	UNITTESTS=tests
-fi
-
+# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])


+LDFLAGS=$save_LDFLAGS

+#
+# Check for i18n
+#
 for ac_header in locale.h
 do :
  ac_fn_c_check_header_mongrel "$LINENO" "locale.h" "ac_cv_header_locale_h" "$ac_includes_default"
@@ -21632,7 +21632,7 @@ ac_config_commands="$ac_config_commands chmod"
 # elsewhere if there's a good reason for doing so.
 #

-ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/pthreads/Makefile lib/isc/pthreads/include/Makefile lib/isc/pthreads/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/ns/Makefile lib/ns/include/Makefile lib/ns/include/ns/Makefile lib/ns/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/Makefile unit/unittest.sh fuzz/Makefile"
+ac_config_files="$ac_config_files make/Makefile make/mkdep Makefile bin/Makefile bin/check/Makefile bin/confgen/Makefile bin/confgen/unix/Makefile bin/delv/Makefile bin/dig/Makefile bin/dnssec/Makefile bin/named/Makefile bin/named/unix/Makefile bin/nsupdate/Makefile bin/pkcs11/Makefile bin/python/Makefile bin/python/isc/Makefile bin/python/isc/utils.py bin/python/isc/tests/Makefile bin/python/dnssec-checkds.py bin/python/dnssec-coverage.py bin/python/dnssec-keymgr.py bin/python/isc/__init__.py bin/python/isc/checkds.py bin/python/isc/coverage.py bin/python/isc/dnskey.py bin/python/isc/eventlist.py bin/python/isc/keydict.py bin/python/isc/keyevent.py bin/python/isc/keymgr.py bin/python/isc/keyseries.py bin/python/isc/keyzone.py bin/python/isc/policy.py bin/python/isc/rndc.py bin/python/isc/tests/dnskey_test.py bin/python/isc/tests/policy_test.py bin/rndc/Makefile bin/tests/Makefile bin/tests/headerdep_test.sh bin/tests/optional/Makefile bin/tests/pkcs11/Makefile bin/tests/pkcs11/benchmarks/Makefile bin/tests/system/Makefile bin/tests/system/conf.sh bin/tests/system/dlz/prereq.sh bin/tests/system/dlzexternal/Makefile bin/tests/system/dlzexternal/ns1/dlzs.conf bin/tests/system/dyndb/Makefile bin/tests/system/dyndb/driver/Makefile bin/tests/system/pipelined/Makefile bin/tests/system/rndc/Makefile bin/tests/system/rpz/Makefile bin/tests/system/rsabigexponent/Makefile bin/tests/system/tkey/Makefile bin/tests/virtual-time/Makefile bin/tests/virtual-time/conf.sh bin/tools/Makefile contrib/scripts/check-secure-delegation.pl contrib/scripts/zone-edit.sh doc/Makefile doc/arm/Makefile doc/arm/noteversion.xml doc/arm/pkgversion.xml doc/arm/releaseinfo.xml doc/doxygen/Doxyfile doc/doxygen/Makefile doc/doxygen/doxygen-input-filter doc/misc/Makefile doc/tex/Makefile doc/tex/armstyle.sty doc/xsl/Makefile doc/xsl/isc-docbook-chunk.xsl doc/xsl/isc-docbook-html.xsl doc/xsl/isc-manpage.xsl doc/xsl/isc-notes-html.xsl isc-config.sh lib/Makefile lib/bind9/Makefile lib/bind9/include/Makefile lib/bind9/include/bind9/Makefile lib/dns/Makefile lib/dns/include/Makefile lib/dns/include/dns/Makefile lib/dns/include/dst/Makefile lib/dns/tests/Makefile lib/irs/Makefile lib/irs/include/Makefile lib/irs/include/irs/Makefile lib/irs/include/irs/netdb.h lib/irs/include/irs/platform.h lib/irs/tests/Makefile lib/isc/pthreads/Makefile lib/isc/pthreads/include/Makefile lib/isc/pthreads/include/isc/Makefile lib/isc/Makefile lib/isc/include/Makefile lib/isc/include/isc/Makefile lib/isc/include/isc/platform.h lib/isc/include/pk11/Makefile lib/isc/include/pkcs11/Makefile lib/isc/tests/Makefile lib/isc/nls/Makefile lib/isc/unix/Makefile lib/isc/unix/include/Makefile lib/isc/unix/include/isc/Makefile lib/isc/unix/include/pkcs11/Makefile lib/isccc/Makefile lib/isccc/include/Makefile lib/isccc/include/isccc/Makefile lib/isccc/tests/Makefile lib/isccfg/Makefile lib/isccfg/include/Makefile lib/isccfg/include/isccfg/Makefile lib/isccfg/tests/Makefile lib/ns/Makefile lib/ns/include/Makefile lib/ns/include/ns/Makefile lib/ns/tests/Makefile lib/samples/Makefile lib/samples/Makefile-postinstall unit/unittest.sh fuzz/Makefile"


 #
@@ -22614,7 +22614,6 @@ fi



-atfdir=`pwd`/unit/atf

 _ACEOF

@@ -22628,7 +22627,6 @@ do
    "libtool") CONFIG_COMMANDS="$CONFIG_COMMANDS libtool" ;;
    "make/rules") CONFIG_FILES="$CONFIG_FILES make/rules" ;;
    "make/includes") CONFIG_FILES="$CONFIG_FILES make/includes" ;;
-    "atf-config") CONFIG_COMMANDS="$CONFIG_COMMANDS atf-config" ;;
    "contrib/dlz/bin/dlzbdb/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/dlz/bin/dlzbdb/Makefile" ;;
    "$DLZ_DRIVER_RULES") CONFIG_FILES="$CONFIG_FILES $DLZ_DRIVER_RULES" ;;
    "contrib/dlz/modules/mysql/Makefile") CONFIG_FILES="$CONFIG_FILES contrib/dlz/modules/mysql/Makefile" ;;
@@ -22742,6 +22740,7 @@ do
    "lib/isccc/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccc/Makefile" ;;
    "lib/isccc/include/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccc/include/Makefile" ;;
    "lib/isccc/include/isccc/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccc/include/isccc/Makefile" ;;
+    "lib/isccc/tests/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccc/tests/Makefile" ;;
    "lib/isccfg/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccfg/Makefile" ;;
    "lib/isccfg/include/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccfg/include/Makefile" ;;
    "lib/isccfg/include/isccfg/Makefile") CONFIG_FILES="$CONFIG_FILES lib/isccfg/include/isccfg/Makefile" ;;
@@ -22752,7 +22751,6 @@ do
    "lib/ns/tests/Makefile") CONFIG_FILES="$CONFIG_FILES lib/ns/tests/Makefile" ;;
    "lib/samples/Makefile") CONFIG_FILES="$CONFIG_FILES lib/samples/Makefile" ;;
    "lib/samples/Makefile-postinstall") CONFIG_FILES="$CONFIG_FILES lib/samples/Makefile-postinstall" ;;
-    "unit/Makefile") CONFIG_FILES="$CONFIG_FILES unit/Makefile" ;;
    "unit/unittest.sh") CONFIG_FILES="$CONFIG_FILES unit/unittest.sh" ;;
    "fuzz/Makefile") CONFIG_FILES="$CONFIG_FILES fuzz/Makefile" ;;

@@ -23892,15 +23890,6 @@ ltmain=$ac_aux_dir/ltmain.sh
  chmod +x "$ofile"

 ;;
-    "atf-config":C) (
-		 mkdir -p unit/atf-src;
-		 cd unit/atf-src;
-		 case "$srcdir" in
-		 /*) ;;
-		 *) srcdir="../../$srcdir";;
-		 esac
-		 ${SHELL} "${srcdir}${srcdir:+/unit/atf-src/}./configure" --enable-tools --disable-shared MISSING=: --prefix $atfdir;
-		) || as_fn_error $? "Failed to configure ATF." "$LINENO" 5  ;;
    "chmod":C) chmod a+x isc-config.sh doc/doxygen/doxygen-input-filter ;;

  esac
@@ -24013,7 +24002,7 @@ report() {
    test "no" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
    test "yes" = "$want_querytrace" && \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
-    test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"
+    test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"

    test "no" = "$want_autoval" || echo "    DNSSEC validation active by default (--enable-auto-validation)"

@@ -24068,7 +24057,7 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"

    test "yes" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
-    test "no" = "$atf" && echo "    Automated Testing Framework (--with-atf)"
+    test "no" = "$with_cmocka" && echo "    CMocka Unit Testng Framework (--with-cmocka)"

    test "X$PYTHON" = "X" && echo "    Python tools (--with-python)"
    test "X$XMLSTATS" = "X" && echo "    XML statistics (--with-libxml2)"
@@ -24,6 +24,7 @@ AC_PROG_MAKE_SET
 AC_PROG_LIBTOOL
 AC_PROG_INSTALL
 AC_PROG_LN_S
+AX_POSIX_SHELL

 AC_SUBST(STD_CINCLUDES)
 AC_SUBST(STD_CDEFINES)
@@ -78,7 +79,6 @@ yes)
 	STD_CDEFINES="$STD_CDEFINES -DISC_MEM_DEFAULTFILL=1 -DISC_LIST_CHECKINIT=1 -DNS_HOOKS_ENABLE=1"
 	test "${enable_fixed_rrset+set}" = set || enable_fixed_rrset=yes
 	test "${enable_querytrace+set}" = set || enable_querytrace=yes
-	test "${with_atf+set}" = set || with_atf=yes
 	test "${with_cmocka+set}" = set || with_cmocka=yes
 	test "${with_dlz_filesystem+set}" = set || with_dlz_filesystem=yes
 	test "${enable_symtable+set}" = set || enable_symtable=all
@@ -2016,6 +2016,21 @@ LIBS="$LIBS $ISC_ATOMIC_LIBS"

 AC_CHECK_HEADERS([uchar.h])

+#
+# Check for __builtin_unreachable
+#
+AC_MSG_CHECKING([compiler support for __builtin_unreachable()])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[]],
+     [[__builtin_unreachable();]]
+   )],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_UNREACHABLE], [1], [define if the compiler supports __builtin_unreachable().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
+
 #
 # Check for __builtin_expect
 #
@@ -2389,8 +2404,11 @@ AC_ARG_WITH([cmocka],

