add parser support for TLS/DoH configuration options

This commit adds stub parser support and tests for: - "tls" statement, specifying key and cert. - an optional "tls" keyvalue in listen-on statements for DoT configuration. - an "https-server" global option for HTTP/2 configuration. - an "https-endpoint" view option for DoH configuration. Documentation for these options has also been added to the ARM, but needs further work.
2020-09-16 14:55:10 -07:00
980 changed files with 28384 additions and 77415 deletions
@@ -11,7 +11,6 @@ BraceWrapping:
  AfterFunction:   false # should also be MultiLine, but not yet supported
  AfterExternBlock: false
  BeforeElse:      false
-  BeforeWhile:     false
  IndentBraces:    false
  SplitEmptyFunction: true
 AllowShortIfStatementsOnASingleLine: false
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
 Cpp11BracedListStyle: false
 ColumnLimit: 80
 AlignAfterOpenBracket: Align
-AlignConsecutiveBitFields: true
 AlignConsecutiveDeclarations: false
 AlignConsecutiveMacros: true
 AlignTrailingComments: true
@@ -64,7 +62,6 @@ IncludeCategories:
    Priority:        1
  - Regex:           '.*'
    Priority:        0
-IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -11,7 +11,6 @@ BraceWrapping:
  AfterFunction:   false # should also be MultiLine, but not yet supported
  AfterExternBlock: false
  BeforeElse:      false
-  BeforeWhile:     false
  IndentBraces:    false
  SplitEmptyFunction: true
 AllowShortIfStatementsOnASingleLine: false
@@ -20,7 +19,6 @@ AlwaysBreakAfterReturnType: All
 Cpp11BracedListStyle: false
 ColumnLimit: 80
 AlignAfterOpenBracket: Align
-AlignConsecutiveBitFields: true
 AlignConsecutiveDeclarations: true
 AlignConsecutiveMacros: true
 AlignTrailingComments: true
@@ -52,7 +50,6 @@ IncludeCategories:
    Priority:        1
  - Regex:           '".*"'
    Priority:        9
-IndentExternBlock: NoIndent
 KeepEmptyLinesAtTheStartOfBlocks: false
 MaxEmptyLinesToKeep: 1
 PenaltyBreakAssignment: 30
@@ -106,9 +106,6 @@
 	 (list
 	  "--enable=all"
 	  "--suppress=missingIncludeSystem"
-	  "--suppress=nullPointerRedundantCheck"
-	  (concat "--suppressions-list=" (expand-file-name
-			       (concat directory-of-current-dir-locals-file "util/suppressions.txt")))
 	  (concat "-include=" (expand-file-name
 			       (concat directory-of-current-dir-locals-file "config.h")))
 	  )
@@ -1,15 +0,0 @@
-name: 'Lock down mirror repository'
-
-on:
-  issues:
-    types: opened
-  pull_request:
-    types: opened
-
-jobs:
-  lockdown:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: dessant/repo-lockdown@v2
-        with:
-          github-token: ${{ github.token }}
@@ -39,6 +39,7 @@ __pycache__/
 /depcomp
 /install-sh
 /isc-config.sh
+/libltdl/*
 /libtool
 /ltmain.sh
 /m4/libtool.m4
@@ -56,45 +57,13 @@ Makefile
 Makefile.in
 ans.run
 gen.dSYM/
+kyua.log
 named.memstats
 named.run
 timestamp
 /compile_commands.json
-# Gets generated by Build Ear (bear)
-/compile_commands.commands.json
 /cppcheck_html/
 /cppcheck.results
 /tsan
 /util/check-make-install
 /INSTALL
-doc/man/dnssec-cds.8in
-doc/man/dnssec-checkds.8in
-doc/man/dnssec-coverage.8in
-doc/man/dnssec-dsfromkey.8in
-doc/man/dnssec-importkey.8in
-doc/man/dnssec-keyfromlabel.8in
-doc/man/dnssec-keygen.8in
-doc/man/dnssec-keymgr.8in
-doc/man/dnssec-revoke.8in
-doc/man/dnssec-settime.8in
-doc/man/dnssec-signzone.8in
-doc/man/dnssec-verify.8in
-doc/man/named-checkconf.8in
-doc/man/named-checkzone.8in
-doc/man/named-journalprint.8in
-doc/man/named-nzd2nzf.8in
-doc/man/nsec3hash.8in
-doc/man/pkcs11-destroy.8in
-doc/man/pkcs11-keygen.8in
-doc/man/pkcs11-list.8in
-doc/man/pkcs11-tokens.8in
-# clangd index directory
-/\.cache/
-# GNU Global index files
-/GPATH
-/GRTAGS
-/GTAGS
-# Emacs specific files
-\.dir-locals-2.el
-/emacs.desktop
-/emacs.desktop-lock
@@ -1,33 +0,0 @@
-<!--
-THIS ISSUE TEMPLATE IS INTENDED ONLY FOR INTERNAL USE.
-
-If the bug you are reporting is potentially security-related - for example,
-if it involves an assertion failure or other crash in `named` that can be
-triggered repeatedly - then please do *NOT* report it here, but send an
-email to [security-officer@isc.org](security-officer@isc.org).
-->
-
-### CVE-specific actions
-
-  - [ ] Assign a CVE identifier
-  - [ ] Determine CVSS score
-  - [ ] Determine the range of BIND versions affected (including the Subscription Edition)
-  - [ ] Determine whether workarounds for the problem exists
-  - [ ] Create a draft of the security advisory and put the information above in there
-  - [ ] Prepare a detailed description of the problem which should include the following by default:
-      - instructions for reproducing the problem (a system test is good enough)
-      - explanation of code flow which triggers the problem (a system test is *not* good enough)
-  - [ ] Prepare a private merge request containing the following items in separate commits:
-      - a test for the issue (may be moved to a separate merge request for deferred merging)
-      - a fix for the issue
-      - documentation updates (`CHANGES`, release notes, anything else applicable)
-  - [ ] Ensure the merge request from the previous step is reviewed by SWENG staff and has no outstanding discussions
-  - [ ] Ensure the documentation changes introduced by the merge request addressing the problem are reviewed by Support and Marketing staff
-  - [ ] Prepare backports of the merge request addressing the problem for all affected (and still maintained) BIND branches (backporting might affect the issue's scope and/or description)
-  - [ ] Prepare a standalone patch for the last stable release of each affected (and still maintained) BIND branch
-
-### Release-specific actions
-
-  - [ ] Create/update the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
-  - [ ] Ensure the merge requests containing CVE fixes are merged into `security-*` branches in CVE identifier order
@@ -6,26 +6,6 @@

 **Public Release:**

-## Documentation Review Links
-
-**Closed issues assigned to the milestone without a release note:**
-
- - []()
- - []()
- - []()
-
-**Merge requests merged into the milestone without a release note:**
-
- - []()
- - []()
- - []()
-
-**Merge requests merged into the milestone without a `CHANGES` entry:**
-
- - []()
- - []()
- - []()
-
 ## Release Checklist

 ### Before the Code Freeze
@@ -41,17 +21,20 @@

 - [ ] ***(QA)*** Look for outstanding documentation issues (e.g. `CHANGES` mistakes) and address them if any are found.
 - [ ] ***(QA)*** Ensure release notes are correct, ask Support and Marketing to check them as well.
- - [ ] ***(QA)*** Update API files for libraries with new version information.
- - [ ] ***(QA)*** Change software version and library versions in `configure.ac` (new major release only).
- - [ ] ***(QA)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
- - [ ] ***(QA)*** Update `CHANGES`.
- - [ ] ***(QA)*** Update `CHANGES.SE` (Subscription Edition only).
- - [ ] ***(QA)*** Update `README.md`.
- - [ ] ***(QA)*** Update `version`.
- - [ ] ***(QA)*** Build documentation on `docs.isc.org`.
+ - [ ] ***(Support)*** Check release notes, ask QA to correct any mistakes found.
+ - [ ] ***(Marketing)*** Check release notes, ask QA to correct any mistakes found.
+ - [ ] ***(SwEng)*** Update API files for libraries with new version information.
+ - [ ] ***(SwEng)*** Change software version and library versions in `configure.ac` (new major release only).
+ - [ ] ***(SwEng)*** Rebuild `configure` using Autoconf on `docs.isc.org`.
+ - [ ] ***(SwEng)*** Update `CHANGES`.
+ - [ ] ***(SwEng)*** Update `CHANGES.SE` (Subscription Edition only).
+ - [ ] ***(SwEng)*** Update `README.md`.
+ - [ ] ***(SwEng)*** Update `version`.
+ - [ ] ***(SwEng)*** Build documentation on `docs.isc.org`.
+ - [ ] ***(QA)*** Check that all the above steps were performed correctly.
 - [ ] ***(QA)*** Check that the formatting is correct for text, PDF, and HTML versions of release notes.
- - [ ] ***(QA)*** Check that the formatting of the generated man pages is correct.
- - [ ] ***(QA)*** Tag the releases in the private repository (`git tag -s -m "BIND 9.x.y" v9_x_y`).
+ - [ ] ***(SwEng)*** Tag the releases[^2].  (Tags may only be pushed to the public repository for releases which are *not* security releases.)
+ - [ ] ***(SwEng)*** If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` to allow development to continue on the maintenance branch whilst release engineering continues.

 ### Before the ASN Deadline (for ASN Releases) or the Public Release Date (for Regular Releases)

@@ -71,7 +54,6 @@
 - [ ] ***(Support)*** Publish links to downloads on ISC website.
 - [ ] ***(Support)*** Write release email to *bind-announce*.
 - [ ] ***(Support)*** Write email to *bind-users* (if a major release).
- - [ ] ***(Support)*** Send eligible customers updated links to the Subscription Edition (update the -S edition delivery tickets, even if those links were provided earlier via an ASN ticket).
 - [ ] ***(Support)*** Update tickets in case of waiting support customers.
 - [ ] ***(QA)*** Build and test any outstanding private packages.
 - [ ] ***(QA)*** Build public packages (`*.deb`, RPMs).
@@ -81,13 +63,13 @@
 - [ ] ***(Marketing)*** Update [Wikipedia entry for BIND](https://en.wikipedia.org/wiki/BIND).
 - [ ] ***(Marketing)*** Write blog article (if a major release).
 - [ ] ***(QA)*** Ensure all new tags are annotated and signed.
- - [ ] ***(QA)*** Push tags for the published releases to the public repository.
- - [ ] ***(QA)*** Merge the automatically prepared `prep 9.x.y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_x`).
+ - [ ] ***(SwEng)*** Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`).
+ - [ ] ***(SwEng)*** Push tags for the published releases to the public repository.
 - [ ] ***(QA)*** For each maintained branch, update the `BIND_BASELINE_VERSION` variable for the `abi-check` job in `.gitlab-ci.yml` to the latest published BIND version tag for a given branch.
 - [ ] ***(QA)*** Prepare empty release notes for the next set of releases.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to the current release milestone and do not describe a security vulnerability, then make them public.
- - [ ] ***(QA)*** Sanitize confidential issues which are assigned to older release milestones and describe security vulnerabilities, then make them public if appropriate[^2].
+ - [ ] ***(QA)*** Sanitize all confidential issues assigned to the release milestone and make them public.
 - [ ] ***(QA)*** Update QA tools used in GitLab CI (e.g. Flake8, PyLint) by modifying the relevant `Dockerfile`.

