add lock profiling

2020-03-23 16:12:48 -07:00
613 changed files with 8931 additions and 15064 deletions
@@ -66,8 +66,6 @@
 		(concat directory-of-current-dir-locals-file "bin/dig/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/named/include"))
-	       (expand-file-name
-		(concat directory-of-current-dir-locals-file "bin/named/unix/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "bin/rndc/include"))
 	       (expand-file-name
@@ -1,12 +1,3 @@
 *.sln.in eol=crlf
 *.vcxproj.in eol=crlf
 *.vcxproj.filters.in eol=crlf
-
-.gitignore			 export-ignore
-/conftools			 export-ignore
-/doc/design			 export-ignore
-/doc/dev			 export-ignore
-/util/**			 export-ignore
-/util/bindkeys.pl		-export-ignore
-/util/check-make-install.in	-export-ignore
-/util/mksymtbl.pl		-export-ignore
@@ -56,7 +56,3 @@ kyua.log
 named.memstats
 named.run
 timestamp
-/compile_commands.json
-/cppcheck_html/
-/cppcheck.results
-/util/check-make-install
@@ -1,128 +1,8 @@
-	--- 9.14.12 released ---
-
-5395.	[security]	Further limit the number of queries that can be
-			triggered from a request.  Root and TLD servers
-			are no longer exempt from max-recursion-queries.
-			Fetches for missing name server address records
-			are limited to 4 for any domain. (CVE-2020-8616)
-			[GL #1388]
-
-5390.	[security]	Replaying a TSIG BADTIME response as a request could
-			trigger an assertion failure. (CVE-2020-8617)
-			[GL #1703]
-
-5376.	[bug]		Fix ineffective DNS rebinding protection when BIND is
-			configured as a forwarding DNS server. Thanks to Tobias
-			Klein. [GL #1574]
-
-5358.	[bug]		Inline master zones whose master files were touched
-			but otherwise unchanged and were subsequently reloaded
-			may have stopped re-signing. [GL !3135]
-
-5357.	[bug]		Newly added RRSIG records with expiry times before
-			the previous earliest expiry times might not be
-			re-signed in time.  This was a side effect of 5315.
-			[GL !3137]
-
-	--- 9.14.11 released ---
-
-5353.	[doc]		Document port and dscp parameters in forwarders
-			configuration option. [GL #914]
-
-5352.	[bug]		Correctly handle catalog zone entries containing
-			characters that aren't legal in filenames. [GL #1592]
-
-5351.	[bug]		CDS / CDNSKEY consistency checks failed to handle
-			removal records. [GL #1554]
-
-5350.	[bug]		When a view was configured with class CHAOS, the
-			server could crash while processing a query for a
-			non-existent record. [GL #1540]
-
-5348.	[bug]		dnssec-settime -Psync was not being honoured.
-			[GL !2925]
-
-	--- 9.14.10 released ---
-
-5339.	[bug]		With some libmaxminddb versions, named could erroneously
-			match an IP address not belonging to any subnet defined
-			in a given GeoIP2 database to one of the existing
-			entries in that database. [GL #1552]
-
-5338.	[bug]		Fix line spacing in `rndc secroots`.
-			Thanks to Tony Finch. [GL !2478]
-
-5337.	[func]		'named -V' now reports maxminddb and protobuf-c
-			versions. [GL !2686]
-
-	--- 9.14.9 released ---
-
-5330.	[bug]		'configure --without-python' was ineffective if
-			PYTHON was set in the environment. [GL #1434]
-
-5329.	[bug]		Reconfiguring named caused memory to be leaked when any
-			GeoIP2 database was in use. [GL #1445]
-
-5328.	[bug]		rbtdb.c:rdataset_{get,set}ownercase failed to obtain
-			a node lock. [GL #1417]
-
-5327.	[func]		Added a statistics counter to track queries
-			dropped because the recursive-clients quota was
-			exceeded. [GL #1399]
-
-5326.	[bug]		Add Python dependency on 'distutils.core' to configure.
-			'distutils.core' is required for installation.
-			[GL #1397]
-
-5321.	[bug]		Obtain write lock before updating version->records
-			and version->bytes. [GL #1341]
-
-	--- 9.14.8 released ---
-
-5315.	[bug]		Apply the inital RRSIG expiration spread fixed
-			to all dynamically created records in the zone
-			including NSEC3. Also fix the signature clusters
-			when the server has been offline for prolonged
-			period of times. [GL #1256]
-
-5314.	[func]		Added a new statistics variable "tcp-highwater"
-			that reports the maximum number of simultaneous TCP
-			clients BIND has handled while running. [GL #1206]
-
-5313.	[bug]		The default GeoIP2 database location did not match
-			the ARM.  'named -V' now reports the default
-			location. [GL #1301]
-
-5310.	[bug]		TCP failures were affecting EDNS statistics. [GL #1059]
-
-5308.	[bug]		Don't log DNS_R_UNCHANGED from sync_secure_journal()
-			at ERROR level in receive_secure_serial(). [GL #1288]
-
-5307.	[bug]		Fix hang when named-compilezone output is sent to pipe.
-			Thanks to Tony Finch. [GL !2481]
-
-5306.	[security]	Set a limit on the number of concurrently served
-			pipelined TCP queries. (CVE-2019-6477) [GL #1264]
-
-5305.	[bug]		NSEC Aggressive Cache ("synth-from-dnssec") has been
-			disabled by default because it was found to have
-			a significant performance impact on the recursive
-			service. [GL #1265]
-
-5304.	[bug]		"dnskey-sig-validity 0;" was not being accepted.
-			[GL #876]
-
-5302.	[bug]		Fix checking that "dnstap-output" is defined when
-			"dnstap" is specified in a view. [GL #1281]
-
-5301.	[bug]		Detect partial prefixes / incomplete IPv4 address in
-			acls. [GL #1143]
-
 	--- 9.14.7 released ---

 5299.	[security]	A flaw in DNSSEC verification when transferring
 			mirror zones could allow data to be incorrectly
-			marked valid. (CVE-2019-6475) [GL #1252]
+			marked valid. (CVE-2019-6475) [GL #16P]

 5298.	[security]	Named could assert if a forwarder returned a
 			referral, rather than resolving the query, when QNAME
@@ -132,11 +12,6 @@
 			is still running before starting a new one; return
 			SERVFAIL and log an error if so. [GL #1191]

-5295.	[cleanup]	Split dns_name_copy() calls into dns_name_copy() and
-			dns_name_copynf() for those calls that can potentially
-			fail and those that should not fail respectively.
-			[GL !2265]
-
 5294.	[func]		Fallback to ACE name on output in locale, which does not
 			support converting it to unicode.  [GL #846]

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -69,7 +69,7 @@ releases. New features include:
  * "rndc modzone" reconfigures a single zone, without requiring the
    entire server to be reconfigured.
  * "rndc showzone" displays the current configuration of a zone.
-  * "rndc managed-keys" can be used to check the status of RFC 5011
+  * "rndc managed-keys" can be used to check the status of RFC 5001
    managed trust anchors, or to force trust anchors to be refreshed.
  * "max-cache-size" can now be set to a percentage of available memory.
    The default is 90%.
@@ -75,7 +75,7 @@ releases.  New features include:
 - "rndc modzone" reconfigures a single zone, without requiring the entire
  server to be reconfigured.
 - "rndc showzone" displays the current configuration of a zone.
- "rndc managed-keys" can be used to check the status of RFC 5011 managed
+- "rndc managed-keys" can be used to check the status of RFC 5001 managed
  trust anchors, or to force trust anchors to be refreshed.
 - "max-cache-size" can now be set to a percentage of available memory. The
  default is 90%.
@@ -15,16 +15,15 @@ offer support on a "best effort" basis for some.

