No mem checks, pt 1

Remove layering from isc_task, isc_app, isc_socket, isc_timer, isc_mem
Get rid of isc_bind9 conditional
2018-10-03 18:23:36 +02:00 · 2018-10-02 07:26:35 +00:00 · 2018-10-02 07:26:35 +00:00 · 2018-10-02 01:18:58 -04:00 · 2018-10-02 15:10:26 +10:00 · 2018-10-02 15:09:32 +10:00
734 changed files with 10576 additions and 59472 deletions
@@ -4,6 +4,7 @@ variables:
  DOCKER_DRIVER: overlay2
  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
  CCACHE_DIR: "/ccache"
+  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"

 stages:
  - precheck
@@ -114,20 +115,25 @@ stages:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
 #    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr $EXTRA_CONFIGURE
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
  artifacts:
    expire_in: '1 hour'
    untracked: true

+.install_test: &install_test_job
+  stage: test
+  before_script:
+    - mkdir $HOME/.local
+  script:
+    - make install
+
 .system_test: &system_test_job
  stage: test
  before_script:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
+    - bash -x util/prepare-softhsm2.sh
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
@@ -140,9 +146,7 @@ stages:
  stage: test
  before_script:
    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
-    - export SOFTHSM_CONF="/tmp/softhsm.conf"
-    - echo "0:/tmp/softhsm.db" > $SOFTHSM_CONF
-    - if command -v softhsm2-util >/dev/null; then softhsm2-util --init-token --free --pin 0000 --so-pin 0000 --label "softhsm"; fi
+    - bash -x util/prepare-softhsm2.sh
  script:
    - make unit
  after_script:
@@ -165,6 +169,8 @@ precheck:debian:sid:amd64:
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
    - rm util/newcopyrights
+    - perl -w util/update_copyrights < util/copyrights
+    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
  artifacts:
@@ -214,12 +220,11 @@ build:centos:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *build_job

-build:clang:debian:sid:amd64:
+build:clang:debian:stretch:amd64:
  variables:
-    CC: clang-6.0
+    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *debian_sid_amd64_image
+  <<: *debian_stretch_amd64_image
  <<: *build_job

 build:debian:jessie:amd64:
@@ -244,12 +249,11 @@ build:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *build_job

-build:clang:debian:sid:i386:
+build:clang:debian:stretch:i386:
  variables:
-    CC: clang-6.0
+    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *debian_sid_i386_image
+  <<: *debian_stretch_i386_image
  <<: *build_job

 build:debian:sid:i386:
@@ -290,11 +294,11 @@ unittest:debian:sid:amd64:
  dependencies:
    - build:debian:sid:amd64

-unittest:clang:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
+unittest:clang:debian:stretch:amd64:
+  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
-    - build:clang:debian:sid:amd64
+    - build:clang:debian:stretch:amd64

 unittest:debian:sid:i386:
  <<: *debian_sid_i386_image
@@ -338,6 +342,12 @@ systemtest:debian:sid:i386:
  dependencies:
    - build:debian:sid:i386

+install:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *install_test_job
+  dependencies:
+    - build:debian:sid:amd64
+
 pkcs11:build:debian:sid:amd64:
  variables:
    CC: gcc
@@ -0,0 +1,29 @@
+## Release Checklist
+
+ - [ ] Check for the presence of a milestone for the release
+    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist)
+ - [ ] Prepare the sources for tarball generation
+ - [ ] Change software version and library versions in configure.in
+ - [ ] Update CHANGES
+ - [ ] Ensure the release notes are correct for this release
+ - [ ] Ensure the metainformation is correct for this release
+ - [ ] Make sure the tests are passing
+ - [ ] Create a tag (name vX_Y_Z[-alphatag], content BIND X.Y.Z[-alphatag], signed with a developer's GPG key): git tag -u <DEVELOPER_KEYID> -a -s -m "BIND X.Y.Z" vX.Y.Z
+ - [ ] Push the changes and tag
+ - [ ] Create the tarball
+ - [ ] Create the Windows zips
+ - [ ] Ask QA to sanity check the tarball and zips
+ - [ ] Request the signature on the tarballs
+ - [ ] Make tarballs and signatures available to download
+ - [ ] Edit the release https://gitlab.isc.org/isc-projects/bind9/tags and the NEWS snippet + links to the tarballs
+ - [ ] Update DEB and RPM packages
+
+## Communication
+
+ - [ ] Inform support to upload to the web site (nice to give them a heads-up in advance)
+       - Write release e-mail to bind9-announce, bind-users in case of a major release
+       - Update tickets in case of waiting support customers
+ - [ ] Inform marketing to announce the release
+        - Post short note to Twitter 
+        - Update http://en.wikipedia.org/wiki/BIND (mktg)
+        - Blog post if a major release
@@ -1,3 +1,125 @@
+5039.	[bug]		Named could fail to preserve owner name case of new
+			RRset. [GL #420]
+
+5038.	[bug]		Chaosnet addresses were compared incorrectly.
+			[GL #562]
+
+5037.	[func]		"allow-recursion-on" and "allow-query-cache-on"
+			each now default to the other if only one of them
+			is set, in order to be more consistent with the way
+			"allow-recursion" and "allow-query-cache" work.
+			Also we now ensure that both query-cache ACLs are
+			checked when determining cache access. [GL #319]
+
+5036.	[cleanup]	Fixed a spacing/formatting error in some RPZ-related
+			error messages in the log. [GL !805]
+
+5035.	[test]		Fixed errors that prevented the DNSRPS subtests
+			from running in the rpz and rpzrecurse system
+			tests. [GL #503]
+
+5034.	[bug]		A race between threads could prevent zone maintenance
+			scheduled immediately after zone load from being
+			performed. [GL #542]
+
+5033.	[bug]		When adding NTAs to multiple views using "rndc nta",
+			the text returned via rndc was incorrectly terminated
+			after the first line, making it look as if only one
+			NTA had been added. Also, it was not possible to
+			differentiate between views with the same name but
+			different classes; this has been corrected with the
+			addition of a "-class" option. [GL #105]
+
+5032.	[func]		Add krb5-selfsub and ms-selfsub update policy rules.
+			[GL #511]
+
+5031.	[cleanup]	Various defines in platform.h has been either dropped
+			if always or never triggered on supported platforms
+			or replaced with config.h equivalents if the defines
+			didn't have any impact on public headers.  Workarounds
+			for LinuxThreads have been removed because NPTL is
+			available since Linux kernel 2.6.0.  [GL #525]
+
+5030.	[bug]		Align CMSG buffers to a 64-bit boundary, fixes crash
+			on architectures with strict alignment. [GL #521]
+
+	--- 9.13.3 released ---
+
+5029.	[func]		Workarounds for servers that misbehave when queried
+			with EDNS have been removed, because these broken
+			servers and the workarounds for their noncompliance
+			cause unnecessary delays, increase code complexity,
+			and prevent deployment of new DNS features. See
+			https://dnsflagday.net for further details. [GL #150]
+
+5028.	[bug]		Spread the initial RRSIG expiration times over the
+			entire working sig-validity-interval when signing a
+			zone in named to even out re-signing and transfer
+			loads. [GL #418]
+
+5027.	[func]		Set SO_SNDBUF size on sockets. [GL #74]
+
+5026.	[bug]		rndc reconfig should not touch already loaded zones.
+			[GL #276]
+
+5025.	[cleanup]	Remove isc_keyboard family of functions. [GL #178]
+
+5024.	[func]		Replace custom assembly for atomic operations with
+			atomic support from the compiler. The code will now use
+			C11 stdatomic, or __atomic, or __sync builtins with GCC
+			or Clang compilers, and Interlocked functions with MSVC.
+			[GL #10]
+
+5023.	[cleanup]	Remove wrappers that try to fix broken or incomplete
+			implementations of IPv6, pthreads and other core
+			functionality required and used by BIND. [GL #192]
+
+5022.	[doc]		Update ms-self, ms-subdomain, krb5-self, and
+			krb5-subdomain documentation. [GL !708]
+
+5021.	[bug]		dig returned a non-zero exit code when it received a
+			reply over TCP after a retry. [GL #487]
+
+5020.	[func]		RNG uses thread-local storage instead of locks, if
+			supported by platform. [GL #496]
+
+5019.	[cleanup]	A message is now logged when ixfr-from-differences is
+			set at zone level for an inline-signed zone. [GL #470]
+
+5018.	[bug]		Fix incorrect sizeof arguments in lib/isc/pk11.c.
+			[GL !588]
+
+5017.	[bug]		lib/isc/pk11.c failed to unlink the session before
+			releasing the lock which is unsafe. [GL !589]
+
+5016.	[bug]		Named could assert with overlapping filter-aaaa and
+			dns64 acls. [GL #445]
+
+5015.	[bug]		Reloading all zones caused zone maintenance to cease
+			for inline-signed zones. [GL #435]
+
+5014.	[bug]		Signatures loaded from the journal for the signed
+			version of an inline-signed zone were not scheduled for
+			refresh. [GL #482]
+
+5013.	[bug]		A referral response with a non-empty ANSWER section was
+			inadvertently being treated as an error. [GL #390]
+
+5012.	[bug]		Fix lock order reversal in pk11_initialize. [GL !590]
+
+5011.	[func]		Remove support for unthreaded named. [GL #478]
+
+5010.	[func]		New "validate-except" option specifies a list of
+			domains beneath which DNSSEC validation should not
+			be performed. [GL #237]
+
+5009.	[bug]		Upon an OpenSSL failure, the first error in the OpenSSL
+			error queue was not logged. [GL #476]
+
+5008.	[bug]		"rndc signing -nsec3param ..." requests were silently
+			ignored for zones which were not yet loaded or
+			transferred. [GL #468]
+
 5007.	[cleanup]	Replace custom ISC boolean and integer data types
 			with C99 stdint.h and stdbool.h types. [GL #9]

@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@

 VERSION=@BIND9_VERSION@

-SUBDIRS =	make unit lib bin doc
+SUBDIRS =	make unit lib fuzz bin doc
 TARGETS =
 PREREQS =	bind.keys.h

@@ -90,6 +90,7 @@ force-test: test-force

 test-force:
 	status=0; \
+	(cd fuzz && ${MAKE} check) || status=1; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f ${top_builddir}/unit/unittest.sh && \
 		$(SHELL) ${top_builddir}/unit/unittest.sh) || status=1; \
@@ -1,9 +1,11 @@
 Supported platforms

 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
+system with a C99-compliant C compiler, BSD-style sockets with
+RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
+cryptography library. Atomic operations support from the compiler is
+needed, either in the form of builtin operations, C11 atomics or the
+Interlocked family of functions on Windows.

 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -53,4 +55,7 @@ These are platforms on which BIND is known not to build or run:

  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
-  * Windows Server 2012
+  * Windows Server 2012 and older
+  * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
+  * Platforms that don't support atomic operations (via compiler or
+    library)
@@ -11,9 +11,11 @@
 ## Supported platforms

 In general, this version of BIND will build and run on any POSIX-compliant
-system with a C99-compliant C compiler, BSD-style sockets, and the OpenSSL
-cryptography library. To build with multiprocessing support, a
-C11-compliant C compiler will be needed for standard atomics.
+system with a C99-compliant C compiler, BSD-style sockets with RFC-compliant
+IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
+Atomic operations support from the compiler is needed, either in the form of
+builtin operations, C11 atomics or the Interlocked family of functions on
+Windows.

 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
@@ -61,4 +63,7 @@ These are platforms on which BIND is known *not* to build or run:

 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
-* Windows Server 2012
+* Windows Server 2012 and older
+* Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
+* Platforms that don't support atomic operations (via compiler or library)
+* Linux without NPTL (Native POSIX Thread Library)
@@ -104,8 +104,7 @@ BIND 9.13 features
 BIND 9.13 is the newest development branch of BIND 9. It includes a number
 of changes from BIND 9.12 and earlier releases. New features include:

-  * The default value of "dnssec-validation" is now "auto".
-  * Support for IDNA2008 when linking with libidn2.
+  * QNAME minimization, as described in RFC 7816, is now supported.
  * "Root key sentinel" support, enabling validating resolvers to indicate
    via a special query which trust anchors are configured for the root
    zone.
@@ -114,12 +113,24 @@ of changes from BIND 9.12 and earlier releases. New features include:
    subject to DNSSEC validation and are not treated as authoritative data
    when answering. This makes it easier to configure a local copy of the
    root zone as described in RFC 7706.
+  * The "validate-except" option allows configuration of domains below
+    which DNSSEC validation should not be performed.
+  * The default value of "dnssec-validation" is now "auto".
+  * IDNA2008 is now supported when linking with libidn2.

-In addition, cryptographic support has been modernized. BIND now uses the
-best available pseudo-random number generator for the platform on which
-it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now longer
-supported.
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See https://dnsflagday.net for more details.
+
+Cryptographic support has been modernized. BIND now uses the best
+available pseudo-random number generator for the platform on which it's
+built. Very old versions of OpenSSL are no longer supported. Cryptography
+is now mandatory: building BIND without DNSSEC is now longer supported.
+
+Special code to support certain legacy operating systems has also been
+removed; see the file PLATFORMS.md for details of supported platforms. In
+addition to OpenSSL, BIND now requires support for IPv6, threads, and
+standard atomic operations provided by the C compiler.

 Building BIND

@@ -127,7 +138,7 @@ Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have
 been observed on many versions of Linux and UNIX, including RedHat,
 Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
-X, Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
+X, Solaris, HP-UX, and OpenWRT.

 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires the
@@ -253,10 +264,6 @@ specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
 command line. By default, fixed rrset-order is disabled to reduce memory
 footprint.

-If your operating system has integrated support for IPv6, it will be used
-automatically. If you have installed KAME IPv6 separately, use --with-kame
-[=PATH] to specify its location.
-
 make install will install named and the various BIND 9 libraries. By
 default, installation is into /usr/local, but this can be changed with the
 --prefix option when running configure.
@@ -122,8 +122,7 @@ BIND 9.13 is the newest development branch of BIND 9. It includes a
 number of changes from BIND 9.12 and earlier releases.  New features
 include:

-* The default value of "dnssec-validation" is now "auto".
-* Support for IDNA2008 when linking with `libidn2`.
+* QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate
  via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
@@ -131,20 +130,35 @@ include:
  DNSSEC validation and are not treated as authoritative data when
  answering. This makes it easier to configure a local copy of the root
  zone as described in RFC 7706.
+* The "validate-except" option allows configuration of domains below which
+  DNSSEC validation should not be performed.
+* The default value of "dnssec-validation" is now "auto".
+* IDNA2008 is now supported when linking with `libidn2`.

-In addition, cryptographic support has been modernized. BIND now uses the
+In addition, workarounds that were formerly in place to enable resolution
+of domains whose authoritative servers did not respond to EDNS queries
+have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
+for more details.
+
+Cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
 it's built. Very old versions of OpenSSL are no longer supported.
-Cryptography is now mandatory; building BIND without DNSSEC is now
+Cryptography is now mandatory: building BIND without DNSSEC is now
 longer supported.

+Special code to support certain legacy operating systems has also
+been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
+of supported platforms. In addition to OpenSSL, BIND now requires
+support for IPv6, threads, and standard atomic operations provided
+by the C compiler.
+
 ### <a name="build"/> Building BIND

 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. Successful builds have been
 observed on many versions of Linux and UNIX, including RedHat, Fedora,
 Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
-Solaris, HP-UX, AIX, SCO OpenServer, and OpenWRT.
+Solaris, HP-UX, and OpenWRT.

 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires
@@ -268,10 +282,6 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
 configure command line.  By default, fixed rrset-order is disabled to
 reduce memory footprint.

-If your operating system has integrated support for IPv6, it will be used
-automatically.  If you have installed KAME IPv6 separately, use
-`--with-kame[=PATH]` to specify its location.
-
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
 `--prefix` option when running `configure`.
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-/***
- *** This file is not to be included by any public header files, because
- *** it does not get installed.
- ***/
-@TOP@
-
-/** define on DEC OSF to enable 4.4BSD style sa_len support */
-#undef _SOCKADDR_LEN
-
-/** define if your system needs pthread_init() before using pthreads */
-#undef NEED_PTHREAD_INIT
-
-/** define if your system has sigwait() */
-#undef HAVE_SIGWAIT
-
-/** define if sigwait() is the UnixWare flavor */
-#undef HAVE_UNIXWARE_SIGWAIT
-
-/** define on Solaris to get sigwait() to work using pthreads semantics */
-#undef _POSIX_PTHREAD_SEMANTICS
-
-/** define if LinuxThreads is in use */
-#undef HAVE_LINUXTHREADS
-
-/** define if sysconf() is available */
-#undef HAVE_SYSCONF
-
-/** define if sysctlbyname() is available */
-#undef HAVE_SYSCTLBYNAME
-
-/** define if catgets() is available */
-#undef HAVE_CATGETS
-
-/** define if getifaddrs() exists */
-#undef HAVE_GETIFADDRS
-
-/** define if you have the NET_RT_IFLIST sysctl variable and sys/sysctl.h */
-#undef HAVE_IFLIST_SYSCTL
-
-/** define if tzset() is available */
-#undef HAVE_TZSET
-
-/** define if struct addrinfo exists */
-#undef HAVE_ADDRINFO
-
-/** define if getaddrinfo() exists */
-#undef HAVE_GETADDRINFO
-
-/** define if gai_strerror() exists */
-#undef HAVE_GAISTRERROR
-
-/**
- * define if pthread_setconcurrency() should be called to tell the
- * OS how many threads we might want to run.
- */
-#undef CALL_PTHREAD_SETCONCURRENCY
-
-/** define if IPv6 is not disabled */
-#undef WANT_IPV6
-
-/** define if flockfile() is available */
-#undef HAVE_FLOCKFILE
-
-/** define if getc_unlocked() is available */
-#undef HAVE_GETCUNLOCKED
-
-/** Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */
-#undef SHUTUP_SPUTAUX
-#ifdef SHUTUP_SPUTAUX
-struct __sFILE;
-extern __inline int __sputaux(int _c, struct __sFILE *_p);
-#endif
-
-/** Shut up warnings about missing sigwait prototype on BSD/OS 4.0* */
-#undef SHUTUP_SIGWAIT
-#ifdef SHUTUP_SIGWAIT
-int sigwait(const unsigned int *set, int *sig);
-#endif
-
-/** Shut up warnings from gcc -Wcast-qual on BSD/OS 4.1. */
-#undef SHUTUP_STDARG_CAST
-#if defined(SHUTUP_STDARG_CAST) && defined(__GNUC__)
-#include <stdarg.h>		/** Grr.  Must be included *every time*. */
-/**
- * The silly continuation line is to keep configure from
- * commenting out the #undef.
- */
-
-#undef \
-	va_start
-#define	va_start(ap, last) \
-	do { \
-		union { const void *konst; long *var; } _u; \
-		_u.konst = &(last); \
-		ap = (va_list)(_u.var + __va_words(__typeof(last))); \
-	} while (0)
-#endif /** SHUTUP_STDARG_CAST && __GNUC__ */
-
-/** define if the system has a random number generating device */
-#undef PATH_RANDOMDEV
-
-/** define if pthread_attr_getstacksize() is available */
-#undef HAVE_PTHREAD_ATTR_GETSTACKSIZE
-
-/** define if pthread_attr_setstacksize() is available */
-#undef HAVE_PTHREAD_ATTR_SETSTACKSIZE
-
-/** define if you have strerror in the C library. */
-#undef HAVE_STRERROR
-
-/* Define to the length type used by the socket API (socklen_t, size_t, int). */
-#undef ISC_SOCKADDR_LEN_T
-
-/* Define if threads need PTHREAD_SCOPE_SYSTEM */
-#undef NEED_PTHREAD_SCOPE_SYSTEM
-
-/* Define to 1 if you have the uname library function. */
-#undef HAVE_UNAME
@@ -289,6 +289,7 @@ AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR

 m4_include([m4/ax_check_openssl.m4])
+m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])
@@ -88,12 +88,12 @@ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)