 [^1]: If not, use the time remaining until the tagging deadline to ensure all outstanding issues are either resolved or moved to a different milestone.
-[^2]: As a rule of thumb, security vulnerabilities which have reproducers merged to the public repository are considered okay for full disclosure.
+
+[^2]: Preferred command line: `git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]`, where `[alphatag]` is an optional string such as `b1`, `rc1`, etc.
@@ -13,7 +13,6 @@ extraction:
      - "libidn2-dev"
      - "libmaxminddb-dev"
      - "libuv1-dev"
-      - "libnghttp2-dev"
    configure:
      command:
      - "autoreconf -fi"
@@ -30,6 +29,7 @@ path_classifiers:
    - "**/*.5"
    - "**/*.8"
 queries:
+  - exclude: libltdl/
  - exclude: fuzz/
  - exclude: "bin/tests/system/*/ans*/*.py"
  - exclude: cpp/use-of-goto
@@ -5,4 +5,3 @@ disable=
    C0116, # missing-function-docstring
    R0801, # duplicate-code
    C0103, # invalid-name
-    C0415,# import-outside-toplevel
@@ -1,631 +1,3 @@
-5652.	[bug]		Copy and paste error caused the socket option to
-			be enabled instead of disabled. [GL #2746]
-
-5651.	[func]		Refactor zone dumping to be processed asynchronously
-			via the uv_work_t thread pool API. [GL #2732]
-
-5650.	[bug]		Prevent a crash that could occur if serve-stale
-			was enabled and a prefetch was triggered during a
-			query restart. [GL #2733]
-
-5649.	[bug]		If a query was answered with stale data on a server
-			with DNS64 enabled, an assertion could occur if a
-			non-stale answer arrived afterward. [GL #2731]
-
-5648.	[bug]		The calculation of the estimated IXFR transaction
-			size by dns_journal_iter_init() was invalid. [GL #2685]
-
-5647.	[func]		The interfacemgr has been refactored to use fewer
-			clientmgr objects, which in turn use fewer memory
-			contexts and tasks.  This should result in less
-			fragmented memory and better startup performance.
-			[GL #2433]
-
-5646.	[bug]		The default TCP timeout for rndc has been increased
-			to 60 seconds. This was its original value, but it
-			had been inadvertently lowered to 10. [GL #2643]
-
-5645.	[cleanup]	Remove the rarely-used dns_name_copy() function
-			and rename dns_name_copynf() to dns_name_copy().
-			[GL !5081]
-
-5644.	[bug]		Fix a race condition in reading and writing key files
-			for KASP zones in multiple views. [GL #1875]
-
-5643.	[placeholder]
-
-5642.	[bug]		Check "key-directory" conflicts in "named.conf" for
-			zones in multiple views with different "dnssec-policy".
-			[GL #2463].
-
-5641.	[bug]		Address potential memory leak in dst_key_fromnamedfile.
-			[GL #2689]
-
-5640.	[func]		Add new configuration option to set the operating system
-			receive and send buffers. [GL #2313]
-
-5639.	[bug]		Check that the first and last SOA record of an AXFR
-			are consistent. [GL #2528]
-
-	--- 9.17.13 released ---
-
-5638.	[bug]		Improvements related to network manager/task manager
-			integration:
-			- isc_managers_create() and isc_managers_destroy()
-			  functions were added to handle setup and teardown of
-			  netmgr, taskmgr, timermgr, and socketmgr, since these
-			  require a precise order of operations now.
-			- Event queue processing is now quantized to prevent
-			  infinite looping.
-			- The netmgr can now be paused from within a netmgr
-			  thread.
-			- Deadlocks due to a conflict between netmgr's
-			  pause/resume and listen/stoplistening operations were
-			  fixed.
-			[GL #2654]
-
-5637.	[placeholder]
-
-5636.	[bug]		named and named-checkconf did not report an error when
-			multiple zones with the "dnssec-policy" option set were
-			using the same zone file. This has been fixed.
-			[GL #2603]
-
-5635.	[bug]		Journal compaction could fail when a journal with
-			invalid transaction headers was not detected at startup.
-			This has been fixed. [GL #2670]
-
-5634.	[bug]		If "dnssec-policy" was active and a private key file was
-			temporarily offline during a rekey event, named could
-			incorrectly introduce replacement keys and break a
-			signed zone. This has been fixed. [GL #2596]
-
-5633.	[doc]		The "inline-signing" option was incorrectly described as
-			being inherited from the "options"/"view" levels and was
-			incorrectly accepted at those levels without effect.
-			This has been fixed. [GL #2536]
-
-5632.	[func]		Add a new built-in KASP, "insecure", which is used to
-			transition a zone from a signed to an unsigned state.
-			The existing built-in KASP "none" should no longer be
-			used to unsign a zone. [GL #2645]
-
-5631.	[protocol]	Update the implementation of the ZONEMD RR type to match
-			RFC 8976. [GL #2658]
-
-5630.	[func]		Treat DNSSEC responses containing NSEC3 records with
-			iteration counts greater than 150 as insecure.
-			[GL #2445]
-
-5629.	[func]		Reduce the maximum supported number of NSEC3 iterations
-			that can be configured for a zone to 150. [GL #2642]
-
-5628.	[bug]		Host and nslookup could crash upon receiving a SERVFAIL
-			response. This has been fixed. [GL #2564]
-
-5627.	[bug]		RRSIG(SOA) RRsets placed anywhere other than at the zone
-			apex were triggering infinite resigning loops. This has
-			been fixed. [GL #2650]
-
-5626.	[bug]		When generating zone signing keys, KASP now also checks
-			for key ID conflicts among newly created keys, rather
-			than just between new and existing ones. [GL #2628]
-
-5625.	[bug]		A deadlock could occur when multiple "rndc addzone",
-			"rndc delzone", and/or "rndc modzone" commands were
-			invoked simultaneously for different zones. This has
-			been fixed. [GL #2626]
-
-5624.	[func]		Task manager events are now processed inside network
-			manager loops. The task manager no longer needs its own
-			set of worker threads, which improves resolver
-			performance. [GL #2638]
-
-5623.	[bug]		When named was shut down during an ongoing zone
-			transfer, xfrin_fail() could incorrectly be called
-			twice. This has been fixed. [GL #2630]
-
-5622.	[cleanup]	The lib/samples/ directory has been removed, as export
-			versions of libraries are no longer maintained.
-			[GL !4835]
-
-5621.	[placeholder]
-
-5620.	[bug]		If zone journal files written by BIND 9.16.11 or earlier
-			were present when BIND was upgraded, the zone file for
-			that zone could have been inadvertently rewritten with
-			the current zone contents. This caused the original zone
-			file structure (e.g. comments, $INCLUDE directives) to
-			be lost, although the zone data itself was preserved.
-			This has been fixed. [GL #2623]
-
-5619.	[protocol]	Implement draft-vandijk-dnsop-nsec-ttl, updating the
-			protocol such that NSEC(3) TTL values are set to the
-			minimum of the SOA MINIMUM value or the SOA TTL.
-			[GL #2347]
-
-5618.	[bug]		Change 5149 introduced some inconsistencies in the way
-			record TTLs were presented in cache dumps. These
-			inconsistencies have been eliminated. [GL #389]
-			[GL #2289]
-
-	--- 9.17.12 released ---
-
-5617.	[placeholder]
-
-5616.	[security]	named crashed when a DNAME record placed in the ANSWER
-			section during DNAME chasing turned out to be the final
-			answer to a client query. (CVE-2021-25215) [GL #2540]
-
-5615.	[security]	Insufficient IXFR checks could result in named serving a
-			zone without an SOA record at the apex, leading to a
-			RUNTIME_CHECK assertion failure when the zone was
-			subsequently refreshed. This has been fixed by adding an
-			owner name check for all SOA records which are included
-			in a zone transfer. (CVE-2021-25214) [GL #2467]
-
-5614.	[bug]		Ensure all resources are properly cleaned up when a call
-			to gss_accept_sec_context() fails. [GL #2620]
-
-5613.	[bug]		It was possible to write an invalid transaction header
-			in the journal file for a managed-keys database after
-			upgrading. This has been fixed. Invalid headers in
-			existing journal files are detected and named is able
-			to recover from them. [GL #2600]
-
-5612.	[bug]		Continued refactoring of the network manager:
-			- allow recovery from read and connect timeout events,
-			- ensure that calls to isc_nm_*connect() always
-			  return the connection status via a callback
-			  function.
-			[GL #2401]
-
-5611.	[func]		Set "stale-answer-client-timeout" to "off" by default.
-			[GL #2608]
-
-5610.	[bug]		Prevent a crash which could happen when a lookup
-			triggered by "stale-answer-client-timeout" was attempted
-			right after recursion for a client query finished.
-			[GL #2594]
-
-5609.	[func]		The ISC implementation of SPNEGO was removed from BIND 9
-			source code. It was no longer necessary as all major
-			contemporary Kerberos/GSSAPI libraries include support
-			for SPNEGO. [GL #2607]
-
-5608.	[bug]		When sending queries over TCP, dig now properly handles
-			"+tries=1 +retry=0" by not retrying the connection when
-			the remote server closes the connection prematurely.
-			[GL #2490]
-
-5607.	[bug]		As "rndc dnssec -checkds" and "rndc dnssec -rollover"
-			commands may affect the next scheduled key event,
-			reconfiguration of zone keys is now triggered after
-			receiving either of these commands to prevent
-			unnecessary key rollover delays. [GL #2488]
-
-5606.	[bug]		CDS/CDNSKEY DELETE records are now removed when a zone
-			transitions from a secure to an insecure state.
-			named-checkzone also no longer reports an error when
-			such records are found in an unsigned zone. [GL #2517]
-
-5605.	[bug]		"dig -u" now uses the CLOCK_REALTIME clock source for
-			more accurate time reporting. [GL #2592]
-
-5604.	[experimental]	A "filter-a.so" plugin, which is similar to the
-			"filter-aaaa.so" plugin but which omits A records
-			instead of AAAA records, has been added. Thanks to
-			GitLab user @treysis. [GL #2585]
-
-5603.	[placeholder]
-
-5602.	[bug]		Fix TCPDNS and TLSDNS timers in Network Manager. This
-			makes the "tcp-initial-timeout" and "tcp-idle-timeout"
-			options work correctly again. [GL #2583]
-
-5601.	[bug]		Zones using KASP could not be thawed after they were
-			frozen using "rndc freeze". This has been fixed.
-			[GL #2523]
-
-5600.	[bug]		Send a full certificate chain instead of just the leaf
-			certificate to DNS-over-TLS (DoT) and DNS-over-HTTPS
-			(DoH) clients. This makes BIND 9 DoT/DoH servers
-			compatible with a broader set of clients. [GL #2514]
-
-5599.	[bug]		Fix a named crash which occurred after skipping a
-			primary server while transferring a zone over TLS.
-			[GL #2562]
-
-5598.	[port]		Silence -Wchar-subscripts compiler warnings triggered on
-			some platforms due to calling character classification
-			functions declared in the <ctype.h> header with
-			arguments of type char. [GL #2567]
-
-	--- 9.17.11 released ---
-
-5597.	[bug]		When serve-stale was enabled and starting the recursive
-			resolution process for a query failed, a named instance
-			could crash if it was configured as both a recursive and
-			authoritative server. This problem was introduced by
-			change 5573 and has now been fixed. [GL #2565]
-
-5596.	[func]		Client-side support for DNS-over-HTTPS (DoH) has been
-			added to dig. "dig +https" can now query a server via
-			HTTP/2. [GL #1641]
-
-5595.	[cleanup]	Public header files for BIND 9 libraries no longer
-			directly include third-party library headers. This
-			prevents the need to include paths to third-party header
-			files in CFLAGS whenever BIND 9 public header files are
-			used, which could cause build-time issues on hosts with
-			older versions of BIND 9 installed. [GL #2357]
-
-5594.	[bug]		Building with --enable-dnsrps --enable-dnsrps-dl failed.
-			[GL #2298]
-
-5593.	[bug]		Journal files written by older versions of named can now
-			be read when loading zones, so that journal
-			incompatibility does not cause problems on upgrade.
-			Outdated journals are updated to the new format after
-			loading. [GL #2505]
-
-5592.	[bug]		Prevent hazard pointer table overflows on machines with
-			many cores, by allowing the thread IDs (serving as
-			indices into hazard pointer tables) of finished threads
-			to be reused by those created later. [GL #2396]
-
-5591.	[bug]		Fix a crash that occurred when
-			"stale-answer-client-timeout" was triggered without any
-			(stale) data available in the cache to answer the query.
-			[GL #2503]
-
-5590.	[bug]		NSEC3 records were not immediately created for dynamic
-			zones using NSEC3 with "dnssec-policy", resulting in
-			such zones going bogus. Add code to process the
-			NSEC3PARAM queue at zone load time so that NSEC3 records
-			for such zones are created immediately. [GL #2498]
-
-5589.	[placeholder]
-
-5588.	[func]		Add a new "purge-keys" option for "dnssec-policy". This
-			option determines the period of time for which key files
-			are retained after they become obsolete. [GL #2408]
-
-5587.	[bug]		A standalone libtool script no longer needs to be
-			present in PATH to build BIND 9 from a source tarball
-			prepared using "make dist". [GL #2504]
-
-5586.	[bug]		An invalid direction field in a LOC record resulted in
-			an INSIST failure when a zone file containing such a
-			record was loaded. [GL #2499]
-
-5585.	[func]		Memory contexts and memory pool implementations were
-			refactored to reduce lock contention for shared memory
-			contexts by replacing mutexes with atomic operations.
-			The internal memory allocator was simplified so that it
-			is only a thin wrapper around the system allocator. This
-			change made the "-M external" named option redundant and
-			it was therefore removed. [GL #2433]
-
-5584.	[bug]		No longer set the IP_DONTFRAG option on UDP sockets, to
-			prevent dropping outgoing packets exceeding
-			"max-udp-size". [GL #2466]
-
-5583.	[func]		Changes to DNS-over-HTTPS (DoH) configuration syntax:
-			- When "http" is specified in "listen-on" or
-			  "listen-on-v6" statements, "tls" must also now be
-			  specified. If an unencrypted connection is desired
-			  (for example, when running behind a reverse proxy),
-			  use "tls none".
-			- "http default" can now be specified in "listen-on" and
-			  "listen-on-v6" statements to use the default HTTP
-			  endpoint of "/dns-query". It is no longer necessary to
-			  include an "http" statement in named.conf unless
-			  overriding this value.
-			[GL #2472]
-
-5582.	[bug]		BIND 9 failed to build when static OpenSSL libraries
-			were used and the pkg-config files for libssl and/or
-			libcrypto were unavailable. This has been fixed by
-			ensuring that the correct linking order for libssl and
-			libcrypto is always used. [GL #2402]
-
-5581.	[bug]		Fix a memory leak that occurred when inline-signed zones
-			were added to the configuration, followed by a
-			reconfiguration of named. [GL #2041]
-
-5580.	[test]		The system test framework no longer differentiates
-			between SKIPPED and UNTESTED system test results. Any
-			system test which is not run is now marked as SKIPPED.
-			[GL !4517]
-
-5579.	[bug]		If an invalid key name (e.g. "a..b") was specified in a
-			primaries list in named.conf, the wrong size was passed
-			to isc_mem_put(), resulting in the returned memory being
-			put on the wrong free list. This prevented named from
-			starting up. [GL #2460]
-
-	--- 9.17.10 released ---
-
-5578.	[protocol]	Make "check-names" accept A records below "_spf",
-			"_spf_rate", and "_spf_verify" labels in order to cater
-			for the "exists" SPF mechanism specified in RFC 7208
-			section 5.7 and appendix D.1. [GL #2377]
-
-5577.	[bug]		Fix the "three is a crowd" key rollover bug in KASP by
-			correctly implementing Equation (2) of the "Flexible and
-			Robust Key Rollover" paper. [GL #2375]
-
-5576.	[experimental]	Initial server-side implementation of DNS-over-HTTPS
-			(DoH). Support for both TLS-encrypted and unencrypted
-			HTTP/2 connections has been added to the network manager
-			and integrated into named. (Note: there is currently no
-			client-side support for DNS-over-HTTPS; this will be
-			added to dig in a future release.) [GL #1144]
-
-5575.	[bug]		When migrating to KASP, BIND 9 considered keys with the
-			"Inactive" and/or "Delete" timing metadata to be
-			possible active keys. This has been fixed. [GL #2406]
-
-5574.	[func]		Incoming zone transfers can now use TLS. Addresses in a
-			"primaries" list take an optional "tls" argument,
-			specifying either a previously configured "tls" block or
-			"ephemeral"; SOA queries and zone transfer requests are
-			then sent via TLS. [GL #2392]
-
-5573.	[func]		When serve-stale is enabled and stale data is available,
-			named now returns stale answers upon encountering any
-			unexpected error in the query resolution process.
-			However, the "stale-refresh-time" window is still only
-			started upon a timeout. [GL #2434]
-
-5572.	[bug]		Address potential double free in generatexml().
-			[GL #2420]
-
-5571.	[bug]		named failed to start when its configuration included a
-			zone with a non-builtin "allow-update" ACL attached.
-			[GL #2413]
-
-5570.	[bug]		Improve performance of the DNSSEC verification code by
-			reducing the number of repeated calls to
-			dns_dnssec_keyfromrdata(). [GL #2073]
-
-5569.	[bug]		Emit useful error message when "rndc retransfer" is
-			applied to a zone of inappropriate type. [GL #2342]
-
-5568.	[bug]		Fixed a crash in "dnssec-keyfromlabel" when using ECDSA
-			keys. [GL #2178]
-
-5567.	[bug]		Dig now reports unknown dash options while pre-parsing
-			the options. This prevents "-multi" instead of "+multi"
-			from reporting memory usage before ending option parsing
-			with "Invalid option: -lti". [GL #2403]
-
-5566.	[func]		Add "stale-answer-client-timeout" option, which is the
-			amount of time a recursive resolver waits before
-			attempting to answer the query using stale data from
-			cache. [GL #2247]
-
-5565.	[func]		The SONAMEs for BIND 9 libraries now include the current
-			BIND 9 version number, in an effort to tightly couple
-			internal libraries with a specific release. [GL #2387]
-
-5564.	[cleanup]	Network manager's TLSDNS module was refactored to use
-			libuv and libssl directly instead of a stack of TCP/TLS
-			sockets. [GL #2335]
-
-5563.	[cleanup]	Changed several obsolete configuration options to
-			ancient, making them fatal errors. Also cleaned up the
-			number of clause flags in the configuration parser.
-			[GL #1086]
-
-5562.	[placeholder]
-
-5561.	[bug]		KASP incorrectly set signature validity to the value of
-			the DNSKEY signature validity. This is now fixed.
-			[GL #2383]
-
-5560.	[func]		The default value of "max-stale-ttl" has been changed
-			from 12 hours to 1 day and the default value of
-			"stale-answer-ttl" has been changed from 1 second to 30
-			seconds, following RFC 8767 recommendations. [GL #2248]
-
-	--- 9.17.9 released ---
-
-5559.	[bug]		The --with-maxminddb=PATH form of the build-time option
-			enabling support for libmaxminddb was not working
-			correctly. This has been fixed. [GL #2366]
-
-5558.	[bug]		Asynchronous hook modules could trigger an assertion
-			failure when the fetch handle was detached too late.
-			Thanks to Jinmei Tatuya at Infoblox. [GL #2379]
-
-5557.	[bug]		Prevent RBTDB instances from being destroyed by multiple
-			threads at the same time. [GL #2317]
-
-5556.	[bug]		Further tweak newline printing in dnssec-signzone and
-			dnssec-verify. [GL #2359]
-
-5555.	[placeholder]
-
-5554.	[bug]		dnssec-signzone and dnssec-verify were missing newlines
-			between log messages. [GL #2359]
-
-5553.	[bug]		When reconfiguring named, removing "auto-dnssec" did not
-			turn off DNSSEC maintenance. [GL #2341]
-
-5552.	[func]		When switching to "dnssec-policy none;", named now
-			permits a safe transition to insecure mode and publishes
-			the CDS and CDNSKEY DELETE records, as described in RFC
-			8078. [GL #1750]
-
-5551.	[bug]		named no longer attempts to assign threads to CPUs
-			outside the CPU affinity set. Thanks to Ole Bjørn
-			Hessen. [GL #2245]
-
-5550.	[func]		dnssec-signzone and named now log a warning when falling
-			back to the "increment" SOA serial method. [GL #2058]
-
-5549.	[protocol]	ipv4only.arpa is now served when DNS64 is configured.
-			[GL #385]
-
-5548.	[placeholder]
-
-5547.	[placeholder]
-
-	--- 9.17.8 released ---
-
-5546.	[placeholder]
-
-5545.	[func]		OS support for load-balanced sockets is no longer
-			required to receive incoming queries in multiple netmgr
-			threads. [GL #2137]
-
-5544.	[func]		Restore the default value of "nocookie-udp-size" to 4096
-			bytes. [GL #2250]
-
-5543.	[bug]		Fix UDP performance issues caused by making netmgr
-			callbacks asynchronous-only. [GL #2320]
-
-5542.	[bug]		Refactor netmgr. [GL #1920] [GL #2034] [GL #2061]
-			[GL #2194] [GL #2221] [GL #2266] [GL #2283] [GL #2318]
-			[GL #2321]
-
-5541.	[func]		Adjust the "max-recursion-queries" default from 75 to
-			100. [GL #2305]
-
-5540.	[port]		Fix building with native PKCS#11 support for AEP Keyper.
-			[GL #2315]
-
-5539.	[bug]		Tighten handling of missing DNS COOKIE responses over
-			UDP by falling back to TCP. [GL #2275]
-
-5538.	[func]		Add NSEC3 support to KASP. A new option for
-			"dnssec-policy", "nsec3param", can be used to set the
-			desired NSEC3 parameters. NSEC3 salt collisions are
-			automatically prevented during resalting. Salt
-			generation is now logged with zone context. [GL #1620]
-
-5537.	[func]		The query plugin mechanism has been extended
-			to support asynchronous operations. For example, a
-			plugin can now trigger recursion and resume
-			processing when it is complete. Thanks to Jinmei
-			Tatuya at Infoblox. [GL #2141]
-
-5536.	[func]		Dig can now report the DNS64 prefixes in use
-			(+dns64prefix). [GL #1154]
-
-5535.	[bug]		dig/nslookup/host could crash on shutdown after an
-			interrupt. [GL #2287] [GL #2288]
-
-5534.	[bug]		The CNAME synthesized from a DNAME was incorrectly
-			followed when the QTYPE was CNAME or ANY. [GL #2280]
-
-	--- 9.17.7 released ---
-
-5533.	[func]		Add the "stale-refresh-time" option, a time window that
-			starts after a failed lookup, during which a stale RRset
-			is served directly from cache before a new attempt to
-			refresh it is made. [GL #2066]
-
-5532.	[cleanup]	Unused header files were removed:
-			bin/rndc/include/rndc/os.h, lib/isc/timer_p.h,
-			lib/isccfg/include/isccfg/dnsconf.h and code related
-			to those files. [GL #1913]
-
-5531.	[func]		Add support for DNS over TLS (DoT) to dig and named.
-			dig output now includes the transport protocol used.
-			[GL #1816] [GL #1840]
-
-5530.	[bug]		dnstap did not capture responses to forwarded UPDATE
-			requests. [GL #2252]
-
-5529.	[func]		The network manager API is now used by named to send
-			zone transfer requests. [GL #2016]
-
-5528.	[func]		Convert dig, host, and nslookup to use the network
-			manager API. As a side effect of this change, "dig
-			+unexpected" no longer works, and has been disabled.
-			[GL #2140]
-
-5527.	[bug]		A NULL pointer dereference occurred when creating an NTA
-			recheck query failed. [GL #2244]
-
-5526.	[bug]		Fix a race/NULL dereference in TCPDNS read. [GL #2227]
-
-5525.	[placeholder]
-
-5524.	[func]		Added functionality to the network manager to support
-			outgoing DNS queries in addition to incoming ones.
-			[GL #2235]
-
-5523.	[bug]		The initial lookup in a zone transitioning to/from a
-			signed state could fail if the DNSKEY RRset was not
-			found. [GL #2236]
-
-5522.	[bug]		Fixed a race/NULL dereference in TCPDNS send. [GL #2227]
-
-5521.	[func]		All use of libltdl was dropped. libuv's shared library
-			handling interface is now used instead. [GL !4278]
-
-5520.	[bug]		Fixed a number of shutdown races, reference counting
-			errors, and spurious log messages that could occur
-			in the network manager. [GL #2221]
-
-5519.	[cleanup]	Unused source code was removed: lib/dns/dbtable.c,
-			lib/dns/portlist.c, lib/isc/bufferlist.c, and code
-			related to those files. [GL #2060]
-
-5518.	[bug]		Stub zones now work correctly with primary servers using
-			"minimal-responses yes". [GL #1736]
-
-5517.	[bug]		Do not treat UV_EOF as a TCP4RecvErr or a TCP6RecvErr.
-			[GL #2208]
-
-	--- 9.17.6 released ---
-
-5516.	[func]		The default EDNS buffer size has been changed from 4096
-			to 1232 bytes, the EDNS buffer size probing has been
-			removed, and named now sets the DF (Don't Fragment) flag
-			on outgoing UDP packets. [GL #2183]
-
-5515.	[func]		Add 'rndc dnssec -rollover' command to trigger a manual
-			rollover for a specific key. [GL #1749]
-
-5514.	[bug]		Fix KASP expected key size for Ed25519 and Ed448.
-			[GL #2171]
-
-5513.	[doc]		The ARM section describing the "rrset-order" statement
-			was rewritten to make it unambiguous and up-to-date with
-			the source code. [GL #2139]
-
-5512.	[bug]		"rrset-order" rules using "order none" were causing
-			named to crash despite named-checkconf treating them as
-			valid. [GL #2139]
-
-5511.	[bug]		'dig -u +yaml' failed to display timestamps to the
-			microsecond. [GL #2190]
-
-5510.	[bug]		Implement the attach/detach semantics for dns_message_t
-			to fix a data race in accessing an already-destroyed
-			fctx->rmessage. [GL #2124]
-
-5509.	[bug]		filter-aaaa: named crashed upon shutdown if it was in
-			the process of recursing for A RRsets. [GL #1040]
-
-5508.	[func]		Added new parameter "-expired" for "rndc dumpdb" that
-			also prints expired RRsets (awaiting cleanup) to the
-			dump file. [GL #1870]
-
-5507.	[bug]		Named could compute incorrect SIG(0) responses.
-			[GL #2109]
-
-5506.	[bug]		Properly handle failed sysconf() calls, so we don't
-			report invalid memory size. [GL #2166]
-
-5505.	[bug]		Updating contents of a mixed-case RPZ could cause some
-			rules to be ignored. [GL #2169]
-
 5504.	[func]		The "glue-cache" option has been marked as deprecated.
 			The glue cache feature will be permanently enabled in a
 			future release. [GL #2146]
@@ -634,8 +6,6 @@
 			handles, now using isc_nmhandle_attach() and _detach()
 			instead of _ref() and _unref(). [GL #2122]