 Regularly tested platforms

-As of Mar 2020, BIND 9.14 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

  * Debian 8, 9, 10
-  * Ubuntu LTS 16.04, 18.04
-  * Fedora 31
-  * Red Hat Enterprise Linux / CentOS 6, 7, 8
-  * FreeBSD 11.3, 12.1
-  * OpenBSD 6.6
-  * Alpine Linux
+  * Ubuntu 16.04, 18.04
+  * Fedora 28, 29
+  * Red Hat Enterprise Linux / CentOS 6, 7
+  * FreeBSD 11.x
+  * OpenBSD 6.2, 6.3

 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.
@@ -41,6 +40,8 @@ Server 2012 R2, none of these are tested regularly by ISC.
  * Windows 10 / x64
  * macOS 10.12+
  * Solaris 11
+  * FreeBSD 10.x, 12.0+
+  * OpenBSD 6.4+
  * NetBSD
  * Other Linux distributions still supported by their vendors, such as:
      + Ubuntu 14.04, 18.10+
@@ -23,16 +23,15 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Mar 2020, BIND 9.14 is fully supported and regularly tested on the
+As of Feb 2019, BIND 9.14 is fully supported and regularly tested on the
 following systems:

 * Debian 8, 9, 10
-* Ubuntu LTS 16.04, 18.04
-* Fedora 31
-* Red Hat Enterprise Linux / CentOS 6, 7, 8
-* FreeBSD 11.3, 12.1
-* OpenBSD 6.6
-* Alpine Linux
+* Ubuntu 16.04, 18.04
+* Fedora 28, 29
+* Red Hat Enterprise Linux / CentOS 6, 7
+* FreeBSD 11.x
+* OpenBSD 6.2, 6.3

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.

@@ -48,6 +47,8 @@ Server 2012 R2, none of these are tested regularly by ISC.
 * Windows 10 / x64
 * macOS 10.12+
 * Solaris 11
+* FreeBSD 10.x, 12.0+
+* OpenBSD 6.4+
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
    * Ubuntu 14.04, 18.10+
@@ -48,8 +48,8 @@ the file HISTORY.
 For a detailed list of changes made throughout the history of BIND 9, see
 the file CHANGES. See below for details on the CHANGES file format.

-For up-to-date versions and release notes, see https://www.isc.org/
-download/.
+For up-to-date release notes and errata, see http://www.isc.org/software/
+bind9/releasenotes

 For information about supported platforms, see PLATFORMS.

@@ -69,10 +69,7 @@ named-checkconf -px.

 If the bug you are reporting is a potential security issue, such as an
 assertion failure or other crash in named, please do NOT use GitLab to
-report it. Instead, send mail to security-officer@isc.org using our
-OpenPGP key to secure your message. (Information about OpenPGP and links
-to our key can be found at https://www.isc.org/pgpkey.) Please do not
-discuss the bug on any public mailing list.
+report it. Instead, please send mail to security-officer@isc.org.

 For a general overview of ISC security policies, read the Knowledge Base
 article at https://kb.isc.org/docs/aa-00861.
@@ -183,28 +180,6 @@ BIND 9.14.7
 BIND 9.14.7 is a maintenance release, and also addresses the security
 vulnerabilities disclosed in CVE-2019-6475 and CVE-2019-6476.

-BIND 9.14.8
-
-BIND 9.14.8 is a maintenance release, and also addresses the security
-vulnerability disclosed in CVE-2019-6477.
-
-BIND 9.14.9
-
-BIND 9.14.9 is a maintenance release.
-
-BIND 9.14.10
-
-BIND 9.14.10 is a maintenance release.
-
-BIND 9.14.11
-
-BIND 9.14.11 is a maintenance release.
-
-BIND 9.14.12
-
-BIND 9.14.12 is a maintenance release, and also addresses the security
-vulnerabilities disclosed in CVE-2020-8616 and CVE-2020-8617.
-
 Building BIND

 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
@@ -233,7 +208,7 @@ If you're planning on making changes to the BIND 9 source, you should run
 make depend. If you're using Emacs, you might find make tags helpful.

 Several environment variables that can be set before running configure
-will affect compilation. Significant ones are:
+will affect compilation:

   Variable                            Description
 CC             The C compiler to use. configure tries to figure out the
@@ -255,26 +230,19 @@ BUILD_CPPFLAGS CPPFLAGS for the target system during cross-compiling.
 BUILD_LDFLAGS  LDFLAGS for the target system during cross-compiling.
 BUILD_LIBS     LIBS for the target system during cross-compiling.

-Additional environment variables affecting the build are listed at the end
-of the configure help text, which can be obtained by running the command:
-
-$ ./configure --help
-
 macOS

 Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from https://developer.apple.com/download/more/ or,
-if you have Xcode already installed, you can run xcode-select --install.
-(Note that an Apple ID may be required to access the download page.)
+This can be downloaded from https://developer.apple.com/download/more/ or
+if you have Xcode already installed you can run xcode-select --install.

 Dependencies

 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-argparse, ply and distutils.core modules to be available. argparse is a
-standard module as of Python 2.7 and Python 3.2. ply is available from
-https://pypi.python.org/pypi/ply. distutils.core is required for
-installation.
+argparse and ply modules to be available. argparse is a standard module as
+of Python 2.7 and Python 3.2. ply is available from https://
+pypi.python.org/pypi/ply.

 Compile-time options

@@ -57,8 +57,8 @@ For a detailed list of changes made throughout the history of BIND 9, see
 the file [CHANGES](CHANGES). See [below](#changes) for details on the
 CHANGES file format.

-For up-to-date versions and release notes, see
-[https://www.isc.org/download/](https://www.isc.org/download/).
+For up-to-date release notes and errata, see
+[http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)

 For information about supported platforms, see [PLATFORMS](PLATFORMS.md).

@@ -79,12 +79,8 @@ using `named-checkconf -px`.

 If the bug you are reporting is a potential security issue, such as an
 assertion failure or other crash in `named`, please do *NOT* use GitLab to
-report it. Instead, send mail to
-[security-officer@isc.org](mailto:security-officer@isc.org) using our
-OpenPGP key to secure your message. (Information about OpenPGP and links
-to our key can be found at
-[https://www.isc.org/pgpkey](https://www.isc.org/pgpkey).) Please do not
-discuss the bug on any public mailing list.
+report it. Instead, please send mail to
+[security-officer@isc.org](mailto:security-officer@isc.org).

 For a general overview of ISC security policies, read the Knowledge Base
 article at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
@@ -200,28 +196,6 @@ BIND 9.14.6 is a maintenance release.
 BIND 9.14.7 is a maintenance release, and also addresses the security
 vulnerabilities disclosed in CVE-2019-6475 and CVE-2019-6476.

-#### BIND 9.14.8
-
-BIND 9.14.8 is a maintenance release, and also addresses the security
-vulnerability disclosed in CVE-2019-6477.
-
-#### BIND 9.14.9
-
-BIND 9.14.9 is a maintenance release.
-
-#### BIND 9.14.10
-
-BIND 9.14.10 is a maintenance release.
-
-#### BIND 9.14.11
-
-BIND 9.14.11 is a maintenance release.
-
-#### BIND 9.14.12
-
-BIND 9.14.12 is a maintenance release, and also addresses the security
-vulnerabilities disclosed in CVE-2020-8616 and CVE-2020-8617.
-
 ### <a name="build"/> Building BIND

 Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
@@ -250,7 +224,7 @@ If you're planning on making changes to the BIND 9 source, you should run
 `make depend`.  If you're using Emacs, you might find `make tags` helpful.

 Several environment variables that can be set before running `configure` will
-affect compilation.  Significant ones are:
+affect compilation:

 |Variable|Description |
 |--------------------|-----------------------------------------------|
@@ -265,30 +239,19 @@ affect compilation.  Significant ones are:
 |`BUILD_LDFLAGS`|`LDFLAGS` for the target system during cross-compiling.|
 |`BUILD_LIBS`|`LIBS` for the target system during cross-compiling.|

-Additional environment variables affecting the build are listed at the
-end of the `configure` help text, which can be obtained by running the
-command:
-
-    $ ./configure --help
-
 #### <a name="macos"> macOS

 Building on macOS assumes that the "Command Tools for Xcode" is installed.
-This can be downloaded from
-[https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
-or, if you have Xcode already installed, you can run `xcode-select
--install`.  (Note that an Apple ID may be required to access the download
-page.)
+This can be downloaded from [https://developer.apple.com/download/more/](https://developer.apple.com/download/more/)
+or if you have Xcode already installed you can run `xcode-select --install`.

 ### <a name="dependencies"/> Dependencies

 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-system tests, require the `argparse`, `ply` and `distutils.core` modules
-to be available.
+system tests, require the `argparse` and `ply` modules to be available.
 `argparse` is a standard module as of Python 2.7 and Python 3.2.
 `ply` is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
-`distutils.core` is required for installation.