 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
 	rm -f ${DESTDIR}${sbindir}/named-compilezone@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkconf@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkzone@EXEEXT@
@@ -62,14 +62,6 @@
 #define CHECK_LOCAL 1
 #endif

-#ifdef HAVE_ADDRINFO
-#ifdef HAVE_GETADDRINFO
-#ifdef HAVE_GAISTRERROR
-#define USE_GETADDRINFO
-#endif
-#endif
-#endif
-
 #define CHECK(r) \
 	do { \
 		result = (r); \
@@ -137,9 +129,7 @@ add(char *key, int value) {
 	isc_symvalue_t symvalue;

 	if (sym_mctx == NULL) {
-		result = isc_mem_create(0, 0, &sym_mctx);
-		if (result != ISC_R_SUCCESS)
-			return;
+		isc_mem_create(0, 0, &sym_mctx);
 	}

 	if (symtab == NULL) {
@@ -177,7 +167,6 @@ static bool
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
-#ifdef USE_GETADDRINFO
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct addrinfo hints, *ai, *cur;
@@ -373,14 +362,10 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	freeaddrinfo(ai);
 	return (answer);
-#else
-	return (true);
-#endif
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -459,14 +444,10 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
-#else
-	return (true);
-#endif
 }

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-#ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
@@ -544,9 +525,6 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 		}
 		return (true);
 	}
-#else
-	return (true);
-#endif
 }

 isc_result_t
@@ -711,7 +689,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	if (dochecksrv)
 		dns_zone_setchecksrv(zone, checksrv);

-	CHECK(dns_zone_load(zone));
+	CHECK(dns_zone_load(zone, false));

 	/*
 	 * When loading map files we can't catch oversize TTLs during
@@ -791,4 +769,3 @@ DestroySockets(void) {
 	WSACleanup();
 }
 #endif
-
@@ -569,7 +569,7 @@ main(int argc, char **argv) {
 	}
 	isc_commandline_reset = true;

-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+	isc_mem_create(0, 0, &mctx);

 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
@@ -517,7 +517,7 @@ main(int argc, char **argv) {
 	InitSockets();
 #endif

-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+	isc_mem_create(0, 0, &mctx);
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -99,7 +99,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
  </ItemDefinitionGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -105,7 +105,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
    <PostBuildEvent>
@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>
@@ -208,7 +207,7 @@ main(int argc, char **argv) {
 	/* Use canonical algorithm name */
 	algname = alg_totext(alg);

-	DO("create memory context", isc_mem_create(0, 0, &mctx));
+	isc_mem_create(0, 0, &mctx);

 	if (keyname == NULL) {
 		const char *suffix = NULL;
@@ -20,7 +20,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/result.h>
@@ -192,4 +191,3 @@ write_key_file(const char *keyfile, const char *user,
 		fatal("fclose(%s) failed\n", keyfile);
 	fprintf(stderr, "wrote key file \"%s\"\n", keyfile);
 }
-
@@ -31,7 +31,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>
@@ -212,7 +211,7 @@ main(int argc, char **argv) {
 		keysize = alg_bits(alg);
 	algname = alg_totext(alg);

-	DO("create memory context", isc_mem_create(0, 0, &mctx));
+	isc_mem_create(0, 0, &mctx);
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

 	generate_key(mctx, alg, keysize, &key_txtbuffer);
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -106,7 +106,7 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1585,14 +1585,12 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("dns_lib_init failed: %d", result);

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("failed to create mctx");
+	isc_mem_create(0, 0, &mctx);

 	CHECK(isc_appctx_create(mctx, &actx));
 	CHECK(isc_taskmgr_createinctx(mctx, actx, 1, 0, &taskmgr));
 	CHECK(isc_socketmgr_createinctx(mctx, actx, &socketmgr));
-	CHECK(isc_timermgr_createinctx(mctx, actx, &timermgr));
+	isc_timermgr_createinctx(mctx, actx, &timermgr);

 	parse_args(argc, argv);

@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -101,12 +101,12 @@ install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 	for m in ${MANPAGES}; do \
-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
-		done
+		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
+	done

 uninstall::
 	for m in ${MANPAGES}; do \
-		rm -f ${DESTDIR}${mandir}/man1/$$m ; \
+		rm -f ${DESTDIR}${mandir}/man1/$$m || exit 1; \
 	done
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nslookup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/host@EXEEXT@
@@ -263,7 +263,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
+#if !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
 #else
 		tmnow  = *localtime(&tnow);
@@ -520,8 +520,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	if (!query->lookup->comments)
 		flags |= DNS_MESSAGETEXTFLAG_NOCOMMENTS;

-	result = isc_buffer_allocate(mctx, &buf, len);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &buf, len);

 	if (query->lookup->comments && !short_form) {
 		if (query->lookup->cmdline[0] != 0)
@@ -597,11 +596,8 @@ repopulate_buffer:
 buftoosmall:
 			len += OUTPUTBUF;
 			isc_buffer_free(&buf);
-			result = isc_buffer_allocate(mctx, &buf, len);
-			if (result == ISC_R_SUCCESS)
-				goto repopulate_buffer;
-			else
-				goto cleanup;
+			isc_buffer_allocate(mctx, &buf, len);
+			goto repopulate_buffer;
 		}
 		check_result(result,
 		     "dns_message_pseudosectiontotext");
@@ -1008,7 +1004,7 @@ plus_option(char *option, bool is_batchfile,
 						code = NULL;
 						if (value != NULL) {
 							code = strtok_r(value,
-								        ":",
+									":",
 									&last);
 						}
 						if (code == NULL) {
@@ -862,8 +862,7 @@ setup_text_key(void) {
 	unsigned char *secretstore;

 	debug("setup_text_key()");
-	result = isc_buffer_allocate(mctx, &namebuf, MXNAME);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &namebuf, MXNAME);
 	dns_name_init(&keyname, NULL);
 	check_result(result, "dns_name_init");
 	isc_buffer_putstr(namebuf, keynametext);
@@ -1328,8 +1327,7 @@ setup_libs(void) {
 	if (!have_ipv6 && !have_ipv4)
 		fatal("can't find either v4 or v6 networking");

-	result = isc_mem_create(0, 0, &mctx);
-	check_result(result, "isc_mem_create");
+	isc_mem_create(0, 0, &mctx);
 	isc_mem_setname(mctx, "dig", NULL);

 	result = isc_log_create(mctx, &lctx, &logconfig);
@@ -1351,8 +1349,7 @@ setup_libs(void) {
 	check_result(result, "isc_task_create");
 	isc_task_setname(global_task, "dig", NULL);

-	result = isc_timermgr_create(mctx, &timermgr);
-	check_result(result, "isc_timermgr_create");
+	isc_timermgr_create(mctx, &timermgr);

 	result = isc_socketmgr_create(mctx, &socketmgr);
 	check_result(result, "isc_socketmgr_create");
@@ -1361,8 +1358,7 @@ setup_libs(void) {
 	check_result(result, "dst_lib_init");
 	is_dst_up = true;

-	result = isc_mempool_create(mctx, COMMSIZE, &commctx);
-	check_result(result, "isc_mempool_create");
+	isc_mempool_create(mctx, COMMSIZE, &commctx);
 	isc_mempool_setname(commctx, "COMMPOOL");
 	/*
 	 * 6 and 2 set as reasonable parameters for 3 or 4 nameserver
@@ -1371,8 +1367,7 @@ setup_libs(void) {
 	isc_mempool_setfreemax(commctx, 6);
 	isc_mempool_setfillcount(commctx, 2);

-	result = isc_mutex_init(&lookup_lock);
-	check_result(result, "isc_mutex_init");
+	isc_mutex_init(&lookup_lock);
 }

 typedef struct dig_ednsoptname {
@@ -2018,9 +2013,8 @@ setup_lookup(dig_lookup_t *lookup) {

 	debug("setup_lookup(%p)", lookup);

-	result = dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER,
+	dns_message_create(mctx, DNS_MESSAGE_INTENTRENDER,
 				    &lookup->sendmsg);
-	check_result(result, "dns_message_create");

 	if (lookup->new_search) {
 		debug("resetting lookup counter.");
@@ -2256,8 +2250,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	if (lookup->sendspace == NULL)
 		fatal("memory allocation failure");

-	result = dns_compress_init(&cctx, -1, mctx);
-	check_result(result, "dns_compress_init");
+	dns_compress_init(&cctx, -1, mctx);

 	debug("starting to render the message");
 	isc_buffer_init(&lookup->renderbuf, lookup->sendspace, COMMSIZE);
@@ -3202,6 +3195,7 @@ connect_done(isc_task_t *task, isc_event_t *event) {
 		UNLOCK_LOOKUP;
 		return;
 	}
+	exitcode = 0;
 	if (keep_open) {
 		if (keep != NULL)
 			isc_socket_detach(&keep);
@@ -3610,8 +3604,7 @@ recv_done(isc_task_t *task, isc_event_t *event) {
 	if (!match)
 		goto udp_mismatch;

-	result = dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);
-	check_result(result, "dns_message_create");
+	dns_message_create(mctx, DNS_MESSAGE_INTENTPARSE, &msg);

 	if (tsigkey != NULL) {
 		if (l->querysig == NULL) {
@@ -29,7 +29,6 @@
 #include <isc/string.h>
 #include <isc/util.h>
 #include <isc/task.h>
-#include <isc/stdlib.h>

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -202,8 +201,7 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,

 	dns_name_format(name, namestr, sizeof(namestr));
 retry:
-	result = isc_buffer_allocate(mctx, &b, bufsize);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &b, bufsize);
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
@@ -223,9 +223,7 @@ printrdata(dns_rdata_t *rdata) {
 		printf("rdata_%d = ", rdata->type);

 	while (!done) {
-		result = isc_buffer_allocate(mctx, &b, size);
-		if (result != ISC_R_SUCCESS)
-			check_result(result, "isc_buffer_allocate");
+		isc_buffer_allocate(mctx, &b, size);
 		result = dns_rdata_totext(rdata, NULL, b);
 		if (result == ISC_R_SUCCESS) {
 			printf("%.*s\n", (int)isc_buffer_usedlength(b),
@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -115,12 +115,12 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8

 install:: ${TARGETS} installdirs
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done

 uninstall::
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done

 clean distclean::
 	rm -f ${TARGETS}
@@ -62,7 +62,7 @@
 #include "dnssectool.h"

 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif

 const char *program = "dnssec-cds";
@@ -383,8 +383,7 @@ formatset(dns_rdataset_t *rdataset) {
 					mctx);
 	check_result(result, "dns_master_stylecreate2 failed");

-	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
-	check_result(result, "printing DS records");
+	isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
 	result = dns_master_rdatasettotext(name, rdataset, style, buf);

 	if ((result == ISC_R_SUCCESS) && isc_buffer_availablelength(buf) < 1) {
@@ -896,8 +895,7 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata,
 		result = dns_rdatalist_tordataset(dslist, &new_ds_set);
 		check_result(result, "dns_rdatalist_tordataset(dslist)");

-		result = isc_buffer_allocate(mctx, &new_ds_buf, size);
-		check_result(result, "building new DS records");
+		isc_buffer_allocate(mctx, &new_ds_buf, size);

 		for (result = dns_rdataset_first(rdset);
 		     result == ISC_R_SUCCESS;
@@ -1144,10 +1142,7 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS) {
-		fatal("out of memory");
-	}
+	isc_mem_create(0, 0, &mctx);

 #if USE_PKCS11
 	pk11_result_register();
@@ -50,7 +50,7 @@
 #include "dnssectool.h"

 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif

 const char *program = "dnssec-dsfromkey";
@@ -368,7 +368,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-	result = isc_mem_create(0, 0, &mctx);
+	isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

@@ -49,7 +49,7 @@
 #include "dnssectool.h"

 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif

 const char *program = "dnssec-importkey";
@@ -307,9 +307,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("out of memory");
+	isc_mem_create(0, 0, &mctx);

 #if USE_PKCS11
 	pk11_result_register();
@@ -166,7 +166,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+	isc_mem_create(0, 0, &mctx);

 #if USE_PKCS11
 	pk11_result_register();
@@ -274,7 +274,7 @@ main(int argc, char **argv) {
 	}
 	isc_commandline_reset = true;

-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+	isc_mem_create(0, 0, &mctx);

 	isc_stdtime_get(&now);

@@ -308,7 +308,7 @@ main(int argc, char **argv) {
 		case 'e':
 			fprintf(stderr,
 				"phased-out option -e "
-				"(was 'use (RSA) large exponent)\n");
+				"(was 'use (RSA) large exponent')\n");
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -91,9 +91,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("Out of memory");
+	isc_mem_create(0, 0, &mctx);

 #if HAVE_PKCS11
 	pk11_result_register();
@@ -170,9 +170,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("Out of memory");
+	isc_mem_create(0, 0, &mctx);

 	setup_logging(mctx, &log);

@@ -49,7 +49,6 @@
 #include <isc/serial.h>
 #include <isc/safe.h>
 #include <isc/stdio.h>
-#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/time.h>
@@ -89,7 +88,7 @@
 #include "dnssectool.h"

 #ifndef PATH_MAX
-#define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
 #endif

 const char *program = "dnssec-signzone";
@@ -233,8 +232,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {

 	dns_rdataset_init(&rds);

-	result = isc_buffer_allocate(mctx, &buffer, bufsize);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(mctx, &buffer, bufsize);

 	for (result = dns_rdatasetiter_first(iter);
 	     result == ISC_R_SUCCESS;
@@ -259,8 +257,7 @@ dumpnode(dns_name_t *name, dns_dbnode_t *node) {

 			bufsize <<= 1;
 			isc_buffer_free(&buffer);
-			result = isc_buffer_allocate(mctx, &buffer, bufsize);
-			check_result(result, "isc_buffer_allocate");
+			isc_buffer_allocate(mctx, &buffer, bufsize);
 		}
 		check_result(result, "dns_master_rdatasettotext");

@@ -3278,9 +3275,7 @@ main(int argc, char *argv[]) {

 	check_result(isc_app_start(), "isc_app_start");

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("out of memory");
+	isc_mem_create(0, 0, &mctx);

 #if USE_PKCS11
 	pk11_result_register();
@@ -3711,10 +3706,7 @@ main(int argc, char *argv[]) {
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	result = isc_rwlock_init(&keylist_lock, 0, 0);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize keylist_lock: %s",
-		      isc_result_totext(result));
+	isc_rwlock_init(&keylist_lock, 0, 0);

 	/*
 	 * Fill keylist with:
@@ -3876,9 +3868,9 @@ main(int argc, char *argv[]) {
 			      isc_result_totext(result));
 	}

-	RUNTIME_CHECK(isc_mutex_init(&namelock) == ISC_R_SUCCESS);
+	isc_mutex_init(&namelock);
 	if (printstats)
-		RUNTIME_CHECK(isc_mutex_init(&statslock) == ISC_R_SUCCESS);
+		isc_mutex_init(&statslock);

 	presign();
 	TIME_NOW(&sign_start);
@@ -32,7 +32,6 @@
 #include <isc/rwlock.h>
 #include <isc/serial.h>
 #include <isc/stdio.h>
-#include <isc/stdlib.h>
 #include <isc/string.h>
 #include <isc/time.h>
 #include <isc/util.h>
@@ -202,9 +201,7 @@ main(int argc, char *argv[]) {
 	isc_commandline_reset = true;
 	check_result(isc_app_start(), "isc_app_start");

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		fatal("out of memory");
+	isc_mem_create(0, 0, &mctx);

 #if USE_PKCS11
 	pk11_result_register();
@@ -410,7 +410,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	uint16_t id, oldid;
 	uint32_t rid, roldid;
 	dns_secalg_t alg;
-	char filename[ISC_DIR_NAMEMAX];
+	char filename[NAME_MAX];
 	isc_buffer_t fileb;
 	isc_stdtime_t now;

@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
@IF PYTHON
    <PostBuildEvent>
@@ -113,7 +113,7 @@ set PYTHONPATH=.
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
@IF PYTHON
    <PostBuildEvent>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -69,7 +69,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -69,7 +69,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -69,7 +69,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -99,7 +99,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -802,10 +802,8 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
-		result = dns_name_dup(dns_fixedname_name(&fname), mctx,
+		dns_name_dup(dns_fixedname_name(&fname), mctx,
 				      keys[i - 1]);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -100,15 +100,11 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		return (result);
 	}

-	result = isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);

 	isc_buffer_init(&src, cmdline, strlen(cmdline));
 	isc_buffer_add(&src, strlen(cmdline));
-	result = isc_lex_openbuffer(lex, &src);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup;
+	isc_lex_openbuffer(lex, &src);

 	result = getcommand(lex, &command);
 	if (result != ISC_R_SUCCESS)
@@ -448,9 +448,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_request;
 	}

-	result = isc_buffer_allocate(listener->mctx, &text, 2 * 2048);
-	if (result != ISC_R_SUCCESS)
-		goto cleanup_request;
+	isc_buffer_allocate(listener->mctx, &text, 2 * 2048);