-	--- 9.17.5 released ---
-
 5502.	[func]		'dig +bufsize=0' no longer disables EDNS. [GL #2054]

 5501.	[func]		Log CDS/CDNSKEY publication. [GL #1748]
@@ -644,53 +14,53 @@
 			[GL #2103]

 5499.	[func]		Add '-P ds' and '-D ds' arguments to dnssec-settime.
-			[GL #1748]

 5498.	[test]		The --with-gperftools-profiler configure option was
 			removed. [GL !4045]

 5497.	[placeholder]

-5496.	[bug]		Address a TSAN report by ensuring each rate limiter
-			object holds a reference to its task. [GL #2081]
+5496.	[bug]		The rate limiter needs to hold a reference to its task.
+			[GL #2081]

 5495.	[bug]		With query minimization enabled, named failed to
-			resolve ip6.arpa. names that had extra labels to the
-			left of the IPv6 part. [GL #1847]
+			resolve ip6.arpa. names that had more labels after the
+			IPv6 part. [GL #1847]

 5494.	[bug]		Silence the EPROTO syslog message on older systems.
 			[GL #1928]

-5493.	[bug]		Fix off-by-one error when calculating new hash table
+5493.	[bug]		Fix off-by-one error when calculating new hashtable
 			size. [GL #2104]

-5492.	[bug]		Tighten LOC parsing to reject a period (".") and/or "m"
-			as a value. Fix handling of negative altitudes which are
-			not whole meters. [GL #2074]
+5492.	[bug]		Tighten LOC parsing to reject period and/or m as a
+			value.  Correct handling of negative altitudes which
+			are not whole metres.  [GL #2074]

 5491.	[bug]		rbtversion->glue_table_size could be read without the
 			appropriate lock being held. [GL #2080]

-5490.	[func]		Refactor readline support to use pkg-config and add
-			support for the editline library. [GL !3942]
+5490.	[func]		Refactor the readline support to use pkg-config and
+			add support for editline library. [GL !3942]

-5489.	[bug]		Named erroneously accepted certain invalid resource
-			records that were incorrectly processed after
-			subsequently being written to disk and loaded back, as
-			the wire format differed. Such records include: CERT,
+5489.	[bug]		Named failed to reject some invalid records resulting
+			in records that, after being printed, could not be
+			loaded or would result in DNSSEC validation failures
+			when re-read from zone files as the wire format
+			differed.  The covered records records are: CERT,
 			IPSECKEY, NSEC3, NSEC3PARAM, NXT, SIG, TLSA, WKS, and
 			X25. [GL !3953]

-5488.	[bug]		NTA code needed to have a weak reference on its
-			associated view to prevent the latter from being deleted
-			while NTA tests were being performed. [GL #2067]
+5488.	[bug]		nta needed to have a weak reference on view to prevent
+			the view being deleted while nta tests are being
+			performed. [GL #2067]

 5487.	[cleanup]	Update managed keys log messages to be less confusing.
 			[GL #2027]

-5486.	[func]		Add 'rndc dnssec -checkds' command, which signals to
-			named that the DS record for a given zone or key has
-			been updated in the parent zone. [GL #1613]
+5486.	[func]		Add 'rndc dnssec -checkds' command to tell named
+			that the DS record has been published in the parent.
+			[GL #1613]

 	--- 9.17.4 released ---

@@ -7,8 +7,8 @@ people.

 Diversity is one of our huge strengths, but it can also lead to communication
 issues and unhappiness. To that end, we have a few ground rules that we ask
-people to adhere to. This code applies equally to the core development team,
-open source contributors and those seeking help and guidance.
+people to adhere to. This code applies equally to the core development team, open source contributors and those
+seeking help and guidance.

 This isn't an exhaustive list of things that you can't do. Rather, take it in
 the spirit in which it's intended - a guide to make it easier to enrich all of
@@ -39,28 +39,29 @@ anyone can see the source, but only ISC employees have commit access.
 In the past, the source could only be seen once ISC had published
 a release; read access to the source repository was restricted just
 as commit access was.  That has changed, as ISC now provides a
-public git repository of the BIND source tree (see below).
+public git mirror to the BIND source tree (see below).

 At ISC, we're committed to
 building communities that are welcoming and inclusive: environments where people
 are encouraged to share ideas, treat each other with respect, and collaborate
 towards the best solutions. To reinforce our commitment, ISC
 has adopted a slightly modified version of the Django
-[Code of Conduct](https://gitlab.isc.org/isc-projects/bind9/-/blob/main/CODE_OF_CONDUCT.md)
-for the BIND 9 project, as well as for the conduct of our developers throughout
-the industry.
+[Code of Conduct](https://gitlab.isc.org/isc-projects/bind9/-/blob/master/CODE_OF_CONDUCT.md) for the BIND 9 project, as well as for the conduct of our
+developers throughout the industry.

 ### <a name="access"></a>Access to source code

 Public BIND releases are always available from the
 [ISC FTP site](ftp://ftp.isc.org/isc/bind9).