 AS_CASE([$with_cmocka],
 	[no],[:],
-	[yes],[PKG_CHECK_MODULES([CMOCKA], [cmocka >= 1.0.0],
-				 [AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])])],
+	[yes],[
+            PKG_CHECK_MODULES([CMOCKA], [cmocka >= 1.0.0],
+			      [AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])])
+            UNITTESTS=tests
+            ],
 	[*],[
 	    save_CFLAGS="$CFLAGS"
 	    save_LIBS="$LIBS"
@@ -2408,98 +2426,52 @@ AS_CASE([$with_cmocka],
 			   [
 			       CMOCKA_CFLAGS="-I$with_cmocka/include"
 			       CMOCKA_LIBS="-L$with_cmocka/lib -lcmocka"
+                               UNITTESTS=tests
 			       AC_DEFINE([HAVE_CMOCKA], [1], [Use cmocka])
 			   ],
 			   [AC_MSG_ERROR([cmocka unit testing framework not found in $with_cmocka path])])
 	    ])
 AC_SUBST([CMOCKA_CFLAGS])
 AC_SUBST([CMOCKA_LIBS])
-
-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-AC_MSG_CHECKING([for linker support for --wrap option])
-AC_LINK_IFELSE(
-    [AC_LANG_PROGRAM([#include <stdio.h>], [__wrap_printf("success"); return (0);])],
-    [enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-     AC_DEFINE([LD_WRAP], [1], [define if the linker supports --wrap option])
-     AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no])])
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-AC_SUBST([LD_WRAP_TESTS])
-
-LDFLAGS=$save_LDFLAGS
-
-#
-# Check for -Wl,--wrap= support
-#
-
-save_LDFLAGS=$LDFLAGS
-LDFLAGS="--wrap=printf"
-
-LD_WRAP_TESTS=false
-enable_ld_wrap=no
-AC_MSG_CHECKING([for linker support for --wrap option])
-AC_LINK_IFELSE(
-    [AC_LANG_PROGRAM([#include <stdio.h>], [__wrap_printf("success"); return (0);])],
-    [enable_ld_wrap=yes
-     LD_WRAP_TESTS=true
-     AC_DEFINE([LD_WRAP], [1], [define if the linker supports --wrap option])
-     AC_MSG_RESULT([yes])],
-    [AC_MSG_RESULT([no])])
-# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
-AC_SUBST([LD_WRAP_TESTS])
-
-LDFLAGS=$save_LDFLAGS
-
-#
-# Check whether to build Automated Test Framework unit tests
-#
-AC_ARG_WITH(atf,
-	    AS_HELP_STRING([--with-atf],[support Automated Test Framework]),
-	atf="$withval", atf="no")
-if test "yes" = "$atf"; then
-	atf=`pwd`/unit/atf
-	ATFBUILD=atf-src
-	AC_SUBST(ATFBUILD)
-	AC_CONFIG_COMMANDS([atf-config],
-		[(
-		 mkdir -p unit/atf-src;
-		 cd unit/atf-src;
-		 case "$srcdir" in
-		 /*) ;;
-		 *) srcdir="../../$srcdir";;
-		 esac
-		 ${SHELL} "${srcdir}${srcdir:+/unit/atf-src/}./configure" --enable-tools --disable-shared MISSING=: --prefix $atfdir;
-		) || AC_MSG_ERROR([Failed to configure ATF.]) ],
-		[atfdir=`pwd`/unit/atf])
-	AC_MSG_RESULT(building ATF from bind9/unit/atf-src)
-fi
-
-ATFLIBS=
-if test "no" != "$atf"; then
-	AC_DEFINE(ATF_TEST, 1, [define if ATF unit tests are to be built.])
-	STD_CINCLUDES="$STD_CINCLUDES -I$atf/include"
-	STD_CDEFINES="$STD_CDEFINES -DNS_HOOKS_ENABLE=1"
-	ATFBIN="$atf/bin"
-	ATFLIBS="-L$atf/lib -latf-c"
-	AC_CHECK_LIB(m, exp, libm=yes, libm=no)
-	if test "yes" = "$libm"; then
-		ATFLIBS="$ATFLIBS -lm"
-	fi
-	UNITTESTS=tests
-fi
-AC_SUBST(ATFBIN)
-AC_SUBST(ATFLIBS)
 AC_SUBST(UNITTESTS)

+#
+# Check for kyua execution engine if CMocka was requested
+# and bail out if execution engine was not found
+#
+AC_ARG_VAR([KYUA], [path to kyua execution engine])
+AS_IF([test "$with_cmocka" != "no"],
+      [AC_PATH_PROGS([KYUA], [kyua], [])
+       AS_IF([test -z "$KYUA"],
+            [AC_MSG_WARN([kyua test execution engine not found])])])
+
+AC_SUBST([KYUA])
+
+#
+# Check for -Wl,--wrap= support
+#
+
+save_LDFLAGS=$LDFLAGS
+LDFLAGS="--wrap=printf"
+
+LD_WRAP_TESTS=false
+enable_ld_wrap=no
+AC_MSG_CHECKING([for linker support for --wrap option])
+AC_LINK_IFELSE(
+    [AC_LANG_PROGRAM([#include <stdio.h>], [__wrap_printf("success"); return (0);])],
+    [enable_ld_wrap=yes
+     LD_WRAP_TESTS=true
+     AC_DEFINE([LD_WRAP], [1], [define if the linker supports --wrap option])
+     AC_MSG_RESULT([yes])],
+    [AC_MSG_RESULT([no])])
+# AM_CONDITIONAL([LD_WRAP], [test $enable_ld_wrap = yes])
+AC_SUBST([LD_WRAP_TESTS])
+
+LDFLAGS=$save_LDFLAGS
+
+#
+# Check for i18n
+#
 AC_CHECK_HEADERS(locale.h)
 AC_CHECK_FUNCS(setlocale)

@@ -3137,6 +3109,7 @@ AC_CONFIG_FILES([
 	lib/isccc/Makefile
 	lib/isccc/include/Makefile
 	lib/isccc/include/isccc/Makefile
+	lib/isccc/tests/Makefile
 	lib/isccfg/Makefile
 	lib/isccfg/include/Makefile
 	lib/isccfg/include/isccfg/Makefile
@@ -3147,7 +3120,6 @@ AC_CONFIG_FILES([
 	lib/ns/tests/Makefile
 	lib/samples/Makefile
 	lib/samples/Makefile-postinstall
-	unit/Makefile
 	unit/unittest.sh
 	fuzz/Makefile
 ])
@@ -3224,7 +3196,7 @@ report() {
    test "no" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
    test "yes" = "$want_querytrace" && \
 	echo "    Very verbose query trace logging (--enable-querytrace)"
-    test "no" = "$atf" || echo "    Automated Testing Framework (--with-atf)"
+    test "no" = "$with_cmocka" || echo "    CMocka Unit Testing Framework (--with-cmocka)"

    test "no" = "$want_autoval" || echo "    DNSSEC validation active by default (--enable-auto-validation)"

@@ -3279,7 +3251,7 @@ report() {
 	echo "    Very verbose query trace logging (--enable-querytrace)"

    test "yes" = "$use_libtool" || echo "    Use GNU libtool (--with-libtool)"
-    test "no" = "$atf" && echo "    Automated Testing Framework (--with-atf)"
+    test "no" = "$with_cmocka" && echo "    CMocka Unit Testng Framework (--with-cmocka)"

    test "X$PYTHON" = "X" && echo "    Python tools (--with-python)"
    test "X$XMLSTATS" = "X" && echo "    XML statistics (--with-libxml2)"
@@ -60,6 +60,7 @@
 #include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/result.h>
+#include <isc/string.h>
 #include <isc/util.h>

 #include <named/globals.h>
@@ -438,12 +439,12 @@ process_dir(isc_dir_t *dir, void *passback, config_data_t *cd,
 					 */
 					if (strcmp((char *) &dir->entry.name[6],
 						   "-") == 0)
-						strcpy(host, "*");
-					else {
-						strncpy(host,
+					{
+						strlcpy(host, "*", sizeof(host));
+					} else {
+						strlcpy(host,
 						   (char *) &dir->entry.name[6],
-						   sizeof(host) - 1);
-						host[NAME_MAX-1] = '\0';
+						   sizeof(host));
 					}
 					foundHost = true;
 					break;
@@ -655,7 +656,8 @@ fs_allnodes(const char *zone, void *driverarg, void *dbdata,
 	ISC_LIST_INIT(*dir_list);

 	if (create_path(zone, NULL, NULL, cd, &basepath) != ISC_R_SUCCESS) {
-		return (ISC_R_NOTFOUND);
+		result = ISC_R_NOTFOUND;
+		goto complete_allnds;
 	}

 	/* remove path separator at end of path so stat works properly */
@@ -4311,6 +4311,8 @@ badresp:1,adberr:0,findfail:0,valfail:0]
 		  <command>max-ncache-ttl</command>,
 		  <command>max-stale-ttl</command>,
 		  <command>max-cache-size</command>, and
+		  <command>min-cache-ttl</command>,
+		  <command>min-ncache-ttl</command>,
 		  <command>zero-no-soa-ttl</command>.
 		</para>

@@ -8995,6 +8997,38 @@ avoid-v6-udp-ports { 40000; range 50000 60000; };
 	      </listitem>
 	    </varlistentry>

+	    <varlistentry>
+	      <term><command>min-ncache-ttl</command></term>
+	      <listitem>
+		<para>
+		  To reduce network traffic and increase performance, the server
+		  stores negative answers. <command>min-ncache-ttl</command> is
+		  used to set a minimum retention time for these answers in the
+		  server in seconds.  For convenience, TTL-style time unit
+		  suffixes may be used to specify the value.  The default
+		  <command>min-ncache-ttl</command> is <literal>0</literal>
+		  seconds.  <command>min-ncache-ttl</command> cannot exceed 90
+		  seconds and will be truncated to 90 seconds if set to a
+		  greater value.
+		</para>
+	      </listitem>
+	    </varlistentry>
+
+	    <varlistentry>
+	      <term><command>min-cache-ttl</command></term>
+	      <listitem>
+		<para>
+		  Sets the minimum time for which the server will cache ordinary
+		  (positive) answers in seconds. For convenience, TTL-style time
+		  unit suffixes may be used to specify the value. The default
+		  <command>min-cache-ttl</command> is <literal>0</literal>
+		  seconds. <command>min-cache-ttl</command> cannot exceed 90
+		  seconds and will be truncated to 90 seconds if set to a
+		  greater value.
+		</para>
+	      </listitem>
+	    </varlistentry>
+
 	    <varlistentry>
 	      <term><command>max-ncache-ttl</command></term>
 	      <listitem>
@@ -11044,17 +11078,6 @@ example.com                 CNAME   rpz-tcp-only.
 	  javascript-capable browser.
 	</para>

-	<para>
-	  Applications that depend on a particular XML schema
-	  can request
-	  <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://127.0.0.1:8888/xml/v2">http://127.0.0.1:8888/xml/v2</link> for version 2
-	  of the statistics XML schema or
-	  <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://127.0.0.1:8888/xml/v3">http://127.0.0.1:8888/xml/v3</link> for version 3.
-	  If the requested schema is supported by the server, then
-	  it will respond; if not, it will return a "page not found"
-	  error.
-	</para>
-
 	<para>
 	  Broken-out subsets of the statistics can be viewed at
 	  <link xmlns:xlink="http://www.w3.org/1999/xlink" xlink:href="http://127.0.0.1:8888/xml/v3/status">http://127.0.0.1:8888/xml/v3/status</link>
@@ -131,6 +131,15 @@

  <section xml:id="relnotes_features"><info><title>New Features</title></info>
    <itemizedlist>
+      <listitem>
+	<para>
+	  Task manager and socket code have been substantially modified.
+	  The manager uses per-cpu queues for tasks and network stack runs
+	  multiple event loops in CPU-affinitive threads. This greatly
+	  improves performance on large systems, especially when using
+	  multi-queue NICs.
+	</para>
+      </listitem>
      <listitem>
 	<para>
 	  A new secondary zone option, <command>mirror</command>,
@@ -216,6 +225,22 @@
 	  must be only enabled for the systems where FIPS mode is available.
 	</para>
      </listitem>
+      <listitem>
+	<para>
+	  Two new configuration options <command>min-cache-ttl</command> and
+	  <command>min-ncache-ttl</command> has been added to allow the BIND 9
+	  administrator to override the minimum TTL in the received DNS records
+	  (positive caching) and for storing the information about non-existent
+	  records (negative caching).  The configured minimum TTL for both
+	  configuration options cannot exceed 90 seconds.
+	</para>
+      </listitem>
+      <listitem>
+	<para>
+	  The configuration option <command>max-ncache-ttl</command> was
+	  silently capped to 7 days, and the upper limit is now enforced.
+	</para>
+      </listitem>
    </itemizedlist>
  </section>

@@ -197,27 +197,10 @@ points to `rndc`, `SIGNZONE` to `dnssec-signzone`, etc.