 #### <a name="opts"/> Compile-time options

@@ -722,7 +722,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	FILE *output = stdout;
 	const char *flags;

-	flags = (fileformat == dns_masterformat_text) ? "w" : "wb";
+	flags = (fileformat == dns_masterformat_text) ? "w+" : "wb+";

 	if (debug) {
 		if (filename != NULL && strcmp(filename, "-") != 0)
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -143,5 +143,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -41,7 +41,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -44,7 +44,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -45,7 +45,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -160,43 +160,42 @@ usage(void) {
 "        q-class  is one of (in,hs,ch,...) [default: in]\n"
 "        q-type   is one of (a,any,mx,ns,soa,hinfo,axfr,txt,...) [default:a]\n"
 "        q-opt    is one of:\n"
-"                 -4                  (use IPv4 query transport only)\n"
-"                 -6                  (use IPv6 query transport only)\n"
+"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -d level            (set debugging level)\n"
 "                 -a anchor-file      (specify root and dlv trust anchors)\n"
 "                 -b address[#port]   (bind to source address/port)\n"
-"                 -c class            (option included for compatibility;\n"
-"                 -d level            (set debugging level)\n"
-"                 -h                  (print help and exit)\n"
-"                 -i                  (disable DNSSEC validation)\n"
-"                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -t type             (specify query type)\n"
+"                 -c class            (option included for compatibility;\n"
 "                                      only IN is supported)\n"
-"                 -v                  (print version and exit)\n"
-"                 -x dot-notation     (shortcut for reverse lookups)\n"
+"                 -4                  (use IPv4 query transport only)\n"
+"                 -6                  (use IPv6 query transport only)\n"
+"                 -i                  (disable DNSSEC validation)\n"
+"                 -m                  (enable memory usage debugging)\n"
 "        d-opt    is of the form +keyword[=value], where keyword is:\n"
 "                 +[no]all            (Set or clear all display flags)\n"
 "                 +[no]class          (Control display of class)\n"
-"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]crypto         (Control display of cryptographic\n"
 "                                      fields in records)\n"
-"                 +[no]dlv            (DNSSEC lookaside validation anchor)\n"
-"                 +[no]dnssec         (Display DNSSEC records)\n"
-"                 +[no]mtrace         (Trace messages received)\n"
 "                 +[no]multiline      (Print records in an expanded format)\n"
-"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]comments       (Control display of comment lines)\n"
 "                 +[no]rrcomments     (Control display of per-record "
 				       "comments)\n"
-"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]unknownformat  (Print RDATA in RFC 3597 \"unknown\" format)\n"
 "                 +[no]short          (Short form answer)\n"
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]tcp            (TCP mode)\n"
 "                 +[no]ttl            (Control display of ttls in records)\n"
 "                 +[no]trust          (Control display of trust level)\n"
-"                 +[no]unknownformat  (Print RDATA in RFC 3597 "
-					"\"unknown\" format)\n"
-"                 +[no]vtrace         (Trace validation process)\n",
+"                 +[no]rtrace         (Trace resolver fetches)\n"
+"                 +[no]mtrace         (Trace messages received)\n"
+"                 +[no]vtrace         (Trace validation process)\n"
+"                 +[no]dlv            (DNSSEC lookaside validation anchor)\n"
+"                 +[no]root           (DNSSEC validation trust anchor)\n"
+"                 +[no]dnssec         (Display DNSSEC records)\n"
+"        -h                           (print help and exit)\n"
+"        -v                           (print version and exit)\n",
 	stderr);
 	exit(1);
 }
@@ -503,7 +502,7 @@ setup_style(dns_master_style_t **stylep) {
 	isc_result_t result;
 	dns_master_style_t *style = NULL;

-	REQUIRE(stylep != NULL && *stylep == NULL);
+	REQUIRE(stylep != NULL || *stylep == NULL);

 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (showcomments)
@@ -40,7 +40,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -830,5 +830,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -53,7 +53,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -810,8 +810,8 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 		memmove(looknew->ecs_addr, lookold->ecs_addr, len);
 	}

-	dns_name_copynf(dns_fixedname_name(&lookold->fdomain),
-			   dns_fixedname_name(&looknew->fdomain));
+	dns_name_copy(dns_fixedname_name(&lookold->fdomain),
+		      dns_fixedname_name(&looknew->fdomain), NULL);

 	if (servers)
 		clone_server_list(lookold->my_server_list,
@@ -1824,7 +1824,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 				if (lookup->ns_search_only)
 					lookup->recurse = false;
 				domain = dns_fixedname_name(&lookup->fdomain);
-				dns_name_copynf(name, domain);
+				dns_name_copy(name, domain, NULL);
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -2028,9 +2028,6 @@ setup_lookup(dig_lookup_t *lookup) {
 	char cookiebuf[256];
 	char *origin = NULL;
 	char *textname = NULL;
-
-	REQUIRE(lookup != NULL);
-
 #ifdef HAVE_LIBIDN2
 	char idn_origin[MXNAME], idn_textname[MXNAME];

@@ -2039,6 +2036,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	check_result(result, "dns_name_settotextfilter");
 #endif /* HAVE_LIBIDN2 */

+	REQUIRE(lookup != NULL);
 	INSIST(!free_now);

 	debug("setup_lookup(%p)", lookup);
@@ -2139,26 +2137,22 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
-			if (result == ISC_R_SUCCESS) {
-				if (!dns_name_isabsolute(name)) {
-					result = dns_name_concatenate(name,
-							     lookup->oname,
-							     lookup->name,
-							     &lookup->namebuf);
-				} else {
-					result = dns_name_copy(name,
-							     lookup->name,
-							     &lookup->namebuf);
-				}
-			}
+			if (result == ISC_R_SUCCESS &&
+			    !dns_name_isabsolute(name))
+				result = dns_name_concatenate(name,
+							      lookup->oname,
+							      lookup->name,
+							      &lookup->namebuf);
+			else if (result == ISC_R_SUCCESS)
+				result = dns_name_copy(name, lookup->name,
+						       &lookup->namebuf);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
-				if (result == DNS_R_NAMETOOLONG) {
+				if (result == DNS_R_NAMETOOLONG)
 					return (false);
-				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
 				      isc_result_totext(result));
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -269,5 +269,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -396,7 +396,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname, NULL);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -455,7 +455,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {

 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -48,7 +48,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -233,10 +233,7 @@ Change the default TCP/UDP name server port to
 .RS 4
 Change the type of the information query\&.
 .sp
-(Default = A and then AAAA; abbreviations = q, ty)
-.sp
-\fBNote:\fR
-It is only possible to specify one query type, only the default behavior looks up both when an alternative is not specified\&.
+(Default = A; abbreviations = q, ty)
 .RE
 .PP
 \fB\fI[no]\fR\fR\fBrecurse\fR
@@ -304,5 +301,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -425,7 +425,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copynf(&cname.cname, qname);
+		dns_name_copy(&cname.cname, qname, NULL);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -478,7 +478,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {

 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copynf(query->lookup->name, name);
+		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -72,7 +72,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -308,7 +307,7 @@ nslookup -query=hinfo  -timeout=10
                    The class specifies the protocol group of the information.

                  </para>
-                  <para>
+		  <para>
                    (Default = IN; abbreviation = cl)
                  </para>
                </listitem>
@@ -318,10 +317,10 @@ nslookup -query=hinfo  -timeout=10
                <term><constant><replaceable><optional>no</optional></replaceable>debug</constant></term>
                <listitem>
                  <para>
-                    Turn on or off the display of the full response packet and
-                    any intermediate response packets when searching.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                  </para>
-                  <para>
+		  <para>
                    (Default = nodebug; abbreviation = <optional>no</optional>deb)
                  </para>
                </listitem>
@@ -332,9 +331,9 @@ nslookup -query=hinfo  -timeout=10
                <listitem>
                  <para>
                    Turn debugging mode on or off.  This displays more about
-                    what nslookup is doing.
+	            what nslookup is doing.
                  </para>
-                  <para>
+		  <para>
                    (Default = nod2)
                  </para>
                </listitem>
@@ -358,7 +357,7 @@ nslookup -query=hinfo  -timeout=10
                    names in the domain search list to the request until an
                    answer is received.
                  </para>
-                  <para>
+		  <para>
                    (Default = search)
                  </para>
                </listitem>
@@ -370,7 +369,7 @@ nslookup -query=hinfo  -timeout=10
                  <para>
                    Change the default TCP/UDP name server port to <replaceable>value</replaceable>.
                  </para>
-                  <para>
+		  <para>
                    (Default = 53; abbreviation = po)
                  </para>
                </listitem>
@@ -389,15 +388,9 @@ nslookup -query=hinfo  -timeout=10
                  <para>
                    Change the type of the information query.
                  </para>
-                  <para>
-                    (Default = A and then AAAA; abbreviations = q, ty)
+		  <para>
+                    (Default = A; abbreviations = q, ty)
                  </para>
-                    <para>
-                      <emphasis role="bold">Note:</emphasis> It is
-                      only possible to specify one query type, only
-                      the default behavior looks up both when an
-                      alternative is not specified.
-                    </para>
                </listitem>
              </varlistentry>