-A public-access git repository is also available at
-[https://gitlab.isc.org](https://gitlab.isc.org).  This repository
-contains all public release branches. Upcoming releases can be viewed in
-their current state at any time.  Short-lived development branches
-contain unreviewed work in progress.  Commits which address security
-vulnerablilities are withheld until after public disclosure.
+A public-access GIT repository is also available at
+[https://gitlab.isc.org](https://gitlab.isc.org).
+This repository is a mirror, updated several times per day, of the
+source repository maintained by ISC.  It contains all the public release
+branches; upcoming releases can be viewed in their current state at any
+time.  It does *not* contain development branches or unreviewed work in
+progress.  Commits which address security vulnerablilities are withheld
+until after public disclosure.

 You can browse the source online via
 [https://gitlab.isc.org/isc-projects/bind9](https://gitlab.isc.org/isc-projects/bind9)
@@ -79,7 +80,7 @@ Whenever a branch is ready for publication, a tag is placed of the
 form `v9_X_Y`.  The 9.12.0 release, for instance, is tagged as `v9_12_0`.

 The branch in which the next major release is being developed is called
-`main`.
+`master`.

 ### <a name="bugs"></a>Reporting bugs

@@ -99,7 +100,6 @@ use credentials from an existing account at GitHub, GitLab, Google,
 Twitter, or Facebook.

 ### Reporting possible security issues
-
 If you think you may be seeing a potential security vulnerability in BIND
 (for example, a crash with REQUIRE, INSIST, or ASSERT failure), please
 report it immediately by emailing to security-officer@isc.org. Plain-text
@@ -111,8 +111,7 @@ Do not discuss undisclosed security vulnerabilities on any public mailing list.
 ISC has a long history of handling reported vulnerabilities promptly and
 effectively and we respect and acknowledge responsible reporters.

-ISC's Security Vulnerability Disclosure Policy is documented at
-[https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).
+ISC's Security Vulnerability Disclosure Policy is documented at [https://kb.isc.org/docs/aa-00861](https://kb.isc.org/docs/aa-00861).

 If you have a crash, you may want to consult
 ["What to do if your BIND or DHCP server has crashed."](https://kb.isc.org/docs/aa-00340)
@@ -121,8 +120,7 @@ If you have a crash, you may want to consult

 BIND is licensed under the
 [Mozilla Public License 2.0](https://www.mozilla.org/en-US/MPL/2.0/).
-Earlier versions (BIND 9.10 and earlier) were licensed under the
-[ISC License](https://www.isc.org/licenses/)
+Earlier versions (BIND 9.10 and earlier) were licensed under the [ISC License](https://www.isc.org/licenses/)

 ISC does not require an explicit copyright assignment for patch
 contributions.  However, by submitting a patch to ISC, you implicitly
@@ -138,7 +136,7 @@ Patches for BIND may be submitted directly via merge requests in
 repository for BIND.

 Patches can also be submitted as diffs against a specific version of
-BIND -- preferably the current top of the `main` branch.  Diffs may
+BIND -- preferably the current top of the `master` branch.  Diffs may
 be generated using either `git format-patch` or `git diff`.

 Those wanting to write code for BIND may be interested in the
@@ -186,8 +184,7 @@ of documentation in the BIND source tree:
  they document, in files ending in `.rst`: for example, the
  `named` man page is `bin/named/named.rst`.
 * The *BIND 9 Administrator Reference Manual* is in the .rst files in
-  `doc/arm/`; the PDF and HTML versions are automatically generated from
-  the `.rst` files.
+  `doc/arm/`; the PDF and HTML versions are automatically generated from the `.rst` files.
 * API documentation is in the header file describing the API, in
  Doxygen-formatted comments.

@@ -1,4 +1,4 @@
-Copyright (C) 1996-2021  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2020  Internet Systems Consortium, Inc. ("ISC")

 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -367,25 +367,3 @@ distributed under the License is distributed on an "AS IS" BASIS,
 WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 See the License for the specific language governing permissions and
 limitations under the License.
-
-----------------------------------------------------------------------------
-
-Copyright Joyent, Inc. and other Node contributors. All rights reserved.
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to
-deal in the Software without restriction, including without limitation the
-rights to use, copy, modify, merge, publish, distribute, sublicense, and/or
-sell copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
-FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-IN THE SOFTWARE.
@@ -1,6 +1,6 @@
 include $(top_srcdir)/Makefile.top

-SUBDIRS = . lib doc bin fuzz
+SUBDIRS = . libltdl lib doc bin fuzz

 BUILT_SOURCES = bind.keys.h
 CLEANFILES = bind.keys.h
@@ -10,7 +10,6 @@ AM_V_SPHINX_0 = @echo "  SPHINX   $@";
 SPHINXBUILDDIR = $(builddir)/_build

 common_SPHINXOPTS =			\
-	-W				\
 	-c $(srcdir)			\
 	-a				\
 	$(SPHINX_V)
@@ -3,9 +3,8 @@

 AM_CPPFLAGS +=					\
 	$(CMOCKA_CFLAGS)			\
-	-DNAMED_PLUGINDIR=\"$(libdir)/named\"	\
-	-DSKIPPED_TEST_EXIT_CODE=77		\
-	-DTESTS_DIR=\"$(abs_srcdir)\"
+	-DTESTS_DIR=\"$(abs_srcdir)\"		\
+	-DNAMED_PLUGINDIR=\"$(libdir)/named\"

 LDADD =			\
 	$(CMOCKA_LIBS)
@@ -11,12 +11,10 @@ AM_CPPFLAGS =					\
 	-include $(top_builddir)/config.h	\
 	-I$(srcdir)/include

-AM_LDFLAGS =
-
-if HOST_MACOS
-AM_LDFLAGS +=					\
-	-Wl,-flat_namespace
-endif HOST_MACOS
+if HAVE_GSSAPI
+AM_CPPFLAGS +=					\
+	$(GSSAPI_CFLAGS)
+endif

 LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/include				\
@@ -25,6 +23,21 @@ LIBISC_CFLAGS =						\
 	-I$(top_srcdir)/lib/isc/include			\
 	-I$(top_builddir)/lib/isc/include

+if HAVE_JSON_C
+LIBISC_CFLAGS +=					\
+	$(JSON_C_CFLAGS)
+endif HAVE_JSON_C
+
+if HAVE_LIBXML2
+LIBISC_CFLAGS +=					\
+	$(LIBXML2_CFLAGS)
+endif HAVE_LIBXML2
+
+if HAVE_READLINE
+LIBISC_CFLAGS +=					\
+	$(READLINE_CFLAGS)
+endif HAVE_READLINE
+
 LIBISC_LIBS = $(top_builddir)/lib/isc/libisc.la

 LIBDNS_CFLAGS = \
@@ -34,6 +47,16 @@ LIBDNS_CFLAGS = \
 LIBDNS_LIBS = \
 	$(top_builddir)/lib/dns/libdns.la

+if HAVE_DNSTAP
+LIBDNS_CFLAGS +=					\
+	$(DNSTAP_CFLAGS)
+endif HAVE_DNSTAP
+
+if HAVE_LMDB
+LIBDNS_CFLAGS +=					\
+	$(LMDB_CFLAGS)
+endif HAVE_LMDB
+
 LIBNS_CFLAGS = \
 	-I$(top_srcdir)/lib/ns/include

@@ -63,3 +86,9 @@ LIBBIND9_CFLAGS = \

 LIBBIND9_LIBS = \
 	$(top_builddir)/lib/bind9/libbind9.la
+
+LIBLTDL_CFLAGS = \
+	-I$(top_srcdir)/libltdl
+
+LIBLTDL_LIBS = \
+	$(top_builddir)/libltdl/libltdlc.la
@@ -8,19 +8,20 @@
 - See the COPYRIGHT file distributed with this work for additional
 - information regarding copyright ownership.
 -->
-Setting the `CPPFLAGS` environment variable before running `configure`
-can be used to enable certain compile-time options that are not
-explicitly defined in `configure`.
+Setting the `STD_CDEFINES` environment variable before running `configure`
+can be used to enable certain compile-time options that are not explicitly
+defined in `configure`.

 Some of these settings are:

-| Setting                      | Description                                                                                                                            |
-| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
-| `-DCHECK_LOCAL=0`            | Don't check out-of-zone addresses in `named-checkzone`                                                                                 |
-| `-DCHECK_SIBLING=0`          | Don't check sibling glue in `named-checkzone`                                                                                          |
-| `-DISC_FACILITY=LOG_LOCAL0`  | Change the default syslog facility for `named`                                                                                         |
-| `-DISC_HEAP_CHECK`           | Test heap consistency after every heap operation; used when debugging                                                                  |
-| `-DISC_MEM_DEFAULTFILL=1`    | Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier |
-| `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
-| `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
-| `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
+|Setting                            |Description |
+|-----------------------------------|----------------------------------------|
+|`-DISC_MEM_DEFAULTFILL=1`|Overwrite memory with tag values when allocating or freeing it; this impairs performance but makes debugging of memory problems easier.|
+|`-DISC_MEM_TRACKLINES=0`|Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult.|
+|<nobr>`-DISC_FACILITY=LOG_LOCAL0`</nobr>|Change the default syslog facility for `named`|
+|`-DNS_CLIENT_DROPPORT=0`|Disable dropping queries from particular well-known ports:|
+|`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
+|`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
+|`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
+|`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
+|`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
@@ -13,7 +13,7 @@
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C11-compliant C compiler, BSD-style sockets with RFC-compliant
 IPv6 support, POSIX-compliant threads, the `libuv` asynchronous I/O library,
-the OpenSSL cryptography library, and the `nghttp2` HTTP/2 library.
+and the OpenSSL cryptography library.

 The following C11 features are used in BIND 9:

@@ -42,16 +42,16 @@ offer support on a "best effort" basis for some.

 ### Regularly tested platforms

-As of Nov 2020, BIND 9.17 is fully supported and regularly tested on the
+As of Jul 2020, BIND 9.17 is fully supported and regularly tested on the
 following systems:

 * Debian 9, 10
-* Ubuntu LTS 18.04, 20.04
-* Fedora 34
+* Ubuntu LTS 16.04, 20.04
+* Fedora 32
 * Red Hat Enterprise Linux / CentOS 7, 8
-* FreeBSD 11.4, 12.2, 13.0
-* OpenBSD 6.9
-* Alpine Linux 3.13
+* FreeBSD 11.4, 12.1
+* OpenBSD 6.7
+* Alpine Linux 3.12

 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.

@@ -61,7 +61,7 @@ The following are platforms on which BIND is known to build and run.
 ISC makes every effort to fix bugs on these platforms, but may be unable to
 do so quickly due to lack of hardware, less familiarity on the part of
 engineering staff, and other constraints. With the exception of Windows
-Server 2016, none of these are tested regularly by ISC.
+Server 2012 R2, none of these are tested regularly by ISC.

 * Windows Server 2012 R2, 2016 / x64
 * Windows 10 / x64
@@ -69,7 +69,7 @@ Server 2016, none of these are tested regularly by ISC.
 * Solaris 11
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
-    * Ubuntu 20.10+
+    * Ubuntu 19.04+
    * Gentoo
    * Arch Linux
 * OpenWRT/LEDE 17.01+
@@ -86,7 +86,7 @@ assessed against the risk of adverse effect on officially supported
 platforms.

 * Platforms past or close to their respective EOL dates, such as:
-    * Ubuntu 14.04, 16.04 (Ubuntu ESM releases are not supported)
+    * Ubuntu 14.04, 18.10
    * CentOS 6
    * Debian Jessie
    * FreeBSD 10.x
@@ -15,6 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
+1. [BIND 9.17 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
@@ -124,17 +125,27 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

+### <a name="features"/> BIND 9.17 features
+
+BIND 9.17 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.16 and earlier releases. New features include:
+
+* The new option `max-ixfr-ratio` to limit the size of outgoing IXFR responses
+  before falling back to full zone transfers.
+* `rndc nta -d` and `rndc secroots` now include `validate-except` entries
+  when listing negative trust anchors.
+
 ### <a name="build"/> Building BIND 9

 At a minimum, BIND requires a Unix or Linux system with an ANSI C compiler,
 basic POSIX support, and a 64-bit integer type. BIND also requires the
-`libuv` asynchronous I/O library, the `nghttp2` HTTP/2 library, and a
-cryptography provider library such as OpenSSL or a hardware service
-module supporting PKCS#11. On Linux, BIND requires the `libcap` library
-to set process privileges, though this requirement can be overridden by
-disabling capability support at compile time. See [Compile-time
-options](#opts) below for details on other libraries that may be
-required to support optional features.
+`libuv` asynchronous I/O library, and a cryptography provider library
+such as OpenSSL or a hardware service module supporting PKCS#11. On
+Linux, BIND requires the `libcap` library to set process privileges,
+though this requirement can be overridden by disabling capability
+support at compile time. See [Compile-time options](#opts) below
+for details on other libraries that may be required to support
+optional features.

 Successful builds have been observed on many versions of Linux and
 Unix, including RHEL/CentOS, Fedora, Debian, Ubuntu, SLES, openSUSE,
@@ -151,7 +162,8 @@ To build on a Unix or Linux system, use:
 		$ ./configure
 		$ make

-If you're using Emacs, you might find `make tags` helpful.
+If you're planning on making changes to the BIND 9 source, you should run
+`make depend`.  If you're using Emacs, you might find `make tags` helpful.