 #### <a name="unittest"></a> Building unit tests

-BIND uses the Automated Testing Framework (ATF), originally from the NetBSD
-project, as its unit testing framework.  (Note: ATF has been supplanted by
-a newer version called Kyua, but BIND is still using the older system.)
+BIND uses the cmocka, unit testing framework.

-To build BIND with unit tests, run `configure` with the `--with-atf`
-option.  This causes the ATF source code in the `unit/atf-src`
-subdirectory to be built.  
-
-To save time on repeated builds, you can build and install ATF
-in another directory, and configure BIND to use the pre-built
-version.  (Be sure to disable shared libraries in the ATF build,
-and to build the ATF tools; libraries alone are not sufficient).
-
-        $ cd atf-src
-        $ configure --prefix=<prefix> --enable-tools --disable-shared
-        $ make
-        $ make install
-
-After this has been done, specify the ATF prefix when building BIND:
-
-        $ configure --with-atf=<prefix>
+To build BIND with unit tests, run `configure` with the `--with-cmocka`
+option.  This requires cmocka >= 1.0.0 to be installed in the system.

 #### Running unit tests

@@ -249,53 +232,11 @@ redirected:

 #### Writing unit tests

-Information on writing ATF tests can be found at the
-[NetBSD site](http://wiki.netbsd.org/tutorials/atf/).
+Information on writing cmocka tests can be found at the
+[cmocka website](https://cmocka.org).

-New unit tests should be added whenever significant new API
-functionality is added to libdns or libisc.
-
-Each unit test file contains at least one unit test case, and
-a list of test cases to execute when the test is run.  These
-will look like the following:
-
-        ATF_TC(test_case);
-        ATF_TC_HEAD(test_case, tc) {
-                atf_tc_set_md_var(tc, "descr",
-                                  "Describe the test case here.");
-        }
-        ATF_TC_BODY(serialize_align, tc) {
-                UNUSED(tc);
-
-                result = isc_test_begin(NULL, true);
-                ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
-
-                ATF_CHECK_EQ(value1, value2);
-                ATF_CHECK(value1 + value2 < 100);
-
-                isc_test_end();
-        }
-
-        /*
-         * Main
-         */
-        ATF_TP_ADD_TCS(tp) {
-                ATF_TP_ADD_TC(tp, test_case);
-        
-                return (atf_no_error());
-        }
-
-If the conditions specified in `ATF_CHECK` and `ATF_CHECK_EQ`
-directives are found to be false, then the test case will fail, but it
-will continue running to see if there are any more failures.
-
-If the conditions specified in `ATF_REQUIRE` and `ATF_REQUIRE_EQ` are
-found to be false, the test case cannot continue running and will stop
-
-`isc_test_begin()` and `isc_test_end()` set up necessary preconditions
-for checking libisc functions, such as starting a task manger and
-creating a memory context.  Similar functions `dns_test_begin()` and
-`dns_test_end()` are available for testing libdns functions.
+New unit tests should be added whenever new API functionality is added to the
+libraries.

 ### <a name="arch"></a> BIND system architecture

@@ -89,9 +89,9 @@ options {
        bindkeys-file <quoted_string>;
        blackhole { <address_match_element>; ... };
        cache-file <quoted_string>;
-        catalog-zones { zone <quoted_string> [ default-masters [ port
-            <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [
-            port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
+        catalog-zones { zone <string> [ default-masters [ port <integer> ]
+            [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port
+            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
            <string> ]; ... } ] [ zone-directory <quoted_string> ] [
            in-memory <boolean> ] [ min-update-interval <ttlval> ]; ... };
        check-dup-records ( fail | warn | ignore );
@@ -183,7 +183,7 @@ options {
        fstrm-set-output-queue-model ( mpsc | spsc );
        fstrm-set-output-queue-size <integer>;
        fstrm-set-reopen-interval <ttlval>;
-        geoip-directory ( <quoted_string> | none );
+        geoip-directory ( <quoted_string> | none ); // not configured
        geoip-use-ecs <boolean>; // obsolete
        glue-cache <boolean>;
        has-old-clients <boolean>; // obsolete
@@ -234,6 +234,8 @@ options {
        memstatistics <boolean>;
        memstatistics-file <quoted_string>;
        message-compression <boolean>;
+        min-cache-ttl <ttlval>;
+        min-ncache-ttl <ttlval>;
        min-refresh-time <integer>;
        min-retry-time <integer>;
        min-roots <integer>; // not implemented
@@ -305,18 +307,17 @@ options {
        resolver-retry-interval <integer>;
        response-padding { <address_match_element>; ... } block-size
            <integer>;
-        response-policy { zone <quoted_string> [ log <boolean> ] [
-            max-policy-ttl <ttlval> ] [ min-update-interval <ttlval> ] [
-            policy ( cname | disabled | drop | given | no-op | nodata |
-            nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ break-dnssec <boolean> ] [
-            max-policy-ttl <ttlval> ] [ min-update-interval <ttlval> ] [
-            min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [
-            qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [
-            nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
+        response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
+            <ttlval> ] [ min-update-interval <ttlval> ] [ policy ( cname |
+            disabled | drop | given | no-op | nodata | nxdomain | passthru
+            | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [
+            nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [
+            break-dnssec <boolean> ] [ max-policy-ttl <ttlval> ] [
+            min-update-interval <ttlval> ] [ min-ns-dots <integer> ] [
+            nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ]
+            [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [
+            nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [
+            dnsrps-options { <unspecified-text> } ];
        rfc2308-type1 <boolean>; // not yet implemented
        root-delegation-only [ exclude { <string>; ... } ];
        root-key-sentinel <boolean>;
@@ -457,9 +458,9 @@ view <string> [ <class> ] {
        auth-nxdomain <boolean>; // default changed
        auto-dnssec ( allow | maintain | off );
        cache-file <quoted_string>;
-        catalog-zones { zone <quoted_string> [ default-masters [ port
-            <integer> ] [ dscp <integer> ] { ( <masters> | <ipv4_address> [
-            port <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
+        catalog-zones { zone <string> [ default-masters [ port <integer> ]
+            [ dscp <integer> ] { ( <masters> | <ipv4_address> [ port
+            <integer> ] | <ipv6_address> [ port <integer> ] ) [ key
            <string> ]; ... } ] [ zone-directory <quoted_string> ] [
            in-memory <boolean> ] [ min-update-interval <ttlval> ]; ... };
        check-dup-records ( fail | warn | ignore );
@@ -574,6 +575,8 @@ view <string> [ <class> ] {
        max-udp-size <integer>;
        max-zone-ttl ( unlimited | <ttlval> );
        message-compression <boolean>;
+        min-cache-ttl <ttlval>;
+        min-ncache-ttl <ttlval>;
        min-refresh-time <integer>;
        min-retry-time <integer>;
        min-roots <integer>; // not implemented
@@ -635,18 +638,17 @@ view <string> [ <class> ] {
        resolver-retry-interval <integer>;
        response-padding { <address_match_element>; ... } block-size
            <integer>;
-        response-policy { zone <quoted_string> [ log <boolean> ] [
-            max-policy-ttl <ttlval> ] [ min-update-interval <ttlval> ] [
-            policy ( cname | disabled | drop | given | no-op | nodata |
-            nxdomain | passthru | tcp-only <quoted_string> ) ] [
-            recursive-only <boolean> ] [ nsip-enable <boolean> ] [
-            nsdname-enable <boolean> ]; ... } [ break-dnssec <boolean> ] [
-            max-policy-ttl <ttlval> ] [ min-update-interval <ttlval> ] [
-            min-ns-dots <integer> ] [ nsip-wait-recurse <boolean> ] [
-            qname-wait-recurse <boolean> ] [ recursive-only <boolean> ] [
-            nsip-enable <boolean> ] [ nsdname-enable <boolean> ] [
-            dnsrps-enable <boolean> ] [ dnsrps-options { <unspecified-text>
-            } ];
+        response-policy { zone <string> [ log <boolean> ] [ max-policy-ttl
+            <ttlval> ] [ min-update-interval <ttlval> ] [ policy ( cname |
+            disabled | drop | given | no-op | nodata | nxdomain | passthru
+            | tcp-only <quoted_string> ) ] [ recursive-only <boolean> ] [
+            nsip-enable <boolean> ] [ nsdname-enable <boolean> ]; ... } [
+            break-dnssec <boolean> ] [ max-policy-ttl <ttlval> ] [
+            min-update-interval <ttlval> ] [ min-ns-dots <integer> ] [
+            nsip-wait-recurse <boolean> ] [ qname-wait-recurse <boolean> ]
+            [ recursive-only <boolean> ] [ nsip-enable <boolean> ] [
+            nsdname-enable <boolean> ] [ dnsrps-enable <boolean> ] [
+            dnsrps-options { <unspecified-text> } ];
        rfc2308-type1 <boolean>; // not yet implemented
        root-delegation-only [ exclude { <string>; ... } ];
        root-key-sentinel <boolean>;
@@ -1,9 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: dns
-tp: irs
-tp: isc
-tp: isccfg
-tp: ns
@@ -4,5 +4,6 @@ test_suite('bind9')
 include('dns/Kyuafile')
 include('irs/Kyuafile')
 include('isc/Kyuafile')
+include('isccc/Kyuafile')
 include('isccfg/Kyuafile')
 include('ns/Kyuafile')
@@ -954,15 +954,25 @@ check_options(const cfg_obj_t *options, isc_log_t *logctx, isc_mem_t *mctx,
 	uint32_t lifetime = 3600;
 	const char *ccalg = "aes";

+	/*
+	 * { "name", scale, value }
+	 * (scale * value) <= UINT32_MAX
+	 */
 	static intervaltable intervals[] = {
-	{ "cleaning-interval", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "heartbeat-interval", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "interface-interval", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "max-transfer-idle-in", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "max-transfer-idle-out", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "max-transfer-time-in", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "max-transfer-time-out", 60, 28 * 24 * 60 },	/* 28 days */
-	{ "statistics-interval", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "cleaning-interval", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "heartbeat-interval", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "interface-interval", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "max-transfer-idle-in", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "max-transfer-idle-out", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "max-transfer-time-in", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "max-transfer-time-out", 60, 28 * 24 * 60 },	/* 28 days */
+		{ "statistics-interval", 60, 28 * 24 * 60 },	/* 28 days */
+
+		/* minimum and maximum cache and negative cache TTLs */
+		{ "min-cache-ttl", 1, MAX_MIN_CACHE_TTL },	/* 90 secs */
+		{ "max-cache-ttl", 1, UINT32_MAX },		/* no limit */
+		{ "min-ncache-ttl", 1, MAX_MIN_NCACHE_TTL},	/* 90 secs */
+		{ "max-ncache-ttl", 1, MAX_MAX_NCACHE_TTL },	/*  7 days */
 	};

 	static const char *server_contact[] = {
@@ -1863,6 +1873,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		for (element2 = cfg_list_first(typelist);
@@ -2233,6 +2244,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,