 	/*
 	 * Establish nonce.
@@ -496,10 +494,8 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 		goto cleanup_response;

 	if (conn->buffer == NULL) {
-		result = isc_buffer_allocate(listener->mctx,
+		isc_buffer_allocate(listener->mctx,
 					     &conn->buffer, 2 * 2048);
-		if (result != ISC_R_SUCCESS)
-			goto cleanup_response;
 	}

 	isc_buffer_clear(conn->buffer);
@@ -1061,7 +1057,8 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 					    aclconfctx, listener->mctx, 0,
 					    &new_acl);
 	} else {
-		result = dns_acl_any(listener->mctx, &new_acl);
+		dns_acl_any(listener->mctx, &new_acl);
+		result = ISC_R_SUCCESS;
 	}

 	if (control != NULL) {
@@ -1158,7 +1155,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 						    aclconfctx, mctx, 0,
 						    &new_acl);
 		} else {
-			result = dns_acl_any(mctx, &new_acl);
+			dns_acl_any(mctx, &new_acl);
+			result = ISC_R_SUCCESS;
 		}
 	}

@@ -9,7 +9,7 @@
 * information regarding copyright ownership.
 */

-#include "config.h"
+#include <config.h>

 #include <inttypes.h>
 #include <stdbool.h>
@@ -36,10 +36,6 @@
 #include <unistd.h>
 #include <pthread.h>

-#ifndef __AFL_LOOP
-#error To use American Fuzzy Lop you have to set CC to afl-clang-fast!!!
-#endif
-
 /*
 * We are using pthreads directly because we might be using it with
 * unthreaded version of BIND, where all thread functions are
@@ -61,7 +57,6 @@ fuzz_thread_client(void *arg) {
 	char *port;
 	struct sockaddr_in servaddr;
 	int sockfd;
-	int loop;
 	void *buf;

 	UNUSED(arg);
@@ -103,14 +98,18 @@ fuzz_thread_client(void *arg) {
 	 * Processing fuzzed packets 100,000 times before shutting down
 	 * the app.
 	 */
-	for (loop = 0; loop < 100000; loop++) {
+#ifdef __AFL_LOOP
+	for (int loop = 0; loop < 100000; loop++) {
+#else
+	{
+#endif
 		ssize_t length;
 		ssize_t sent;

 		length = read(0, buf, 65536);
 		if (length <= 0) {
 			usleep(1000000);
-			continue;
+			goto next;
 		}

 		/*
@@ -130,7 +129,7 @@ fuzz_thread_client(void *arg) {
 				return (NULL);
 			}
 			raise(SIGSTOP);
-			continue;
+			goto next;
 		}

 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);
@@ -151,6 +150,7 @@ fuzz_thread_client(void *arg) {
 			pthread_cond_wait(&cond, &mutex);

 		RUNTIME_CHECK(pthread_mutex_unlock(&mutex) == 0);
+	next: ;
 	}

 	free(buf);
@@ -586,6 +586,7 @@ fuzz_thread_resolver(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_app_shutdown();

+#ifdef __AFL_LOOP
 	/*
 	 * This is here just for the signature, that's how AFL detects
 	 * if it's a 'persistent mode' binary. It has to occur somewhere
@@ -594,6 +595,7 @@ fuzz_thread_resolver(void *arg) {
 	 * in persistent mode if it's present.
 	 */
 	__AFL_LOOP(0);
+#endif

 	return (NULL);
 }
@@ -110,8 +110,8 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
 LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;

 static bool	want_stats = false;
-static char		program_name[ISC_DIR_NAMEMAX] = "named";
-static char		absolute_conffile[ISC_DIR_PATHMAX];
+static char		program_name[NAME_MAX] = "named";
+static char		absolute_conffile[PATH_MAX];
 static char		saved_command_line[512];
 static char		version[512];
 static unsigned int	maxsocks = 0;
@@ -122,14 +122,17 @@ static int		maxudp = 0;
 */
 static bool clienttest = false;
 static bool dropedns = false;
-static bool noedns = false;
-static bool nosoa = false;
-static bool noaa = false;
-static unsigned int delay = 0;
-static bool nonearest = false;
-static bool notcp = false;
+static bool ednsformerr = false;
+static bool ednsnotimp = false;
+static bool ednsrefused = false;
 static bool fixedlocal = false;
+static bool noaa = false;
+static bool noedns = false;
+static bool nonearest = false;
+static bool nosoa = false;
+static bool notcp = false;
 static bool sigvalinsecs = false;
+static unsigned int delay = 0;

 /*
 * -4 and -6
@@ -488,6 +491,12 @@ parse_T_opt(char *option) {
 		dropedns = true;
 	} else if (!strncmp(option, "dscp=", 5)) {
 		isc_dscp_check_value = atoi(option + 5);
+	} else if (!strcmp(option, "ednsformerr")) {
+		ednsformerr = true;
+	} else if (!strcmp(option, "ednsnotimp")) {
+		ednsnotimp = true;
+	} else if (!strcmp(option, "ednsrefused")) {
+		ednsrefused = true;
 	} else if (!strcmp(option, "fixedlocal")) {
 		fixedlocal = true;
 	} else if (!strcmp(option, "keepstderr")) {
@@ -547,7 +556,7 @@ parse_T_opt(char *option) {
 	} else if (!strncmp(option, "tat=", 4)) {
 		named_g_tat_interval = atoi(option + 4);
 	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
+		fprintf(stderr, "unknown -T flag '%s'\n", option);
 	}
 }

@@ -720,11 +729,7 @@ parse_command_line(int argc, char *argv[]) {
 			printf("linked to zlib version: %s\n",
 			       zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 			printf("threads support is enabled\n");
-#else
-			printf("threads support is disabled\n");
-#endif
 			exit(0);
 		case 'x':
 			/* Obsolete. No longer in use. Ignore. */
@@ -776,7 +781,6 @@ create_managers(void) {

 	INSIST(named_g_cpus_detected > 0);

-#ifdef ISC_PLATFORM_USETHREADS
 	if (named_g_cpus == 0)
 		named_g_cpus = named_g_cpus_detected;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -785,9 +789,6 @@ create_managers(void) {
 		      named_g_cpus_detected,
 		      named_g_cpus_detected == 1 ? "" : "s",
 		      named_g_cpus, named_g_cpus == 1 ? "" : "s");
-#else
-	named_g_cpus = 1;
-#endif
 #ifdef WIN32
 	named_g_udpdisp = 1;
 #else
@@ -800,12 +801,10 @@ create_managers(void) {
 	if (named_g_udpdisp > named_g_cpus)
 		named_g_udpdisp = named_g_cpus;
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 		      "using %u UDP listener%s per interface",
 		      named_g_udpdisp, named_g_udpdisp == 1 ? "" : "s");
-#endif

 	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0,
 				    &named_g_taskmgr);
@@ -816,14 +815,7 @@ create_managers(void) {
 		return (ISC_R_UNEXPECTED);
 	}

-	result = isc_timermgr_create(named_g_mctx, &named_g_timermgr);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_timermgr_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
+	isc_timermgr_create(named_g_mctx, &named_g_timermgr);
 	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
 				       maxsocks);
 	if (result != ISC_R_SUCCESS) {
@@ -832,7 +824,7 @@ create_managers(void) {
 				 isc_result_totext(result));
 		return (ISC_R_UNEXPECTED);
 	}
-	isc__socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -917,12 +909,10 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */

-#ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
 	 */
 	named_g_cpus_detected = isc_os_ncpus();
-#endif

 	named_os_chroot(named_g_chrootdir);

@@ -1006,7 +996,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif
-#ifdef OPENSSL
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with OpenSSL version: %s",
@@ -1023,7 +1012,6 @@ setup(void) {
 		      "linked to OpenSSL version: %s",
 		      SSLeay_version(SSLEAY_VERSION));
 #endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#endif
 #ifdef HAVE_LIBXML2
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1049,16 +1037,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "linked to zlib version: %s", zlibVersion());
 #endif
-#ifdef ISC_PLATFORM_USETHREADS
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif
-
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
@@ -1173,24 +1151,30 @@ setup(void) {
 	 */
 	if (clienttest)
 		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
-	if (dropedns)
-		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, true);
-	if (noedns)
-		ns_server_setoption(sctx, NS_SERVER_NOEDNS, true);
-	if (nosoa)
-		ns_server_setoption(sctx, NS_SERVER_NOSOA, true);
-	if (noaa)
-		ns_server_setoption(sctx, NS_SERVER_NOAA, true);
-	if (nonearest)
-		ns_server_setoption(sctx, NS_SERVER_NONEAREST, true);
-	if (notcp)
-		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
-	if (fixedlocal)
-		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, true);
 	if (disable4)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, true);
+	if (dropedns)
+		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, true);
+	if (ednsformerr)	/* STD13 server */
+		ns_server_setoption(sctx, NS_SERVER_EDNSFORMERR, true);
+	if (ednsnotimp)
+		ns_server_setoption(sctx, NS_SERVER_EDNSNOTIMP, true);
+	if (ednsrefused)
+		ns_server_setoption(sctx, NS_SERVER_EDNSREFUSED, true);
+	if (fixedlocal)
+		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, true);
+	if (noaa)
+		ns_server_setoption(sctx, NS_SERVER_NOAA, true);
+	if (noedns)
+		ns_server_setoption(sctx, NS_SERVER_NOEDNS, true);
+	if (nonearest)
+		ns_server_setoption(sctx, NS_SERVER_NONEAREST, true);
+	if (nosoa)
+		ns_server_setoption(sctx, NS_SERVER_NOSOA, true);
+	if (notcp)
+		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
 	if (sigvalinsecs)
 		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);

@@ -1396,10 +1380,7 @@ main(int argc, char *argv[]) {
 						named_g_chrootdir);
 	}

-	result = isc_mem_create(0, 0, &named_g_mctx);
-	if (result != ISC_R_SUCCESS)
-		named_main_earlyfatal("isc_mem_create() failed: %s",
-				   isc_result_totext(result));
+	isc_mem_create(0, 0, &named_g_mctx);
 	isc_mem_setname(named_g_mctx, "main", NULL);