@@ -409,7 +402,7 @@ nslookup -query=hinfo  -timeout=10
                    have the
                    information.
                  </para>
-                  <para>
+		  <para>
                    (Default = recurse; abbreviation = [no]rec)
                  </para>
                </listitem>
@@ -419,9 +412,9 @@ nslookup -query=hinfo  -timeout=10
                <term><constant>ndots=</constant><replaceable>number</replaceable></term>
                <listitem>
                  <para>
-                    Set the number of dots (label separators) in a domain
-                    that will disable searching.  Absolute names always
-                    stop searching.
+		    Set the number of dots (label separators) in a domain
+		    that will disable searching.  Absolute names always
+		    stop searching.
                  </para>
                </listitem>
              </varlistentry>
@@ -452,7 +445,7 @@ nslookup -query=hinfo  -timeout=10
                    Always use a virtual circuit when sending requests to the
                    server.
                  </para>
-                  <para>
+		  <para>
                    (Default = novc)
                  </para>
                </listitem>
@@ -462,15 +455,15 @@ nslookup -query=hinfo  -timeout=10
                <term><constant><replaceable><optional>no</optional></replaceable>fail</constant></term>
                <listitem>
                  <para>
-                    Try the next nameserver if a nameserver responds with
-                    SERVFAIL or a referral (nofail) or terminate query
-                    (fail) on such a response.
-                  </para>
-                  <para>
+		    Try the next nameserver if a nameserver responds with
+		    SERVFAIL or a referral (nofail) or terminate query
+		    (fail) on such a response.
+		  </para>
+		  <para>
                    (Default = nofail)
                  </para>
-                </listitem>
-              </varlistentry>
+	        </listitem>
+	      </varlistentry>

            </variablelist>
          </para>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -229,17 +229,17 @@ nslookup -query=hinfo  -timeout=10
                    The class specifies the protocol group of the information.

                  </p>
-                  <p>
+		  <p>
                    (Default = IN; abbreviation = cl)
                  </p>
                </dd>
 <dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>debug</code></span></dt>
 <dd>
                  <p>
-                    Turn on or off the display of the full response packet and
-                    any intermediate response packets when searching.
+		    Turn on or off the display of the full response packet and
+		    any intermediate response packets when searching.
                  </p>
-                  <p>
+		  <p>
                    (Default = nodebug; abbreviation = [<span class="optional">no</span>]deb)
                  </p>
                </dd>
@@ -247,9 +247,9 @@ nslookup -query=hinfo  -timeout=10
 <dd>
                  <p>
                    Turn debugging mode on or off.  This displays more about
-                    what nslookup is doing.
+	            what nslookup is doing.
                  </p>
-                  <p>
+		  <p>
                    (Default = nod2)
                  </p>
                </dd>
@@ -267,7 +267,7 @@ nslookup -query=hinfo  -timeout=10
                    names in the domain search list to the request until an
                    answer is received.
                  </p>
-                  <p>
+		  <p>
                    (Default = search)
                  </p>
                </dd>
@@ -276,7 +276,7 @@ nslookup -query=hinfo  -timeout=10
                  <p>
                    Change the default TCP/UDP name server port to <em class="replaceable"><code>value</code></em>.
                  </p>
-                  <p>
+		  <p>
                    (Default = 53; abbreviation = po)
                  </p>
                </dd>
@@ -289,15 +289,9 @@ nslookup -query=hinfo  -timeout=10
                  <p>
                    Change the type of the information query.
                  </p>
-                  <p>
-                    (Default = A and then AAAA; abbreviations = q, ty)
+		  <p>
+                    (Default = A; abbreviations = q, ty)
                  </p>
-                    <p>
-                      <span class="bold"><strong>Note:</strong></span> It is
-                      only possible to specify one query type, only
-                      the default behavior looks up both when an
-                      alternative is not specified.
-                    </p>
                </dd>
 <dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>recurse</code></span></dt>
 <dd>
@@ -306,16 +300,16 @@ nslookup -query=hinfo  -timeout=10
                    have the
                    information.
                  </p>
-                  <p>
+		  <p>
                    (Default = recurse; abbreviation = [no]rec)
                  </p>
                </dd>
 <dt><span class="term"><code class="constant">ndots=</code><em class="replaceable"><code>number</code></em></span></dt>
 <dd>
                  <p>
-                    Set the number of dots (label separators) in a domain
-                    that will disable searching.  Absolute names always
-                    stop searching.
+		    Set the number of dots (label separators) in a domain
+		    that will disable searching.  Absolute names always
+		    stop searching.
                  </p>
                </dd>
 <dt><span class="term"><code class="constant">retry=</code><em class="replaceable"><code>number</code></em></span></dt>
@@ -337,21 +331,21 @@ nslookup -query=hinfo  -timeout=10
                    Always use a virtual circuit when sending requests to the
                    server.
                  </p>
-                  <p>
+		  <p>
                    (Default = novc)
                  </p>
                </dd>
 <dt><span class="term"><code class="constant"><em class="replaceable"><code>[<span class="optional">no</span>]</code></em>fail</code></span></dt>
 <dd>
                  <p>
-                    Try the next nameserver if a nameserver responds with
-                    SERVFAIL or a referral (nofail) or terminate query
-                    (fail) on such a response.
-                  </p>
-                  <p>
+		    Try the next nameserver if a nameserver responds with
+		    SERVFAIL or a referral (nofail) or terminate query
+		    (fail) on such a response.
+		  </p>
+		  <p>
                    (Default = nofail)
                  </p>
-                </dd>
+	        </dd>
 </dl></div>
 <p>
          </p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -28,7 +28,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/serial.h>
 #include <isc/string.h>
@@ -62,6 +61,10 @@

 #include "dnssectool.h"

+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-cds";
 int verbose;

@@ -788,8 +791,6 @@ ds_from_cds(dns_rdatalist_t *dslist, isc_buffer_t *buf, dns_rdata_t *cds) {
 	dns_rdata_ds_t ds;
 	dns_rdata_t *rdata;

-	REQUIRE(buf != NULL);
-
 	rdata = rdata_get();

 	result = dns_rdata_tostruct(cds, &ds, NULL);
@@ -809,8 +810,6 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 	isc_result_t result;
 	unsigned i, n;

-	REQUIRE(buf != NULL);
-
 	n = sizeof(dtype)/sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
 		if (dtype[i] != 0) {
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -237,5 +237,5 @@ RFC 7344
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -21,7 +21,6 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -50,6 +49,10 @@

 #include "dnssectool.h"

+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-dsfromkey";
 int verbose;

@@ -204,7 +207,9 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	result = dns_name_copy(dst_key_name(key), name, NULL);
+	if (result != ISC_R_SUCCESS)
+		fatal("can't copy name");

 	dst_key_free(&key);
 }
@@ -343,7 +348,7 @@ main(int argc, char **argv) {
 	char		*classname = NULL;
 	char		*filename = NULL, *dir = NULL, *namestr;
 	char		*lookaside = NULL;
-	char		*endp, *arg1;
+	char		*endp;
 	int		ch;
 	dns_dsdigest_t	dtype = DNS_DSDIGEST_SHA1;
 	bool	cds = false;
@@ -471,15 +476,10 @@ main(int argc, char **argv) {
 		showall = true;
 	}

-	/*
-	 * Use local variable arg1 so that clang can correctly analyse
-	 * reachable paths rather than 'argc < isc_commandline_index + 1'.
-	 */
-	arg1 = argv[isc_commandline_index];
-	if (arg1 == NULL && filename == NULL) {
+	if (argc < isc_commandline_index + 1 && filename == NULL) {
 		fatal("the key file name was not specified");
 	}
-	if (arg1 != NULL && argv[isc_commandline_index + 1] != NULL) {
+	if (argc > isc_commandline_index + 1) {
 		fatal("extraneous arguments");
 	}