 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}

@@ -2658,14 +2670,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	(void)cfg_map_get(zoptions, "masterfile-format", &obj);
 	if (obj != NULL) {
 		const char *masterformatstr = cfg_obj_asstring(obj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}

 	if (masterformat == dns_masterformat_map) {
@@ -20,6 +20,18 @@

 #include <isccfg/cfg.h>

+#ifndef MAX_MIN_CACHE_TTL
+#define MAX_MIN_CACHE_TTL 90
+#endif /* MAX_MIN_CACHE_TTL */
+
+#ifndef MAX_MIN_NCACHE_TTL
+#define MAX_MIN_NCACHE_TTL 90
+#endif /* MAX_MIN_NCACHE_TTL */
+
+#ifndef MAX_MAX_NCACHE_TTL
+#define MAX_MAX_NCACHE_TTL 7 * 24 * 3600
+#endif /* MAX_MAX_NCACHE_TTL */
+
 ISC_LANG_BEGINDECLS

 isc_result_t
@@ -1,5 +0,0 @@
-Content-Type: application/X-atf-atffile; version="1"
-
-prop: test-suite = bind9
-
-tp: tests
@@ -416,8 +416,8 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr,
 		return (dns_geoip_match(reqaddr, env->geoip, &e->geoip_elem));
 #endif
 	default:
-		/* Should be impossible. */
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	result = dns_acl_match(reqaddr, reqsigner, inner, env,
@@ -593,7 +593,7 @@ dns_acl_isinsecure(const dns_acl_t *a) {

 		default:
 			INSIST(0);
-			return (true);
+			ISC_UNREACHABLE();
 		}
 	}

@@ -2188,7 +2188,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find,

 	bucket = DNS_ADB_INVALIDBUCKET;

-	if (find->options & DNS_ADBFIND_INET) {
+	if ((find->options & DNS_ADBFIND_INET) != 0) {
 		namehook = ISC_LIST_HEAD(name->v4);
 		while (namehook != NULL) {
 			entry = namehook->entry;
@@ -2228,7 +2228,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find,
 		}
 	}

-	if (find->options & DNS_ADBFIND_INET6) {
+	if ((find->options & DNS_ADBFIND_INET6) != 0) {
 		namehook = ISC_LIST_HEAD(name->v6);
 		while (namehook != NULL) {
 			entry = namehook->entry;
@@ -3701,8 +3701,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype)
 	result = dns_view_find(adb->view, &adbname->name, rdtype, now,
 			       NAME_GLUEOK(adbname) ? DNS_DBFIND_GLUEOK : 0,
 			       NAME_HINTOK(adbname),
-			       (adbname->flags & NAME_STARTATZONE) != 0 ?
-			       true : false,
+			       ((adbname->flags & NAME_STARTATZONE) != 0),
 			       NULL, NULL, fname, &rdataset, NULL);

 	/* XXXVIX this switch statement is too sparse to gen a jump table. */
@@ -273,6 +273,7 @@ getudpdispatch(int family, dns_dispatchmgr_t *dispatchmgr,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	attrmask = 0;
 	attrmask |= DNS_DISPATCHATTR_UDP;
@@ -1331,10 +1332,10 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	mctx = client->mctx;
 	rdataset = NULL;
 	sigrdataset = NULL;
-	want_dnssec = !(options & DNS_CLIENTRESOPT_NODNSSEC);
-	want_validation = !(options & DNS_CLIENTRESOPT_NOVALIDATE);
-	want_cdflag = !(options & DNS_CLIENTRESOPT_NOCDFLAG);
-	want_tcp = (options & DNS_CLIENTRESOPT_TCP);
+	want_dnssec = ((options & DNS_CLIENTRESOPT_NODNSSEC) == 0);
+	want_validation = ((options & DNS_CLIENTRESOPT_NOVALIDATE) == 0);
+	want_cdflag = ((options & DNS_CLIENTRESOPT_NOCDFLAG) == 0);
+	want_tcp = ((options & DNS_CLIENTRESOPT_TCP) != 0);

 	/*
 	 * Prepare some intermediate resources
@@ -2848,7 +2849,7 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 	if (result != ISC_R_SUCCESS)
 		return (result);

-	want_tcp = (options & DNS_CLIENTUPDOPT_TCP);
+	want_tcp = ((options & DNS_CLIENTUPDOPT_TCP) != 0);

 	/*
 	 * Create a context and prepare some resources.
@@ -3177,6 +3178,7 @@ dns_client_updaterec(dns_client_updateop_t op, const dns_name_t *owner,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	rdatalist->type = rdata->type;
@@ -378,6 +378,7 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}

 			if (result == ISC_R_SUCCESS) {
@@ -299,7 +299,8 @@ static isc_result_t get_udpsocket(dns_dispatchmgr_t *mgr,
 				  isc_socketmgr_t *sockmgr,
 				  const isc_sockaddr_t *localaddr,
 				  isc_socket_t **sockp,
-				  isc_socket_t *dup_socket);
+				  isc_socket_t *dup_socket,
+				  bool duponly);
 static isc_result_t dispatch_createudp(dns_dispatchmgr_t *mgr,
 				       isc_socketmgr_t *sockmgr,
 				       isc_taskmgr_t *taskmgr,
@@ -317,7 +318,7 @@ static void qid_destroy(isc_mem_t *mctx, dns_qid_t **qidp);
 static isc_result_t open_socket(isc_socketmgr_t *mgr,
 				const isc_sockaddr_t *local,
 				unsigned int options, isc_socket_t **sockp,
-				isc_socket_t *dup_socket);
+				isc_socket_t *dup_socket, bool duponly);
 static bool portavailable(dns_dispatchmgr_t *mgr, isc_socket_t *sock,
 				   isc_sockaddr_t *sockaddrp);

@@ -728,7 +729,7 @@ get_dispsocket(dns_dispatch_t *disp, const isc_sockaddr_t *dest,
 		if (portentry != NULL)
 			bindoptions |= ISC_SOCKET_REUSEADDRESS;
 		result = open_socket(sockmgr, &localaddr, bindoptions, &sock,
-				     NULL);
+				     NULL, false);
 		if (result == ISC_R_SUCCESS) {
 			if (portentry == NULL) {
 				portentry = new_portentry(disp, port);
@@ -908,7 +909,7 @@ free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }

@@ -1160,7 +1161,7 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {

 	dispatch_log(disp, LVL(92),
 		     "got valid DNS message header, /QR %c, id %u",
-		     ((flags & DNS_MESSAGEFLAG_QR) ? '1' : '0'), id);
+		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);

 	/*
 	 * Look at flags.  If query, drop it. If response,
@@ -1413,7 +1414,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {

 	dispatch_log(disp, LVL(92),
 		     "got valid DNS message header, /QR %c, id %u",
-		     ((flags & DNS_MESSAGEFLAG_QR) ? '1' : '0'), id);
+		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);

 	/*
 	 * Allocate an event to send to the query or response client, and
@@ -1577,7 +1578,7 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}

 	return (ISC_R_SUCCESS);
@@ -1667,7 +1668,7 @@ destroy_mgr(dns_dispatchmgr_t **mgrp) {
 static isc_result_t
 open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 	    unsigned int options, isc_socket_t **sockp,
-	    isc_socket_t *dup_socket)
+	    isc_socket_t *dup_socket, bool duponly)
 {
 	isc_socket_t *sock;
 	isc_result_t result;
@@ -1675,12 +1676,16 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 	sock = *sockp;
 	if (sock != NULL) {
 		result = isc_socket_open(sock);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
-	} else if (dup_socket != NULL) {
+		}
+	} else if (dup_socket != NULL &&
+		   (!isc_socket_hasreuseport() || duponly))
+	{
 		result = isc_socket_dup(dup_socket, &sock);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}

 		isc_socket_setname(sock, "dispatcher", NULL);
 		*sockp = sock;
@@ -1688,8 +1693,9 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 	} else {
 		result = isc_socket_create(mgr, isc_sockaddr_pf(local),
 					   isc_sockettype_udp, &sock);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			return (result);
+		}
 	}

 	isc_socket_setname(sock, "dispatcher", NULL);
@@ -1699,9 +1705,9 @@ open_socket(isc_socketmgr_t *mgr, const isc_sockaddr_t *local,
 #endif
 	result = isc_socket_bind(sock, local, options);
 	if (result != ISC_R_SUCCESS) {
-		if (*sockp == NULL)
+		if (*sockp == NULL) {
 			isc_socket_detach(&sock);
-		else {
+		} else {
 			isc_socket_close(sock);
 		}
 		return (result);
@@ -2757,7 +2763,7 @@ dns_dispatch_getudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 static isc_result_t
 get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	      isc_socketmgr_t *sockmgr, const isc_sockaddr_t *localaddr,
-	      isc_socket_t **sockp, isc_socket_t *dup_socket)
+	      isc_socket_t **sockp, isc_socket_t *dup_socket, bool duponly)
 {
 	unsigned int i, j;
 	isc_socket_t *held[DNS_DISPATCH_HELD];
@@ -2795,7 +2801,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 			prt = ports[isc_random_uniform(nports)];
 			isc_sockaddr_setport(&localaddr_bound, prt);
 			result = open_socket(sockmgr, &localaddr_bound,
-					     0, &sock, NULL);
+					     0, &sock, NULL, false);
 			/*
 			 * Continue if the port choosen is already in use
 			 * or the OS has reserved it.
@@ -2816,7 +2822,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 		/* Allow to reuse address for non-random ports. */
 		result = open_socket(sockmgr, localaddr,
 				     ISC_SOCKET_REUSEADDRESS, &sock,
-				     dup_socket);
+				     dup_socket, duponly);

 		if (result == ISC_R_SUCCESS)
 			*sockp = sock;
@@ -2828,7 +2834,7 @@ get_udpsocket(dns_dispatchmgr_t *mgr, dns_dispatch_t *disp,
 	i = 0;

 	for (j = 0; j < 0xffffU; j++) {
-		result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
+		result = open_socket(sockmgr, localaddr, 0, &sock, NULL, false);
 		if (result != ISC_R_SUCCESS)
 			goto end;
 		else if (portavailable(mgr, sock, NULL))
@@ -2872,22 +2878,27 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	dns_dispatch_t *disp;
 	isc_socket_t *sock = NULL;
 	int i = 0;
+	bool duponly = ((attributes & DNS_DISPATCHATTR_CANREUSE) == 0);

+	/* This is an attribute needed only at creation time */
+	attributes &= ~DNS_DISPATCHATTR_CANREUSE;
 	/*
 	 * dispatch_allocate() checks mgr for us.
 	 */
 	disp = NULL;
 	result = dispatch_allocate(mgr, maxrequests, &disp);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		return (result);
+	}

 	disp->socktype = isc_sockettype_udp;