 	setup();
@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-05-29
+.\"      Date: 2018-06-21
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-05\-29" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -231,9 +231,9 @@ options {
 	coresize ( default | unlimited | \fIsizeval\fR );
 	datasize ( default | unlimited | \fIsizeval\fR );
 	deny\-answer\-addresses { \fIaddress_match_element\fR; \&.\&.\&. } [
-	    except\-from { \fIquoted_string\fR; \&.\&.\&. } ];
-	deny\-answer\-aliases { \fIquoted_string\fR; \&.\&.\&. } [ except\-from {
-	    \fIquoted_string\fR; \&.\&.\&. } ];
+	    except\-from { \fIstring\fR; \&.\&.\&. } ];
+	deny\-answer\-aliases { \fIstring\fR; \&.\&.\&. } [ except\-from { \fIstring\fR; \&.\&.\&.
+	    } ];
 	dialup ( notify | notify\-passive | passive | refresh | \fIboolean\fR );
 	directory \fIquoted_string\fR;
 	disable\-algorithms \fIstring\fR { \fIstring\fR;
@@ -264,14 +264,12 @@ options {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver ) [ ( query | response ) ]; \&.\&.\&. };
-	dnstap\-identity ( \fIquoted_string\fR | none |
-	    hostname );
-	dnstap\-output ( file | unix ) \fIquoted_string\fR [
-	    size ( unlimited | \fIsize\fR ) ] [ versions (
-	    unlimited | \fIinteger\fR ) ] [ suffix ( increment
-	    | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	    response ) ]; \&.\&.\&. };
+	dnstap\-identity ( \fIquoted_string\fR | none | hostname );
+	dnstap\-output ( file | unix ) \fIquoted_string\fR [ size ( unlimited |
+	    \fIsize\fR ) ] [ versions ( unlimited | \fIinteger\fR ) ] [ suffix (
+	    increment | timestamp ) ];
 	dnstap\-version ( \fIquoted_string\fR | none );
 	dscp \fIinteger\fR;
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
@@ -369,7 +367,7 @@ options {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
+	qname\-minimization ( strict | relaxed | disabled | off );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -420,7 +418,7 @@ options {
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
-	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
+	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
@@ -470,6 +468,7 @@ options {
 	use\-v4\-udp\-ports { \fIportrange\fR; \&.\&.\&. };
 	use\-v6\-udp\-ports { \fIportrange\fR; \&.\&.\&. };
 	v6\-bias \fIinteger\fR;
+	validate\-except { \fIstring\fR; \&.\&.\&. };
 	version ( \fIquoted_string\fR | none );
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zero\-no\-soa\-ttl\-cache \fIboolean\fR;
@@ -597,9 +596,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	cleaning\-interval \fIinteger\fR;
 	clients\-per\-query \fIinteger\fR;
 	deny\-answer\-addresses { \fIaddress_match_element\fR; \&.\&.\&. } [
-	    except\-from { \fIquoted_string\fR; \&.\&.\&. } ];
-	deny\-answer\-aliases { \fIquoted_string\fR; \&.\&.\&. } [ except\-from {
-	    \fIquoted_string\fR; \&.\&.\&. } ];
+	    except\-from { \fIstring\fR; \&.\&.\&. } ];
+	deny\-answer\-aliases { \fIstring\fR; \&.\&.\&. } [ except\-from { \fIstring\fR; \&.\&.\&.
+	    } ];
 	dialup ( notify | notify\-passive | passive | refresh | \fIboolean\fR );
 	disable\-algorithms \fIstring\fR { \fIstring\fR;
 	    \&.\&.\&. };
@@ -633,8 +632,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	dnssec\-secure\-to\-insecure \fIboolean\fR;
 	dnssec\-update\-mode ( maintain | no\-resign );
 	dnssec\-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver ) [ ( query | response ) ]; \&.\&.\&. };
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	    response ) ]; \&.\&.\&. };
 	dual\-stack\-servers [ port \fIinteger\fR ] { ( \fIquoted_string\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv4_address\fR [ port
 	    \fIinteger\fR ] [ dscp \fIinteger\fR ] | \fIipv6_address\fR [ port
@@ -712,7 +711,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	preferred\-glue \fIstring\fR;
 	prefetch \fIinteger\fR [ \fIinteger\fR ];
 	provide\-ixfr \fIboolean\fR;
-	qname\-minimization ( strict | relaxed | disabled );
+	qname\-minimization ( strict | relaxed | disabled | off );
 	query\-source ( ( [ address ] ( \fIipv4_address\fR | * ) [ port (
 	    \fIinteger\fR | * ) ] ) | ( [ [ address ] ( \fIipv4_address\fR | * ) ]
 	    port ( \fIinteger\fR | * ) ) ) [ dscp \fIinteger\fR ];
@@ -758,7 +757,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    nsip\-enable \fIboolean\fR ] [ nsdname\-enable \fIboolean\fR ] [
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
-	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
+	root\-delegation\-only [ exclude { \fIstring\fR; \&.\&.\&. } ];
 	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
@@ -820,6 +819,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 	update\-check\-ksk \fIboolean\fR;
 	use\-alt\-transfer\-source \fIboolean\fR;
 	v6\-bias \fIinteger\fR;
+	validate\-except { \fIstring\fR; \&.\&.\&. };
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zero\-no\-soa\-ttl\-cache \fIboolean\fR;
 	zone \fIstring\fR [ \fIclass\fR ] {
@@ -901,7 +901,7 @@ view \fIstring\fR [ \fIclass\fR ] {
 		serial\-update\-method ( date | increment | unixtime );
 		server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [
 		    port \fIinteger\fR ]; \&.\&.\&. };
-		server\-names { \fIquoted_string\fR; \&.\&.\&. };
+		server\-names { \fIstring\fR; \&.\&.\&. };
 		sig\-signing\-nodes \fIinteger\fR;
 		sig\-signing\-signatures \fIinteger\fR;
 		sig\-signing\-type \fIinteger\fR;
@@ -1009,7 +1009,7 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	serial\-update\-method ( date | increment | unixtime );
 	server\-addresses { ( \fIipv4_address\fR | \fIipv6_address\fR ) [ port
 	    \fIinteger\fR ]; \&.\&.\&. };
-	server\-names { \fIquoted_string\fR; \&.\&.\&. };
+	server\-names { \fIstring\fR; \&.\&.\&. };
 	sig\-signing\-nodes \fIinteger\fR;
 	sig\-signing\-signatures \fIinteger\fR;
 	sig\-signing\-type \fIinteger\fR;
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-05-29</date>
+    <date>2018-06-21</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -224,9 +224,9 @@ options {
 	coresize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	datasize ( default | unlimited | <replaceable>sizeval</replaceable> );
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
-	    <replaceable>quoted_string</replaceable>; ... } ];
+	    except-from { <replaceable>string</replaceable>; ... } ];
+	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
+	    } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	directory <replaceable>quoted_string</replaceable>;
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
@@ -257,14 +257,12 @@ options {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver ) [ ( query | response ) ]; ... };
-	dnstap-identity ( <replaceable>quoted_string</replaceable> | none |
-	    hostname );
-	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [
-	    size ( unlimited | <replaceable>size</replaceable> ) ] [ versions (
-	    unlimited | <replaceable>integer</replaceable> ) ] [ suffix ( increment
-	    | timestamp ) ];
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	    response ) ]; ... };
+	dnstap-identity ( <replaceable>quoted_string</replaceable> | none | hostname );
+	dnstap-output ( file | unix ) <replaceable>quoted_string</replaceable> [ size ( unlimited |
+	    <replaceable>size</replaceable> ) ] [ versions ( unlimited | <replaceable>integer</replaceable> ) ] [ suffix (
+	    increment | timestamp ) ];
 	dnstap-version ( <replaceable>quoted_string</replaceable> | none );
 	dscp <replaceable>integer</replaceable>;
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
@@ -362,7 +360,7 @@ options {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
+	qname-minimization ( strict | relaxed | disabled | off );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -413,7 +411,7 @@ options {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -463,6 +461,7 @@ options {
 	use-v4-udp-ports { <replaceable>portrange</replaceable>; ... };
 	use-v6-udp-ports { <replaceable>portrange</replaceable>; ... };
 	v6-bias <replaceable>integer</replaceable>;
+	validate-except { <replaceable>string</replaceable>; ... };
 	version ( <replaceable>quoted_string</replaceable> | none );
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
@@ -574,9 +573,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	cleaning-interval <replaceable>integer</replaceable>;
 	clients-per-query <replaceable>integer</replaceable>;
 	deny-answer-addresses { <replaceable>address_match_element</replaceable>; ... } [
-	    except-from { <replaceable>quoted_string</replaceable>; ... } ];
-	deny-answer-aliases { <replaceable>quoted_string</replaceable>; ... } [ except-from {
-	    <replaceable>quoted_string</replaceable>; ... } ];
+	    except-from { <replaceable>string</replaceable>; ... } ];
+	deny-answer-aliases { <replaceable>string</replaceable>; ... } [ except-from { <replaceable>string</replaceable>; ...
+	    } ];
 	dialup ( notify | notify-passive | passive | refresh | <replaceable>boolean</replaceable> );
 	disable-algorithms <replaceable>string</replaceable> { <replaceable>string</replaceable>;
 	    ... };
@@ -610,8 +609,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	dnssec-secure-to-insecure <replaceable>boolean</replaceable>;
 	dnssec-update-mode ( maintain | no-resign );
 	dnssec-validation ( yes | no | auto );
-	dnstap { ( all | auth | client | forwarder |
-	    resolver ) [ ( query | response ) ]; ... };
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |
+	    response ) ]; ... };
 	dual-stack-servers [ port <replaceable>integer</replaceable> ] { ( <replaceable>quoted_string</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv4_address</replaceable> [ port
 	    <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ] | <replaceable>ipv6_address</replaceable> [ port
@@ -689,7 +688,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	preferred-glue <replaceable>string</replaceable>;
 	prefetch <replaceable>integer</replaceable> [ <replaceable>integer</replaceable> ];
 	provide-ixfr <replaceable>boolean</replaceable>;
-	qname-minimization ( strict | relaxed | disabled );
+	qname-minimization ( strict | relaxed | disabled | off );
 	query-source ( ( [ address ] ( <replaceable>ipv4_address</replaceable> | * ) [ port (
 	    <replaceable>integer</replaceable> | * ) ] ) | ( [ [ address ] ( <replaceable>ipv4_address</replaceable> | * ) ]
 	    port ( <replaceable>integer</replaceable> | * ) ) ) [ dscp <replaceable>integer</replaceable> ];
@@ -735,7 +734,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    nsip-enable <replaceable>boolean</replaceable> ] [ nsdname-enable <replaceable>boolean</replaceable> ] [
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
-	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
+	root-delegation-only [ exclude { <replaceable>string</replaceable>; ... } ];
 	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
@@ -797,6 +796,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	update-check-ksk <replaceable>boolean</replaceable>;
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	v6-bias <replaceable>integer</replaceable>;
+	validate-except { <replaceable>string</replaceable>; ... };
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl-cache <replaceable>boolean</replaceable>;
 	zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
@@ -878,7 +878,7 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		serial-update-method ( date | increment | unixtime );
 		server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [
 		    port <replaceable>integer</replaceable> ]; ... };
-		server-names { <replaceable>quoted_string</replaceable>; ... };
+		server-names { <replaceable>string</replaceable>; ... };
 		sig-signing-nodes <replaceable>integer</replaceable>;
 		sig-signing-signatures <replaceable>integer</replaceable>;
 		sig-signing-type <replaceable>integer</replaceable>;
@@ -982,7 +982,7 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	serial-update-method ( date | increment | unixtime );
 	server-addresses { ( <replaceable>ipv4_address</replaceable> | <replaceable>ipv6_address</replaceable> ) [ port
 	    <replaceable>integer</replaceable> ]; ... };
-	server-names { <replaceable>quoted_string</replaceable>; ... };
+	server-names { <replaceable>string</replaceable>; ... };
 	sig-signing-nodes <replaceable>integer</replaceable>;
 	sig-signing-signatures <replaceable>integer</replaceable>;
 	sig-signing-type <replaceable>integer</replaceable>;
@@ -212,9 +212,9 @@ options
 	coresize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	datasize ( default | unlimited | <em class="replaceable"><code>sizeval</code></em> );<br>
 	deny-answer-addresses { <em class="replaceable"><code>address_match_element</code></em>; ... } [<br>
-	    except-from { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	deny-answer-aliases { <em class="replaceable"><code>quoted_string</code></em>; ... } [ except-from {<br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    except-from { <em class="replaceable"><code>string</code></em>; ... } ];<br>
+	deny-answer-aliases { <em class="replaceable"><code>string</code></em>; ... } [ except-from { <em class="replaceable"><code>string</code></em>; ...<br>
+	    } ];<br>
 	dialup ( notify | notify-passive | passive | refresh | <em class="replaceable"><code>boolean</code></em> );<br>
 	directory <em class="replaceable"><code>quoted_string</code></em>;<br>
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>;<br>
@@ -245,14 +245,12 @@ options
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
-	    resolver ) [ ( query | response ) ]; ... };<br>
-	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none |<br>
-	    hostname );<br>
-	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [<br>
-	    size ( unlimited | <em class="replaceable"><code>size</code></em> ) ] [ versions (<br>
-	    unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix ( increment<br>
-	    | timestamp ) ];<br>
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
+	    response ) ]; ... };<br>
+	dnstap-identity ( <em class="replaceable"><code>quoted_string</code></em> | none | hostname );<br>
+	dnstap-output ( file | unix ) <em class="replaceable"><code>quoted_string</code></em> [ size ( unlimited |<br>
+	    <em class="replaceable"><code>size</code></em> ) ] [ versions ( unlimited | <em class="replaceable"><code>integer</code></em> ) ] [ suffix (<br>
+	    increment | timestamp ) ];<br>
 	dnstap-version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	dscp <em class="replaceable"><code>integer</code></em>;<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
@@ -350,7 +348,7 @@ options
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
+	qname-minimization ( strict | relaxed | disabled | off );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -401,7 +399,7 @@ options
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
-	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -451,6 +449,7 @@ options
 	use-v4-udp-ports { <em class="replaceable"><code>portrange</code></em>; ... };<br>
 	use-v6-udp-ports { <em class="replaceable"><code>portrange</code></em>; ... };<br>
 	v6-bias <em class="replaceable"><code>integer</code></em>;<br>
+	validate-except { <em class="replaceable"><code>string</code></em>; ... };<br>
 	version ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
@@ -566,9 +565,9 @@ view
 	cleaning-interval <em class="replaceable"><code>integer</code></em>;<br>
 	clients-per-query <em class="replaceable"><code>integer</code></em>;<br>
 	deny-answer-addresses { <em class="replaceable"><code>address_match_element</code></em>; ... } [<br>
-	    except-from { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	deny-answer-aliases { <em class="replaceable"><code>quoted_string</code></em>; ... } [ except-from {<br>
-	    <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	    except-from { <em class="replaceable"><code>string</code></em>; ... } ];<br>
+	deny-answer-aliases { <em class="replaceable"><code>string</code></em>; ... } [ except-from { <em class="replaceable"><code>string</code></em>; ...<br>
+	    } ];<br>
 	dialup ( notify | notify-passive | passive | refresh | <em class="replaceable"><code>boolean</code></em> );<br>
 	disable-algorithms <em class="replaceable"><code>string</code></em> { <em class="replaceable"><code>string</code></em>;<br>
 	    ... };<br>
@@ -602,8 +601,8 @@ view
 	dnssec-secure-to-insecure <em class="replaceable"><code>boolean</code></em>;<br>
 	dnssec-update-mode ( maintain | no-resign );<br>
 	dnssec-validation ( yes | no | auto );<br>
-	dnstap { ( all | auth | client | forwarder |<br>
-	    resolver ) [ ( query | response ) ]; ... };<br>
+	dnstap { ( all | auth | client | forwarder | resolver ) [ ( query |<br>
+	    response ) ]; ... };<br>
 	dual-stack-servers [ port <em class="replaceable"><code>integer</code></em> ] { ( <em class="replaceable"><code>quoted_string</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv4_address</code></em> [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ] | <em class="replaceable"><code>ipv6_address</code></em> [ port<br>
@@ -681,7 +680,7 @@ view
 	preferred-glue <em class="replaceable"><code>string</code></em>;<br>
 	prefetch <em class="replaceable"><code>integer</code></em> [ <em class="replaceable"><code>integer</code></em> ];<br>
 	provide-ixfr <em class="replaceable"><code>boolean</code></em>;<br>
-	qname-minimization ( strict | relaxed | disabled );<br>
+	qname-minimization ( strict | relaxed | disabled | off );<br>
 	query-source ( ( [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) [ port (<br>
 	    <em class="replaceable"><code>integer</code></em> | * ) ] ) | ( [ [ address ] ( <em class="replaceable"><code>ipv4_address</code></em> | * ) ]<br>
 	    port ( <em class="replaceable"><code>integer</code></em> | * ) ) ) [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
@@ -727,7 +726,7 @@ view
 	    nsip-enable <em class="replaceable"><code>boolean</code></em> ] [ nsdname-enable <em class="replaceable"><code>boolean</code></em> ] [<br>
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
-	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
+	root-delegation-only [ exclude { <em class="replaceable"><code>string</code></em>; ... } ];<br>
 	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
@@ -789,6 +788,7 @@ view
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 	v6-bias <em class="replaceable"><code>integer</code></em>;<br>
+	validate-except { <em class="replaceable"><code>string</code></em>; ... };<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	zone <em class="replaceable"><code>string</code></em> [ <em class="replaceable"><code>class</code></em> ] {<br>
@@ -870,7 +870,7 @@ view
 		serial-update-method ( date | increment | unixtime );<br>
 		server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [<br>
 		    port <em class="replaceable"><code>integer</code></em> ]; ... };<br>
-		server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+		server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 		sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 		sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
@@ -975,7 +975,7 @@ zone
 	serial-update-method ( date | increment | unixtime );<br>
 	server-addresses { ( <em class="replaceable"><code>ipv4_address</code></em> | <em class="replaceable"><code>ipv6_address</code></em> ) [ port<br>
 	    <em class="replaceable"><code>integer</code></em> ]; ... };<br>
-	server-names { <em class="replaceable"><code>quoted_string</code></em>; ... };<br>
+	server-names { <em class="replaceable"><code>string</code></em>; ... };<br>
 	sig-signing-nodes <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-signatures <em class="replaceable"><code>integer</code></em>;<br>
 	sig-signing-type <em class="replaceable"><code>integer</code></em>;<br>
@@ -656,9 +656,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 			return (ISC_R_SUCCESS);
 	}

-	result = dns_rbt_create(mctx, NULL, NULL, rbtp);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_rbt_create(mctx, NULL, NULL, rbtp);

 	name = dns_fixedname_initname(&fixed);
 	for (element = cfg_list_first(obj);
@@ -938,7 +936,8 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,

 	/* We don't need trust anchors for the _bind view */
 	if (strcmp(view->name, "_bind") == 0 &&
-	    view->rdclass == dns_rdataclass_chaos) {
+	    view->rdclass == dns_rdataclass_chaos)
+	{
 		return (ISC_R_SUCCESS);
 	}

@@ -965,13 +964,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	maps[i++] = named_g_defaults;
 	maps[i] = NULL;

-	result = dns_view_initsecroots(view, mctx);
-	if (result != ISC_R_SUCCESS) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "couldn't create keytable");
-		return (ISC_R_UNEXPECTED);
-	}
+	dns_view_initsecroots(view, mctx);

 	result = dns_view_initntatable(view, named_g_taskmgr, named_g_timermgr);
 	if (result != ISC_R_SUCCESS) {
@@ -1676,10 +1669,8 @@ setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) {

 	zoneqrystats = NULL;
 	if (level == dns_zonestat_full) {
-		result = isc_stats_create(mctx, &zoneqrystats,
+		isc_stats_create(mctx, &zoneqrystats,
 					  ns_statscounter_max);
-		if (result != ISC_R_SUCCESS)
-			return (result);
 	}
 	dns_zone_setrequeststats(zone, zoneqrystats);
 	if (zoneqrystats != NULL)
@@ -2608,12 +2599,12 @@ catz_addmodzone_taskaction(isc_task_t *task, isc_event_t *event0) {
 	 * Load the zone from the master file.	If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
-			      "catz: dns_zone_loadnew() failed "
+			      "catz: dns_zone_load() failed "
 			      "with %s; reverting.",
 			      isc_result_totext(result));

@@ -2835,13 +2826,7 @@ configure_catz_zone(dns_view_t *view, const cfg_obj_t *config,
 		 * We have to walk through all the member zones and attach
 		 * them to current view
 		 */
-		result = dns_catz_get_iterator(zone, &it);
-		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(catz_obj, named_g_lctx,
-				    DNS_CATZ_ERROR_LEVEL,
-				    "catz: unable to create iterator");
-			goto cleanup;
-		}
+		dns_catz_get_iterator(zone, &it);

 		for (result = isc_ht_iter_first(it);
 		     result == ISC_R_SUCCESS;
@@ -2937,9 +2922,9 @@ configure_catz(dns_view_t *view, const cfg_obj_t *config,
 	if (zone_element == NULL)
 		return (ISC_R_SUCCESS);

-	CHECK(dns_catz_new_zones(&view->catzs, &ns_catz_zonemodmethods,
+	dns_catz_new_zones(&view->catzs, &ns_catz_zonemodmethods,
 				 view->mctx, named_g_taskmgr,
-				 named_g_timermgr));
+				 named_g_timermgr);

 	result = dns_viewlist_find(&named_g_server->viewlist, view->name,
 				   view->rdclass, &pview);
@@ -3016,9 +3001,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map) {
 		if (min_entries < 1)
 			min_entries = 1;
 	}
-	result = dns_rrl_init(&rrl, view, min_entries);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_rrl_init(&rrl, view, min_entries);

 	i = ISC_MAX(20000, min_entries);
 	obj = NULL;
@@ -3602,24 +3585,18 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 }
 #endif /* HAVE_DNSTAP */

-static isc_result_t
+static void
 create_mapped_acl(void) {
-	isc_result_t result;
 	dns_acl_t *acl = NULL;
 	struct in6_addr in6 = IN6ADDR_V4MAPPED_INIT;
 	isc_netaddr_t addr;

 	isc_netaddr_fromin6(&addr, &in6);

-	result = dns_acl_create(named_g_mctx, 1, &acl);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_acl_create(named_g_mctx, 1, &acl);

-	result = dns_iptable_addprefix(acl->iptable, &addr, 96, true);
-	if (result == ISC_R_SUCCESS)
-		dns_acl_attach(acl, &named_g_mapped);
+	dns_iptable_addprefix(acl->iptable, &addr, 96, true);
 	dns_acl_detach(&acl);
-	return (result);
 }

 /*
@@ -3692,6 +3669,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	isc_dscp_t dscp4 = -1, dscp6 = -1;
 	dns_dyndbctx_t *dctx = NULL;
 	unsigned int resolver_param;
+	dns_ntatable_t *ntatable = NULL;
 	const char *qminmode = NULL;

 	REQUIRE(DNS_VIEW_VALID(view));
@@ -4019,9 +3997,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					goto cleanup;
 			} else {
 				if (named_g_mapped == NULL) {
-					result = create_mapped_acl();
-					if (result != ISC_R_SUCCESS)
-						goto cleanup;
+					create_mapped_acl();
 				}
 				dns_acl_attach(named_g_mapped, &excluded);
 			}
@@ -4200,9 +4176,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			 * cache, for the main cache memory and the heap
 			 * memory.
 			 */
-			CHECK(isc_mem_create(0, 0, &cmctx));
+			isc_mem_create(0, 0, &cmctx);
 			isc_mem_setname(cmctx, "cache", NULL);
-			CHECK(isc_mem_create(0, 0, &hmctx));
+			isc_mem_create(0, 0, &hmctx);
 			isc_mem_setname(hmctx, "cache_heap", NULL);
 			CHECK(dns_cache_create(cmctx, hmctx, named_g_taskmgr,
 					       named_g_timermgr, view->rdclass,
@@ -4268,20 +4244,20 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	}

 	if (resstats == NULL) {
-		CHECK(isc_stats_create(mctx, &resstats,
-				       dns_resstatscounter_max));
+		isc_stats_create(mctx, &resstats,
+				       dns_resstatscounter_max);
 	}
 	dns_view_setresstats(view, resstats);
 	if (resquerystats == NULL)
-		CHECK(dns_rdatatypestats_create(mctx, &resquerystats));
+		dns_rdatatypestats_create(mctx, &resquerystats);
 	dns_view_setresquerystats(view, resquerystats);

 	ndisp = 4 * ISC_MIN(named_g_udpdisp, MAX_UDP_DISPATCH);
-	CHECK(dns_view_createresolver(view, named_g_taskmgr, RESOLVER_NTASKS,
+	dns_view_createresolver(view, named_g_taskmgr, RESOLVER_NTASKS,
 				      ndisp, named_g_socketmgr,
 				      named_g_timermgr, resopts,
 				      named_g_dispatchmgr,
-				      dispatch4, dispatch6));
+				      dispatch4, dispatch6);

 	if (dscp4 == -1)
 		dscp4 = named_g_dscp;
@@ -4706,14 +4682,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	INSIST(result == ISC_R_SUCCESS);
 	view->root_key_sentinel = cfg_obj_asboolean(obj);

-	CHECK(configure_view_acl(vconfig, config, named_g_config,
-				 "allow-query-cache-on", NULL, actx,
-				 named_g_mctx, &view->cacheonacl));
 	/*
 	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
-	 * and "allow-recursion-on" ACLs if configured in named.conf, but
-	 * NOT from the global defaults. This is done by leaving the third
-	 * argument to configure_view_acl() NULL.
+	 * "allow-recursion-on" and "allow-query-cache-on" ACLs if
+	 * configured in named.conf, but NOT from the global defaults.
+	 * This is done by leaving the third argument to configure_view_acl()
+	 * NULL.
 	 *
 	 * We ignore the global defaults here because these ACLs
 	 * can inherit from each other.  If any are still unset after
@@ -4730,6 +4704,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECK(configure_view_acl(vconfig, config, NULL,
 				 "allow-query-cache", NULL, actx,
 				 named_g_mctx, &view->cacheacl));
+	/* named.conf only */
+	CHECK(configure_view_acl(vconfig, config, NULL,
+				 "allow-query-cache-on", NULL, actx,
+				 named_g_mctx, &view->cacheonacl));

 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
@@ -4748,8 +4726,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		/*
 		 * "allow-query-cache" inherits from "allow-recursion" if set,
 		 * otherwise from "allow-query" if set.
-		 * "allow-recursion" inherits from "allow-query-cache" if set,
-		 * otherwise from "allow-query" if set.
 		 */
 		if (view->cacheacl == NULL) {
 			if (view->recursionacl != NULL) {
@@ -4760,6 +4736,11 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 					       &view->cacheacl);
 			}
 		}
+
+		/*
+		 * "allow-recursion" inherits from "allow-query-cache" if set,
+		 * otherwise from "allow-query" if set.
+		 */
 		if (view->recursionacl == NULL) {
 			if (view->cacheacl != NULL) {
 				dns_acl_attach(view->cacheacl,
@@ -4771,10 +4752,32 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		}