 Several environment variables, which can be set before running `configure`,
 affect compilation.  Significant ones are:
@@ -189,6 +201,7 @@ installed:
    autoconf (includes autoreconf)
    automake
    libtool
+    libltdl-dev (Debian) / libtool-ltdl-dev (Fedora/CentOS) / libltdl (FreeBSD)

 #### <a name="opts"/> Compile-time options

@@ -322,7 +335,7 @@ the change that was made; these categories are:
 | [cleanup] | Minor corrections and refactoring |
 | [doc] | Documentation |
 | [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
-| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+| [placeholder] | Used in the master development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |

 In general, [func] and [experimental] tags only appear in new-feature
 releases (i.e., those with version numbers ending in zero). Some new
@@ -21,6 +21,8 @@

 .. highlight: console

+.. _man_named-checkzone:
+
 named-checkzone, named-compilezone - zone file validity checking or converting tool
 -----------------------------------------------------------------------------------

@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -108,7 +108,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
  </ItemDefinitionGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -114,7 +114,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
    <PostBuildEvent>
@@ -21,6 +21,8 @@

 .. highlight: console

+.. _man_tsig-keygen:
+
 tsig-keygen, ddns-confgen - TSIG key generation tool
 ----------------------------------------------------

@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -115,7 +115,7 @@ copy /Y tsig-keygen.ilk ddns-confgen.ilk
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -34,10 +34,8 @@
 #include <isc/hex.h>
 #include <isc/lib.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
-#include <isc/netmgr.h>
 #ifdef WIN32
 #include <isc/ntpaths.h>
 #endif /* ifdef WIN32 */
@@ -612,13 +610,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_name_t *keyname;
 	isc_result_t result;
 	bool match_root = false;
-	enum {
-		INITIAL_KEY,
-		STATIC_KEY,
-		INITIAL_DS,
-		STATIC_DS,
-		TRUSTED
-	} anchortype;
+	enum { INITIAL_KEY,
+	       STATIC_KEY,
+	       INITIAL_DS,
+	       STATIC_DS,
+	       TRUSTED } anchortype;
 	const cfg_obj_t *obj;

 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
@@ -1738,7 +1734,6 @@ main(int argc, char *argv[]) {
 	dns_namelist_t namelist;
 	unsigned int resopt;
 	isc_appctx_t *actx = NULL;
-	isc_nm_t *netmgr = NULL;
 	isc_taskmgr_t *taskmgr = NULL;
 	isc_socketmgr_t *socketmgr = NULL;
 	isc_timermgr_t *timermgr = NULL;
@@ -1762,8 +1757,9 @@ main(int argc, char *argv[]) {
 	isc_mem_create(&mctx);

 	CHECK(isc_appctx_create(mctx, &actx));
-	isc_managers_create(mctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
+	CHECK(isc_taskmgr_createinctx(mctx, 1, 0, &taskmgr));
+	CHECK(isc_socketmgr_createinctx(mctx, &socketmgr));
+	CHECK(isc_timermgr_createinctx(mctx, &timermgr));

 	parse_args(argc, argv);

@@ -1783,8 +1779,8 @@ main(int argc, char *argv[]) {
 #endif /* ifndef WIN32 */

 	/* Create client */
-	result = dns_client_create(mctx, actx, taskmgr, socketmgr, timermgr, 0,
-				   &client, srcaddr4, srcaddr6);
+	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr, 0,
+				    &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			 isc_result_totext(result));
@@ -1804,7 +1800,7 @@ main(int argc, char *argv[]) {
 	CHECK(convert_name(&qfn, &query_name, qname));

 	/* Set up resolution options */
-	resopt = DNS_CLIENTRESOPT_NOCDFLAG;
+	resopt = DNS_CLIENTRESOPT_ALLOWRUN | DNS_CLIENTRESOPT_NOCDFLAG;
 	if (no_sigs) {
 		resopt |= DNS_CLIENTRESOPT_NODNSSEC;
 	}
@@ -1866,7 +1862,15 @@ cleanup:
 	if (client != NULL) {
 		dns_client_destroy(&client);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	if (taskmgr != NULL) {
+		isc_taskmgr_destroy(&taskmgr);
+	}
+	if (timermgr != NULL) {
+		isc_timermgr_destroy(&timermgr);
+	}
+	if (socketmgr != NULL) {
+		isc_socketmgr_destroy(&socketmgr);
+	}
 	if (actx != NULL) {
 		isc_appctx_destroy(&actx);
 	}
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -25,15 +25,10 @@ libdighost_la_SOURCES = \

 bin_PROGRAMS = dig host nslookup

-nslookup_CPPFLAGS =		\
-	$(AM_CPPFLAGS)
-
 nslookup_LDADD =		\
 	$(LDADD)

 if HAVE_READLINE
-nslookup_CPPFLAGS +=		\
-	$(READLINE_CFLAGS)
 nslookup_LDADD +=		\
 	$(READLINE_LIBS)
 endif HAVE_READLINE
@@ -30,7 +30,6 @@
 #include <pk11/site.h>

 #include <dns/byaddr.h>
-#include <dns/dns64.h>
 #include <dns/fixedname.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
@@ -207,8 +206,6 @@ help(void) {
 	       "                                      fields in records)\n"
 	       "                 +[no]defname        (Use search list "
 	       "(+[no]search))\n"
-	       "                 +[no]dns64prefix    (Get the DNS64 prefixes "
-	       "from ipv4only.arpa)\n"
 	       "                 +[no]dnssec         (Request DNSSEC records)\n"
 	       "                 +domain=###         (Set default domainname)\n"
 	       "                 +[no]dscp[=###]     (Set the DSCP value to "
@@ -228,10 +225,6 @@ help(void) {
 	       "SERVFAIL)\n"
 	       "                 +[no]header-only    (Send query without a "
 	       "question section)\n"
-	       "                 +[no]https[=###]    (DNS over HTTPS mode) "
-	       "[/]\n"
-	       "                 +[no]https-get      (Use GET instead of "
-	       "default POST method\n"
 	       "                 +[no]identify       (ID responders in short "
 	       "answers)\n"
 #ifdef HAVE_LIBIDN2
@@ -294,7 +287,6 @@ help(void) {
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 	       "                 +timeout=###        (Set query timeout) [5]\n"
-	       "                 +[no]tls            (DNS over TLS mode)\n"
 	       "                 +[no]trace          (Trace delegation down "
 	       "from root "
 	       "[+dnssec])\n"
@@ -304,6 +296,9 @@ help(void) {
 	       "in records)\n"
 	       "                 +[no]ttlunits       (Display TTLs in "
 	       "human-readable units)\n"
+	       "                 +[no]unexpected     (Print replies from "
+	       "unexpected sources\n"
+	       "                                      default=off)\n"
 	       "                 +[no]unknownformat  (Print RDATA in RFC 3597 "
 	       "\"unknown\" "
 	       "format)\n"
@@ -343,28 +338,13 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	}

 	if (query->lookup->stats) {
-		const char *proto;
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (query->lookup->use_usec) {
 			printf(";; Query time: %ld usec\n", (long)diff);
 		} else {
 			printf(";; Query time: %ld msec\n", (long)diff / 1000);
 		}
-		if (query->lookup->tls_mode) {
-			proto = "TLS";
-		} else if (query->lookup->https_mode) {
-			if (query->lookup->http_plain) {
-				proto = "HTTP";
-			} else {
-				proto = "HTTPS";
-			}
-		} else if (query->lookup->tcp_mode) {
-			proto = "TCP";
-		} else {
-			proto = "UDP";
-		}
-		printf(";; SERVER: %s(%s) (%s)\n", fromtext, query->userarg,
-		       proto);
+		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
 		(void)localtime_r(&tnow, &tmnow);

@@ -486,50 +466,6 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	return (ISC_R_SUCCESS);
 }

-/*%
- * short_form message print handler.  Calls above say_message()
- */
-static isc_result_t
-dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
-	dns_rdataset_t *rdataset = NULL;
-	dns_fixedname_t fixed;
-	dns_name_t *name;
-	isc_result_t result;
-	isc_netprefix_t prefix[10];
-	size_t i, count = 10;
-
-	name = dns_fixedname_initname(&fixed);
-	result = dns_name_fromstring(name, "ipv4only.arpa", 0, NULL);
-	check_result(result, "dns_name_fromstring");
-
-	result = dns_message_findname(msg, DNS_SECTION_ANSWER, name,
-				      dns_rdatatype_aaaa, dns_rdatatype_none,
-				      NULL, &rdataset);
-	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return (ISC_R_SUCCESS);
-	} else if (result != ISC_R_SUCCESS) {
-		return (result);
-	}
-
-	result = dns_dns64_findprefix(rdataset, prefix, &count);
-	if (result == ISC_R_NOTFOUND)
-		return (ISC_R_SUCCESS);
-	if (count > 10)
-		count = 10;
-	for (i = 0; i < count; i++) {
-		result = isc_netaddr_totext(&prefix[i].addr, buf);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-
-	return (ISC_R_SUCCESS);
-}
-
 /*%
 * short_form message print handler.  Calls above say_message()
 */
@@ -616,12 +552,9 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	dns_master_style_t *style = NULL;
 	unsigned int styleflags = 0;
 	bool isquery = (msg == query->lookup->sendmsg);
-	bool dns64prefix = query->lookup->dns64prefix;

 	UNUSED(msgbuf);

-	dig_idnsetup(query->lookup, true);
-
 	styleflags |= DNS_STYLEFLAG_REL_OWNER;
 	if (yaml) {
 		msg->indent.string = "  ";
@@ -681,16 +614,14 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
-		if (!short_form && !dns64prefix && printcmd) {
+		if (!short_form && printcmd) {
 			printf("%s", query->lookup->cmdline);
 		}
 		query->lookup->cmdline[0] = '\0';
 	}
 	debug("printmessage(%s %s %s)", headers ? "headers" : "noheaders",
 	      query->lookup->comments ? "comments" : "nocomments",
-	      short_form    ? "short_form"
-	      : dns64prefix ? "dns64prefix_form"
-			    : "long_form");
+	      short_form ? "short_form" : "long_form");

 	flags = 0;
 	if (!headers) {
@@ -711,6 +642,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 	if (yaml) {
 		enum { Q = 0x1, R = 0x2 }; /* Q:query; R:ecursive */
 		unsigned int tflag = 0;
+		isc_sockaddr_t saddr;
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 		uint16_t sport;
 		char *hash;
@@ -743,25 +675,15 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		if (!isc_time_isepoch(&query->time_sent)) {
 			char tbuf[100];
-			if (query->lookup->use_usec) {
-				isc_time_formatISO8601us(&query->time_sent,
-							 tbuf, sizeof(tbuf));
-			} else {
-				isc_time_formatISO8601ms(&query->time_sent,
-							 tbuf, sizeof(tbuf));
-			}
+			isc_time_formatISO8601ms(&query->time_sent, tbuf,
+						 sizeof(tbuf));
 			printf("    query_time: !!timestamp %s\n", tbuf);
 		}

 		if (!isquery && !isc_time_isepoch(&query->time_recv)) {
 			char tbuf[100];
-			if (query->lookup->use_usec) {
-				isc_time_formatISO8601us(&query->time_recv,
-							 tbuf, sizeof(tbuf));
-			} else {
-				isc_time_formatISO8601ms(&query->time_recv,
-							 tbuf, sizeof(tbuf));
-			}
+			isc_time_formatISO8601ms(&query->time_recv, tbuf,
+						 sizeof(tbuf));
 			printf("    response_time: !!timestamp %s\n", tbuf);
 		}

@@ -791,9 +713,10 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			printf("    response_port: %u\n", sport);
 		}

-		if (query->handle != NULL) {
-			isc_sockaddr_t saddr =
-				isc_nmhandle_localaddr(query->handle);
+		if (query->sock != NULL &&
+		    isc_socket_getsockname(query->sock, &saddr) ==
+			    ISC_R_SUCCESS)
+		{
 			sport = isc_sockaddr_getport(&saddr);
 			isc_sockaddr_format(&saddr, sockstr, sizeof(sockstr));
 			hash = strchr(sockstr, '#');
@@ -811,7 +734,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("    %s:\n", isquery ? "query_message_data"
 					    : "response_message_data");
 		result = dns_message_headertotext(msg, style, flags, buf);
-	} else if (query->lookup->comments && !short_form && !dns64prefix) {
+	} else if (query->lookup->comments && !short_form) {
 		if (query->lookup->cmdline[0] != '\0' && printcmd) {
 			printf("; %s\n", query->lookup->cmdline);
 		}
@@ -892,7 +815,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 repopulate_buffer:

-	if (query->lookup->comments && headers && !short_form && !dns64prefix) {
+	if (query->lookup->comments && headers && !short_form) {
 		result = dns_message_pseudosectiontotext(
 			msg, DNS_PSEUDOSECTION_OPT, style, flags, buf);
 		if (result == ISC_R_NOSPACE) {
@@ -906,7 +829,7 @@ repopulate_buffer:
 	}

 	if (query->lookup->section_question && headers) {
-		if (!short_form && !dns64prefix) {
+		if (!short_form) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_QUESTION, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -916,18 +839,13 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_answer) {
-		if (!short_form && !dns64prefix) {
+		if (!short_form) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_ANSWER, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
 				goto buftoosmall;
 			}
 			check_result(result, "dns_message_sectiontotext");
-		} else if (dns64prefix) {
-			result = dns64prefix_answer(msg, buf);
-			if (result == ISC_R_NOSPACE)
-				goto buftoosmall;
-			check_result(result, "dns64prefix_answer");
 		} else {
 			result = short_answer(msg, flags, buf, query);
 			if (result == ISC_R_NOSPACE) {
@@ -937,7 +855,7 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_authority) {
-		if (!short_form && !dns64prefix) {
+		if (!short_form) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_AUTHORITY, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -947,7 +865,7 @@ repopulate_buffer:
 		}
 	}
 	if (query->lookup->section_additional) {
-		if (!short_form && !dns64prefix) {
+		if (!short_form) {
 			result = dns_message_sectiontotext(
 				msg, DNS_SECTION_ADDITIONAL, style, flags, buf);
 			if (result == ISC_R_NOSPACE) {
@@ -989,9 +907,6 @@ repopulate_buffer:
 	if (style != NULL) {
 		dns_master_styledestroy(&style, mctx);
 	}
-
-	dig_idnsetup(query->lookup, false);
-
 	return (result);
 }

@@ -1041,9 +956,8 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 * XXX doc options
 */