 	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) == 0) {
 		result = get_udpsocket(mgr, disp, sockmgr, localaddr, &sock,
-				       dup_socket);
-		if (result != ISC_R_SUCCESS)
+				       dup_socket, duponly);
+		if (result != ISC_R_SUCCESS) {
 			goto deallocate_dispatch;
+		}

 		if (isc_log_wouldlog(dns_lctx, 90)) {
 			char addrbuf[ISC_SOCKADDR_FORMATSIZE];
@@ -2910,35 +2921,42 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 		 */
 		isc_sockaddr_anyofpf(&sa_any, isc_sockaddr_pf(localaddr));
 		if (!isc_sockaddr_eqaddr(&sa_any, localaddr)) {
-			result = open_socket(sockmgr, localaddr, 0, &sock, NULL);
-			if (sock != NULL)
+			result = open_socket(sockmgr, localaddr, 0,
+					     &sock, NULL, false);
+			if (sock != NULL) {
 				isc_socket_detach(&sock);
-			if (result != ISC_R_SUCCESS)
+			}
+			if (result != ISC_R_SUCCESS) {
 				goto deallocate_dispatch;
+			}
 		}

 		disp->port_table = isc_mem_get(mgr->mctx,
 					       sizeof(disp->port_table[0]) *
 					       DNS_DISPATCH_PORTTABLESIZE);
-		if (disp->port_table == NULL)
+		if (disp->port_table == NULL) {
 			goto deallocate_dispatch;
-		for (i = 0; i < DNS_DISPATCH_PORTTABLESIZE; i++)
+		}
+		for (i = 0; i < DNS_DISPATCH_PORTTABLESIZE; i++) {
 			ISC_LIST_INIT(disp->port_table[i]);
+		}

 		result = isc_mempool_create(mgr->mctx, sizeof(dispportentry_t),
 					    &disp->portpool);
-		if (result != ISC_R_SUCCESS)
+		if (result != ISC_R_SUCCESS) {
 			goto deallocate_dispatch;
+		}
 		isc_mempool_setname(disp->portpool, "disp_portpool");
 		isc_mempool_setfreemax(disp->portpool, 128);
 	}
 	disp->socket = sock;
 	disp->local = *localaddr;

-	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0)
+	if ((attributes & DNS_DISPATCHATTR_EXCLUSIVE) != 0) {
 		disp->ntasks = MAX_INTERNAL_TASKS;
-	else
+	} else {
 		disp->ntasks = 1;
+	}
 	for (i = 0; i < disp->ntasks; i++) {
 		disp->task[i] = NULL;
 		result = isc_task_create(taskmgr, 50, &disp->task[i]);
@@ -2970,8 +2988,9 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 	}

 	result = isc_mutex_init(&disp->sepool_lock);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		goto kill_sepool;
+	}

 	isc_mempool_setname(disp->sepool, "disp_sepool");
 	isc_mempool_setmaxalloc(disp->sepool, 32768);
@@ -2990,8 +3009,9 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,

 	mgr_log(mgr, LVL(90), "created UDP dispatcher %p", disp);
 	dispatch_log(disp, LVL(90), "created task %p", disp->task[0]); /* XXX */
-	if (disp->socket != NULL)
+	if (disp->socket != NULL) {
 		dispatch_log(disp, LVL(90), "created socket %p", disp->socket);
+	}

 	*dispp = disp;

@@ -3005,11 +3025,13 @@ dispatch_createudp(dns_dispatchmgr_t *mgr, isc_socketmgr_t *sockmgr,
 kill_ctlevent:
 	isc_event_free(&disp->ctlevent);
 kill_task:
-	for (i = 0; i < disp->ntasks; i++)
+	for (i = 0; i < disp->ntasks; i++) {
 		isc_task_detach(&disp->task[i]);
+	}
 kill_socket:
-	if (disp->socket != NULL)
+	if (disp->socket != NULL) {
 		isc_socket_detach(&disp->socket);
+	}
 deallocate_dispatch:
 	dispatch_free(&disp);

@@ -311,6 +311,7 @@ dns_dnsrps_2policy(librpz_policy_t rps_policy) {
 	case LIBRPZ_POLICY_DISABLED:
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -46,7 +46,7 @@

 LIBDNS_EXTERNAL_DATA isc_stats_t *dns_dnssec_stats;

-#define is_response(msg) (msg->flags & DNS_MESSAGEFLAG_QR)
+#define is_response(msg) ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)

 #define RETERR(x) do { \
 	result = (x); \
@@ -220,10 +220,12 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Is the key allowed to sign data?
 	 */
 	flags = dst_key_flags(key);
-	if (flags & DNS_KEYTYPE_NOAUTH)
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
 		return (DNS_R_KEYUNAUTHORIZED);
-	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
+	}
+	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
 		return (DNS_R_KEYUNAUTHORIZED);
+	}

 	sig.mctx = mctx;
 	sig.common.rdclass = set->rdclass;
@@ -447,7 +449,7 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Is the key allowed to sign data?
 	 */
 	flags = dst_key_flags(key);
-	if (flags & DNS_KEYTYPE_NOAUTH) {
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
 		inc_stat(dns_dnssecstats_fail);
 		return (DNS_R_KEYUNAUTHORIZED);
 	}
@@ -1237,7 +1239,7 @@ dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 	dk->index = 0;

 	/* KSK or ZSK? */
-	dk->ksk = (dst_key_flags(dk->key) & DNS_KEYFLAG_KSK);
+	dk->ksk = ((dst_key_flags(dk->key) & DNS_KEYFLAG_KSK) != 0);

 	/* Is this an old-style key? */
 	result = dst_key_getprivateformat(dk->key, &major, &minor);
@@ -700,6 +700,7 @@ dnstap_type(dns_dtmsgtype_t msgtype) {
 		return (DNSTAP__MESSAGE__TYPE__UPDATE_RESPONSE);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -1042,6 +1043,7 @@ dns_dt_open(const char *filename, dns_dtmode_t mode, isc_mem_t *mctx,
 		return (ISC_R_NOTIMPLEMENTED);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	isc_mem_attach(mctx, &handle->mctx);
@@ -386,13 +386,13 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory) {
 	if (key->func->tofile == NULL)
 		return (DST_R_UNSUPPORTEDALG);

-	if (type & DST_TYPE_PUBLIC) {
+	if ((type & DST_TYPE_PUBLIC) != 0) {
 		ret = write_public_key(key, type, directory);
 		if (ret != ISC_R_SUCCESS)
 			return (ret);
 	}

-	if ((type & DST_TYPE_PRIVATE) &&
+	if (((type & DST_TYPE_PRIVATE) != 0) &&
 	    (key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
 		return (key->func->tofile(key, directory));
 	else
@@ -608,7 +608,7 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
 	isc_buffer_putuint8(target, (uint8_t)key->key_proto);
 	isc_buffer_putuint8(target, (uint8_t)key->key_alg);

-	if (key->key_flags & DNS_KEYFLAG_EXTENDED) {
+	if ((key->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
 		if (isc_buffer_availablelength(target) < 2)
 			return (ISC_R_NOSPACE);
 		isc_buffer_putuint16(target,
@@ -646,7 +646,7 @@ dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 	id = dst_region_computeid(&r, alg);
 	rid = dst_region_computerid(&r, alg);

-	if (flags & DNS_KEYFLAG_EXTENDED) {
+	if ((flags & DNS_KEYFLAG_EXTENDED) != 0) {
 		if (isc_buffer_remaininglength(source) < 2)
 			return (DST_R_INVALIDPUBLICKEY);
 		extflags = isc_buffer_getuint16(source);
@@ -727,7 +727,7 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	raw += 2;
 #endif
 	if (rdataset->type == dns_rdatatype_rrsig) {
-		if (*raw & DNS_RDATASLAB_OFFLINE)
+		if ((*raw & DNS_RDATASLAB_OFFLINE) != 0)
 			flags |= DNS_RDATA_OFFLINE;
 		length--;
 		raw++;
@@ -138,20 +138,20 @@ static const char copyright[] =
 static struct cc {
 	struct cc *next;
 	int rdclass;
-	char classname[TYPECLASSBUF];
+	char classbuf[TYPECLASSBUF];
 } *classes;

 static struct tt {
 	struct tt *next;
 	int rdclass;
 	int type;
-	char classname[TYPECLASSBUF];
-	char typename[TYPECLASSBUF];
-	char dirname[DIRNAMESIZE-30];	/* XXX Should be max path length */
+	char classbuf[TYPECLASSBUF];
+	char typebuf[TYPECLASSBUF];
+	char dirbuf[DIRNAMESIZE-30];	/* XXX Should be max path length */
 } *types;

 static struct ttnam {
-	char typename[TYPECLASSBUF];
+	char typebuf[TYPECLASSBUF];
 	char macroname[TYPECLASSBUF];
 	char attr[ATTRIBUTESIZE];
 	unsigned int sorted;
@@ -249,13 +249,13 @@ doswitch(const char *name, const char *function, const char *args,
 			fprintf(stdout,
 				"\tcase %d:%s %s_%s(%s); break;",
 				tt->type, result, function,
-				funname(tt->typename, buf1), args);
+				funname(tt->typebuf, buf1), args);
 		else
 			fprintf(stdout,
 				"\t\tcase %d:%s %s_%s_%s(%s); break;",
 				tt->rdclass, result, function,
-				funname(tt->classname, buf1),
-				funname(tt->typename, buf2), args);
+				funname(tt->classbuf, buf1),
+				funname(tt->typebuf, buf2), args);
 		fputs(" \\\n", stdout);
 		lasttype = tt->type;
 	}
@@ -286,32 +286,36 @@ find_typename(int type) {
 	int i;

 	for (i = 0; i < TYPENAMES; i++) {
-		if (typenames[i].typename[0] != 0 &&
+		if (typenames[i].typebuf[0] != 0 &&
 		    typenames[i].type == type)
+		{
 			return (&typenames[i]);
+		}
 	}
 	return (NULL);
 }

 static void
-insert_into_typenames(int type, const char *typename, const char *attr) {
+insert_into_typenames(int type, const char *typebuf, const char *attr) {
 	struct ttnam *ttn = NULL;
 	size_t c;
 	int i, n;
 	char tmp[256];

-	INSIST(strlen(typename) < TYPECLASSBUF);
+	INSIST(strlen(typebuf) < TYPECLASSBUF);
 	for (i = 0; i < TYPENAMES; i++) {
-		if (typenames[i].typename[0] != 0 &&
+		if (typenames[i].typebuf[0] != 0 &&
 		    typenames[i].type == type &&
-		    strcmp(typename, typenames[i].typename) != 0) {
+		    strcmp(typebuf, typenames[i].typebuf) != 0)
+		{
 			fprintf(stderr,
 				"Error:  type %d has two names: %s, %s\n",
-				type, typenames[i].typename, typename);
+				type, typenames[i].typebuf, typebuf);
 			exit(1);
 		}
-		if (typenames[i].typename[0] == 0 && ttn == NULL)
+		if (typenames[i].typebuf[0] == 0 && ttn == NULL) {
 			ttn = &typenames[i];
+		}
 	}
 	if (ttn == NULL) {
 		fprintf(stderr, "Error: typenames array too small\n");
@@ -319,23 +323,24 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
 	}

 	/* XXXMUKS: This is redundant due to the INSIST above. */
-	if (strlen(typename) > sizeof(ttn->typename) - 1) {
+	if (strlen(typebuf) > sizeof(ttn->typebuf) - 1) {
 		fprintf(stderr, "Error:  type name %s is too long\n",
-			typename);
+			typebuf);
 		exit(1);
 	}

-	strncpy(ttn->typename, typename, sizeof(ttn->typename));
-	ttn->typename[sizeof(ttn->typename) - 1] = '\0';
+	strncpy(ttn->typebuf, typebuf, sizeof(ttn->typebuf));
+	ttn->typebuf[sizeof(ttn->typebuf) - 1] = '\0';

-	strncpy(ttn->macroname, ttn->typename, sizeof(ttn->macroname));
+	strncpy(ttn->macroname, ttn->typebuf, sizeof(ttn->macroname));
 	ttn->macroname[sizeof(ttn->macroname) - 1] = '\0';

 	ttn->type = type;
 	c = strlen(ttn->macroname);
 	while (c > 0) {
-		if (ttn->macroname[c - 1] == '-')
+		if (ttn->macroname[c - 1] == '-') {
 			ttn->macroname[c - 1] = '_';
+		}
 		c--;
 	}