 		/*
-		 * If any are still unset, we now get default "allow-recursion",
-		 * "allow-recursion-on" and "allow-query-cache" ACLs from
-		 * the global config.
+		 * "allow-query-cache-on" inherits from "allow-recursion-on"
+		 * if set.
 		 */
+		if (view->cacheonacl == NULL) {
+			if (view->recursiononacl != NULL) {
+				dns_acl_attach(view->recursiononacl,
+					       &view->cacheonacl);
+			}
+		}
+
+		/*
+		 * "allow-recursion-on" inherits from "allow-query-cache-on"
+		 * if set.
+		 */
+		if (view->recursiononacl == NULL) {
+			if (view->cacheonacl != NULL) {
+				dns_acl_attach(view->cacheonacl,
+					       &view->recursiononacl);
+			}
+		}
+
+		/*
+		 * If any are still unset at this point, we now get default
+		 * values for from the global config.
+		 */
+
 		if (view->recursionacl == NULL) {
 			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -4796,14 +4799,30 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 						 actx, named_g_mctx,
 						 &view->cacheacl));
 		}
-	} else if (view->cacheacl == NULL) {
+		if (view->cacheonacl == NULL) {
+			/* global default only */
+			CHECK(configure_view_acl(NULL, NULL, named_g_config,
+						 "allow-query-cache-on", NULL,
+						 actx, named_g_mctx,
+						 &view->cacheonacl));
+		}
+	} else {
 		/*
-		 * We're not recursive; if "allow-query-cache" hasn't been
-		 * set at the options/view level, set it to none.
+		 * We're not recursive; if the query-cache ACLs haven't
+		 * been set at the options/view level, set them to none.
 		 */
-		CHECK(dns_acl_none(mctx, &view->cacheacl));
+		if (view->cacheacl == NULL) {
+			dns_acl_none(mctx, &view->cacheacl);
+		}
+		if (view->cacheonacl == NULL) {
+			dns_acl_none(mctx, &view->cacheonacl);
+		}
 	}

+	/*
+	 * Finished setting recursion and query-cache ACLs, so now we
+	 * can get the allow-query default if it wasn't set in named.conf
+	 */
 	if (view->queryacl == NULL) {
 		/* global default only */
 		CHECK(configure_view_acl(NULL, NULL, named_g_config,
@@ -5151,7 +5170,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			CHECK(dns_name_fromstring(name,
 						  cfg_obj_asstring(exclude),
 						  0, NULL));
-			CHECK(dns_view_excludedelegationonly(view, name));
+			dns_view_excludedelegationonly(view, name);
 		}
 	} else
 		dns_view_setrootdelonly(view, false);
@@ -5348,8 +5367,35 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_name_fromstring(name, cfg_obj_asstring(obj), 0,
 					  NULL));
 		view->redirectzone = name;
-	} else
+	} else {
 		view->redirectzone = NULL;
+	}
+
+	/*
+	 * Exceptions to DNSSEC validation.
+	 */
+	obj = NULL;
+	result = named_config_get(maps, "validate-except", &obj);
+	if (result == ISC_R_SUCCESS) {
+		result = dns_view_getntatable(view, &ntatable);
+	}
+	if (result == ISC_R_SUCCESS) {
+		for (element = cfg_list_first(obj);
+		     element != NULL;
+		     element = cfg_list_next(element))
+		{
+			dns_fixedname_t fntaname;
+			dns_name_t *ntaname;
+
+			ntaname = dns_fixedname_initname(&fntaname);
+			obj = cfg_listelt_value(element);
+			CHECK(dns_name_fromstring(ntaname,
+						  cfg_obj_asstring(obj),
+						  0, NULL));
+			CHECK(dns_ntatable_add(ntatable, ntaname,
+					       true, 0, 0xffffffffU));
+		}
+	}

 #ifdef HAVE_DNSTAP
 	/*
@@ -5362,35 +5408,51 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	result = ISC_R_SUCCESS;

 cleanup:
-	if (clients != NULL)
+	if (ntatable != NULL) {
+		dns_ntatable_detach(&ntatable);
+	}
+	if (clients != NULL) {
 		dns_acl_detach(&clients);
-	if (mapped != NULL)
+	}
+	if (mapped != NULL) {
 		dns_acl_detach(&mapped);
-	if (excluded != NULL)
+	}
+	if (excluded != NULL) {
 		dns_acl_detach(&excluded);
-	if (ring != NULL)
+	}
+	if (ring != NULL) {
 		dns_tsigkeyring_detach(&ring);
-	if (zone != NULL)
+	}
+	if (zone != NULL) {
 		dns_zone_detach(&zone);
-	if (dispatch4 != NULL)
+	}
+	if (dispatch4 != NULL) {
 		dns_dispatch_detach(&dispatch4);
-	if (dispatch6 != NULL)
+	}
+	if (dispatch6 != NULL) {
 		dns_dispatch_detach(&dispatch6);
-	if (resstats != NULL)
+	}
+	if (resstats != NULL) {
 		isc_stats_detach(&resstats);
-	if (resquerystats != NULL)
+	}
+	if (resquerystats != NULL) {
 		dns_stats_detach(&resquerystats);
-	if (order != NULL)
+	}
+	if (order != NULL) {
 		dns_order_detach(&order);
-	if (cmctx != NULL)
+	}
+	if (cmctx != NULL) {
 		isc_mem_detach(&cmctx);
-	if (hmctx != NULL)
+	}
+	if (hmctx != NULL) {
 		isc_mem_detach(&hmctx);
-
-	if (cache != NULL)
+	}
+	if (cache != NULL) {
 		dns_cache_detach(&cache);
-	if (dctx != NULL)
+	}
+	if (dctx != NULL) {
 		dns_dyndb_destroyctx(&dctx);
+	}

 	return (result);
 }
@@ -5734,6 +5796,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	const cfg_obj_t *typeobj = NULL;
 	const cfg_obj_t *forwarders = NULL;
 	const cfg_obj_t *forwardtype = NULL;
+	const cfg_obj_t *ixfrfromdiffs = NULL;
 	const cfg_obj_t *only = NULL;
 	const cfg_obj_t *signing = NULL;
 	const cfg_obj_t *viewobj = NULL;
@@ -5869,7 +5932,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			tresult = cfg_map_get(zoptions, "delegation-only",
 					      &only);
 			if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
-				CHECK(dns_view_adddelegationonly(view, origin));
+				dns_view_adddelegationonly(view, origin);
 		} else {
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
@@ -5900,7 +5963,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		only = NULL;
 		tresult = cfg_map_get(zoptions, "delegation-only", &only);
 		if (tresult == ISC_R_SUCCESS && cfg_obj_asboolean(only))
-			CHECK(dns_view_adddelegationonly(view, origin));
+			dns_view_adddelegationonly(view, origin);
 		goto cleanup;
 	}

@@ -5908,7 +5971,8 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	 * "delegation-only zones" aren't zones either.
 	 */
 	if (strcasecmp(ztypestr, "delegation-only") == 0) {
-		result = dns_view_adddelegationonly(view, origin);
+		dns_view_adddelegationonly(view, origin);
+		result = ISC_R_SUCCESS;
 		goto cleanup;
 	}

@@ -6063,7 +6127,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	if (cfg_map_get(zoptions, "delegation-only", &only) == ISC_R_SUCCESS)
 	{
 		if (cfg_obj_asboolean(only))
-			CHECK(dns_view_adddelegationonly(view, origin));
+			dns_view_adddelegationonly(view, origin);
 	}

 	/*
@@ -6087,6 +6151,15 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 			dns_zone_setstats(raw, named_g_server->zonestats);
 			CHECK(dns_zone_link(zone, raw));
 		}
+		if (cfg_map_get(zoptions, "ixfr-from-differences",
+				&ixfrfromdiffs) == ISC_R_SUCCESS)
+		{
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "zone '%s': 'ixfr-from-differences' is "
+				      "ignored for inline-signed zones",
+				      zname);
+		}
 	}

 	/*
@@ -6185,7 +6258,7 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {

 	CHECK(dns_zonemgr_managezone(named_g_server->zonemgr, zone));

-	CHECK(dns_acl_none(mctx, &none));
+	dns_acl_none(mctx, &none);
 	dns_zone_setqueryacl(zone, none);
 	dns_zone_setqueryonacl(zone, none);
 	dns_acl_detach(&none);
@@ -6294,14 +6367,10 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 	    (wcardport_ok || isc_sockaddr_getport(addr) != 0)) {
 		isc_netaddr_fromin6(&netaddr, &addr->type.sin6.sin6_addr);

-		result = dns_acl_create(mctx, 0, &src_acl);
-		if (result != ISC_R_SUCCESS)
-			return (result);
+		dns_acl_create(mctx, 0, &src_acl);

-		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
+		dns_iptable_addprefix(src_acl->iptable, &netaddr,
 					       128, true);
-		if (result != ISC_R_SUCCESS)
-			goto clean;

 		result = ns_listenelt_create(mctx, isc_sockaddr_getport(addr),
 					     dscp, src_acl, &lelt);
@@ -7075,7 +7144,7 @@ configure_session_key(const cfg_obj_t **maps, named_server_t *server,
 		if (server->session_keyname == NULL)
 			goto cleanup;
 		dns_name_init(server->session_keyname, NULL);
-		CHECK(dns_name_dup(keyname, mctx, server->session_keyname));
+		dns_name_dup(keyname, mctx, server->session_keyname);

 		server->session_keyfile = isc_mem_strdup(mctx, keyfile);
 		if (server->session_keyfile == NULL)
@@ -8000,7 +8069,7 @@ load_configuration(const char *filename, named_server_t *server,
 			      "less than 128 UDP sockets available after "
 			      "applying 'reserved-sockets' and 'maxsockets'");
 	}
-	isc__socketmgr_setreserved(named_g_socketmgr, reserved);
+	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

 #ifdef HAVE_GEOIP
 	/*
@@ -8143,10 +8212,8 @@ load_configuration(const char *filename, named_server_t *server,
 	/*
 	 * Configure sets of UDP query source ports.
 	 */
-	CHECKM(isc_portset_create(named_g_mctx, &v4portset),
-	       "creating UDP port set");
-	CHECKM(isc_portset_create(named_g_mctx, &v6portset),
-	       "creating UDP port set");
+	isc_portset_create(named_g_mctx, &v4portset);
+	isc_portset_create(named_g_mctx, &v6portset);

 	usev4ports = NULL;
 	usev6ports = NULL;
@@ -9089,7 +9156,6 @@ view_loaded(void *arg) {
 	ns_zoneload_t *zl = (ns_zoneload_t *) arg;
 	named_server_t *server = zl->server;
 	bool reconfig = zl->reconfig;
-	unsigned int refs;


 	/*
@@ -9100,35 +9166,34 @@ view_loaded(void *arg) {
 	 * We use the zoneload reference counter to let us
 	 * know when all views are finished.
 	 */
-	isc_refcount_decrement(&zl->refs, &refs);
-	if (refs != 0)
-		return (ISC_R_SUCCESS);
+	if (isc_refcount_decrement(&zl->refs) == 1) {

-	isc_refcount_destroy(&zl->refs);
-	isc_mem_put(server->mctx, zl, sizeof (*zl));
+		isc_refcount_destroy(&zl->refs);
+		isc_mem_put(server->mctx, zl, sizeof (*zl));

-	/*
-	 * To maintain compatibility with log parsing tools that might
-	 * be looking for this string after "rndc reconfig", we keep it
-	 * as it is
-	 */
-	if (reconfig) {
+		/*
+		 * To maintain compatibility with log parsing tools that might
+		 * be looking for this string after "rndc reconfig", we keep it
+		 * as it is
+		 */
+		if (reconfig) {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+				      "any newly configured zones are now loaded");
+		} else {
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+				      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+				      "all zones loaded");
+		}
+
+		CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
+			   "forcing zone maintenance");
+
+		named_os_started();
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
-			      "any newly configured zones are now loaded");
-	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
-			      "all zones loaded");
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
 	}

-	CHECKFATAL(dns_zonemgr_forcemaint(server->zonemgr),
-		   "forcing zone maintenance");
-
-	named_os_started();
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE, "running");
-
 	return (ISC_R_SUCCESS);
 }

@@ -9137,7 +9202,6 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	isc_result_t result;
 	dns_view_t *view;
 	ns_zoneload_t *zl;
-	unsigned int refs = 0;

 	zl = isc_mem_get(server->mctx, sizeof (*zl));
 	if (zl == NULL)
@@ -9158,14 +9222,14 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 	     view = ISC_LIST_NEXT(view, link))
 	{
 		if (view->managed_keys != NULL) {
-			result = dns_zone_load(view->managed_keys);
+			result = dns_zone_load(view->managed_keys, false);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
 				goto cleanup;
 		}
 		if (view->redirect != NULL) {
-			result = dns_zone_load(view->redirect);
+			result = dns_zone_load(view->redirect, false);
 			if (result != ISC_R_SUCCESS &&
 			    result != DNS_R_UPTODATE &&
 			    result != DNS_R_CONTINUE)
@@ -9176,13 +9240,12 @@ load_zones(named_server_t *server, bool init, bool reconfig) {
 		 * 'dns_view_asyncload' calls view_loaded if there are no
 		 * zones.
 		 */
-		isc_refcount_increment(&zl->refs, NULL);
-		CHECK(dns_view_asyncload(view, view_loaded, zl));
+		isc_refcount_increment(&zl->refs);
+		CHECK(dns_view_asyncload(view, reconfig, view_loaded, zl));
 	}

 cleanup:
-	isc_refcount_decrement(&zl->refs, &refs);
-	if (refs == 0) {
+	if (isc_refcount_decrement(&zl->refs) == 1) {
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof (*zl));
 	} else if (init) {
@@ -9211,8 +9274,7 @@ run_server(isc_task_t *task, isc_event_t *event) {

 	isc_event_free(&event);

-	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, &named_g_dispatchmgr),
-		   "creating dispatch manager");
+	dns_dispatchmgr_create(named_g_mctx, &named_g_dispatchmgr);

 	dns_dispatchmgr_setstats(named_g_dispatchmgr, server->resolverstats);

@@ -9443,8 +9505,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 				     &server->in_roothints),
 		   "setting up root hints");

-	CHECKFATAL(isc_mutex_init(&server->reload_event_lock),
-		   "initializing reload event lock");
+	isc_mutex_init(&server->reload_event_lock);
 	server->reload_event =
 		isc_event_allocate(named_g_mctx, server,
 				   NAMED_EVENT_RELOAD,
@@ -9535,18 +9596,15 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	server->zonestats = NULL;
 	server->resolverstats = NULL;
 	server->sockstats = NULL;
-	CHECKFATAL(isc_stats_create(server->mctx, &server->sockstats,
-				    isc_sockstatscounter_max),
-		   "isc_stats_create");
+	isc_stats_create(server->mctx, &server->sockstats,
+				    isc_sockstatscounter_max);
 	isc_socketmgr_setstats(named_g_socketmgr, server->sockstats);

-	CHECKFATAL(isc_stats_create(named_g_mctx, &server->zonestats,
-				    dns_zonestatscounter_max),
-		   "dns_stats_create (zone)");
+	isc_stats_create(named_g_mctx, &server->zonestats,
+				    dns_zonestatscounter_max);

-	CHECKFATAL(isc_stats_create(named_g_mctx, &server->resolverstats,
-				    dns_resstatscounter_max),
-		   "dns_stats_create (resolver)");
+	isc_stats_create(named_g_mctx, &server->resolverstats,
+				    dns_resstatscounter_max);

 	server->flushonshutdown = false;

@@ -10074,7 +10132,7 @@ named_server_reloadcommand(named_server_t *server, isc_lex_t *lex,
 			dns_zone_detach(&zone);
 			msg = "zone refresh queued";
 		} else {
-			result = dns_zone_load(zone);
+			result = dns_zone_load(zone, false);
 			dns_zone_detach(&zone);
 			switch (result) {
 			case ISC_R_SUCCESS:
@@ -11208,7 +11266,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	}
 	CHECK(putstr(text, line));

-#ifdef ISC_PLATFORM_USETHREADS
 	snprintf(line, sizeof(line), "CPUs found: %u\n", named_g_cpus_detected);
 	CHECK(putstr(text, line));

@@ -11218,10 +11275,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 	snprintf(line, sizeof(line), "UDP listeners per interface: %u\n",
 		 named_g_udpdisp);
 	CHECK(putstr(text, line));
-#else
-	snprintf(line, sizeof(line), "CPUs found: N/A (threads disabled)\n");
-	CHECK(putstr(text, line));
-#endif

 	snprintf(line, sizeof(line), "number of zones: %u (%u automatic)\n",
 		     zonecount, automatic);
@@ -12733,7 +12786,7 @@ do_addzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	 * Load the zone from the master file.  If this fails, we'll
 	 * need to undo the configuration we've done already.
 	 */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_t *dbp = NULL;

@@ -12923,7 +12976,7 @@ do_modzone(named_server_t *server, ns_cfgctx_t *cfg, dns_view_t *view,
 	}

 	/* Load the zone from the master file if it needs reloading. */
-	result = dns_zone_loadnew(zone);
+	result = dns_zone_load(zone, true);

 	/*
 	 * Dynamic zones need no reloading, so we can pass this result.
@@ -14186,6 +14239,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	dns_name_t *fname;
 	dns_ttl_t ntattl;
 	bool ttlset = false, excl = false;
+	dns_rdataclass_t rdclass = dns_rdataclass_in;

 	UNUSED(force);

@@ -14193,18 +14247,20 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,

 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL)
+	if (ptr == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}

 	for (;;) {
 		/* Check for options */
 		ptr = next_token(lex, text);
-		if (ptr == NULL)
+		if (ptr == NULL) {
 			return (ISC_R_UNEXPECTEDEND);
+		}

-		if (argcheck(ptr, "dump"))
+		if (argcheck(ptr, "dump")) {
 			dump = true;
-		else if (argcheck(ptr, "remove")) {
+		} else if (argcheck(ptr, "remove")) {
 			ntattl = 0;
 			ttlset = true;
 		} else if (argcheck(ptr, "force")) {
@@ -14234,8 +14290,22 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,

 			ttlset = true;
 			continue;
-		} else
+		} else if (argcheck(ptr, "class")) {
+			isc_textregion_t tr;
+
+			ptr = next_token(lex, text);
+			if (ptr == NULL) {
+				msg = "No class specified";
+				CHECK(ISC_R_UNEXPECTEDEND);
+			}
+
+			tr.base = ptr;
+			tr.length = strlen(ptr);
+			CHECK(dns_rdataclass_fromtext(&rdclass, &tr));
+			continue;
+		} else {
 			nametext = ptr;
+		}

 		break;
 	}
@@ -14248,11 +14318,13 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ntatable != NULL)
+			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
+			}
 			result = dns_view_getntatable(view, &ntatable);
-			if (result == ISC_R_NOTFOUND)
+			if (result == ISC_R_NOTFOUND) {
 				continue;
+			}
 			CHECK(dns_ntatable_totext(ntatable, text));
 		}
 		CHECK(putnull(text));
@@ -14269,17 +14341,19 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	}

 	/* Get the NTA name. */
-	if (nametext == NULL)
+	if (nametext == NULL) {
 		nametext = next_token(lex, text);
-	if (nametext == NULL)
+	}
+	if (nametext == NULL) {
 		return (ISC_R_UNEXPECTEDEND);
+	}