@@ -494,11 +494,11 @@ main(int argc, char **argv) {
 	dns_rdataset_init(&rdataset);

 	if (usekeyset || filename != NULL) {
-		if (arg1 == NULL) {
-			/* using file name as the zone name */
+		if (argc < isc_commandline_index + 1) {
+			/* using zone name as the zone file name */
 			namestr = filename;
 		} else {
-			namestr = arg1;
+			namestr = argv[isc_commandline_index];
 		}

 		result = initname(namestr);
@@ -540,7 +540,8 @@ main(int argc, char **argv) {
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];

-		loadkey(arg1, key_buf, DST_KEY_MAXSIZE, &rdata);
+		loadkey(argv[isc_commandline_index], key_buf,
+			DST_KEY_MAXSIZE, &rdata);

 		if (both) {
 			emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds,
@@ -42,7 +42,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -20,7 +20,6 @@
 #include <isc/commandline.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
-#include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/string.h>
 #include <isc/util.h>
@@ -49,6 +48,10 @@

 #include "dnssectool.h"

+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-importkey";
 int verbose;

@@ -178,7 +181,9 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copynf(dst_key_name(key), name);
+	result = dns_name_copy(dst_key_name(key), name, NULL);
+	if (result != ISC_R_SUCCESS)
+		fatal("can't copy name");

 	dst_key_free(&key);
 }
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -92,7 +92,7 @@ Specifies the label for a key pair in the crypto hardware\&.
 .sp
 When
 BIND
-9 is built with OpenSSL\-based PKCS#11 support, the label is an arbitrary string that identifies a particular key\&.
+9 is built with OpenSSL\-based PKCS#11 support, the label is an arbitrary string that identifies a particular key\&. It may be preceded by an optional OpenSSL engine name, followed by a colon, as in "pkcs11:\fIkeylabel\fR"\&.
 .sp
 When
 BIND
@@ -307,5 +307,5 @@ The PKCS#11 URI Scheme (draft\-pechanec\-pkcs11uri\-13)\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -44,7 +44,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -173,7 +172,9 @@
 	  <para>
 	    When <acronym>BIND</acronym> 9 is built with OpenSSL-based
 	    PKCS#11 support, the label is an arbitrary string that
-	    identifies a particular key.
+	    identifies a particular key.  It may be preceded by an
+	    optional OpenSSL engine name, followed by a colon, as in
+	    "pkcs11:<replaceable>keylabel</replaceable>".
 	  </para>
 	  <para>
 	    When <acronym>BIND</acronym> 9 is built with native PKCS#11
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -146,7 +146,9 @@
 	  <p>
 	    When <acronym class="acronym">BIND</acronym> 9 is built with OpenSSL-based
 	    PKCS#11 support, the label is an arbitrary string that
-	    identifies a particular key.
+	    identifies a particular key.  It may be preceded by an
+	    optional OpenSSL engine name, followed by a colon, as in
+	    "pkcs11:<em class="replaceable"><code>keylabel</code></em>".
 	  </p>
 	  <p>
 	    When <acronym class="acronym">BIND</acronym> 9 is built with native PKCS#11
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -353,5 +353,5 @@ RFC 4034\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2005, 2007-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2005, 2007-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -99,5 +99,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2011, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2011, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -200,5 +200,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -188,6 +188,110 @@ main(int argc, char **argv) {
 #define CMDLINE_FLAGS "A:D:E:fhI:i:K:L:P:p:R:S:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
+		case 'E':
+			engine = isc_commandline_argument;
+			break;
+		case 'f':
+			force = true;
+			break;
+		case 'p':
+			p = isc_commandline_argument;
+			if (!strcasecmp(p, "all")) {
+				printcreate = true;
+				printpub = true;
+				printact = true;
+				printrev = true;
+				printinact = true;
+				printdel = true;
+				printsyncadd = true;
+				printsyncdel = true;
+				break;
+			}
+
+			do {
+				switch (*p++) {
+				case 'C':
+					printcreate = true;
+					break;
+				case 'P':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncadd = true;
+						break;
+					}
+					printpub = true;
+					break;
+				case 'A':
+					printact = true;
+					break;
+				case 'R':
+					printrev = true;
+					break;
+				case 'I':
+					printinact = true;
+					break;
+				case 'D':
+					if (!strncmp(p, "sync", 4)) {
+						p += 4;
+						printsyncdel = true;
+						break;
+					}
+					printdel = true;
+					break;
+				case ' ':
+					break;
+				default:
+					usage();
+					break;
+				}
+			} while (*p != '\0');
+			break;
+		case 'u':
+			epoch = true;
+			break;
+		case 'K':
+			/*
+			 * We don't have to copy it here, but do it to
+			 * simplify cleanup later
+			 */
+			directory = isc_mem_strdup(mctx,
+						   isc_commandline_argument);
+			if (directory == NULL) {
+				fatal("Failed to allocate memory for "
+				      "directory");
+			}
+			break;
+		case 'L':
+			ttl = strtottl(isc_commandline_argument);
+			setttl = true;
+			break;
+		case 'v':
+			verbose = strtol(isc_commandline_argument, &endp, 0);
+			if (*endp != '\0')
+				fatal("-v must be followed by a number");
+			break;
+		case 'P':
+			/* -Psync ? */
+			if (isoptarg("sync", argv, usage)) {
+				if (unsetsyncadd || setsyncadd)
+					fatal("-P sync specified more than "
+					      "once");
+
+				changed = true;
+				syncadd = strtotime(isc_commandline_argument,
+						   now, now, &setsyncadd);
+				unsetsyncadd = !setsyncadd;
+				break;
+			}
+			(void)isoptarg("dnskey", argv, usage);
+			if (setpub || unsetpub)
+				fatal("-P specified more than once");
+
+			changed = true;
+			pub = strtotime(isc_commandline_argument,
+					now, now, &setpub);
+			unsetpub = !setpub;
+			break;
 		case 'A':
 			if (setact || unsetact)
 				fatal("-A specified more than once");
@@ -197,6 +301,24 @@ main(int argc, char **argv) {
 					now, now, &setact);
 			unsetact = !setact;
 			break;
+		case 'R':
+			if (setrev || unsetrev)
+				fatal("-R specified more than once");
+
+			changed = true;
+			rev = strtotime(isc_commandline_argument,
+					now, now, &setrev);
+			unsetrev = !setrev;
+			break;
+		case 'I':
+			if (setinact || unsetinact)
+				fatal("-I specified more than once");
+
+			changed = true;
+			inact = strtotime(isc_commandline_argument,
+					now, now, &setinact);
+			unsetinact = !setinact;
+			break;
 		case 'D':
 			/* -Dsync ? */
 			if (isoptarg("sync", argv, usage)) {
@@ -220,11 +342,11 @@ main(int argc, char **argv) {
 					now, now, &setdel);
 			unsetdel = !setdel;
 			break;
-		case 'E':
-			engine = isc_commandline_argument;
+		case 'S':
+			predecessor = isc_commandline_argument;
 			break;
-		case 'f':
-			force = true;
+		case 'i':
+			prepub = strtottl(isc_commandline_argument);
 			break;
 		case '?':
 			if (isc_commandline_option != '?')
@@ -234,131 +356,11 @@ main(int argc, char **argv) {
 		case 'h':
 			/* Does not return. */
 			usage();
-		case 'I':
-			if (setinact || unsetinact)
-				fatal("-I specified more than once");