@@ -354,7 +359,7 @@ insert_into_typenames(int type, const char *typename, const char *attr) {

 	if (strlen(attr) > sizeof(ttn->attr) - 1) {
 		fprintf(stderr, "Error:  attr (%s) [name %s] is too long\n",
-			attr, typename);
+			attr, typebuf);
 		exit(1);
 	}

@@ -362,24 +367,25 @@ insert_into_typenames(int type, const char *typename, const char *attr) {
 	ttn->attr[sizeof(ttn->attr) - 1] = '\0';

 	ttn->sorted = 0;
-	if (maxtype < type)
+	if (maxtype < type) {
 		maxtype = type;
+	}
 }

 static void
-add(int rdclass, const char *classname, int type, const char *typename,
-    const char *dirname)
+add(int rdclass, const char *classbuf, int type, const char *typebuf,
+    const char *dirbuf)
 {
 	struct tt *newtt = (struct tt *)malloc(sizeof(*newtt));
 	struct tt *tt, *oldtt;
 	struct cc *newcc;
 	struct cc *cc, *oldcc;

-	INSIST(strlen(typename) < TYPECLASSBUF);
-	INSIST(strlen(classname) < TYPECLASSBUF);
-	INSIST(strlen(dirname) < DIRNAMESIZE);
+	INSIST(strlen(typebuf) < TYPECLASSBUF);
+	INSIST(strlen(classbuf) < TYPECLASSBUF);
+	INSIST(strlen(dirbuf) < DIRNAMESIZE);

-	insert_into_typenames(type, typename, NULL);
+	insert_into_typenames(type, typebuf, NULL);

 	if (newtt == NULL) {
 		fprintf(stderr, "malloc() failed\n");
@@ -390,16 +396,17 @@ add(int rdclass, const char *classname, int type, const char *typename,
 	newtt->rdclass = rdclass;
 	newtt->type = type;

-	strncpy(newtt->classname, classname, sizeof(newtt->classname));
-	newtt->classname[sizeof(newtt->classname) - 1] = '\0';
+	strncpy(newtt->classbuf, classbuf, sizeof(newtt->classbuf));
+	newtt->classbuf[sizeof(newtt->classbuf) - 1] = '\0';

-	strncpy(newtt->typename, typename, sizeof(newtt->typename));
-	newtt->typename[sizeof(newtt->typename) - 1] = '\0';
+	strncpy(newtt->typebuf, typebuf, sizeof(newtt->typebuf));
+	newtt->typebuf[sizeof(newtt->typebuf) - 1] = '\0';

-	if (strncmp(dirname, "./", 2) == 0)
-		dirname += 2;
-	strncpy(newtt->dirname, dirname, sizeof(newtt->dirname));
-	newtt->dirname[sizeof(newtt->dirname) - 1] = '\0';
+	if (strncmp(dirbuf, "./", 2) == 0) {
+		dirbuf += 2;
+	}
+	strncpy(newtt->dirbuf, dirbuf, sizeof(newtt->dirbuf));
+	newtt->dirbuf[sizeof(newtt->dirbuf) - 1] = '\0';

 	tt = types;
 	oldtt = NULL;
@@ -410,26 +417,30 @@ add(int rdclass, const char *classname, int type, const char *typename,
 	}

 	while ((tt != NULL) && (tt->type == type) && (tt->rdclass < rdclass)) {
-		if (strcmp(tt->typename, typename) != 0)
+		if (strcmp(tt->typebuf, typebuf) != 0) {
 			exit(1);
+		}
 		oldtt = tt;
 		tt = tt->next;
 	}

-	if ((tt != NULL) && (tt->type == type) && (tt->rdclass == rdclass))
+	if ((tt != NULL) && (tt->type == type) && (tt->rdclass == rdclass)) {
 		exit(1);
+	}

 	newtt->next = tt;
-	if (oldtt != NULL)
+	if (oldtt != NULL) {
 		oldtt->next = newtt;
-	else
+	} else {
 		types = newtt;
+	}

 	/*
 	 * Do a class switch for this type.
 	 */
-	if (rdclass == 0)
+	if (rdclass == 0) {
 		return;
+	}

 	newcc = (struct cc *)malloc(sizeof(*newcc));
 	if (newcc == NULL) {
@@ -437,8 +448,8 @@ add(int rdclass, const char *classname, int type, const char *typename,
 		exit(1);
 	}
 	newcc->rdclass = rdclass;
-	strncpy(newcc->classname, classname, sizeof(newcc->classname));
-	newcc->classname[sizeof(newcc->classname) - 1] = '\0';
+	strncpy(newcc->classbuf, classbuf, sizeof(newcc->classbuf));
+	newcc->classbuf[sizeof(newcc->classbuf) - 1] = '\0';
 	cc = classes;
 	oldcc = NULL;

@@ -453,34 +464,39 @@ add(int rdclass, const char *classname, int type, const char *typename,
 	}

 	newcc->next = cc;
-	if (oldcc != NULL)
+	if (oldcc != NULL) {
 		oldcc->next = newcc;
-	else
+	} else {
 		classes = newcc;
+	}
 }

 static void
-sd(int rdclass, const char *classname, const char *dirname, char filetype) {
+sd(int rdclass, const char *classbuf, const char *dirbuf, char filetype) {
 	char buf[TYPECLASSLEN + sizeof("_65535.h")];
-	char typename[TYPECLASSBUF];
+	char typebuf[TYPECLASSBUF];
 	int type, n;
 	isc_dir_t dir;

-	if (!start_directory(dirname, &dir))
+	if (!start_directory(dirbuf, &dir)) {
 		return;
+	}

 	while (next_file(&dir)) {
-		if (sscanf(dir.filename, TYPECLASSFMT, typename, &type) != 2)
+		if (sscanf(dir.filename, TYPECLASSFMT, typebuf, &type) != 2) {
 			continue;
-		if ((type > 65535) || (type < 0))
+		}
+		if ((type > 65535) || (type < 0)) {
 			continue;
+		}

-		n = snprintf(buf, sizeof(buf), "%s_%d.%c", typename,
+		n = snprintf(buf, sizeof(buf), "%s_%d.%c", typebuf,
 			     type, filetype);
 		INSIST(n > 0 && (unsigned)n < sizeof(buf));
-		if (strcmp(buf, dir.filename) != 0)
+		if (strcmp(buf, dir.filename) != 0) {
 			continue;
-		add(rdclass, classname, type, typename, dirname);
+		}
+		add(rdclass, classbuf, type, typebuf, dirbuf);
 	}

 	end_directory(&dir);
@@ -507,7 +523,7 @@ main(int argc, char **argv) {
 	char buf[DIRNAMESIZE];		/* XXX Should be max path length */
 	char srcdir[DIRNAMESIZE];	/* XXX Should be max path length */
 	int rdclass;
-	char classname[TYPECLASSBUF];
+	char classbuf[TYPECLASSBUF];
 	struct tt *tt;
 	struct cc *cc;
 	struct ttnam *ttn, *ttn2;
@@ -571,7 +587,8 @@ main(int argc, char **argv) {
 		case 's':
 			if (strlen(isc_commandline_argument) >
 			    DIRNAMESIZE - 2 * TYPECLASSLEN  -
-			    sizeof("/rdata/_65535_65535")) {
+			    sizeof("/rdata/_65535_65535"))
+			{
 				fprintf(stderr, "\"%s\" too long\n",
 					isc_commandline_argument);
 				exit(1);
@@ -596,22 +613,27 @@ main(int argc, char **argv) {
 	n = snprintf(buf, sizeof(buf), "%srdata", srcdir);
 	INSIST(n > 0 && (unsigned)n < sizeof(srcdir));

-	if (!start_directory(buf, &dir))
+	if (!start_directory(buf, &dir)) {
 		exit(1);
+	}

 	while (next_file(&dir)) {
-		if (sscanf(dir.filename, TYPECLASSFMT, classname,
+		if (sscanf(dir.filename, TYPECLASSFMT, classbuf,
 			   &rdclass) != 2)
+		{
 			continue;
-		if ((rdclass > 65535) || (rdclass < 0))
+		}
+		if ((rdclass > 65535) || (rdclass < 0)) {
 			continue;
+		}

 		n = snprintf(buf, sizeof(buf), "%srdata/%s_%d",
-			     srcdir, classname, rdclass);
+			     srcdir, classbuf, rdclass);
 		INSIST(n > 0 && (unsigned)n < sizeof(buf));
-		if (strcmp(buf + 6 + strlen(srcdir), dir.filename) != 0)
+		if (strcmp(buf + 6 + strlen(srcdir), dir.filename) != 0) {
 			continue;
-		sd(rdclass, classname, buf, filetype);
+		}
+		sd(rdclass, classbuf, buf, filetype);
 	}
 	end_directory(&dir);
 	n = snprintf(buf, sizeof(buf), "%srdata/generic", srcdir);
@@ -630,8 +652,9 @@ main(int argc, char **argv) {
 		snprintf(year, sizeof(year), "-2016");
 	}

-	if (!depend)
+	if (!depend) {
 		fprintf(stdout, copyright, year);
+	}

 	if (code) {
 		fputs("#ifndef DNS_CODE_H\n", stdout);
@@ -641,9 +664,10 @@ main(int argc, char **argv) {
 		fputs("#include <isc/result.h>\n\n", stdout);
 		fputs("#include <dns/name.h>\n\n", stdout);

-		for (tt = types; tt != NULL; tt = tt->next)
+		for (tt = types; tt != NULL; tt = tt->next) {
 			fprintf(stdout, "#include \"%s/%s_%d.c\"\n",
-				tt->dirname, tt->typename, tt->type);
+				tt->dirbuf, tt->typebuf, tt->type);
+		}

 		fputs("\n\n", stdout);

@@ -734,16 +758,18 @@ main(int argc, char **argv) {
 		fprintf(stdout, "\tswitch (_hash) { \\\n");
 		for (i = 0; i <= maxtype; i++) {
 			ttn = find_typename(i);
-			if (ttn == NULL)
+			if (ttn == NULL) {
 				continue;
+			}

 			/*
 			 * Skip entries we already processed.
 			 */
-			if (ttn->sorted != 0)
+			if (ttn->sorted != 0) {
 				continue;
+			}

-			hash = HASH(ttn->typename);
+			hash = HASH(ttn->typebuf);
 			fprintf(stdout, "\t\tcase %u: \\\n", hash);