 	/* Copy nametext as it'll be overwritten by next_token() */
 	strlcpy(namebuf, nametext, DNS_NAME_FORMATSIZE);

-	if (strcmp(namebuf, ".") == 0)
+	if (strcmp(namebuf, ".") == 0) {
 		ntaname = dns_rootname;
-	else {
+	} else {
 		isc_buffer_t b;
 		isc_buffer_init(&b, namebuf, strlen(namebuf));
 		isc_buffer_add(&b, strlen(namebuf));
@@ -14299,18 +14373,27 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 	     view != NULL;
 	     view = ISC_LIST_NEXT(view, link))
 	{
-		if (viewname != NULL &&
-		    strcmp(view->name, viewname) != 0)
-			continue;
+		static bool first = true;

-		if (view->nta_lifetime == 0)
+		if (viewname != NULL && strcmp(view->name, viewname) != 0) {
 			continue;
+		}

-		if (!ttlset)
+		if (view->rdclass != rdclass && rdclass != dns_rdataclass_any) {
+			continue;
+		}
+
+		if (view->nta_lifetime == 0) {
+			continue;
+		}
+
+		if (!ttlset) {
 			ntattl = view->nta_lifetime;
+		}

-		if (ntatable != NULL)
+		if (ntatable != NULL) {
 			dns_ntatable_detach(&ntatable);
+		}

 		result = dns_view_getntatable(view, &ntatable);
 		if (result == ISC_R_NOTFOUND) {
@@ -14333,6 +14416,11 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 			isc_time_set(&t, when, 0);
 			isc_time_formattimestamp(&t, tbuf, sizeof(tbuf));

+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
+			first = false;
+
 			CHECK(putstr(text, "Negative trust anchor added: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
@@ -14347,6 +14435,11 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 		} else {
 			CHECK(dns_ntatable_delete(ntatable, ntaname));

+			if (!first) {
+				CHECK(putstr(text, "\n"));
+			}
+			first = false;
+
 			CHECK(putstr(text, "Negative trust anchor removed: "));
 			CHECK(putstr(text, namebuf));
 			CHECK(putstr(text, "/"));
@@ -14366,20 +14459,21 @@ named_server_nta(named_server_t *server, isc_lex_t *lex,
 				      "for view '%s': %s",
 				      view->name, isc_result_totext(result));
 		}
-
-		CHECK(putnull(text));
-
 	}

+	CHECK(putnull(text));
+
 cleanup:
 	if (msg != NULL) {
 		(void) putstr(text, msg);
 		(void) putnull(text);
 	}
-	if (excl)
+	if (excl) {
 		isc_task_endexclusive(server->task);
-	if (ntatable != NULL)
+	}
+	if (ntatable != NULL) {
 		dns_ntatable_detach(&ntatable);
+	}
 	return (result);
 }

@@ -3235,7 +3235,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext)
 {
-	isc_result_t result;
+	isc_result_t result = ISC_R_SUCCESS;
 	named_statschannel_t *listener;
 	isc_task_t *task = NULL;
 	isc_socket_t *sock = NULL;
@@ -3243,8 +3243,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	dns_acl_t *new_acl = NULL;

 	listener = isc_mem_get(server->mctx, sizeof(*listener));
-	if (listener == NULL)
-		return (ISC_R_NOMEMORY);

 	listener->httpdmgr = NULL;
 	listener->address = *addr;
@@ -3252,11 +3250,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	listener->mctx = NULL;
 	ISC_LINK_INIT(listener, link);

-	result = isc_mutex_init(&listener->lock);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(server->mctx, listener, sizeof(*listener));
-		return (ISC_R_FAILURE);
-	}
+	isc_mutex_init(&listener->lock);

 	isc_mem_attach(server->mctx, &listener->mctx);

@@ -3266,7 +3260,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 					    aclconfctx, listener->mctx, 0,
 					    &new_acl);
 	} else
-		result = dns_acl_any(listener->mctx, &new_acl);
+		dns_acl_any(listener->mctx, &new_acl);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;
 	dns_acl_attach(new_acl, &listener->acl);
@@ -3394,7 +3388,7 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 					    aclconfctx, listener->mctx, 0,
 					    &new_acl);
 	} else
-		result = dns_acl_any(listener->mctx, &new_acl);
+		dns_acl_any(listener->mctx, &new_acl);

 	if (result == ISC_R_SUCCESS) {
 		LOCK(&listener->lock);
@@ -91,7 +91,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			goto failure;
 		}
 		dns_name_init(tctx->domain, NULL);
-		RETERR(dns_name_dup(name, mctx, tctx->domain));
+		dns_name_dup(name, mctx, tctx->domain);
 	}

 	obj = NULL;
@@ -155,9 +155,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	maps[i] = NULL;

-	result = dns_tsigkeyring_create(mctx, &ring);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_tsigkeyring_create(mctx, &ring);

 	for (i = 0; ; i++) {
 		if (maps[i] == NULL)
@@ -226,35 +226,20 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		return (ISC_R_FAILURE);
 	}

-	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	isc_mem_create(0, 0, &mctx);

 	cd = isc_mem_get(mctx, sizeof(*cd));
-	if (cd == NULL) {
-		isc_mem_destroy(&mctx);
-		return (ISC_R_NOMEMORY);
-	}
+
 	memset(cd, 0, sizeof(*cd));

 	cd->mctx = mctx;

 	cd->dl_path = isc_mem_strdup(cd->mctx, argv[1]);
-	if (cd->dl_path == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto failed;
-	}

 	cd->dlzname = isc_mem_strdup(cd->mctx, dlzname);
-	if (cd->dlzname == NULL) {
-		result = ISC_R_NOMEMORY;
-		goto failed;
-	}

 	/* Initialize the lock */
-	result = isc_mutex_init(&cd->lock);
-	if (result != ISC_R_SUCCESS)
-		goto failed;
+	isc_mutex_init(&cd->lock);

 	/* Open the library */
 	dlopen_flags = RTLD_NOW|RTLD_GLOBAL;
@@ -23,8 +23,8 @@

 #include <ctype.h>
 #include <errno.h>
+#include <grp.h>
 #include <fcntl.h>
-#include <grp.h>		/* Required for initgroups() on IRIX. */
 #include <pwd.h>
 #include <stdio.h>
 #include <stdlib.h>
@@ -40,7 +40,7 @@
 #include <isc/print.h>
 #include <isc/resource.h>
 #include <isc/result.h>
-#include <isc/strerror.h>
+#include <isc/strerr.h>
 #include <isc/string.h>

 #include <named/globals.h>
@@ -59,54 +59,6 @@ static int singletonfd = -1;
 #define ISC_FACILITY LOG_DAEMON
 #endif

-/*
- * If there's no <sys/capability.h>, we don't care about <sys/prctl.h>
- */
-#ifndef HAVE_SYS_CAPABILITY_H
-#undef HAVE_SYS_PRCTL_H
-#endif
-
-/*
- * Linux defines:
- *	(T) HAVE_LINUXTHREADS
- *	(C) HAVE_SYS_CAPABILITY_H
- *	(P) HAVE_SYS_PRCTL_H
- * The possible cases are:
- *	none:	setuid() normally
- *	T:	no setuid()
- *	C:	setuid() normally, drop caps (keep CAP_SETUID)
- *	T+C:	no setuid(), drop caps (don't keep CAP_SETUID)
- *	T+C+P:	setuid() early, drop caps (keep CAP_SETUID)
- *	C+P:	setuid() normally, drop caps (keep CAP_SETUID)
- *	P:	not possible
- *	T+P:	not possible
- *
- * if (C)
- *	caps = BIND_SERVICE + CHROOT + SETGID
- *	if ((T && C && P) || !T)
- *		caps += SETUID
- *	endif
- *	capset(caps)
- * endif
- * if (T && C && P && -u)
- *	setuid()
- * else if (T && -u)
- *	fail
- * --> start threads
- * if (!T && -u)
- *	setuid()
- * if (C && (P || !-u))
- *	caps = BIND_SERVICE
- *	capset(caps)
- * endif
- *
- * It will be nice when Linux threads work properly with setuid().
- */
-
-#ifdef HAVE_LINUXTHREADS
-static pid_t mainpid = 0;
-#endif
-
 static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };
@@ -117,10 +69,7 @@ static bool non_root = false;
 static bool non_root_caps = false;

 #include <sys/capability.h>
-
-#ifdef HAVE_SYS_PRCTL_H
-#include <sys/prctl.h>		/* Required for prctl(). */
-#endif /* HAVE_SYS_PRCTL_H */
+#include <sys/prctl.h>

 static void
 linux_setcaps(cap_t caps) {
@@ -130,7 +79,7 @@ linux_setcaps(cap_t caps) {
 		return;
 	}
 	if (cap_set_proc(caps) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("cap_set_proc() failed: %s:"
 				      " please ensure that the capset kernel"
 				      " module is loaded.  see insmod(8)",
@@ -146,13 +95,13 @@ linux_setcaps(cap_t caps) {
 		if (err != -1 && curval) { \
 			err = cap_set_flag(caps, CAP_EFFECTIVE, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				isc__strerror(errno, strbuf, sizeof(strbuf)); \
+				strerror_r(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 			\
 			err = cap_set_flag(caps, CAP_PERMITTED, 1, &capval, CAP_SET); \
 			if (err == -1) { \
-				isc__strerror(errno, strbuf, sizeof(strbuf)); \
+				strerror_r(errno, strbuf, sizeof(strbuf)); \
 				named_main_earlyfatal("cap_set_proc failed: %s", strbuf); \
 			} \
 		} \
@@ -161,12 +110,12 @@ linux_setcaps(cap_t caps) {
 	do { \
 		caps = cap_init(); \
 		if (caps == NULL) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
+			strerror_r(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_init failed: %s", strbuf); \
 		} \
 		curcaps = cap_get_proc(); \
 		if (curcaps == NULL) { \
-			isc__strerror(errno, strbuf, sizeof(strbuf)); \
+			strerror_r(errno, strbuf, sizeof(strbuf)); \
 			named_main_earlyfatal("cap_get_proc failed: %s", strbuf); \
 		} \
 	} while (0)
@@ -201,15 +150,11 @@ linux_initialprivs(void) {
 	 */
 	SET_CAP(CAP_SYS_CHROOT);

-#if defined(HAVE_SYS_PRCTL_H) || !defined(HAVE_LINUXTHREADS)
 	/*
-	 * We can setuid() only if either the kernel supports keeping
-	 * capabilities after setuid() (which we don't know until we've
-	 * tried) or we're not using threads.  If either of these is
-	 * true, we want the setuid capability.
+	 * We need setuid() as the kernel supports keeping capabilities after
+	 * setuid().
 	 */
 	SET_CAP(CAP_SETUID);
-#endif

 	/*
 	 * Since we call initgroups, we need this.
@@ -275,7 +220,6 @@ linux_minprivs(void) {
 	FREE_CAP;
 }

-#ifdef HAVE_SYS_PRCTL_H
 static void
 linux_keepcaps(void) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -286,7 +230,7 @@ linux_keepcaps(void) {

 	if (prctl(PR_SET_KEEPCAPS, 1, 0, 0, 0) < 0) {
 		if (errno != EINVAL) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("prctl() failed: %s", strbuf);
 		}
 	} else {
@@ -295,11 +239,9 @@ linux_keepcaps(void) {
 			non_root = true;
 	}
 }
-#endif

 #endif	/* HAVE_SYS_CAPABILITY_H */

-
 static void
 setup_syslog(const char *progname) {
 	int options;
@@ -317,9 +259,6 @@ named_os_init(const char *progname) {
 #ifdef HAVE_SYS_CAPABILITY_H
 	linux_initialprivs();
 #endif
-#ifdef HAVE_LINUXTHREADS
-	mainpid = getpid();
-#endif
 #ifdef SIGXFSZ
 	signal(SIGXFSZ, SIG_IGN);
 #endif
@@ -331,13 +270,13 @@ named_os_daemonize(void) {
 	char strbuf[ISC_STRERRORSIZE];

 	if (pipe(dfd) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("pipe(): %s", strbuf);
 	}

 	pid = fork();
 	if (pid == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("fork(): %s", strbuf);
 	}
 	if (pid != 0) {
@@ -362,12 +301,8 @@ named_os_daemonize(void) {
 	 * We're the child.
 	 */

-#ifdef HAVE_LINUXTHREADS
-	mainpid = getpid();
-#endif
-
 	if (setsid() == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setsid(): %s", strbuf);
 	}

@@ -450,14 +385,14 @@ named_os_chroot(const char *root) {
 	if (root != NULL) {
 #ifdef HAVE_CHROOT
 		if (chroot(root) < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chroot(): %s", strbuf);
 		}
 #else
 		named_main_earlyfatal("chroot(): disabled");
 #endif
 		if (chdir("/") < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("chdir(/): %s", strbuf);
 		}
 #ifdef HAVE_LIBSCF
@@ -484,7 +419,7 @@ named_os_inituserinfo(const char *username) {

 	if (getuid() == 0) {
 		if (initgroups(runas_pw->pw_name, runas_pw->pw_gid) < 0) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlyfatal("initgroups(): %s", strbuf);
 		}
 	}
@@ -499,42 +434,27 @@ named_os_changeuser(void) {

 	done_setuid = true;

-#ifdef HAVE_LINUXTHREADS
-#ifdef HAVE_SYS_CAPABILITY_H
-	if (!non_root_caps) {
-		named_main_earlyfatal("-u with Linux threads not supported: "
-				      "requires kernel support for "
-				      "prctl(PR_SET_KEEPCAPS)");
-	}
-#else
-	named_main_earlyfatal("-u with Linux threads not supported: "
-			      "no capabilities support or capabilities "
-			      "disabled at build time");
-#endif
-#endif
-
 	if (setgid(runas_pw->pw_gid) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

 	if (setuid(runas_pw->pw_uid) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}

-#if defined(HAVE_SYS_PRCTL_H) && defined(PR_SET_DUMPABLE)
+#if defined(HAVE_SYS_CAPABILITY_H)
 	/*
 	 * Restore the ability of named to drop core after the setuid()
 	 * call has disabled it.
 	 */
 	if (prctl(PR_SET_DUMPABLE,1,0,0,0) < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("prctl(PR_SET_DUMPABLE) failed: %s",
 					strbuf);
 	}
-#endif
-#if defined(HAVE_SYS_CAPABILITY_H) && !defined(HAVE_LINUXTHREADS)
+
 	linux_minprivs();
 #endif
 }
@@ -548,7 +468,7 @@ ns_os_uid(void) {

 void
 named_os_adjustnofile(void) {
-#ifdef HAVE_LINUXTHREADS
+#if defined(__linux__)
 	isc_result_t result;
 	isc_resourcevalue_t newvalue;

@@ -566,15 +486,9 @@ named_os_adjustnofile(void) {

 void
 named_os_minprivs(void) {
-#ifdef HAVE_SYS_PRCTL_H
+#if defined(HAVE_SYS_CAPABILITY_H)
 	linux_keepcaps();
-#endif
-
-#ifdef HAVE_LINUXTHREADS
-	named_os_changeuser(); /* Call setuid() before threads are started */
-#endif
-
-#if defined(HAVE_SYS_CAPABILITY_H) && defined(HAVE_LINUXTHREADS)
+	named_os_changeuser();
 	linux_minprivs();
 #endif
 }
@@ -648,7 +562,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {

 		if (stat(filename, &sb) == -1) {
 			if (errno != ENOENT) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't stat '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -668,7 +582,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			mode |= S_IRGRP | S_IXGRP;		/* g=rx */
 			mode |= S_IROTH | S_IXOTH;		/* o=rx */
 			if (mkdir(filename, mode) == -1) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't mkdir '%s': %s", filename,
 					  strbuf);
 				goto error;
@@ -676,7 +590,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			if (runas_pw != NULL &&
 			    chown(filename, runas_pw->pw_uid,
 				  runas_pw->pw_gid) == -1) {
-				isc__strerror(errno, strbuf, sizeof(strbuf));
+				strerror_r(errno, strbuf, sizeof(strbuf));
 				(*report)("couldn't chown '%s': %s", filename,
 					  strbuf);
 			}
@@ -703,7 +617,7 @@ setperms(uid_t uid, gid_t gid) {
 #endif
 #if defined(HAVE_SETEGID)
 	if (getegid() != gid && setegid(gid) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"gid to %ld: %s",
 					(long)gid, strbuf);
@@ -711,7 +625,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESGID)
 	if (getresgid(&tmpg, &oldgid, &tmpg) == -1 || oldgid != gid) {
 		if (setresgid(-1, gid, -1) == -1) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"gid to %d: %s", gid, strbuf);
 		}
@@ -720,7 +634,7 @@ setperms(uid_t uid, gid_t gid) {

 #if defined(HAVE_SETEUID)
 	if (geteuid() != uid && seteuid(uid) == -1) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective "
 					"uid to %ld: %s",
 					(long)uid, strbuf);
@@ -728,7 +642,7 @@ setperms(uid_t uid, gid_t gid) {
 #elif defined(HAVE_SETRESUID)
 	if (getresuid(&tmpu, &olduid, &tmpu) == -1 || olduid != uid) {
 		if (setresuid(-1, uid, -1) == -1) {
-			isc__strerror(errno, strbuf, sizeof(strbuf));
+			strerror_r(errno, strbuf, sizeof(strbuf));
 			named_main_earlywarning("unable to set effective "
 						"uid to %d: %s", uid, strbuf);
 		}
@@ -747,7 +661,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	 */
 	f = strdup(filename);
 	if (f == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -759,21 +673,16 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	free(f);

 	if (switch_user && runas_pw != NULL) {
-#ifndef HAVE_LINUXTHREADS
 		gid_t oldgid = getgid();
-#endif
 		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

 		fd = safe_open(filename, mode, false);

-#ifndef HAVE_LINUXTHREADS
 		/* Restore UID/GID to root */
 		setperms(0, oldgid);
-#endif /* HAVE_LINUXTHREADS */

 		if (fd == -1) {
-#ifndef HAVE_LINUXTHREADS
 			fd = safe_open(filename, mode, false);
 			if (fd != -1) {
 				named_main_earlywarning("Required root "
@@ -786,20 +695,13 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 			named_main_earlywarning("Please check file and "
 						"directory permissions "
 						"or reconfigure the filename.");
-#else /* HAVE_LINUXTHREADS */
-			named_main_earlywarning("Could not open "
-						"'%s'.", filename);
-			named_main_earlywarning("Please check file and "
-						"directory permissions "
-						"or reconfigure the filename.");
-#endif /* HAVE_LINUXTHREADS */
 		}
 	} else {
 		fd = safe_open(filename, mode, false);
 	}

 	if (fd < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -807,7 +709,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {

 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 	}
@@ -835,7 +737,7 @@ named_os_writepidfile(const char *filename, bool first_time) {

 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -846,11 +748,7 @@ named_os_writepidfile(const char *filename, bool first_time) {
 		cleanup_pidfile();
 		return;
 	}
-#ifdef HAVE_LINUXTHREADS
-	pid = mainpid;
-#else
 	pid = getpid();
-#endif
 	if (fprintf(fh, "%ld\n", (long)pid) < 0) {
 		(*report)("fprintf() to pid file '%s' failed", filename);
 		(void)fclose(fh);
@@ -882,7 +780,7 @@ named_os_issingleton(const char *filename) {
 	 */
 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	} else {
@@ -956,11 +854,7 @@ named_os_shutdownmsg(char *command, isc_buffer_t *text) {
 		return;
 	}

-#ifdef HAVE_LINUXTHREADS
-	pid = mainpid;
-#else
 	pid = getpid();
-#endif

 	(void)isc_buffer_printf(text, "pid: %ld", (long)pid);
 }
@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBXML2_LIB@@OPENSSL_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -27,7 +27,6 @@

 #include <isc/print.h>
 #include <isc/result.h>
-#include <isc/strerror.h>
 #include <isc/string.h>
 #include <isc/ntpaths.h>
 #include <isc/util.h>
@@ -231,7 +230,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 	UNUSED(switch_user);
 	fd = safe_open(filename, mode, false);
 	if (fd < 0) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
 		return (NULL);
@@ -239,7 +238,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {

 	fp = fdopen(fd, "w");
 	if (fp == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlywarning("could not fdopen() file '%s': %s",
 					filename, strbuf);
 		close(fd);
@@ -268,7 +267,7 @@ named_os_writepidfile(const char *filename, bool first_time) {

 	pidfile = strdup(filename);
 	if (pidfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		(*report)("couldn't strdup() '%s': %s", filename, strbuf);
 		return;
 	}
@@ -312,7 +311,7 @@ named_os_issingleton(const char *filename) {

 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
-		isc__strerror(errno, strbuf, sizeof(strbuf));
+		strerror_s(strbuf, sizeof(strbuf), errno);
 		named_main_earlyfatal("couldn't allocate memory for '%s': %s",
 				      filename, strbuf);
 	}
@@ -207,9 +207,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		updatepolicy = NULL;
 	}

-	result = dns_ssutable_create(mctx, &table);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_ssutable_create(mctx, &table);

 	for (element = cfg_list_first(updatepolicy);
 	     element != NULL;
@@ -224,7 +222,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		const char *str;
 		bool grant = false;
 		bool usezone = false;
-		unsigned int mtype = dns_ssumatchtype_name;
+		dns_ssumatchtype_t mtype = dns_ssumatchtype_name;
 		dns_fixedname_t fname, fident;
 		isc_buffer_t b;
 		dns_rdatatype_t *types;
@@ -320,16 +318,13 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

-		result = dns_ssutable_addrule(table, grant,
+		dns_ssutable_addrule(table, grant,
 					      dns_fixedname_name(&fident),
 					      mtype,
 					      dns_fixedname_name(&fname),
 					      n, types);
 		if (types != NULL)
 			isc_mem_put(mctx, types, n * sizeof(dns_rdatatype_t));
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
 	}

 	/*
@@ -350,14 +345,11 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		result = dns_ssutable_addrule(table, true,
+		dns_ssutable_addrule(table, true,
 					      named_g_server->session_keyname,
 					      dns_ssumatchtype_local,
 					      dns_zone_getorigin(zone),
 					      1, &any);
-
-		if (result != ISC_R_SUCCESS)
-			goto cleanup;
 	}

 	result = ISC_R_SUCCESS;
@@ -1144,10 +1136,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	zoneqrystats  = NULL;
 	rcvquerystats = NULL;
 	if (statlevel == dns_zonestat_full) {
-		RETERR(isc_stats_create(mctx, &zoneqrystats,
-					ns_statscounter_max));
-		RETERR(dns_rdatatypestats_create(mctx,
-					&rcvquerystats));
+		isc_stats_create(mctx, &zoneqrystats,
+					ns_statscounter_max);
+		dns_rdatatypestats_create(mctx,
+					&rcvquerystats);
 	}
 	dns_zone_setrequeststats(zone,  zoneqrystats);
 	dns_zone_setrcvquerystats(zone, rcvquerystats);
@@ -1744,7 +1736,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 						  &obj);
 				if (obj == NULL) {
 					dns_acl_t *none;
-					RETERR(dns_acl_none(mctx, &none));
+					dns_acl_none(mctx, &none);
 					dns_zone_setxfracl(zone, none);
 					dns_acl_detach(&none);
 				}
@@ -1880,9 +1872,7 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase,
 	TIME_NOW(&now);

 	dns_zone_settype(zone, dns_zone_dlz);
-	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
-	if (result != ISC_R_SUCCESS)
-		return (result);
+	dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
 	return (result);
@@ -99,20 +99,6 @@
 #endif
 #endif

-#ifdef HAVE_ADDRINFO
-#ifdef HAVE_GETADDRINFO
-#ifdef HAVE_GAISTRERROR
-#define USE_GETADDRINFO
-#endif
-#endif
-#endif
-
-#ifndef USE_GETADDRINFO
-#ifndef ISC_PLATFORM_NONSTDHERRNO
-extern int h_errno;
-#endif
-#endif
-
 #define MAXCMD (128 * 1024)
 #define MAXWIRE (64 * 1024)
 #define PACKETSIZE ((64 * 1024) - 1)
@@ -368,9 +354,8 @@ reset_system(void) {
 	if (updatemsg != NULL)
 		dns_message_reset(updatemsg, DNS_MESSAGE_INTENTRENDER);
 	else {
-		result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER,
+		dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER,
 					    &updatemsg);
-		check_result(result, "dns_message_create");
 	}
 	updatemsg->opcode = dns_opcode_update;
 	if (usegsstsig) {
@@ -890,14 +875,12 @@ setup_system(void) {

 	irs_resconf_destroy(&resconf);

-	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
-	check_result(result, "dns_dispatchmgr_create");
+	dns_dispatchmgr_create(gmctx, &dispatchmgr);

 	result = isc_socketmgr_create(gmctx, &socketmgr);
 	check_result(result, "dns_socketmgr_create");

-	result = isc_timermgr_create(gmctx, &timermgr);
-	check_result(result, "dns_timermgr_create");
+	isc_timermgr_create(gmctx, &timermgr);

 	result = isc_taskmgr_create(gmctx, 1, 0, &taskmgr);
 	check_result(result, "isc_taskmgr_create");
@@ -939,10 +922,9 @@ setup_system(void) {
 		check_result(result, "dns_dispatch_getudp (v4)");
 	}

-	result = dns_requestmgr_create(gmctx, timermgr,
+	dns_requestmgr_create(gmctx, timermgr,
 				       socketmgr, taskmgr, dispatchmgr,
 				       dispatchv4, dispatchv6, &requestmgr);
-	check_result(result, "dns_requestmgr_create");

 	if (keystr != NULL)
 		setup_keystr();
@@ -1229,8 +1211,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {

 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
-	result = isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
-	check_result(result, "isc_buffer_allocate");
+	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
 	dns_name_init(*namep, NULL);
 	dns_name_setbuffer(*namep, namebuf);
 	dns_message_takebuffer(msg, &namebuf);
@@ -1269,22 +1250,18 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,

 	if (*cmdline != 0) {
 		dns_rdatacallbacks_init(&callbacks);
-		result = isc_lex_create(gmctx, strlen(cmdline), &lex);
-		check_result(result, "isc_lex_create");
+		isc_lex_create(gmctx, strlen(cmdline), &lex);
 		isc_buffer_init(&source, cmdline, strlen(cmdline));
 		isc_buffer_add(&source, strlen(cmdline));
-		result = isc_lex_openbuffer(lex, &source);
-		check_result(result, "isc_lex_openbuffer");
-		result = isc_buffer_allocate(gmctx, &buf, MAXWIRE);
-		check_result(result, "isc_buffer_allocate");
+		isc_lex_openbuffer(lex, &source);
+		isc_buffer_allocate(gmctx, &buf, MAXWIRE);
 		result = dns_rdata_fromtext(NULL, rdataclass, rdatatype, lex,
 					    dns_rootname, 0, gmctx, buf,
 					    &callbacks);
 		isc_lex_destroy(&lex);
 		if (result == ISC_R_SUCCESS) {
 			isc_buffer_usedregion(buf, &r);
-			result = isc_buffer_allocate(gmctx, &newbuf, r.length);
-			check_result(result, "isc_buffer_allocate");
+			isc_buffer_allocate(gmctx, &newbuf, r.length);
 			isc_buffer_putmem(newbuf, r.base, r.length);
 			isc_buffer_usedregion(newbuf, &r);
 			dns_rdata_fromregion(rdata, rdataclass, rdatatype, &r);
@@ -2040,8 +2017,7 @@ show_message(FILE *stream, dns_message_t *msg, const char *description) {
 		}
 		if (buf != NULL)
 			isc_buffer_free(&buf);
-		result = isc_buffer_allocate(gmctx, &buf, bufsz);
-		check_result(result, "isc_buffer_allocate");
+		isc_buffer_allocate(gmctx, &buf, bufsz);
 		result = dns_message_totext(msg, style, 0, buf);
 		bufsz *= 2;
 	} while (result == ISC_R_NOSPACE);
@@ -2312,8 +2288,7 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 		return;
 	}

-	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
-	check_result(result, "dns_message_create");
+	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
 	result = dns_request_getresponse(request, answer,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	switch (result) {
@@ -2494,8 +2469,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	reqev = NULL;

 	ddebug("About to create rcvmsg");
-	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
-	check_result(result, "dns_message_create");
+	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
@@ -2807,11 +2781,7 @@ start_gssrequest(dns_name_t *master) {
 	if (gssring != NULL)
 		dns_tsigkeyring_detach(&gssring);
 	gssring = NULL;
-	result = dns_tsigkeyring_create(gmctx, &gssring);
-
-	if (result != ISC_R_SUCCESS)
-		fatal("dns_tsigkeyring_create failed: %s",
-		      isc_result_totext(result));
+	dns_tsigkeyring_create(gmctx, &gssring);

 	dns_name_format(master, namestr, sizeof(namestr));
 	if (kserver == NULL) {
@@ -2860,10 +2830,7 @@ start_gssrequest(dns_name_t *master) {
 	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;

 	rmsg = NULL;
-	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
-	if (result != ISC_R_SUCCESS)
-		fatal("dns_message_create failed: %s",
-		      isc_result_totext(result));
+	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);

 	/* Build first request. */
 	context = GSS_C_NO_CONTEXT;
@@ -2985,8 +2952,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	reqev = NULL;

 	ddebug("recvgss creating rcvmsg");
-	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
-	check_result(result, "dns_message_create");
+	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);

 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
@@ -3108,9 +3074,8 @@ start_update(void) {
 		return;
 	}

-	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER,
+	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER,
 				    &soaquery);
-	check_result(result, "dns_message_create");

 	if (default_servers)
 		soaquery->flags |= DNS_MESSAGEFLAG_RD;
@@ -3268,8 +3233,7 @@ main(int argc, char **argv) {

 	pre_parse_args(argc, argv);

-	result = isc_mem_create(0, 0, &gmctx);
-	check_result(result, "isc_mem_create");
+	isc_mem_create(0, 0, &gmctx);

 	parse_args(argc, argv);

@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -100,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -932,7 +932,7 @@ main(int argc, char **argv) {

 	serial = isc_random32();

-	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
+	isc_mem_create(0, 0, &rndc_mctx);
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
 	DO("create task manager", isc_taskmgr_create(rndc_mctx, 1, 0, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &task));
@@ -957,8 +957,7 @@ main(int argc, char **argv) {

 	command = *argv;

-	DO("allocate data buffer",
-	   isc_buffer_allocate(rndc_mctx, &databuf, 2048));
+	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

 	/*
 	 * Convert argc/argv into a space-delimited command string
@@ -575,7 +575,7 @@

      <varlistentry>
 	<term><userinput>nta
-	<optional>( -d | -f | -r | -l <replaceable>duration</replaceable>)</optional>
+	    <optional>( -class <replaceable>class</replaceable> | -dump | -force | -remove | -lifetime <replaceable>duration</replaceable>)</optional>
 	<replaceable>domain</replaceable>
 	<optional><replaceable>view</replaceable></optional>
 	</userinput></term>
@@ -623,7 +623,7 @@
 	    is equivalent to <option>-remove</option>.
 	  </para>
 	  <para>
-	    If <option>-dump</option> is used, any other arguments
+	    If the <option>-dump</option> is used, any other arguments
 	    are ignored, and a list of existing NTAs is printed
 	    (note that this may include NTAs that are expired but
 	    have not yet been cleaned up).
@@ -640,10 +640,15 @@
 	    lifetime, regardless of whether data could be
 	    validated if the NTA were not present.
 	  </para>
+	  <para>
+	    The view class can be specified with <option>-class</option>.
+	    The default is class <userinput>IN</userinput>, which is
+	    the only class for which DNSSEC is currently supported.
+	  </para>
 	  <para>
 	    All of these options can be shortened, i.e., to
 	    <option>-l</option>, <option>-r</option>, <option>-d</option>,
-	    and <option>-f</option>.
+	    <option>-f</option>, and <option>-c</option>.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -68,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -98,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@util.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -70,7 +70,7 @@ main(int argc, char **argv) {
 	char *filename = NULL;
 	unsigned int zonetype = 0;

-	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
+	isc_mem_create(0, 0, &mctx);

 	result = isc_log_create(mctx, &lctx, &lcfg);
 	check_result(result, "isc_log_create()");
@@ -97,7 +97,7 @@ main(int argc, char **argv) {
 	journal = argv[4];

 	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
-	CHECK(isc_mem_create(0, 0, &mctx));
+	isc_mem_create(0, 0, &mctx);

 	CHECK(dst_lib_init(mctx, NULL));
 	dst_active = true;
@@ -20,6 +20,7 @@ CDEFINES =	@USE_GSSAPI@

 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
+PTHREAD_CFLAGS = @PTHREAD_CFLAGS@

 DNSLIBS =	../../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCLIBS =	../../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
@@ -51,7 +52,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
 		inter_test@EXEEXT@ \
-		keyboard_test@EXEEXT@ \
 		lex_test@EXEEXT@ \
 		lfsr_test@EXEEXT@ \
 		log_test@EXEEXT@ \
@@ -82,7 +82,6 @@ XSRCS =		adb_test.c \
 		fsaccess_test.c \
 		gsstest.c \
 		inter_test.c \
-		keyboard_test.c \
 		lex_test.c \
 		lfsr_test.c \
 		log_test.c \
@@ -106,7 +105,7 @@ XSRCS =		adb_test.c \

 # disable optimization for backtrace test to get the expected result
 BTTEST_CFLAGS =	${BACKTRACECFLAGS} ${EXT_CFLAGS} ${ALL_CPPFLAGS} -g \
-		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS}
+		${ALWAYS_WARNINGS} ${STD_CWARNINGS} ${CWARNINGS} ${PTHREAD_CFLAGS}

 all_tests: ${XTARGETS}

@@ -240,10 +239,6 @@ inter_test@EXEEXT@: inter_test.@O@ ${ISCDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ inter_test.@O@ \
 		${ISCLIBS} ${LIBS}

-keyboard_test@EXEEXT@: keyboard_test.@O@ ${ISCDEPLIBS}
-	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ keyboard_test.@O@ \
-		${ISCLIBS} ${LIBS}
-
 sig0_test@EXEEXT@: sig0_test.@O@ ${ISCDEPLIBS} ${DNSDEPLIBS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} -o $@ sig0_test.@O@ \
 		${DNSLIBS} ${ISCLIBS} ${LIBS}
@@ -1,67 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <isc/keyboard.h>
-#include <isc/print.h>
-#include <isc/util.h>
-
-static void
-CHECK(const char *msg, isc_result_t result) {
-	if (result != ISC_R_SUCCESS) {
-		printf("FAILURE:  %s:  %s\n", msg, isc_result_totext(result));
-		exit(1);
-	}
-}
-
-int
-main(int argc, char **argv) {
-	isc_keyboard_t kbd;
-	unsigned char c;
-	isc_result_t res;
-	unsigned int count;
-
-	UNUSED(argc);
-	UNUSED(argv);
-
-	printf("Type Q to exit.\n");
-
-	res = isc_keyboard_open(&kbd);
-	CHECK("isc_keyboard_open()", res);
-
-	c = 'x';
-	count = 0;
-	while (res == ISC_R_SUCCESS && c != 'Q') {
-		res = isc_keyboard_getchar(&kbd, &c);
-		printf(".");
-		fflush(stdout);
-		count++;
-		if (count % 64 == 0)
-			printf("\r\n");
-	}
-	printf("\r\n");
-	if (res != ISC_R_SUCCESS) {
-		printf("FAILURE:  keyboard getchar failed:  %s\r\n",
-		       isc_result_totext(res));
-		goto errout;
-	}
-
- errout:
-	res = isc_keyboard_close(&kbd, 3);
-	CHECK("isc_keyboard_close()", res);
-
-	return (0);
-}
@@ -25,8 +25,6 @@
 #define sleep(x)	Sleep(1000 * x)
 #endif

-#ifdef ISC_PLATFORM_USETHREADS
-
 isc_rwlock_t lock;

 static isc_threadresult_t
@@ -130,15 +128,3 @@ main(int argc, char *argv[]) {

 	return (0);
 }
-
-#else
-
-int
-main(int argc, char *argv[]) {
-	UNUSED(argc);
-	UNUSED(argv);
-	fprintf(stderr, "This test requires threads.\n");
-	return(1);
-}
-
-#endif
@@ -12,11 +12,11 @@
 #include <config.h>

 #include <stdio.h>
+#include <stdlib.h>
 #include <inttypes.h>

 #include <isc/print.h>
 #include <isc/serial.h>
-#include <isc/stdlib.h>

 int
 main() {
@@ -12,6 +12,7 @@
 #include <config.h>

 #include <sys/param.h>
+#include <sys/select.h>
 #include <sys/types.h>
 #include <sys/time.h>

@@ -35,10 +36,6 @@
 #include <dns/result.h>
 #include <dns/zone.h>

-#ifdef ISC_PLATFORM_NEEDSYSSELECTH
-#include <sys/select.h>
-#endif
-
 static int debug = 0;
 static int quiet = 0;
 static int stats = 0;
@@ -122,7 +119,7 @@ setup(const char *zonename, const char *filename, const char *classname) {
 	if (zonetype == dns_zone_slave)
 		dns_zone_setmasters(zone, &addr, 1);