-			changed = true;
-			inact = strtotime(isc_commandline_argument,
-					now, now, &setinact);
-			unsetinact = !setinact;
-			break;
-		case 'i':
-			prepub = strtottl(isc_commandline_argument);
-			break;
-		case 'K':
-			/*
-			 * We don't have to copy it here, but do it to
-			 * simplify cleanup later
-			 */
-			directory = isc_mem_strdup(mctx,
-						   isc_commandline_argument);
-			if (directory == NULL) {
-				fatal("Failed to allocate memory for "
-				      "directory");
-			}
-			break;
-		case 'L':
-			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
-			break;
-		case 'P':
-			/* -Psync ? */
-			if (isoptarg("sync", argv, usage)) {
-				if (unsetsyncadd || setsyncadd)
-					fatal("-P sync specified more than "
-					      "once");
-
-				changed = true;
-				syncadd = strtotime(isc_commandline_argument,
-						   now, now, &setsyncadd);
-				unsetsyncadd = !setsyncadd;
-				break;
-			}
-			(void)isoptarg("dnskey", argv, usage);
-			if (setpub || unsetpub)
-				fatal("-P specified more than once");
-
-			changed = true;
-			pub = strtotime(isc_commandline_argument,
-					now, now, &setpub);
-			unsetpub = !setpub;
-			break;
-		case 'p':
-			p = isc_commandline_argument;
-			if (!strcasecmp(p, "all")) {
-				printcreate = true;
-				printpub = true;
-				printact = true;
-				printrev = true;
-				printinact = true;
-				printdel = true;
-				printsyncadd = true;
-				printsyncdel = true;
-				break;
-			}
-
-			do {
-				switch (*p++) {
-				case 'A':
-					printact = true;
-					break;
-				case 'C':
-					printcreate = true;
-					break;
-				case 'D':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncdel = true;
-						break;
-					}
-					printdel = true;
-					break;
-				case 'I':
-					printinact = true;
-					break;
-				case 'P':
-					if (!strncmp(p, "sync", 4)) {
-						p += 4;
-						printsyncadd = true;
-						break;
-					}
-					printpub = true;
-					break;
-				case 'R':
-					printrev = true;
-					break;
-				case ' ':
-					break;
-				default:
-					usage();
-					break;
-				}
-			} while (*p != '\0');
-			break;
-		case 'R':
-			if (setrev || unsetrev)
-				fatal("-R specified more than once");
-
-			changed = true;
-			rev = strtotime(isc_commandline_argument,
-					now, now, &setrev);
-			unsetrev = !setrev;
-			break;
-		case 'S':
-			predecessor = isc_commandline_argument;
-			break;
-		case 'u':
-			epoch = true;
-			break;
 		case 'V':
 			/* Does not return. */
 			version(program);
-		case 'v':
-			verbose = strtol(isc_commandline_argument, &endp, 0);
-			if (*endp != '\0')
-				fatal("-v must be followed by a number");
-			break;
+
 		default:
 			fprintf(stderr, "%s: unhandled option -%c\n",
 				program, isc_commandline_option);
@@ -41,7 +41,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009-2011, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009-2011, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -468,5 +468,5 @@ RFC 4641\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -44,7 +44,6 @@
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
-#include <isc/platform.h>
 #include <isc/print.h>
 #include <isc/random.h>
 #include <isc/rwlock.h>
@@ -89,6 +88,10 @@

 #include "dnssectool.h"

+#ifndef PATH_MAX
+#define PATH_MAX 1024   /* WIN32, and others don't define this. */
+#endif
+
 const char *program = "dnssec-signzone";
 int verbose;

@@ -201,7 +204,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;

 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copynf(name, result);
+	dns_name_copy(name, result, NULL);

 	return (result);
 }
@@ -791,10 +794,7 @@ hashlist_comp(const void *a, const void *b) {

 static void
 hashlist_sort(hashlist_t *l) {
-	INSIST(l->hashbuf != NULL || l->length == 0);
-	if (l->length > 0) {
-		qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
-	}
+	qsort(l->hashbuf, l->entries, l->length, hashlist_comp);
 }

 static bool
@@ -1946,7 +1946,7 @@ addnsec3param(const unsigned char *salt, size_t salt_len,
 	check_result(result, "dns_rdatalist_tordataset()");

 	result = dns_db_findnode(gdb, gorigin, true, &node);
-	check_result(result, "dns_db_findnode(gorigin)");
+	check_result(result, "dns_db_find(gorigin)");

 	/*
 	 * Delete any current NSEC3PARAM records.
@@ -2346,7 +2346,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname, NULL);
 			done = true;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("iterating through the database failed: %s",
@@ -2480,7 +2480,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copynf(gorigin, nextname);
+			dns_name_copy(gorigin, nextname, NULL);
 			done = true;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("iterating through the database failed: %s",
@@ -51,7 +51,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2009, 2011-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2009, 2011-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -113,5 +113,5 @@ RFC 4033\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2012, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -17,7 +17,6 @@
 #include <stdbool.h>

 #include <isc/log.h>
-#include <isc/platform.h>
 #include <isc/stdtime.h>
 #include <dns/rdatastruct.h>
 #include <dst/dst.h>
@@ -67,7 +67,7 @@ options {\n\
 "	files unlimited;\n"
 #endif
 #if defined(HAVE_GEOIP2) && !defined(WIN32)
-"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP\";\n"
+"	geoip-directory \"" MAXMINDDB_PREFIX "/share/GeoIP2\";\n"
 #elif defined(HAVE_GEOIP2)
 "	geoip-directory \".\";\n"
 #endif
@@ -197,7 +197,7 @@ options {\n\
 #	sortlist <none>\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 1; /* 1 second */\n\
-	synth-from-dnssec no;\n\
+	synth-from-dnssec yes;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
 	v6-bias 50;\n\
@@ -244,4 +244,6 @@ named_geoip_shutdown(void) {
 		named_g_geoip->domain = NULL;
 	}
 #endif /* HAVE_GEOIP2 */
+
+	dns_geoip_shutdown();
 }
@@ -135,6 +135,14 @@ EXTERN const char *		named_g_defaultpidfile 	INIT(NAMED_LOCALSTATEDIR
 							     "/run/named.pid");
 #endif

+#ifdef HAVE_DNSTAP
+EXTERN const char *		named_g_defaultdnstap
+					INIT(NAMED_LOCALSTATEDIR "/run/named/"
+							      "dnstap.sock");
+#else
+EXTERN const char *		named_g_defaultdnstap	INIT(NULL);
+#endif /* HAVE_DNSTAP */
+
 EXTERN const char *		named_g_username	INIT(NULL);

 EXTERN const char *		named_g_engine		INIT(NULL);
@@ -57,10 +57,6 @@
 #endif


-#ifdef HAVE_GEOIP2
-#include <maxminddb.h>
-#endif
-
 /*
 * Defining NAMED_MAIN provides storage declarations (rather than extern)
 * for variables in named/globals.h.
@@ -70,7 +66,6 @@
 #include <ns/interfacemgr.h>

 #include <named/builtin.h>
-#include <named/config.h>
 #include <named/control.h>
 #include <named/fuzz.h>
 #include <named/globals.h>	/* Explicit, though named/log.h includes it. */
@@ -453,12 +448,6 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
-#if defined(HAVE_GEOIP2)
-	isc_mem_t *mctx = NULL;
-	cfg_parser_t *parser = NULL;
-	cfg_obj_t *config = NULL;
-	const cfg_obj_t *defaults = NULL, *obj = NULL;
-#endif

 	printf("%s %s%s%s <id:%s>\n",
 	       named_g_product, named_g_version,
@@ -517,17 +506,6 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	       ZLIB_VERSION);
 	printf("linked to zlib version: %s\n",
 	       zlibVersion());
-#endif
-#if defined(HAVE_GEOIP2)
-	/* Unfortunately, no version define on link time */
-	printf("linked to maxminddb version: %s\n",
-	       MMDB_lib_version());
-#endif
-#if defined(HAVE_DNSTAP)
-	printf("compiled with protobuf-c version: %s\n",
-	       PROTOBUF_C_VERSION);
-	printf("linked to protobuf-c version: %s\n",
-	       protobuf_c_version());
 #endif
 	printf("threads support is enabled\n\n");

@@ -556,20 +534,7 @@ OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("  nsupdate session key: %s\n", named_g_defaultsessionkeyfile);
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 	printf("  named lock file:      %s\n", named_g_defaultlockfile);
-#if defined(HAVE_GEOIP2)
-#define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	RTC(isc_mem_create(0, 0, &mctx));
-	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
-	RTC(named_config_parsedefaults(parser, &config));
-	RTC(cfg_map_get(config, "options", &defaults));
-	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
-	if (cfg_obj_isstring(obj)) {
-		printf("  geoip-directory:      %s\n", cfg_obj_asstring(obj));
-	}
-	cfg_obj_destroy(parser, &config);
-	cfg_parser_destroy(&parser);
-	isc_mem_detach(&mctx);
-#endif /* HAVE_GEOIP2 */
+
 }

 static void
@@ -1229,7 +1194,6 @@ setup(void) {
 #endif

 	named_server_create(named_g_mctx, &named_g_server);
-	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

 	/*
@@ -1410,10 +1374,6 @@ main(int argc, char *argv[]) {
 	setvbuf(stderr, NULL, _IOFBF, BUFSIZ);
 #endif