 			/*
@@ -752,13 +778,15 @@ main(int argc, char **argv) {
 			 */
 			for (j = 0; j <= maxtype; j++) {
 				ttn2 = find_typename(j);
-				if (ttn2 == NULL)
+				if (ttn2 == NULL) {
 					continue;
-				if (hash == HASH(ttn2->typename)) {
-					fprintf(stdout, "\t\t\tRDATATYPE_COMPARE"
-					       "(\"%s\", %d, "
-					       "_typename, _length, _typep); \\\n",
-					       ttn2->typename, ttn2->type);
+				}
+				if (hash == HASH(ttn2->typebuf)) {
+					fprintf(stdout, "\t\t\t"
+						"RDATATYPE_COMPARE"
+						"(\"%s\", %d, _typename, "
+						" _length, _typep); \\\n",
+						ttn2->typebuf, ttn2->type);
 					ttn2->sorted = 1;
 				}
 			}
@@ -770,8 +798,9 @@ main(int argc, char **argv) {
 		fprintf(stdout, "\tswitch (type) { \\\n");
 		for (i = 0; i <= maxtype; i++) {
 			ttn = find_typename(i);
-			if (ttn == NULL)
+			if (ttn == NULL) {
 				continue;
+			}
 			fprintf(stdout, "\tcase %d: return (%s); \\\n",
 				i, upper(ttn->attr));
 		}
@@ -781,19 +810,21 @@ main(int argc, char **argv) {
 		fprintf(stdout, "\tswitch (type) { \\\n");
 		for (i = 0; i <= maxtype; i++) {
 			ttn = find_typename(i);
-			if (ttn == NULL)
+			if (ttn == NULL) {
 				continue;
+			}
 			/*
 			 * Remove KEYDATA (65533) from the type to memonic
 			 * translation as it is internal use only.  This
 			 * stops the tools from displaying KEYDATA instead
 			 * of TYPE65533.
 			 */
-			if (i == 65533U)
+			if (i == 65533U) {
 				continue;
+			}
 			fprintf(stdout, "\tcase %d: return "
 				"(str_totext(\"%s\", target)); \\\n",
-				i, upper(ttn->typename));
+				i, upper(ttn->typebuf));
 		}
 		fprintf(stdout, "\t}\n");

@@ -808,12 +839,14 @@ main(int argc, char **argv) {
 		fprintf(stdout, "\tdns_rdatatype_none = 0,\n");

 		lasttype = 0;
-		for (tt = types; tt != NULL; tt = tt->next)
-			if (tt->type != lasttype)
+		for (tt = types; tt != NULL; tt = tt->next) {
+			if (tt->type != lasttype) {
 				fprintf(stdout,
 					"\tdns_rdatatype_%s = %d,\n",
-					funname(tt->typename, buf1),
+					funname(tt->typebuf, buf1),
 					lasttype = tt->type);
+			}
+		}

 		fprintf(stdout, "\tdns_rdatatype_ixfr = 251,\n");
 		fprintf(stdout, "\tdns_rdatatype_axfr = 252,\n");
@@ -826,9 +859,9 @@ main(int argc, char **argv) {
 		fprintf(stdout, "#define dns_rdatatype_none\t"
 			"((dns_rdatatype_t)dns_rdatatype_none)\n");

-		for (tt = types; tt != NULL; tt = tt->next)
+		for (tt = types; tt != NULL; tt = tt->next) {
 			if (tt->type != lasttype) {
-				s = funname(tt->typename, buf1);
+				s = funname(tt->typebuf, buf1);
 				fprintf(stdout,
 					"#define dns_rdatatype_%s\t%s"
 					"((dns_rdatatype_t)dns_rdatatype_%s)"
@@ -836,6 +869,7 @@ main(int argc, char **argv) {
 					s, strlen(s) < 2U ? "\t" : "", s);
 				lasttype = tt->type;
 			}
+		}

 		fprintf(stdout, "#define dns_rdatatype_ixfr\t"
 			"((dns_rdatatype_t)dns_rdatatype_ixfr)\n");
@@ -874,11 +908,12 @@ main(int argc, char **argv) {
 	} while (0)

 		for (cc = classes; cc != NULL; cc = cc->next) {
-			if (cc->rdclass == 3)
+			if (cc->rdclass == 3) {
 				PRINTCLASS("chaos", 3);
-			else if (cc->rdclass == 255)
+			} else if (cc->rdclass == 255) {
 				PRINTCLASS("none", 254);
-			PRINTCLASS(cc->classname, cc->rdclass);
+			}
+			PRINTCLASS(cc->classbuf, cc->rdclass);
 		}

 #undef PRINTCLASS
@@ -888,35 +923,40 @@ main(int argc, char **argv) {
 	} else if (structs) {
 		if (prefix != NULL) {
 			if ((fd = fopen(prefix,"r")) != NULL) {
-				while (fgets(buf, sizeof(buf), fd) != NULL)
+				while (fgets(buf, sizeof(buf), fd) != NULL) {
 					fputs(buf, stdout);
+				}
 				fclose(fd);
 			}
 		}
 		for (tt = types; tt != NULL; tt = tt->next) {
 			snprintf(buf, sizeof(buf), "%s/%s_%d.h",
-				tt->dirname, tt->typename, tt->type);
+				tt->dirbuf, tt->typebuf, tt->type);
 			if ((fd = fopen(buf,"r")) != NULL) {
-				while (fgets(buf, sizeof(buf), fd) != NULL)
+				while (fgets(buf, sizeof(buf), fd) != NULL) {
 					fputs(buf, stdout);
+				}
 				fclose(fd);
 			}
 		}
 		if (suffix != NULL) {
 			if ((fd = fopen(suffix,"r")) != NULL) {
-				while (fgets(buf, sizeof(buf), fd) != NULL)
+				while (fgets(buf, sizeof(buf), fd) != NULL) {
 					fputs(buf, stdout);
+				}
 				fclose(fd);
 			}
 		}
 	} else if (depend) {
-		for (tt = types; tt != NULL; tt = tt->next)
+		for (tt = types; tt != NULL; tt = tt->next) {
 			fprintf(stdout, "%s:\t%s/%s_%d.h\n", file,
-				tt->dirname, tt->typename, tt->type);
+				tt->dirbuf, tt->typebuf, tt->type);
+		}
 	}

-	if (ferror(stdout) != 0)
+	if (ferror(stdout) != 0) {
 		exit(1);
+	}

 	return (0);
 }
@@ -285,6 +285,7 @@ country_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}

 		if (text == NULL)
@@ -349,6 +350,7 @@ city_string(GeoIPRecord *record, dns_geoip_subtype_t subtype, int *maxlen) {
 		return (deconst);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -437,6 +439,7 @@ static char * region_string(GeoIPRegion *region, dns_geoip_subtype_t subtype, in
 		return (deconst);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -807,6 +810,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr,

 	default:
 		INSIST(0);
+		ISC_UNREACHABLE()
 	}

 	return (false);
@@ -392,6 +392,7 @@ hmac__get_tag_key(isc_md_type_t type) {
 		return (TAG_HMACSHA512_KEY);
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -411,6 +412,7 @@ hmac__get_tag_bits(isc_md_type_t type) {
 		return (TAG_HMACSHA512_BITS);
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -462,6 +464,7 @@ hmac__to_dst_alg(isc_md_type_t type) {
 		return (DST_ALG_HMACSHA512);
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }

@@ -140,6 +140,7 @@ struct dns_dispatchset {
 #define DNS_DISPATCHATTR_CONNECTED	0x00000080U
 #define DNS_DISPATCHATTR_FIXEDID	0x00000100U
 #define DNS_DISPATCHATTR_EXCLUSIVE	0x00000200U
+#define DNS_DISPATCHATTR_CANREUSE	0x00000400U
 /*@}*/

 /*
@@ -182,6 +182,11 @@ LIBDNS_EXTERNAL_DATA extern const dns_name_t *dns_wildcardname;
 	{NULL, NULL} \
 }

+#define DNS_NAME_INITEMPTY { \
+	DNS_NAME_MAGIC, NULL, 0, 0, 0, NULL, NULL, \
+	{ (void *)-1, (void *)-1 }, { NULL, NULL } \
+}
+
 /*%
 * Standard size of a wire format name
 */
@@ -56,12 +56,14 @@ ISC_LANG_BEGINDECLS

 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	       dns_rdatatype_t covers, isc_stdtime_t now,
+	       dns_ttl_t minttl, dns_ttl_t maxttl,
 	       dns_rdataset_t *addedrdataset);
 isc_result_t
 dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
 		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t maxttl,
+		     isc_stdtime_t now,
+		     dns_ttl_t minttl, dns_ttl_t maxttl,
 		     bool optout, dns_rdataset_t *addedrdataset);
 /*%<
 * Convert the authority data from 'message' into a negative cache
@@ -154,6 +154,8 @@ struct dns_view {
 	bool			sendcookie;
 	dns_ttl_t			maxcachettl;
 	dns_ttl_t			maxncachettl;
+	dns_ttl_t			mincachettl;
+	dns_ttl_t			minncachettl;
 	uint32_t			nta_lifetime;
 	uint32_t			nta_recheck;
 	char				*nta_file;
@@ -67,7 +67,7 @@ dns_iptable_addprefix(dns_iptable_t *tab, const isc_netaddr_t *addr,
 	int i;

 	INSIST(DNS_IPTABLE_VALID(tab));
-	INSIST(tab->radix);
+	INSIST(tab->radix != NULL);

 	NETADDR_TO_PREFIX_T(addr, pfx, bitlen);

@@ -354,7 +354,7 @@ journal_header_decode(journal_rawheader_t *raw, journal_header_t *cooked) {
 	journal_pos_decode(&raw->h.end, &cooked->end);
 	cooked->index_size = decode_uint32(raw->h.index_size);
 	cooked->sourceserial = decode_uint32(raw->h.sourceserial);
-	cooked->serialset = (raw->h.flags & JOURNAL_SERIALSET);
+	cooked->serialset = ((raw->h.flags & JOURNAL_SERIALSET) != 0);
 }

 static void
@@ -368,8 +368,9 @@ journal_header_encode(journal_header_t *cooked, journal_rawheader_t *raw) {
 	journal_pos_encode(&raw->h.end, &cooked->end);
 	encode_uint32(cooked->index_size, raw->h.index_size);
 	encode_uint32(cooked->sourceserial, raw->h.sourceserial);
-	if (cooked->serialset)
+	if (cooked->serialset) {
 		flags |= JOURNAL_SERIALSET;
+	}
 	raw->h.flags = flags;
 }

@@ -692,8 +693,8 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, unsigned int mode,
 	char backup[1024];
 	bool writable, create;

-	create = (mode & DNS_JOURNAL_CREATE);
-	writable = (mode & (DNS_JOURNAL_WRITE|DNS_JOURNAL_CREATE));
+	create = ((mode & DNS_JOURNAL_CREATE) != 0);
+	writable = ((mode & (DNS_JOURNAL_WRITE|DNS_JOURNAL_CREATE)) != 0);

 	result = journal_open(mctx, filename, writable, create, journalp);
 	if (result == ISC_R_NOTFOUND) {
@@ -744,6 +745,7 @@ ixfr_order(const void *av, const void *bv) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	switch (b->op) {
@@ -757,6 +759,7 @@ ixfr_order(const void *av, const void *bv) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	r = bop - aop;
@@ -549,8 +549,6 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,

 	lctx->format = format;
 	switch (format) {
-	default:
-		INSIST(0);
 	case dns_masterformat_text:
 		lctx->openfile = openfile_text;
 		lctx->load = load_text;
@@ -563,6 +561,9 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 		lctx->openfile = openfile_map;
 		lctx->load = load_map;
 		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	if (lex != NULL) {
@@ -583,7 +584,7 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 		isc_lex_setcomments(lctx->lex, ISC_LEXCOMMENT_DNSMASTERFILE);
 	}

-	lctx->ttl_known = (options & DNS_MASTER_NOTTL);
+	lctx->ttl_known = ((options & DNS_MASTER_NOTTL) != 0);
 	lctx->ttl = 0;
 	lctx->default_ttl_known = lctx->ttl_known;
 	lctx->default_ttl = 0;
@@ -1717,15 +1718,15 @@ load_text(dns_loadctx_t *lctx) {
 		if ((lctx->options & DNS_MASTER_ZONE) != 0 &&
 		    (lctx->options & DNS_MASTER_SLAVE) == 0 &&
 		    (type == dns_rdatatype_md || type == dns_rdatatype_mf)) {
-			char typename[DNS_RDATATYPE_FORMATSIZE];
+			char typebuf[DNS_RDATATYPE_FORMATSIZE];

 			result = DNS_R_OBSOLETE;