-static dig_lookup_t *
-plus_option(char *option, bool is_batchfile, bool *need_clone,
-	    dig_lookup_t *lookup) {
+static void
+plus_option(char *option, bool is_batchfile, dig_lookup_t *lookup) {
 	isc_result_t result;
 	char *cmd, *value, *last = NULL, *code, *extra;
 	uint32_t num;
@@ -1054,7 +968,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return (lookup);
+		return;
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1076,17 +990,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0))   \
 			goto invalid_option;                             \
 	} while (0)
-#define FULLCHECK6(A, B, C, D, E, F)                                     \
-	do {                                                             \
-		size_t _l = strlen(cmd);                                 \
-		if ((_l >= sizeof(A) || strncasecmp(cmd, A, _l) != 0) && \
-		    (_l >= sizeof(B) || strncasecmp(cmd, B, _l) != 0) && \
-		    (_l >= sizeof(C) || strncasecmp(cmd, C, _l) != 0) && \
-		    (_l >= sizeof(D) || strncasecmp(cmd, D, _l) != 0) && \
-		    (_l >= sizeof(E) || strncasecmp(cmd, E, _l) != 0) && \
-		    (_l >= sizeof(F) || strncasecmp(cmd, F, _l) != 0))   \
-			goto invalid_option;                             \
-	} while (0)

 	switch (cmd[0]) {
 	case 'a':
@@ -1232,57 +1135,13 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				usesearch = state;
 			}
 			break;
-		case 'n':
-			switch (cmd[2]) {
-			case 's':
-				switch (cmd[3]) {
-				case '6': /* dns64prefix */
-					FULLCHECK("dns64prefix");
-					if (state) {
-						if (*need_clone) {
-							lookup = clone_lookup(
-								default_lookup,
-								true);
-						}
-						*need_clone = true;
-						lookup->dns64prefix = state;
-						strlcpy(lookup->textname,
-							"ipv4only.arpa",
-							sizeof(lookup->textname));
-						printcmd = false;
-						lookup->section_additional =
-							false;
-						lookup->section_answer = true;
-						lookup->section_authority =
-							false;
-						lookup->section_question =
-							false;
-						lookup->comments = false;
-						lookup->stats = false;
-						lookup->rrcomments = -1;
-						lookup->rdtype =
-							dns_rdatatype_aaaa;
-						lookup->rdtypeset = true;
-						ISC_LIST_APPEND(lookup_list,
-								lookup, link);
-					}
-					break;
-				case 's': /* dnssec */
-					FULLCHECK("dnssec");
-				dnssec:
-					if (state && lookup->edns == -1) {
-						lookup->edns =
-							DEFAULT_EDNS_VERSION;
-					}
-					lookup->dnssec = state;
-					break;
-				default:
-					goto invalid_option;
-				}
-				break;
-			default:
-				goto invalid_option;
+		case 'n': /* dnssec */
+			FULLCHECK("dnssec");
+		dnssec:
+			if (state && lookup->edns == -1) {
+				lookup->edns = DEFAULT_EDNS_VERSION;
 			}
+			lookup->dnssec = state;
 			break;
 		case 'o': /* domain ... but treat "do" as synonym for dnssec */
 			if (cmd[2] == '\0') {
@@ -1433,78 +1292,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		lookup->servfail_stops = state;
 		break;
 	case 'h':
-		switch (cmd[1]) {
-		case 'e': /* header-only */
-			FULLCHECK("header-only");
-			lookup->header_only = state;
-			break;
-		case 't':
-			FULLCHECK6("https", "https-get", "https-post",
-				   "http-plain", "http-plain-get",
-				   "http-plain-post");
-			if (lookup->https_path != NULL) {
-				isc_mem_free(mctx, lookup->https_path);
-				lookup->https_path = NULL;
-			}
-			if (!state) {
-				lookup->https_mode = false;
-				break;
-			}
-			lookup->https_mode = true;
-			if (cmd[4] == '-') {
-				lookup->http_plain = true;
-				switch (cmd[10]) {
-				case '\0':
-					FULLCHECK("http-plain");
-					break;
-				case '-':
-					switch (cmd[6]) {
-					case 'p':
-						FULLCHECK("https-plain-post");
-						break;
-					case 'g':
-						FULLCHECK("https-plain-get");
-						lookup->https_get = true;
-						break;
-					}
-					break;
-				default:
-					goto invalid_option;
-				}
-			} else {
-				switch (cmd[5]) {
-				case '\0':
-					FULLCHECK("https");
-					break;
-				case '-':
-					switch (cmd[6]) {
-					case 'p':
-						FULLCHECK("https-post");
-						break;
-					case 'g':
-						FULLCHECK("https-get");
-						lookup->https_get = true;
-						break;
-					}
-					break;
-				default:
-					goto invalid_option;
-				}
-			}
-			if (!lookup->tcp_mode_set) {
-				lookup->tcp_mode = state;
-			}
-			if (value == NULL) {
-				lookup->https_path = isc_mem_strdup(
-					mctx, DEFAULT_HTTPS_PATH);
-			} else {
-				lookup->https_path = isc_mem_strdup(mctx,
-								    value);
-			}
-			break;
-		default:
-			goto invalid_option;
-		}
+		FULLCHECK("header-only");
+		lookup->header_only = state;
 		break;
 	case 'i':
 		switch (cmd[1]) {
@@ -1927,13 +1716,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				timeout = 1;
 			}
 			break;
-		case 'l':
-			FULLCHECK("tls");
-			lookup->tls_mode = state;
-			if (!lookup->tcp_mode_set) {
-				lookup->tcp_mode = state;
-			}
-			break;
 		case 'o':
 			FULLCHECK("topdown");
 			fprintf(stderr, ";; +topdown option is deprecated");
@@ -2017,8 +1799,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			switch (cmd[2]) {
 			case 'e':
 				FULLCHECK("unexpected");
-				fprintf(stderr, ";; +unexpected option "
-						"is deprecated");
+				lookup->accept_reply_unexpected_src = state;
 				break;
 			case 'k':
 				FULLCHECK("unknownformat");
@@ -2062,7 +1843,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	return (lookup);
+	return;

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2188,10 +1969,10 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			srcport = 0;
 		}
 		if (have_ipv6 && inet_pton(AF_INET6, value, &in6) == 1) {
-			isc_sockaddr_fromin6(&localaddr, &in6, srcport);
+			isc_sockaddr_fromin6(&bind_address, &in6, srcport);
 			isc_net_disableipv4();
 		} else if (have_ipv4 && inet_pton(AF_INET, value, &in4) == 1) {
-			isc_sockaddr_fromin(&localaddr, &in4, srcport);
+			isc_sockaddr_fromin(&bind_address, &in4, srcport);
 			isc_net_disableipv6();
 		} else {
 			if (hash != NULL) {
@@ -2235,7 +2016,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fatal("Couldn't parse port number");
 		}
 		port = num;
-		port_set = true;
 		return (value_from_next);
 	case 'q':
 		if (!config_only) {
@@ -2432,20 +2212,16 @@ preparse_args(int argc, char **argv) {
 			continue;
 		}
 		/* Look for dash value option. */
-		if (strpbrk(option, dash_opts) != &option[0]) {
-			goto invalid_option;
-		}
-		if (strlen(option) > 1U) {
-			/* value in option. */
+		if (strpbrk(option, dash_opts) != &option[0] ||
+		    strlen(option) > 1U) {
+			/* Error or value in option. */
 			continue;
 		}
 		/* Dash value is next argument so we need to skip it. */
 		rc--, rv++;
 		/* Handle missing argument */
 		if (rc == 0) {
-		invalid_option:
-			fprintf(stderr, "Invalid option: -%s\n", option);
-			usage();
+			break;
 		}
 	}
 }
@@ -2577,8 +2353,7 @@ parse_args(bool is_batchfile, bool config_only, int argc, char **argv) {
 				}
 			}
 		} else if (rv[0][0] == '+') {
-			lookup = plus_option(&rv[0][1], is_batchfile,
-					     &need_clone, lookup);
+			plus_option(&rv[0][1], is_batchfile, lookup);
 		} else if (rv[0][0] == '-') {
 			if (rc <= 1) {
 				if (dash_option(&rv[0][1], NULL, &lookup,
@@ -297,9 +297,6 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
 ``+[no]defname``
   This option, which is deprecated, is treated as a synonym for ``+[no]search``.

-``+[no]dns64prefix``
-   Lookup IPV4ONLY.ARPA AAAA and print any DNS64 prefixes found.
-
 ``+[no]dnssec``
   This option requests that DNSSEC records be sent by setting the DNSSEC OK (DO) bit in
   the OPT record in the additional section of the query.
@@ -349,38 +346,11 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   default is to add a question section. The query type and query name
   are ignored when this is set.

-``+[no]https[=value]``
-   This option indicates whether to use DNS-over-HTTPS (DoH) when querying
-   name servers.  When this option is in use, the port number defaults to 443.
-   The HTTP POST request mode is used when sending the query.
-
-   If ``value`` is specified, it will be used as the HTTP endpoint in the
-   query URI; the default is ``/dns-query``. So, for example, ``dig
-   @example.com +https`` will use the URI ``https://example.com/dns-query``.
-
-``+[no]https-get[=value]``
-   Similar to ``+https``, except that the HTTP GET request mode is used
-   when sending the query.
-
-``+[no]https-post[=value]``
-   Same as ``+https``.
-
-``+[no]http-plain[=value]``
-   Similar to ``+https``, except that HTTP queries will be sent over a
-   non-encrypted channel. When this option is in use, the port number
-   defaults to 80 and the HTTP request mode is POST.
-
-``+[no]http-plain-get[=value]``
-   Similar to ``+http-plain``, except that the HTTP request mode is GET.
-
-``+[no]http-plain-post[=value]``
-   Same as ``+http-plain``.
-
 ``+[no]identify``
-   This option shows [or does not show] the IP address and port number that
-   supplied the answer, when the ``+short`` option is enabled. If short
-   form answers are requested, the default is not to show the source
-   address and port number of the server that provided the answer.
+   This option shows [or does not show] the IP address and port number that supplied
+   the answer, when the ``+short`` option is enabled. If short form
+   answers are requested, the default is not to show the source address
+   and port number of the server that provided the answer.

 ``+[no]idnin``
   This option processes [or does not process] IDN domain names on input. This requires
@@ -480,8 +450,8 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   ``+nssearch`` or ``+trace`` query option is used.

 ``+retry=T``
-   This option sets the number of times to retry UDP and TCP queries to server to ``T``
-   instead of the default, 2.  Unlike ``+tries``, this does not include
+   This option sets the number of times to retry UDP queries to server to ``T``
+   instead of the default, 2. Unlike ``+tries``, this does not include
   the initial query.

 ``+[no]rrcomments``
@@ -536,20 +506,14 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   ``+notcflag``. This bit is ignored by the server for QUERY.

 ``+[no]tcp``
-   This option indicates whether to use TCP when querying name servers.
-   The default behavior is to use UDP unless a type ``any`` or ``ixfr=N``
-   query is requested, in which case the default is TCP. AXFR queries
-   always use TCP.
+   This option uses [or does not use] TCP when querying name servers. The default behavior
+   is to use UDP unless a type ``any`` or ``ixfr=N`` query is requested,
+   in which case the default is TCP. AXFR queries always use TCP.

 ``+timeout=T``
   This option sets the timeout for a query to ``T`` seconds. The default timeout is
   5 seconds. An attempt to set ``T`` to less than 1 is silently set to 1.

-``+[no]tls``
-   This option indicates whether to use DNS-over-TLS (DoT) when querying
-   name servers. When this option is in use, the port number defaults
-   to 853.
-
 ``+[no]topdown``
   This feature is related to ``dig +sigchase``, which is obsolete and
   has been removed. Use ``delv`` instead.
@@ -569,7 +533,7 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   default queries from a name server.

 ``+tries=T``
-   This option sets the number of times to try UDP and TCP queries to server to ``T``
+   This option sets the number of times to try UDP queries to server to ``T``
   instead of the default, 3. If ``T`` is less than or equal to zero,
   the number of tries is silently rounded up to 1.

@@ -585,6 +549,11 @@ abbreviation is unambiguous; for example, ``+cd`` is equivalent to
   units of ``s``, ``m``, ``h``, ``d``, and ``w``, representing seconds, minutes,
   hours, days, and weeks. This implies ``+ttlid``.

+``+[no]unexpected``
+   This option accepts [or does not accept] answers from unexpected sources.  By default, ``dig``
+   will not accept a reply from a source other than the one to which it sent the
+   query.
+
 ``+[no]unknownformat``
   This option prints all RDATA in unknown RR type presentation format (:rfc:`3597`).
   The default is to print RDATA for known types in the type's
@@ -19,14 +19,13 @@

 #include <isc/attributes.h>
 #include <isc/buffer.h>
+#include <isc/bufferlist.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
-#include <isc/netmgr.h>
 #include <isc/print.h>
-#include <isc/refcount.h>
 #include <isc/sockaddr.h>
 #include <isc/socket.h>

@@ -74,10 +73,7 @@
 #define LOOKUP_LIMIT 64

 #define DEFAULT_EDNS_VERSION 0
-#define DEFAULT_EDNS_BUFSIZE 1232
-
-#define DEFAULT_HTTPS_PATH  "/dns-query"
-#define DEFAULT_HTTPS_QUERY "?dns="
+#define DEFAULT_EDNS_BUFSIZE 4096

 /*%
 * Lookup_limit is just a limiter, keeping too many lookups from being
@@ -93,39 +89,37 @@ typedef struct dig_server dig_server_t;
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;

-#define DIG_LOOKUP_MAGIC ISC_MAGIC('D', 'i', 'g', 'l')
-
-#define DIG_VALID_LOOKUP(x) ISC_MAGIC_VALID((x), DIG_LOOKUP_MAGIC)
-
 #define DIG_QUERY_MAGIC ISC_MAGIC('D', 'i', 'g', 'q')

 #define DIG_VALID_QUERY(x) ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)

 /*% The dig_lookup structure */
 struct dig_lookup {
-	unsigned int magic;
-	isc_refcount_t references;
-	bool aaonly, adflag, badcookie, besteffort, cdflag, comments,
-		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		expire, header_only, identify, /*%< Append an "on server <foo>"
-						  message */
-		identify_previous_line,	       /*% Prepend a "Nameserver <foo>:"
-						  message, with newline and tab */
-		idnin, idnout, ignore, mapped, multiline, need_search,
-		new_search, noclass, nocrypto, nottl,
-		ns_search_only,	 /*%< dig +nssearch, host -C */
-		nsid,		 /*% Name Server ID (RFC 5001) */
-		onesoa, pending, /*%< Pending a successful answer */
-		print_unknown_format, qr, raflag, recurse, section_additional,
-		section_answer, section_authority, section_question,
-		seenbadcookie, sendcookie, servfail_stops,
-		setqid, /*% use a speciied query ID */
-		stats, tcflag, tcp_keepalive, tcp_mode, tcp_mode_set,
-		tls_mode,   /*% connect using TLS */
+	bool pending, /*%< Pending a successful answer */
+		waiting_connect, doing_xfr, ns_search_only, /*%< dig
+							     * +nssearch,
+							     * host -C */
+		identify, /*%< Append an "on server <foo>" message */
+		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
+					 * message, with newline and tab */
+		ignore, recurse, aaonly, adflag, cdflag, raflag, tcflag, zflag,
 		trace,	    /*% dig +trace */
-		trace_root, /*% initial query for either +trace or +nssearch */
-		ttlunits, use_usec, waiting_connect, zflag;
-	char textname[MXNAME]; /*% Name we're going to be looking up */
+		trace_root, /*% initial query for either +trace or +nssearch
+			     * */
+		tcp_mode, tcp_mode_set, comments, stats, section_question,
+		section_answer, section_authority, section_additional,
+		servfail_stops, new_search, need_search, done_as_is, besteffort,
+		dnssec, expire, sendcookie, seenbadcookie, badcookie,
+		nsid, /*% Name Server ID (RFC 5001) */
+		tcp_keepalive, header_only, ednsneg, mapped,
+		print_unknown_format, multiline, nottl, noclass, onesoa,
+		use_usec, nocrypto, ttlunits, idnin, idnout, expandaaaa, qr,
+		accept_reply_unexpected_src, /*%  print replies from
+					      * unexpected
+					      *   sources. */
+		setqid;			     /*% use a speciied query ID */
+	char textname[MXNAME];		     /*% Name we're going to be
+					      * looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
@@ -171,23 +165,15 @@ struct dig_lookup {
 	int rrcomments;
 	unsigned int eoferr;
 	uint16_t qid;
-	struct {
-		bool http_plain;
-		bool https_mode;
-		bool https_get;
-		char *https_path;
-	};
 };