-#ifdef HAVE_LIBXML2
-	xmlInitThreads();
-#endif /* HAVE_LIBXML2 */
-
 	/*
 	 * Record version in core image.
 	 * strings named.core | grep "named version:"
@@ -1549,10 +1509,6 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#ifdef HAVE_LIBXML2
-	xmlCleanupThreads();
-#endif /* HAVE_LIBXML2 */
-
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -378,5 +378,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1062,5 +1062,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -49,7 +49,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000, 2001, 2003-2009, 2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -70,7 +70,6 @@
 #include <dns/events.h>
 #include <dns/forward.h>
 #include <dns/fixedname.h>
-#include <dns/geoip.h>
 #include <dns/journal.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
@@ -138,6 +137,10 @@
 #define dumpzone dumpzone_file
 #endif /* HAVE_LMDB */

+#ifndef PATH_MAX
+#define PATH_MAX 1024
+#endif
+
 #ifndef SIZE_MAX
 #define SIZE_MAX ((size_t)-1)
 #endif
@@ -203,8 +206,8 @@

 #define CHECKFATAL(op, msg) \
 	do { result = (op);					  \
-		if (result != ISC_R_SUCCESS)			  \
-			fatal(server, msg, result);		  \
+	       if (result != ISC_R_SUCCESS)			  \
+			fatal(msg, result);			  \
 	} while (0)						  \

 /*%
@@ -433,8 +436,7 @@ const char *empty_zones[] = {
 };

 ISC_PLATFORM_NORETURN_PRE static void
-fatal(named_server_t *server,const char *msg, isc_result_t result)
-ISC_PLATFORM_NORETURN_POST;
+fatal(const char *msg, isc_result_t result) ISC_PLATFORM_NORETURN_POST;

 static void
 named_server_reload(isc_task_t *task, isc_event_t *event);
@@ -2493,17 +2495,15 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	} else {
 		old = NULL;
 	}
-	if (old == NULL) {
+	if (old == NULL)
 		*old_rpz_okp = false;
-	} else {
+	else
 		*old_rpz_okp = true;
-	}

 	for (i = 0;
 	     zone_element != NULL;
-	     ++i, zone_element = cfg_list_next(zone_element))
-	{
-		INSIST(!*old_rpz_okp || old != NULL);
+	     ++i, zone_element = cfg_list_next(zone_element)) {
+		INSIST(old != NULL || !*old_rpz_okp);
 		if (*old_rpz_okp && i < old->p.num_zones) {
 			old_zone = old->zones[i];
 		} else {
@@ -2528,21 +2528,24 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 	 * zones are unchanged, then use the same policy data.
 	 * Data for individual zones that must be reloaded will be merged.
 	 */
-	if (*old_rpz_okp) {
-		if (old != NULL &&
-		    memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0)
-		{
-			*old_rpz_okp = false;
-		} else if ((old == NULL || old->rps_cstr == NULL) !=
-			   (zones->rps_cstr == NULL))
-		{
-			*old_rpz_okp = false;
-		} else if (old != NULL &&
-			   zones->rps_cstr != NULL &&
-			   strcmp(old->rps_cstr, zones->rps_cstr) != 0)
-		{
-			*old_rpz_okp = false;
-		}
+	if (*old_rpz_okp &&
+	    old != NULL && memcmp(&old->p, &zones->p, sizeof(zones->p)) != 0)
+	{
+		*old_rpz_okp = false;
+	}
+
+	if (*old_rpz_okp &&
+	    (old == NULL ||
+	     old->rps_cstr == NULL) != (zones->rps_cstr == NULL))
+	{
+		*old_rpz_okp = false;
+	}
+
+	if (*old_rpz_okp &&
+	    (zones->rps_cstr != NULL &&
+	     strcmp(old->rps_cstr, zones->rps_cstr) != 0))
+	{
+		*old_rpz_okp = false;
 	}

 	if (*old_rpz_okp) {
@@ -2556,9 +2559,8 @@ configure_rpz(dns_view_t *view, const cfg_obj_t **maps,
 			    view->rpzs->rpz_ver);
 	}

-	if (pview != NULL) {
+	if (pview != NULL)
 		dns_view_detach(&pview);
-	}

 	return (ISC_R_SUCCESS);
 }
@@ -3483,7 +3485,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 	isc_result_t result;
 	const cfg_obj_t *obj, *obj2;
 	const cfg_listelt_t *element;
-	const char *dpath;
+	const char *dpath = named_g_defaultdnstap;
 	const cfg_obj_t *dlist = NULL;
 	dns_dtmsgtype_t dttypes = 0;
 	unsigned int i;
@@ -6859,7 +6861,7 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {

 	REQUIRE(keytable != NULL);
 	REQUIRE(keynode != NULL);
-	REQUIRE(dotat_arg != NULL);
+	REQUIRE(arg != NULL);

 	view = dotat_arg->view;
 	task = dotat_arg->task;
@@ -8200,7 +8202,6 @@ load_configuration(const char *filename, named_server_t *server,
 	INSIST(result == ISC_R_SUCCESS);
 	CHECKM(setstring(server, &server->bindkeysfile,
 	       cfg_obj_asstring(obj)), "strdup");
-	INSIST(server->bindkeysfile != NULL);

 	if (access(server->bindkeysfile, R_OK) == 0) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -8284,10 +8285,6 @@ load_configuration(const char *filename, named_server_t *server,
 	isc_socketmgr_setreserved(named_g_socketmgr, reserved);

 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
-	/*
-	 * Release any previously opened GeoIP2 databases.
-	 */
-	named_geoip_shutdown();
 	/*
 	 * Initialize GeoIP databases from the configured location.
 	 * This should happen before configuring any ACLs, so that we
@@ -9066,8 +9063,7 @@ load_configuration(const char *filename, named_server_t *server,
 	{
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
-		named_g_memstatistics =
-			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
+		named_g_memstatistics = true;
 	}

 	obj = NULL;
@@ -9660,7 +9656,6 @@ shutdown_server(isc_task_t *task, isc_event_t *event) {
 #endif
 #if defined(HAVE_GEOIP) || defined(HAVE_GEOIP2)
 	named_geoip_shutdown();
-	dns_geoip_shutdown();
 #endif /* HAVE_GEOIP || HAVE_GEOIP2 */

 	dns_db_detach(&server->in_roothints);
@@ -9693,7 +9688,7 @@ get_matching_view(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		if (message->rdclass == view->rdclass ||
 		    message->rdclass == dns_rdataclass_any)
 		{
-			const dns_name_t *tsig = NULL;
+			dns_name_t *tsig = NULL;

 			*sigresult = dns_message_rechecksig(message, view);
 			if (*sigresult == ISC_R_SUCCESS) {
@@ -9725,7 +9720,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	named_server_t *server = isc_mem_get(mctx, sizeof(*server));

 	if (server == NULL)
-		fatal(server, "allocating server object", ISC_R_NOMEMORY);
+		fatal("allocating server object", ISC_R_NOMEMORY);

 	server->mctx = mctx;
 	server->task = NULL;
@@ -9934,15 +9929,7 @@ named_server_destroy(named_server_t **serverp) {
 }

 static void
-fatal(named_server_t *server, const char *msg, isc_result_t result) {
-	if (server != NULL) {
-		/*
-		 * Prevent races between the OpenSSL on_exit registered
-		 * function and any other OpenSSL calls from other tasks
-		 * by requesting exclusive access to the task manager.
-		 */
-		(void)isc_task_beginexclusive(server->task);
-	}
+fatal(const char *msg, isc_result_t result) {
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_CRITICAL,
 		      "%s: %s", msg, isc_result_totext(result));
@@ -11029,20 +11016,17 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	FILE *fp = NULL;
 	isc_time_t now;
 	char tbuf[64];
-	unsigned int used = isc_buffer_usedlength(*text);
-	bool first = true;

 	/* Skip the command name. */
 	ptr = next_token(lex, text);
-	if (ptr == NULL) {
+	if (ptr == NULL)
 		return (ISC_R_UNEXPECTEDEND);
-	}