-			dns_rdatatype_format(type, typename, sizeof(typename));
+			dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 			(*callbacks->error)(callbacks,
 					    "%s:%lu: %s '%s': %s",
 					    source, line,
-					    "type", typename,
+					    "type", typebuf,
 					    dns_result_totext(result));
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
@@ -1741,15 +1742,15 @@ load_text(dns_loadctx_t *lctx) {
 		    (lctx->options & DNS_MASTER_SLAVE) == 0 &&
 		    dns_rdatatype_ismeta(type))
 		{
-			char typename[DNS_RDATATYPE_FORMATSIZE];
+			char typebuf[DNS_RDATATYPE_FORMATSIZE];

 			result = DNS_R_METATYPE;

-			dns_rdatatype_format(type, typename, sizeof(typename));
+			dns_rdatatype_format(type, typebuf, sizeof(typebuf));
 			(*callbacks->error)(callbacks,
 					    "%s:%lu: %s '%s': %s",
 					    source, line,
-					    "type", typename,
+					    "type", typebuf,
 					    dns_result_totext(result));
 			if (MANYERRS(lctx, result)) {
 				SETRESULT(lctx, result);
@@ -1025,7 +1025,7 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,

 	for (i = 0; i < n; i++) {
 		dns_rdataset_t *rds = sorted[i];
-		if (ctx->style.flags & DNS_STYLEFLAG_TRUST) {
+		if ((ctx->style.flags & DNS_STYLEFLAG_TRUST) != 0) {
 			if ((ctx->style.flags & DNS_STYLEFLAG_INDENT) != 0 ||
 			    (ctx->style.flags & DNS_STYLEFLAG_YAML) != 0)
 			{
@@ -1048,8 +1048,8 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 			if ((ctx->style.flags & DNS_STYLEFLAG_OMIT_OWNER) != 0)
 				name = NULL;
 		}
-		if (ctx->style.flags & DNS_STYLEFLAG_RESIGN &&
-		    rds->attributes & DNS_RDATASETATTR_RESIGN) {
+		if (((ctx->style.flags & DNS_STYLEFLAG_RESIGN) != 0) &&
+		    ((rds->attributes & DNS_RDATASETATTR_RESIGN) != 0)) {
 			isc_buffer_t b;
 			char buf[sizeof("YYYYMMDDHHMMSS")];
 			memset(buf, 0, sizeof(buf));
@@ -1494,7 +1494,7 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}

 	result = totext_ctx_init(style, &dctx->tctx);
@@ -1591,24 +1591,7 @@ writeheader(dns_dumpctx_t *dctx) {
 		r.base = (unsigned char *)&rawheader;
 		r.length = sizeof(rawheader);
 		isc_buffer_region(&buffer, &r);
-#if !defined(STDTIME_ON_32BITS) || (STDTIME_ON_32BITS + 0) != 1
-		/*
-		 * We assume isc_stdtime_t is a 32-bit integer,
-		 * which should be the case on most platforms.
-		 * If it turns out to be uncommon, we'll need
-		 * to bump the version number and revise the
-		 * header format.
-		 */
-		isc_log_write(dns_lctx,
-			      ISC_LOGCATEGORY_GENERAL,
-			      DNS_LOGMODULE_MASTERDUMP,
-			      ISC_LOG_INFO,
-			      "dumping master file in raw "
-			      "format: stdtime is not 32bits");
-		now32 = 0;
-#else
 		now32 = dctx->now;
-#endif
 		rawversion = 1;
 		if ((dctx->header.flags & DNS_MASTERRAW_COMPAT) != 0)
 			rawversion = 0;
@@ -1634,6 +1617,7 @@ writeheader(dns_dumpctx_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}

 	isc_mem_put(dctx->mctx, buffer.base, buffer.length);
@@ -920,8 +920,8 @@ getname(dns_name_t *name, isc_buffer_t *source, dns_message_t *msg,
 		}
 	}

-	INSIST(0);  /* Cannot get here... */
-	return (ISC_R_UNEXPECTED);
+	INSIST(0);
+	ISC_UNREACHABLE();
 }

 static isc_result_t
@@ -1008,7 +1008,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,

 	section = &msg->sections[DNS_SECTION_QUESTION];

-	best_effort = (options & DNS_MESSAGEPARSE_BESTEFFORT);
+	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	seen_problem = false;

 	name = NULL;
@@ -1240,8 +1240,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	bool preserve_order, best_effort, seen_problem;
 	bool issigzero;

-	preserve_order = (options & DNS_MESSAGEPARSE_PRESERVEORDER);
-	best_effort = (options & DNS_MESSAGEPARSE_BESTEFFORT);
+	preserve_order = ((options & DNS_MESSAGEPARSE_PRESERVEORDER) != 0);
+	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	seen_problem = false;

 	section = &msg->sections[sectionid];
@@ -1677,7 +1677,7 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 	REQUIRE(msg->from_to_wire == DNS_MESSAGE_INTENTPARSE);

 	seen_problem = false;
-	ignore_tc = (options & DNS_MESSAGEPARSE_IGNORETRUNCATION);
+	ignore_tc = ((options & DNS_MESSAGEPARSE_IGNORETRUNCATION) != 0);

 	origsource = *source;

@@ -1060,7 +1060,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
 		(target == NULL && ISC_BUFFER_VALID(name->buffer)));

-	downcase = (options & DNS_NAME_DOWNCASE);
+	downcase = ((options & DNS_NAME_DOWNCASE) != 0);

 	if (target == NULL && name->buffer != NULL) {
 		target = name->buffer;
@@ -1351,7 +1351,7 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 	dns_name_totextfilter_t *mem;
 	dns_name_totextfilter_t totext_filter_proc = NULL;
 	isc_result_t result;
-	bool omit_final_dot = (options & DNS_NAME_OMITFINALDOT);
+	bool omit_final_dot = ((options & DNS_NAME_OMITFINALDOT) != 0);

 	/*
 	 * This function assumes the name is in proper uncompressed
@@ -1763,7 +1763,7 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
 		(target == NULL && ISC_BUFFER_VALID(name->buffer)));

-	downcase = (options & DNS_NAME_DOWNCASE);
+	downcase = ((options & DNS_NAME_DOWNCASE) != 0);

 	if (target == NULL && name->buffer != NULL) {
 		target = name->buffer;
@@ -1847,9 +1847,10 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 				/*
 				 * Ordinary 14-bit pointer.
 				 */
-				if ((dctx->allowed & DNS_COMPRESS_GLOBAL14) ==
-				    0)
+				if ((dctx->allowed & DNS_COMPRESS_GLOBAL14) == 0)
+				{
 					return (DNS_R_DISALLOWED);
+				}
 				new_current = c & 0x3F;
 				state = fw_newcurrent;
 			} else
@@ -45,7 +45,8 @@

 static isc_result_t
 addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	  dns_rdatatype_t covers, isc_stdtime_t now,
+	  dns_ttl_t minttl, dns_ttl_t maxttl,
 	  bool optout, bool secure,
 	  dns_rdataset_t *addedrdataset);

@@ -95,26 +96,29 @@ copy_rdataset(dns_rdataset_t *rdataset, isc_buffer_t *buffer) {

 isc_result_t
 dns_ncache_add(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	       dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	       dns_rdatatype_t covers, isc_stdtime_t now,
+	       dns_ttl_t minttl, dns_ttl_t maxttl,
 	       dns_rdataset_t *addedrdataset)
 {
-	return (addoptout(message, cache, node, covers, now, maxttl,
+	return (addoptout(message, cache, node, covers, now, minttl, maxttl,
 			  false, false, addedrdataset));
 }

 isc_result_t
 dns_ncache_addoptout(dns_message_t *message, dns_db_t *cache,
 		     dns_dbnode_t *node, dns_rdatatype_t covers,
-		     isc_stdtime_t now, dns_ttl_t maxttl,
+		     isc_stdtime_t now,
+		     dns_ttl_t minttl, dns_ttl_t maxttl,
 		     bool optout, dns_rdataset_t *addedrdataset)
 {
-	return (addoptout(message, cache, node, covers, now, maxttl,
+	return (addoptout(message, cache, node, covers, now, minttl, maxttl,
 			  optout, true, addedrdataset));
 }

 static isc_result_t
 addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
-	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl,
+	  dns_rdatatype_t covers, isc_stdtime_t now,
+	  dns_ttl_t minttl, dns_ttl_t maxttl,
 	  bool optout, bool secure,
 	  dns_rdataset_t *addedrdataset)
 {
@@ -179,10 +183,15 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 				if (type == dns_rdatatype_soa ||
 				    type == dns_rdatatype_nsec ||
 				    type == dns_rdatatype_nsec3) {
-					if (ttl > rdataset->ttl)
+					if (ttl > rdataset->ttl) {
 						ttl = rdataset->ttl;
-					if (trust > rdataset->trust)
+					}
+					if (ttl < minttl) {
+						ttl = minttl;
+					}
+					if (trust > rdataset->trust) {
 						trust = rdataset->trust;
+					}
 					/*
 					 * Copy the owner name to the buffer.
 					 */
@@ -58,7 +58,7 @@ dns_nsec_isset(const unsigned char *array, unsigned int type) {
 	shift = 7 - (type % 8);
 	mask = 1 << shift;

-	return (byte & mask);
+	return ((byte & mask) != 0);
 }

 unsigned int
@@ -2100,13 +2100,12 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 			*exists = false;
 			*data = false;
 			if (optout != NULL) {
-				if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0)
-					(*logit)(arg, ISC_LOG_DEBUG(3),
-						 "NSEC3 indicates optout");
-				else
-					(*logit)(arg, ISC_LOG_DEBUG(3),
-						 "NSEC3 indicates secure range");
-				*optout = (nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
+				*optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT)
+					   != 0);
+				(*logit)(arg, ISC_LOG_DEBUG(3),
+					 (*optout
+					  ? "NSEC3 indicates optout"
+					  : "NSEC3 indicates secure range"));
 			}
 			answer = ISC_R_SUCCESS;
 		}
@@ -149,7 +149,7 @@ dns_ntatable_create(dns_view_t *view,
 	isc_task_detach(&ntatable->task);

   cleanup_ntatable:
-	isc_mem_put(ntatable->view->mctx, ntatable, sizeof(*ntatable));
+	isc_mem_put(view->mctx, ntatable, sizeof(*ntatable));

 	return (result);
 }
@@ -223,8 +223,6 @@ dst__openssl_destroy(void) {
 		isc_mem_free(dst__mctx, locks);
 		locks = NULL;
 	}
-#else
-	OPENSSL_cleanup();
 #endif
 	isc_mem_detach(&dst__mctx);
 }
@@ -303,7 +301,7 @@ dst__openssl_toresult3(isc_logcategory_t *category,
 		isc_log_write(dns_lctx, category,
 			      DNS_LOGMODULE_CRYPTO, ISC_LOG_INFO,
 			      "%s:%s:%d:%s", buf, file, line,
-			      (flags & ERR_TXT_STRING) ? data : "");
+			      ((flags & ERR_TXT_STRING) != 0) ? data : "");
 	}

    done:
--- a/Show More
+++ b/Show More