-	result = dns_zone_load(zone);
+	result = dns_zone_load(zone, false);
 	ERRRET(result, "dns_zone_load");

 	result = dns_zonemgr_managezone(zonemgr, zone);
@@ -22,3 +22,10 @@ ns2			A	10.53.0.2

 a			A	10.0.7.1
 mail			A	10.0.7.2
+b			A	10.0.7.3
+c			A	10.0.7.4
+d			A	10.0.7.5
+e			A	10.0.7.6
+f			A	10.0.7.7
+g			A	10.0.7.8
+h			A	10.0.7.9
@@ -18,6 +18,15 @@ options {
 	dnssec-validation no;
 };

+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
 zone "." {
 	type hint;
 	file "../../common/root.hint";
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-recursion-on { none; };
+	allow-query-cache-on { 10.53.0.3; };
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; 10.53.1.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-query-cache { any; };
+	allow-query-cache-on { 10.53.0.3; }; # allow-recursion-on inherits
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+options {
+	port @PORT@;
+	pid-file "named.pid";
+	listen-on { 10.53.0.3; 10.53.1.2; };
+	listen-on-v6 { none; };
+	recursion yes;
+	allow-recursion { any; };
+	allow-query-cache { any; };
+	allow-recursion-on { 10.53.0.3; }; # allow-query-cache-on inherits
+	dnssec-validation no;
+};
+
+key rndc_key {
+	secret "1234abcd8765";
+	algorithm hmac-sha256;
+};
+
+controls {
+	inet 10.53.0.3 port @CONTROLPORT@ allow { any; } keys { rndc_key; };
+};
+
+zone "." {
+	type hint;
+	file "../../common/root.hint";
+};
@@ -12,7 +12,9 @@
 SYSTEMTESTTOP=..
 . $SYSTEMTESTTOP/conf.sh

+$SHELL clean.sh
+
 copy_setports ../common/controls.conf.in ns2/controls.conf
 copy_setports  ns1/named.conf.in ns1/named.conf
 copy_setports  ns2/named01.conf.in ns2/named.conf
-copy_setports  ns3/named.conf.in ns3/named.conf
+copy_setports  ns3/named1.conf.in ns3/named.conf
@@ -56,9 +56,9 @@ SYSTEMTESTTOP=..
 DIGOPTS="+tcp +nosea +nostat +nocmd +norec +noques +noauth +noadd +nostats +dnssec -p ${PORT}"

 rndc_reload() {
-    echo_i "`$RNDC -c ../common/rndc.conf -s 10.53.0.2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/ns2 /'`"
+    echo_i "`$RNDC -c ../common/rndc.conf -s $2 -p ${CONTROLPORT} reload 2>&1 | sed 's/^/'$1' /'`"
    for try in 0 1 2 3 4 5 6 7 8 9; do
-        nextpart ns2/named.run | grep "reloading configuration succeeded" > /dev/null && break
+        nextpart $1/named.run | grep "reloading configuration succeeded" > /dev/null && break
        sleep 1
    done
 }
@@ -81,7 +81,7 @@ status=`expr $status + $ret`
 # Test 2 - explicit any, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named02.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: explicit any - query allowed"
 ret=0
@@ -94,7 +94,7 @@ status=`expr $status + $ret`
 # Test 3 - none, query refused
 n=`expr $n + 1`
 copy_setports ns2/named03.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: none - query refused"
 ret=0
@@ -107,7 +107,7 @@ status=`expr $status + $ret`
 # Test 4 - address allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named04.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: address allowed - query allowed"
 ret=0
@@ -120,7 +120,7 @@ status=`expr $status + $ret`
 # Test 5 - address not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named05.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: address not allowed - query refused"
 ret=0
@@ -133,7 +133,7 @@ status=`expr $status + $ret`
 # Test 6 - address disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named06.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: address disallowed - query refused"
 ret=0
@@ -146,7 +146,7 @@ status=`expr $status + $ret`
 # Test 7 - acl allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named07.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: acl allowed - query allowed"
 ret=0
@@ -159,7 +159,7 @@ status=`expr $status + $ret`
 # Test 8 - acl not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named08.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: acl not allowed - query refused"
 ret=0
@@ -173,7 +173,7 @@ status=`expr $status + $ret`
 # Test 9 - acl disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named09.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: acl disallowed - query refused"
 ret=0
@@ -186,7 +186,7 @@ status=`expr $status + $ret`
 # Test 10 - key allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named10.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: key allowed - query allowed"
 ret=0
@@ -199,7 +199,7 @@ status=`expr $status + $ret`
 # Test 11 - key not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named11.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: key not allowed - query refused"
 ret=0
@@ -212,7 +212,7 @@ status=`expr $status + $ret`
 # Test 12 - key disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named12.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: key disallowed - query refused"
 ret=0
@@ -228,7 +228,7 @@ n=20
 # Test 21 - views default, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named21.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views default - query allowed"
 ret=0
@@ -241,7 +241,7 @@ status=`expr $status + $ret`
 # Test 22 - views explicit any, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named22.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views explicit any - query allowed"
 ret=0
@@ -254,7 +254,7 @@ status=`expr $status + $ret`
 # Test 23 - views none, query refused
 n=`expr $n + 1`
 copy_setports ns2/named23.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views none - query refused"
 ret=0
@@ -267,7 +267,7 @@ status=`expr $status + $ret`
 # Test 24 - views address allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named24.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views address allowed - query allowed"
 ret=0
@@ -280,7 +280,7 @@ status=`expr $status + $ret`
 # Test 25 - views address not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named25.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views address not allowed - query refused"
 ret=0
@@ -293,7 +293,7 @@ status=`expr $status + $ret`
 # Test 26 - views address disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named26.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views address disallowed - query refused"
 ret=0
@@ -306,7 +306,7 @@ status=`expr $status + $ret`
 # Test 27 - views acl allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named27.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views acl allowed - query allowed"
 ret=0
@@ -319,7 +319,7 @@ status=`expr $status + $ret`
 # Test 28 - views acl not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named28.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views acl not allowed - query refused"
 ret=0
@@ -332,7 +332,7 @@ status=`expr $status + $ret`
 # Test 29 - views acl disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named29.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views acl disallowed - query refused"
 ret=0
@@ -345,7 +345,7 @@ status=`expr $status + $ret`
 # Test 30 - views key allowed, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named30.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key allowed - query allowed"
 ret=0
@@ -358,7 +358,7 @@ status=`expr $status + $ret`
 # Test 31 - views key not allowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named31.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key not allowed - query refused"
 ret=0
@@ -371,7 +371,7 @@ status=`expr $status + $ret`
 # Test 32 - views key disallowed, query refused
 n=`expr $n + 1`
 copy_setports ns2/named32.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views key disallowed - query refused"
 ret=0
@@ -384,7 +384,7 @@ status=`expr $status + $ret`
 # Test 33 - views over options, views allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named33.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views over options, views allow - query allowed"
 ret=0
@@ -397,7 +397,7 @@ status=`expr $status + $ret`
 # Test 34 - views over options, views disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named34.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views over options, views disallow - query refused"
 ret=0
@@ -414,7 +414,7 @@ n=40
 # Test 41 - zone default, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named40.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: zone default - query allowed"
 ret=0
@@ -537,7 +537,7 @@ status=`expr $status + $ret`
 # Test 53 - zones over options, zones allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named53.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views over options, views allow - query allowed"
 ret=0
@@ -550,7 +550,7 @@ status=`expr $status + $ret`
 # Test 54 - zones over options, zones disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named54.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: views over options, views disallow - query refused"
 ret=0
@@ -563,7 +563,7 @@ status=`expr $status + $ret`
 # Test 55 - zones over views, zones allow, query allowed
 n=`expr $n + 1`
 copy_setports ns2/named55.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: zones over views, views allow - query allowed"
 ret=0
@@ -576,7 +576,7 @@ status=`expr $status + $ret`
 # Test 56 - zones over views, zones disallow, query refused
 n=`expr $n + 1`
 copy_setports ns2/named56.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: zones over views, views disallow - query refused"
 ret=0
@@ -589,7 +589,7 @@ status=`expr $status + $ret`
 # Test 57 - zones over views, zones disallow, query refused (allow-query-on)
 n=`expr $n + 1`
 copy_setports ns2/named57.conf.in ns2/named.conf
-rndc_reload
+rndc_reload ns2 10.53.0.2

 echo_i "test $n: zones over views, allow-query-on"
 ret=0
@@ -602,9 +602,9 @@ grep '^a.aclnotallow.example' dig.out.ns2.2.$n > /dev/null && ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

-# Test 58 - allow-recursion inheritance
+# Test 58 - allow-recursion default
 n=`expr $n + 1`
-echo_i "test $n: default recursion configuration"
+echo_i "test $n: default allow-recursion configuration"
 ret=0
 $DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 a.normal.example a > dig.out.ns3.1.$n
 grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
@@ -613,5 +613,82 @@ grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
 if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

+# Test 59 - allow-query-cache default
+n=`expr $n + 1`
+echo_i "test $n: default allow-query-cache configuration"
+ret=0
+$DIG -p ${PORT} @10.53.0.3 -b 127.0.0.1 ns . > dig.out.ns3.1.$n
+grep 'status: NOERROR' dig.out.ns3.1.$n > /dev/null || ret=1
+$DIG -p ${PORT} @10.53.0.3 -b 10.53.0.1 ns . > dig.out.ns3.2.$n
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 60 - block recursion-on, allow query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named2.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: block recursion-on, allow query-cache-on"
+ret=0
+# this should query the cache, and an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'recursion requested but not available' dig.out.ns3.1.$n > /dev/null || ret=1
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should require recursion and therefore can't get an answer
+$DIG -p ${PORT} @10.53.0.3 b.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'ANSWER: 0' dig.out.ns3.2.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 61 - inheritance of allow-query-cache-on from allow-recursion-on
+n=`expr $n + 1`
+copy_setports ns3/named3.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-query-cache-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 c.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 d.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
+# Test 62 - inheritance of allow-recursion-on from allow-query-cache-on
+n=`expr $n + 1`
+copy_setports ns3/named4.conf.in ns3/named.conf
+rndc_reload ns3 10.53.0.3
+
+echo_i "test $n: inheritance of allow-recursion-on"
+ret=0
+# this should query the cache, an answer should already be there
+$DIG -p ${PORT} @10.53.0.3 a.normal.example a > dig.out.ns3.1.$n
+grep 'ANSWER: 1' dig.out.ns3.1.$n > /dev/null || ret=1
+# this should be refused due to allow-recursion-on/allow-query-cache-on
+$DIG -p ${PORT} @10.53.1.2 a.normal.example a > dig.out.ns3.2.$n
+grep 'recursion requested but not available' dig.out.ns3.2.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.2.$n > /dev/null || ret=1
+# this should require recursion and should be allowed
+$DIG -p ${PORT} @10.53.0.3 e.normal.example a > dig.out.ns3.3.$n
+grep 'ANSWER: 1' dig.out.ns3.3.$n > /dev/null || ret=1
+# this should require recursion and be refused
+$DIG -p ${PORT} @10.53.1.2 f.normal.example a > dig.out.ns3.4.$n
+grep 'recursion requested but not available' dig.out.ns3.4.$n > /dev/null || ret=1
+grep 'status: REFUSED' dig.out.ns3.4.$n > /dev/null || ret=1
+if [ $ret != 0 ]; then echo_i "failed"; fi
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -13,4 +13,4 @@ rm -f */named.conf
 rm -f dig.out.test*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
-rm -f ns*/managed-keys.bind*
+rm -f ns*/managed-keys.bind* ns*/*mkeys*
@@ -0,0 +1,21 @@
+; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+;
+; This Source Code Form is subject to the terms of the Mozilla Public
+; License, v. 2.0. If a copy of the MPL was not distributed with this
+; file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;
+; See the COPYRIGHT file distributed with this work for additional
+; information regarding copyright ownership.
+
+$TTL 300	; 5 minutes
+@			CH SOA  ns root (
+				2018010100 ; serial
+				1800       ; refresh (30 minutes)
+				1800       ; retry (30 minutes)
+				1814400    ; expire (3 weeks)
+				3600       ; minimum (1 hour)
+				)
+			NS	ns
+ns			A	ch-addr.example. 1001
+test 			A	ch-addr.example. 1002
+			A	ch-addr.example. 1003
@@ -21,12 +21,21 @@ options {
 	notify yes;
 };

-zone example.net {
-	type master;
-	file "example.net.db";
+view main in {
+	zone example.net {
+		type master;
+		file "example.net.db";
+	};
+
+	zone example.com {
+		type master;
+		file "example.com.db";
+	};
 };

-zone example.com {
-	type master;
-	file "example.com.db";
+view alt chaos {
+	zone example.chaos chaos {
+		type master;
+		file "chaos.db";
+	};
 };
@@ -128,5 +128,14 @@ grep "a.example.com.*A.*10.53.0.1" dig.out.test$n > /dev/null || ret=1
 [ $ret -eq 0 ] || echo_i "failed"
 status=`expr $status + $ret`

+n=`expr $n + 1`
+echo_i "check that CHAOS addresses are compared correctly ($n)"
+ret=0
+$DIG $DIGOPTS @10.53.0.1 +noall +answer ch test.example.chaos > dig.out.test$n
+lines=`wc -l < dig.out.test$n`
+[ ${lines:-0} -eq 2 ] || ret=1
+[ $ret -eq 0 ] || echo_i "failed"
+status=`expr $status + $ret`
+
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -78,7 +78,7 @@ do
 	done
 	for z in bar. example. inacksk2.example. inacksk3.example \
 		 inaczsk2.example. inaczsk3.example
-	do 
+	do
 		$DIG $DIGOPTS $z @10.53.0.3 nsec > dig.out.ns3.test$n || ret=1
 		grep "NS SOA" dig.out.ns3.test$n > /dev/null || ret=1
 	done
@@ -91,6 +91,23 @@ n=`expr $n + 1`
 if [ $ret != 0 ]; then echo_i "done"; fi
 status=`expr $status + $ret`

+echo_i "Initial counts of RRSIG expiry fields values for auto signed zones"
+for z in .
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.1 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+for z in bar. example. private.secure.example.
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.2 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+for z in inacksk2.example. inacksk3.example inaczsk2.example. inaczsk3.example
+do
+	echo_i zone $z
+	$DIG $DIGOPTS $z @10.53.0.3 axfr | awk '$4 == "RRSIG" {print $9}' | sort | uniq -c | cat_i
+done
+
 #
 # Check that DNSKEY is initially signed with a KSK and not a ZSK.
 #
@@ -1147,7 +1164,7 @@ if [ $ret != 0 ]; then echo_i "failed"; fi
 status=`expr $status + $ret`

 # this confirms that key events are never scheduled more than
-# 'dnssec-loadkeys-interval' minutes in the future, and that the 
+# 'dnssec-loadkeys-interval' minutes in the future, and that the
 # event scheduled is within 10 seconds of expected interval.
 check_interval () {
        awk '/next key event/ {print $2 ":" $9}' $1/named.run |
@@ -1,6 +1,6 @@
 DyNaMiC.		300	IN	SOA	mname1. . 2000042407 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 ns1.DYNAMIC.		300	IN	A	10.53.0.1
 DyNaMiC.		300	IN	SOA	mname1. . 2000042407 20 20 1814400 3600
@@ -1,14 +1,6 @@
-
-; <<>> DiG 9.11.0pre-alpha <<>> axfr dynamic @10.53.0.1 -p 5300
-;; global options: +cmd
-dYNAMIc.		0	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
+dYNAMIc.		300	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 Ns1.DyNaMIC.		300	IN	A	10.53.0.1
-dYNAMIc.		0	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
-;; Query time: 0 msec
-;; SERVER: 10.53.0.1#5300(10.53.0.1)
-;; WHEN: Mon Jan 19 14:50:54 EST 2015
-;; XFR size: 6 records (messages 1, bytes 234)
-
+dYNAMIc.		300	IN	SOA	mname1. . 2000042409 20 20 1814400 3600
@@ -1,6 +1,6 @@
 dYNAMIc.		300	IN	SOA	mname1. . 2000042408 20 20 1814400 3600
 DyNaMiC.		300	IN	NS	ns1.DYNAMIC.
-DyNaMiC.		300	IN	MX	0 mail.eXaMpLe.
+DynamiC.		300	IN	MX	0 mail.eXaMpLe.
 mAiL.DynamiC.		300	IN	A	10.53.0.1
 ns1.DYNAMIC.		300	IN	A	10.53.0.1
 dYNAMIc.		300	IN	SOA	mname1. . 2000042408 20 20 1814400 3600
@@ -20,13 +20,13 @@ touch empty

 Z=cds.test

-keyz=$($KEYGEN -q -a RSASHA256 $Z)
-key1=$($KEYGEN -q -a RSASHA256 -f KSK $Z)
-key2=$($KEYGEN -q -a RSASHA256 -f KSK $Z)
+keyz=`$KEYGEN -q -a RSASHA256 $Z`
+key1=`$KEYGEN -q -a RSASHA256 -f KSK $Z`
+key2=`$KEYGEN -q -a RSASHA256 -f KSK $Z`

-idz=$(echo $keyz | sed 's/.*+0*//')
-id1=$(echo $key1 | sed 's/.*+0*//')
-id2=$(echo $key2 | sed 's/.*+0*//')
+idz=`echo $keyz | sed 's/.*+0*//'`
+id1=`echo $key1 | sed 's/.*+0*//'`
+id2=`echo $key2 | sed 's/.*+0*//'`

 cat <<EOF >vars.sh
 Z=$Z
@@ -120,10 +120,11 @@ $mangle '\s+IN\s+RRSIG\s+CDS .* '$id1' '$Z'\. ' \
 $mangle " IN CDS $id1 8 1 " <db.cds.1 |
 sign cds-mangled

-sed 's/IN CDS '$id1' 8 1 /IN CDS '$((id1 ^ 255))' 8 1 /' <db.cds.1 |
+bad=`$PERL -le "print ($id1 ^ 255);"`
+sed 's/IN CDS '$id1' 8 1 /IN CDS '$bad' 8 1 /' <db.cds.1 |
 sign bad-digests

-sed '/IN CDS '$id1' 8 /p;s//IN CDS '$((id1 ^ 255))' 13 /' <db.cds.1 |
+sed '/IN CDS '$id1' 8 /p;s//IN CDS '$bad' 13 /' <db.cds.1 |
 sign bad-algos

 rm -f dsset-*
@@ -0,0 +1,18 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+zone "example.com" {
+	type master;
+	file "example.com.db";
+	update-policy {
+		grant * krb5-selfsub TXT;
+	};
+};
--- a/Show More
+++ b/Show More