 	/* "-" here means print the output instead of dumping to file */
 	ptr = next_token(lex, text);
-	if (ptr != NULL && strcmp(ptr, "-") == 0) {
+	if (ptr != NULL && strcmp(ptr, "-") == 0)
 		ptr = next_token(lex, text);
-	} else {
+	else {
 		result = isc_stdio_open(server->secrootsfile, "w", &fp);
 		if (result != ISC_R_SUCCESS) {
 			(void) putstr(text, "could not open ");
@@ -11057,85 +11041,66 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	CHECK(putstr(text, "secure roots as of "));
 	CHECK(putstr(text, tbuf));
 	CHECK(putstr(text, ":\n"));
-	used = isc_buffer_usedlength(*text);

 	do {
 		for (view = ISC_LIST_HEAD(server->viewlist);
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link))
 		{
-			if (ptr != NULL && strcmp(view->name, ptr) != 0) {
+			if (ptr != NULL && strcmp(view->name, ptr) != 0)
 				continue;
-			}
-			if (secroots != NULL) {
+			if (secroots != NULL)
 				dns_keytable_detach(&secroots);
-			}
 			result = dns_view_getsecroots(view, &secroots);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (first || used != isc_buffer_usedlength(*text)) {
-				CHECK(putstr(text, "\n"));
-				first = false;
-			}
-			CHECK(putstr(text, " Start view "));
+			CHECK(putstr(text, "\n Start view "));
 			CHECK(putstr(text, view->name));
 			CHECK(putstr(text, "\n   Secure roots:\n\n"));
-			used = isc_buffer_usedlength(*text);
 			CHECK(dns_keytable_totext(secroots, text));

-			if (ntatable != NULL) {
+			if (ntatable != NULL)
 				dns_ntatable_detach(&ntatable);
-			}
 			result = dns_view_getntatable(view, &ntatable);
 			if (result == ISC_R_NOTFOUND) {
 				result = ISC_R_SUCCESS;
 				continue;
 			}
-			if (used != isc_buffer_usedlength(*text)) {
-				CHECK(putstr(text, "\n"));
-			}
-			CHECK(putstr(text, "   Negative trust anchors:\n\n"));
-			used = isc_buffer_usedlength(*text);
+			CHECK(putstr(text, "\n   Negative trust anchors:\n\n"));
 			CHECK(dns_ntatable_totext(ntatable, NULL, text));
 		}
-
-		if (ptr != NULL) {
+		if (ptr != NULL)
 			ptr = next_token(lex, text);
-		}
 	} while (ptr != NULL);

 cleanup:
-	if (secroots != NULL) {
-		dns_keytable_detach(&secroots);
-	}
-	if (ntatable != NULL) {
-		dns_ntatable_detach(&ntatable);
-	}
-
-	if (fp != NULL) {
-		if (used != isc_buffer_usedlength(*text)) {
+	if (isc_buffer_usedlength(*text) > 0) {
+		if (fp != NULL)
 			(void)putstr(text, "\n");
-		}
+		else
+			(void)putnull(text);
+	}
+	if (secroots != NULL)
+		dns_keytable_detach(&secroots);
+	if (ntatable != NULL)
+		dns_ntatable_detach(&ntatable);
+	if (fp != NULL) {
 		fprintf(fp, "%.*s", (int) isc_buffer_usedlength(*text),
 			(char *) isc_buffer_base(*text));
 		isc_buffer_clear(*text);
 		(void)isc_stdio_close(fp);
-	} else if (isc_buffer_usedlength(*text) > 0) {
-		(void)putnull(text);
 	}
-
-	if (result == ISC_R_SUCCESS) {
+	if (result == ISC_R_SUCCESS)
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "dumpsecroots complete");
-	} else {
+	else
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "dumpsecroots failed: %s",
 			      dns_result_totext(result));
-	}
 	return (result);
 }

@@ -11616,11 +11581,6 @@ named_server_status(named_server_t *server, isc_buffer_t **text) {
 		     isc_quota_getmax(&server->sctx->tcpquota));
 	CHECK(putstr(text, line));

-	snprintf(line, sizeof(line), "TCP high-water: %u\n",
-		     (unsigned)ns_stats_get_counter(server->sctx->nsstats,
-					  ns_statscounter_tcphighwater));
-	CHECK(putstr(text, line));
-
 	if (server->reload_in_progress) {
 		CHECK(putstr(text, "reload/reconfig in progress"));
 	}
@@ -234,8 +234,6 @@ init_desc(void) {
 	SET_NSSTATDESC(invalidsig, "requests with invalid signature",
 		       "ReqBadSIG");
 	SET_NSSTATDESC(requesttcp, "TCP requests received", "ReqTCP");
-	SET_NSSTATDESC(tcphighwater, "TCP connection high-water",
-		       "TCPConnHighWater");
 	SET_NSSTATDESC(authrej, "auth queries rejected", "AuthQryRej");
 	SET_NSSTATDESC(recurserej, "recursive queries rejected", "RecQryRej");
 	SET_NSSTATDESC(xfrrej, "transfer requests rejected", "XfrRej");
@@ -317,10 +315,6 @@ init_desc(void) {
 		       "QryUsedStale");
 	SET_NSSTATDESC(prefetch, "queries triggered prefetch", "Prefetch");
 	SET_NSSTATDESC(keytagopt, "Keytag option received", "KeyTagOpt");
-	SET_NSSTATDESC(reclimitdropped,
-		       "queries dropped due to recursive client limit",
-		       "RecLimitDropped");
-
 	INSIST(i == ns_statscounter_max);

 	/* Initialize resolver statistics */
@@ -3588,6 +3582,10 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,

 	ISC_LIST_INIT(new_listeners);

+#ifdef HAVE_LIBXML2
+	xmlInitThreads();
+#endif /* HAVE_LIBXML2 */
+
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
@@ -3720,6 +3718,10 @@ named_statschannels_shutdown(named_server_t *server) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
+
+#ifdef HAVE_LIBXML2
+	xmlCleanupThreads();
+#endif /* HAVE_LIBXML2 */
 }

 isc_result_t
@@ -842,7 +842,7 @@ named_os_shutdownmsg(char *command, isc_buffer_t *text) {


 	/* Skip the command name. */
-	if (strtok_r(command, " \t", &last) == NULL) {
+	if ((ptr = strtok_r(command, " \t", &last)) == NULL) {
 		return;
 	}

@@ -60,6 +60,7 @@ named_paths_init(void) {
 	named_g_keyfile = isc_ntpaths_get(RNDC_KEY_PATH);
 	named_g_defaultsessionkeyfile = isc_ntpaths_get(SESSION_KEY_PATH);
 	named_g_defaultbindkeys = isc_ntpaths_get(BIND_KEYS_PATH);
+	named_g_defaultdnstap = NULL;

 	Initialized = TRUE;
 }
@@ -260,8 +260,16 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		dns_fixedname_init(&fname);
 		if (usezone) {
-			dns_name_copynf(dns_zone_getorigin(zone),
-					   dns_fixedname_name(&fname));
+			result = dns_name_copy(dns_zone_getorigin(zone),
+					       dns_fixedname_name(&fname),
+					       NULL);
+			if (result != ISC_R_SUCCESS) {
+				cfg_obj_log(identity, named_g_lctx,
+					    ISC_LOG_ERROR,
+					    "error copying origin: %s",
+					    isc_result_totext(result));
+				goto cleanup;
+			}
 		} else {
 			str = cfg_obj_asstring(dname);
 			isc_buffer_constinit(&b, str, strlen(str));
@@ -777,6 +785,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	dns_aclenv_t *env = ns_interfacemgr_getaclenv(interfacemgr);
 	dns_view_t *view;
 	dns_tsigkey_t *key = NULL;
+	dns_name_t *tsig = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;

@@ -791,9 +800,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,

 	for (view = ISC_LIST_HEAD(named_g_server->viewlist);
 	     view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
-		const dns_name_t *tsig = NULL;
+	     view = ISC_LIST_NEXT(view, link)) {

 		if (view->matchrecursiveonly)
 			continue;
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -519,5 +519,5 @@ The TSIG key is redundantly stored in two separate files\&. This is a consequenc
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -2636,7 +2636,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		 * address.
 		 */
 		zname = dns_fixedname_initname(&fzname);
-		dns_name_copynf(name, zname);
+		dns_name_copy(name, zname, NULL);
 	}

 	if (debugging) {
@@ -50,7 +50,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2012, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2012, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -93,5 +93,5 @@ Specify how long to pause before carrying out key destruction\&. The default is
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -126,7 +126,7 @@ main(int argc, char *argv[]) {
 	if (errflg || (id && (label != NULL))) {
 		fprintf(stderr, "Usage:\n");
 		fprintf(stderr, "\tpkcs11-destroy [-m module] [-s slot] "
-				"{-i id | -l label} [-p pin] [-w waittime]\n");
+				"[-i id | -l label] [-p pin] [-w waittime]\n");
 		exit(1);
 	}

@@ -38,7 +38,6 @@
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -116,5 +116,5 @@ Open the session with the given PKCS#11 slot\&. The default is slot 0\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -39,7 +39,6 @@
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
-      <year>2020</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2020 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
--- a/Show More
+++ b/Show More