 /*% The dig_query structure */
 struct dig_query {
 	unsigned int magic;
 	dig_lookup_t *lookup;
-	bool first_pass;
-	bool first_soa_rcvd;
-	bool second_rr_rcvd;
-	bool first_repeat_rcvd;
-	bool warn_id;
+	bool waiting_connect, pending_free, waiting_senddone, first_pass,
+		first_soa_rcvd, second_rr_rcvd, first_repeat_rcvd, recv_made,
+		warn_id, timedout;
 	uint32_t first_rr_serial;
 	uint32_t second_rr_serial;
 	uint32_t msg_count;
@@ -195,12 +181,9 @@ struct dig_query {
 	bool ixfr_axfr;
 	char *servname;
 	char *userarg;
-	isc_buffer_t sendbuf;
+	isc_buffer_t recvbuf, lengthbuf, tmpsendbuf, sendbuf;
 	char *recvspace, *tmpsendspace, lengthspace[4];
-	isc_refcount_t references;
-	isc_nmhandle_t *handle;
-	isc_nmhandle_t *readhandle;
-	isc_nmhandle_t *sendhandle;
+	isc_socket_t *sock;
 	ISC_LINK(dig_query_t) link;
 	ISC_LINK(dig_query_t) clink;
 	isc_sockaddr_t sockaddr;
@@ -208,7 +191,6 @@ struct dig_query {
 	isc_time_t time_recv;
 	uint64_t byte_count;
 	isc_timer_t *timer;
-	isc_tlsctx_t *tlsctx;
 };

 struct dig_server {
@@ -237,14 +219,13 @@ extern unsigned int extrabytes;
 extern bool check_ra, have_ipv4, have_ipv6, specified_source, usesearch,
 	showsearch, yaml;
 extern in_port_t port;
-extern bool port_set;
 extern unsigned int timeout;
 extern isc_mem_t *mctx;
-extern isc_refcount_t sendcount;
+extern int sendcount;
 extern int ndots;
 extern int lookup_counter;
 extern int exitcode;
-extern isc_sockaddr_t localaddr;
+extern isc_sockaddr_t bind_address;
 extern char keynametext[MXNAME];
 extern char keyfile[MXNAME];
 extern char keysecret[MXNAME];
@@ -409,38 +390,32 @@ setup_text_key(void);
 * Routines exported from dig.c for use by dig for iOS
 */

-/*%
+/*%<
 * Call once only to set up libraries, parse global
 * parameters and initial command line query parameters
 */
 void
 dig_setup(int argc, char **argv);

-/*%
+/*%<
 * Call to supply new parameters for the next lookup
 */
 void
 dig_query_setup(bool, bool, int argc, char **argv);

-/*%
+/*%<
 * set the main application event cycle running
 */
 void
 dig_startup(void);

-/*%
+/*%<
 * Initiates the next lookup cycle
 */
 void
 dig_query_start(void);

-/*%
- * Activate/deactivate IDN filtering of output.
- */
-void
-dig_idnsetup(dig_lookup_t *lookup, bool active);
-
-/*%
+/*%<
 * Cleans up the application
 */
 void
@@ -151,11 +151,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	if (!short_form) {
 		char fromtext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(from, fromtext, sizeof(fromtext));
-		if (query->lookup->use_usec) {
-			TIME_NOW_HIRES(&now);
-		} else {
-			TIME_NOW(&now);
-		}
+		TIME_NOW(&now);
 		diff = (int)isc_time_microdiff(&now, &query->time_sent);
 		printf("Received %u bytes from %s in %d ms\n", bytes, fromtext,
 		       diff / 1000);
@@ -379,7 +375,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -442,7 +438,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA and MX lookups. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -0,0 +1 @@
+../../../.clang-format.headers
@@ -22,6 +22,7 @@
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
 #include <isc/print.h>
+#include <isc/readline.h>
 #include <isc/string.h>
 #include <isc/task.h>
 #include <isc/util.h>
@@ -37,7 +38,6 @@
 #include <dns/rdatatype.h>

 #include "dighost.h"
-#include "readline.h"

 static bool short_form = true, tcpmode = false, tcpmode_set = false,
 	    identify = false, stats = true, comments = true,
@@ -110,6 +110,8 @@ static const char *rtypetext[] = {

 #define N_KNOWN_RRTYPES (sizeof(rtypetext) / sizeof(rtypetext[0]))

+static void
+flush_lookup_list(void);
 static void
 getinput(isc_task_t *task, isc_event_t *event);

@@ -134,6 +136,7 @@ static void
 query_finished(void) {
 	isc_event_t *event = global_event;

+	flush_lookup_list();
 	debug("dighost_shutdown()");

 	if (!in_use) {
@@ -391,7 +394,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 		dns_rdataset_current(rdataset, &rdata);
 		result = dns_rdata_tostruct(&rdata, &cname, NULL);
 		check_result(result, "dns_rdata_tostruct");
-		dns_name_copy(&cname.cname, qname);
+		dns_name_copynf(&cname.cname, qname);
 		dns_rdata_freestruct(&cname);
 	}
 }
@@ -448,7 +451,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* Add AAAA lookup. */
 		name = dns_fixedname_initname(&fixed);
-		dns_name_copy(query->lookup->name, name);
+		dns_name_copynf(query->lookup->name, name);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
 		lookup = clone_lookup(query->lookup, false);
@@ -619,8 +622,6 @@ static void
 setoption(char *opt) {
 	size_t l = strlen(opt);

-	debugging = true;
-
 #define CHECKOPT(A, N) \
 	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))

@@ -903,6 +904,46 @@ parse_args(int argc, char **argv) {
 	}
 }

+static void
+flush_lookup_list(void) {
+	dig_lookup_t *l, *lp;
+	dig_query_t *q, *qp;
+	dig_server_t *s, *sp;
+
+	lookup_counter = 0;
+	l = ISC_LIST_HEAD(lookup_list);
+	while (l != NULL) {
+		q = ISC_LIST_HEAD(l->q);
+		while (q != NULL) {
+			if (q->sock != NULL) {
+				isc_socket_cancel(q->sock, NULL,
+						  ISC_SOCKCANCEL_ALL);
+				isc_socket_detach(&q->sock);
+			}
+			isc_buffer_invalidate(&q->recvbuf);
+			isc_buffer_invalidate(&q->lengthbuf);
+			qp = q;
+			q = ISC_LIST_NEXT(q, link);
+			ISC_LIST_DEQUEUE(l->q, qp, link);
+			isc_mem_free(mctx, qp);
+		}
+		s = ISC_LIST_HEAD(l->my_server_list);
+		while (s != NULL) {
+			sp = s;
+			s = ISC_LIST_NEXT(s, link);
+			ISC_LIST_DEQUEUE(l->my_server_list, sp, link);
+			isc_mem_free(mctx, sp);
+		}
+		if (l->sendmsg != NULL) {
+			dns_message_destroy(&l->sendmsg);
+		}
+		lp = l;
+		l = ISC_LIST_NEXT(l, link);
+		ISC_LIST_DEQUEUE(lookup_list, lp, link);
+		isc_mem_free(mctx, lp);
+	}
+}
+
 static void
 getinput(isc_task_t *task, isc_event_t *event) {
 	UNUSED(task);
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -215,7 +215,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -185,7 +185,7 @@ loadkey(char *filename, unsigned char *key_buf, unsigned int key_buf_size,
 	rdclass = dst_key_class(key);

 	name = dns_fixedname_initname(&fixed);
-	dns_name_copy(dst_key_name(key), name);
+	dns_name_copynf(dst_key_name(key), name);

 	dst_key_free(&key);
 }
@@ -37,8 +37,8 @@ Description
 ~~~~~~~~~~~

 ``dnssec-importkey`` reads a public DNSKEY record and generates a pair
-of .key/.private files. The DNSKEY record may be read from an
-existing .key file, in which case a corresponding .private file is
+of .key/.private files. The DNSKEY record may be read from an existing
+.key file, in which case a corresponding .private file is
 generated, or it may be read from any other file or from the standard
 input, in which case both .key and .private files are generated.

@@ -362,6 +362,7 @@ main(int argc, char **argv) {
 	setup_logging(mctx, &log);

 	if (predecessor == NULL) {
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (label == NULL) {
 			fatal("the key label was not specified");
 		}
@@ -383,6 +384,7 @@ main(int argc, char **argv) {
 			      isc_result_totext(ret));
 		}

+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (strchr(label, ':') == NULL) {
 			char *l;
 			int len;
@@ -394,11 +396,13 @@ main(int argc, char **argv) {
 			label = l;
 		}

+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}

 		r.base = algname;
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&alg, &r);
 		if (ret != ISC_R_SUCCESS) {
@@ -76,9 +76,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -269,8 +269,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, NULL, mctx, lctx,
-					     &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, mctx, lctx, &kasplist,
+					     &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -284,7 +284,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	*kaspp = kasp;

 	/*
-	 * Cleanup kasp list.
+	 * Same cleanup for kasp list.
 	 */
 	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
 		kasp_next = ISC_LIST_NEXT(kasp, link);
@@ -782,7 +782,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		}

 		/* Set dnssec-policy related metadata */
-		if (ctx->policy != NULL) {
+		if (ctx->policy) {
 			dst_key_setnum(key, DST_NUM_LIFETIME, ctx->lifetime);
 			dst_key_setbool(key, DST_BOOL_KSK, ctx->ksk);
 			dst_key_setbool(key, DST_BOOL_ZSK, ctx->zsk);
@@ -1180,10 +1180,12 @@ main(int argc, char **argv) {
 	}

 	if (ctx.predecessor == NULL && ctx.policy == NULL) {
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		if (algname == NULL) {
 			fatal("no algorithm specified");
 		}
 		r.base = algname;
+		/* cppcheck-suppress nullPointerRedundantCheck */
 		r.length = strlen(algname);
 		ret = dns_secalg_fromtext(&ctx.alg, &r);
 		if (ret != ISC_R_SUCCESS) {
@@ -103,9 +103,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -59,9 +59,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND 9 is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -102,9 +102,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -40,7 +40,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/managers.h>
 #include <isc/md.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -145,7 +144,6 @@ static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
 static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
 static isc_mutex_t namelock, statslock;
-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
 static dns_dbversion_t *gversion; /* The database version */
@@ -179,9 +177,8 @@ static bool remove_orphansigs = false;
 static bool remove_inactkeysigs = false;
 static bool output_dnssec_only = false;
 static bool output_stdout = false;
-static bool set_maxttl = false;
+bool set_maxttl = false;
 static dns_ttl_t maxttl = 0;
-static bool no_max_check = false;

 #define INCSTAT(counter)            \
 	if (printstats) {           \
@@ -201,7 +198,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	dns_name_t *result;

 	result = dns_fixedname_initname(fzonecut);
-	dns_name_copy(name, result);
+	dns_name_copynf(name, result);

 	return (result);
 }
@@ -594,10 +591,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
 					 expired ? "expired"
-					 : rrsig.originalttl != set->ttl
-						 ? "ttl change"
-						 : "failed to "
-						   "verify");
+						 : rrsig.originalttl != set->ttl
+							   ? "ttl change"
+							   : "failed to "
+							     "verify");
 				resign = true;
 			}
 		} else if (!ispublishedkey(key) && remove_orphansigs) {
@@ -615,10 +612,10 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
 					 expired ? "expired"
-					 : rrsig.originalttl != set->ttl
-						 ? "ttl change"
-						 : "failed to "
-						   "verify");
+						 : rrsig.originalttl != set->ttl
+							   ? "ttl change"
+							   : "failed to "
+							     "verify");
 			}
 		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
@@ -1337,8 +1334,8 @@ get_soa_ttls(void) {
 	result = dns_rdataset_first(&soaset);
 	check_result(result, "dns_rdataset_first");
 	dns_rdataset_current(&soaset, &rdata);
+	zone_soa_min_ttl = dns_soa_getminimum(&rdata);
 	soa_ttl = soaset.ttl;
-	zone_soa_min_ttl = ISC_MIN(dns_soa_getminimum(&rdata), soa_ttl);
 	if (set_maxttl) {
 		zone_soa_min_ttl = ISC_MIN(zone_soa_min_ttl, maxttl);
 		soa_ttl = ISC_MIN(soa_ttl, maxttl);
@@ -1355,8 +1352,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {
 	dns_dbnode_t *node = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	uint32_t old_serial, new_serial = 0;
-	dns_updatemethod_t used = dns_updatemethod_none;
+	uint32_t old_serial, new_serial;

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
@@ -1380,20 +1376,16 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	if (method == dns_updatemethod_date ||
 	    method == dns_updatemethod_unixtime) {
-		new_serial = dns_update_soaserial(old_serial, method, &used);
+		new_serial = dns_update_soaserial(old_serial, method);
 	} else if (serial != 0 || method == dns_updatemethod_none) {
 		/* Set SOA serial to the value provided. */
 		new_serial = serial;
-		used = method;
 	} else {
-		new_serial = dns_update_soaserial(old_serial, method, &used);
-	}
-
-	if (method != used) {
-		fprintf(stderr,
-			"%s: warning: Serial number would not advance, "
-			"using increment method instead\n",
-			program);
+		/* Increment SOA serial using RFC 1982 arithmetic */
+		new_serial = (old_serial + 1) & 0xFFFFFFFF;
+		if (new_serial == 0) {
+			new_serial = 1;
+		}
 	}

 	/* If the new serial is not likely to cause a zone transfer
@@ -2397,7 +2389,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -2534,7 +2526,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			dns_name_copy(gorigin, nextname);
+			dns_name_copynf(gorigin, nextname);
 			done = true;
 		} else if (result != ISC_R_SUCCESS) {
 			fatal("iterating through the database failed: %s",
@@ -2731,13 +2723,10 @@ static void
 report(const char *format, ...) {
 	if (!quiet) {
 		FILE *out = output_stdout ? stderr : stdout;
-		char buf[4096];
 		va_list args;
-
 		va_start(args, format);
-		vsnprintf(buf, sizeof(buf), format, args);
+		vfprintf(out, format, args);
 		va_end(args);
-		fprintf(out, "%s\n", buf);
 	}
 }

@@ -3441,12 +3430,6 @@ main(int argc, char *argv[]) {

 		case 'H':
 			set_iter = true;
-			/* too-many is NOT DOCUMENTED */
-			if (strcmp(isc_commandline_argument, "too-many") == 0) {
-				nsec3iter = 151;
-				no_max_check = true;
-				break;
-			}
 			nsec3iter = strtoul(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
 				fatal("iterations must be numeric");
@@ -3815,7 +3798,11 @@ main(int argc, char *argv[]) {
 	 * of keys rather early.
 	 */
 	ISC_LIST_INIT(keylist);
-	isc_rwlock_init(&keylist_lock, 0, 0);
+	result = isc_rwlock_init(&keylist_lock, 0, 0);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize keylist_lock: %s",
+		      isc_result_totext(result));
+	}

 	/*
 	 * Fill keylist with:
@@ -3865,6 +3852,7 @@ main(int argc, char *argv[]) {
 	warnifallksk(gdb);

 	if (IS_NSEC3) {
+		unsigned int max;
 		bool answer;

 		hash_length = dns_nsec3_hashlength(dns_hash_sha1);
@@ -3883,15 +3871,12 @@ main(int argc, char *argv[]) {
 			      "NSEC-only DNSKEY");
 		}

-		if (nsec3iter > dns_nsec3_maxiterations()) {
-			if (no_max_check) {
-				fprintf(stderr,
-					"Ignoring max iterations check.\n");
-			} else {
-				fatal("NSEC3 iterations too big. Maximum "
-				      "iterations allowed %u.",
-				      dns_nsec3_maxiterations());
-			}
+		result = dns_nsec3_maxiterations(gdb, NULL, mctx, &max);
+		check_result(result, "dns_nsec3_maxiterations()");
+		if (nsec3iter > max) {
+			fatal("NSEC3 iterations too big for weakest DNSKEY "
+			      "strength. Maximum iterations allowed %u.",
+			      max);
 		}
 	} else {
 		hashlist_init(&hashlist, 0, 0); /* silence clang */
@@ -3964,7 +3949,11 @@ main(int argc, char *argv[]) {
 	print_time(outfp);
 	print_version(outfp);

-	isc_managers_create(mctx, ntasks, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	result = isc_taskmgr_create(mctx, ntasks, 0, NULL, &taskmgr);
+	if (result != ISC_R_SUCCESS) {
+		fatal("failed to create task manager: %s",
+		      isc_result_totext(result));
+	}

 	master = NULL;
 	result = isc_task_create(taskmgr, 0, &master);
@@ -4015,7 +4004,7 @@ main(int argc, char *argv[]) {
 	for (i = 0; i < (int)ntasks; i++) {
 		isc_task_detach(&tasks[i]);
 	}
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
 	isc_mem_put(mctx, tasks, ntasks * sizeof(isc_task_t *));
 	postsign();
 	TIME_NOW(&sign_finish);
@@ -69,9 +69,9 @@ Options
   This option specifies the hardware to use for cryptographic
   operations, such as a secure key store used for signing, when applicable.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -202,16 +202,10 @@ Options
      This format increments the SOA serial number using :rfc:`1982` arithmetic.

   **unixtime**
-      This format sets the SOA serial number to the number of seconds
-      since the beginning of the Unix epoch, unless the serial
-      number is already greater than or equal to that value, in
-      which case it is simply incremented by one.
+      This format sets the SOA serial number to the number of seconds since the beginning of the Unix epoch.

   **date**
-      This format sets the SOA serial number to today's date, in
-      YYYYMMDDNN format, unless the serial number is already greater
-      than or equal to that value, in which case it is simply
-      incremented by one.
+      This format sets the SOA serial number to today's date, in YYYYMMDDNN format.

 ``-o origin``
   This option sets the zone origin. If not specified, the name of the zone file is
@@ -82,13 +82,10 @@ static bool keyset_kskonly = false;
 static void
 report(const char *format, ...) {
 	if (!quiet) {
-		char buf[4096];
 		va_list args;
-
 		va_start(args, format);
-		vsnprintf(buf, sizeof(buf), format, args);
+		vfprintf(stdout, format, args);
 		va_end(args);
-		fprintf(stdout, "%s\n", buf);
 	}
 }

@@ -47,9 +47,9 @@ Options
 ``-E engine``
   This option specifies the cryptographic hardware to use, when applicable.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -43,12 +43,8 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-#ifndef CPPCHECK
 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
-#else /* CPPCHECK */
-#define fatal(...) exit(1)
-#endif

 void
 setfatalcallback(fatalcallback_t *callback);
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
@IF PYTHON
    <PostBuildEvent>
@@ -122,7 +122,7 @@ set PYTHONPATH=.
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
@IF PYTHON
    <PostBuildEvent>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -76,7 +76,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -108,7 +108,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libisccfg.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -76,7 +76,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -108,7 +108,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -76,7 +76,7 @@
      <SubSystem>Console</SubSystem>
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -108,7 +108,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@dnssectool.lib;libisc.lib;libdns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
    </Link>
  </ItemDefinitionGroup>
@@ -9,6 +9,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISCCC_CFLAGS)		\
 	$(LIBISCCFG_CFLAGS)		\
 	$(LIBBIND9_CFLAGS)		\
+	$(LIBLTDL_CFLAGS)		\
 	$(OPENSSL_CFLAGS)		\
 	$(LIBCAP_CFLAGS)		\
 	$(LMDB_CFLAGS)			\
@@ -59,7 +60,6 @@ named_SOURCES =				\
 	server.c			\
 	statschannel.c			\
 	tkeyconf.c			\
-	transportconf.c			\
 	tsigconf.c			\
 	zoneconf.c			\
 	unix/dlz_dlopen_driver.c	\
@@ -78,7 +78,6 @@ named_SOURCES =				\
 	include/named/smf_globals.h	\
 	include/named/statschannel.h	\
 	include/named/tkeyconf.h	\
-	include/named/transportconf.h	\
 	include/named/tsigconf.h	\
 	include/named/types.h		\
 	include/named/zoneconf.h	\
@@ -33,21 +33,17 @@
 typedef struct builtin builtin_t;

 static isc_result_t
-do_authors_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_dns64_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_empty_lookup(dns_sdblookup_t *lookup);
+do_version_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
 do_hostname_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
+do_authors_lookup(dns_sdblookup_t *lookup);
+static isc_result_t
 do_id_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
-do_ipv4only_lookup(dns_sdblookup_t *lookup);
+do_empty_lookup(dns_sdblookup_t *lookup);
 static isc_result_t
-do_ipv4reverse_lookup(dns_sdblookup_t *lookup);
-static isc_result_t
-do_version_lookup(dns_sdblookup_t *lookup);
+do_dns64_lookup(dns_sdblookup_t *lookup);

 /*
 * We can't use function pointers as the db_data directly
@@ -61,14 +57,12 @@ struct builtin {
 	char *contact;
 };

-static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
-static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };
-static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
-static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
-static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
-static builtin_t ipv4only_builtin = { do_ipv4only_lookup, NULL, NULL };
-static builtin_t ipv4reverse_builtin = { do_ipv4reverse_lookup, NULL, NULL };
 static builtin_t version_builtin = { do_version_lookup, NULL, NULL };
+static builtin_t hostname_builtin = { do_hostname_lookup, NULL, NULL };
+static builtin_t authors_builtin = { do_authors_lookup, NULL, NULL };
+static builtin_t id_builtin = { do_id_lookup, NULL, NULL };
+static builtin_t empty_builtin = { do_empty_lookup, NULL, NULL };
+static builtin_t dns64_builtin = { do_dns64_lookup, NULL, NULL };

 static dns_sdbimplementation_t *builtin_impl;
 static dns_sdbimplementation_t *dns64_impl;
@@ -95,8 +89,7 @@ static const unsigned char hex16[256] = {
 	1, 1,	1,   1,	  1,   1,   1,	 1,   1,   1,	1, 1, 1, 1, 1, 1  /*F0*/
 };

-static const unsigned char decimal[] = "0123456789";
-static const unsigned char ipv4only[] = "\010ipv4only\004arpa";
+const unsigned char decimal[] = "0123456789";

 static size_t
 dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
@@ -296,16 +289,6 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name,
 		 */
 		return (ISC_R_NOTFOUND);
 	}
-
-	/*
-	 * Reverse of 192.0.0.170 or 192.0.0.171 maps to ipv4only.arpa.
-	 */
-	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
-	    v[3] == 192) {
-		return (dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600,
-					 ipv4only, sizeof(ipv4only)));
-	}
-
 	return (dns_sdb_putrdata(lookup, dns_rdatatype_cname, 600, rdata,
 				 (unsigned int)len));
 }
@@ -446,30 +429,6 @@ do_empty_lookup(dns_sdblookup_t *lookup) {
 	return (ISC_R_SUCCESS);
 }

-static isc_result_t
-do_ipv4only_lookup(dns_sdblookup_t *lookup) {
-	isc_result_t result;
-	unsigned char data[2][4] = { { 192, 0, 0, 170 }, { 192, 0, 0, 171 } };
-
-	for (int i = 0; i < 2; i++) {
-		result = dns_sdb_putrdata(lookup, dns_rdatatype_a, 3600,
-					  data[i], 4);
-		if (result != ISC_R_SUCCESS) {
-			return (result);
-		}
-	}
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-do_ipv4reverse_lookup(dns_sdblookup_t *lookup) {
-	isc_result_t result;
-
-	result = dns_sdb_putrdata(lookup, dns_rdatatype_ptr, 3600, ipv4only,
-				  sizeof(ipv4only));
-	return (result);
-}
-
 static isc_result_t
 builtin_authority(const char *zone, void *dbdata, dns_sdblookup_t *lookup) {
 	isc_result_t result;
@@ -513,10 +472,7 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 	UNUSED(zone);
 	UNUSED(driverdata);

-	if (strcmp(argv[0], "dns64") == 0 || strcmp(argv[0], "empty") == 0 ||
-	    strcmp(argv[0], "ipv4only") == 0 ||
-	    strcmp(argv[0], "ipv4reverse") == 0)
-	{
+	if (strcmp(argv[0], "empty") == 0 || strcmp(argv[0], "dns64") == 0) {
 		if (argc != 3) {
 			return (DNS_R_SYNTAX);
 		}
@@ -524,27 +480,19 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 		return (DNS_R_SYNTAX);
 	}

-	if (strcmp(argv[0], "authors") == 0) {
-		*dbdata = &authors_builtin;
+	if (strcmp(argv[0], "version") == 0) {
+		*dbdata = &version_builtin;
 	} else if (strcmp(argv[0], "hostname") == 0) {
 		*dbdata = &hostname_builtin;
+	} else if (strcmp(argv[0], "authors") == 0) {
+		*dbdata = &authors_builtin;
 	} else if (strcmp(argv[0], "id") == 0) {
 		*dbdata = &id_builtin;
-	} else if (strcmp(argv[0], "version") == 0) {
-		*dbdata = &version_builtin;
-	} else if (strcmp(argv[0], "dns64") == 0 ||
-		   strcmp(argv[0], "empty") == 0 ||
-		   strcmp(argv[0], "ipv4only") == 0 ||
-		   strcmp(argv[0], "ipv4reverse") == 0)
-	{
+	} else if (strcmp(argv[0], "empty") == 0 ||
+		   strcmp(argv[0], "dns64") == 0) {
 		builtin_t *empty;
 		char *server;
 		char *contact;
-
-		if (argc != 3) {
-			return (DNS_R_SYNTAX);
-		}
-
 		/*
 		 * We don't want built-in zones to fail.  Fallback to
 		 * the static configuration if memory allocation fails.
@@ -553,14 +501,10 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 		server = isc_mem_strdup(named_g_mctx, argv[1]);
 		contact = isc_mem_strdup(named_g_mctx, argv[2]);
 		if (empty == NULL || server == NULL || contact == NULL) {
-			if (strcmp(argv[0], "dns64") == 0) {
-				*dbdata = &dns64_builtin;
-			} else if (strcmp(argv[0], "empty") == 0) {
+			if (strcmp(argv[0], "empty") == 0) {
 				*dbdata = &empty_builtin;
-			} else if (strcmp(argv[0], "ipv4only") == 0) {
-				*dbdata = &ipv4only_builtin;
 			} else {
-				*dbdata = &ipv4reverse_builtin;
+				*dbdata = &dns64_builtin;
 			}
 			if (server != NULL) {
 				isc_mem_free(named_g_mctx, server);
@@ -573,17 +517,11 @@ builtin_create(const char *zone, int argc, char **argv, void *driverdata,
 					    sizeof(*empty));
 			}
 		} else {
-			if (strcmp(argv[0], "dns64") == 0) {
-				memmove(empty, &dns64_builtin,
-					sizeof(empty_builtin));
-			} else if (strcmp(argv[0], "empty") == 0) {
+			if (strcmp(argv[0], "empty") == 0) {
 				memmove(empty, &empty_builtin,
 					sizeof(empty_builtin));
-			} else if (strcmp(argv[0], "ipv4only") == 0) {
-				memmove(empty, &ipv4only_builtin,
-					sizeof(empty_builtin));
 			} else {
-				memmove(empty, &ipv4reverse_builtin,
+				memmove(empty, &dns64_builtin,
 					sizeof(empty_builtin));
 			}
 			empty->server = server;
@@ -606,10 +544,9 @@ builtin_destroy(const char *zone, void *driverdata, void **dbdata) {
 	/*
 	 * Don't free the static versions.
 	 */
-	if (*dbdata == &authors_builtin || *dbdata == &dns64_builtin ||
-	    *dbdata == &empty_builtin || *dbdata == &hostname_builtin ||
-	    *dbdata == &id_builtin || *dbdata == &ipv4only_builtin ||
-	    *dbdata == &ipv4reverse_builtin || *dbdata == &version_builtin)
+	if (*dbdata == &version_builtin || *dbdata == &hostname_builtin ||
+	    *dbdata == &authors_builtin || *dbdata == &id_builtin ||
+	    *dbdata == &empty_builtin || *dbdata == &dns64_builtin)
 	{
 		return;
 	}
@@ -59,7 +59,7 @@ options {\n\
 #	directory <none>\n\
 	dnssec-policy \"none\";\n\
 	dump-file \"named_dump.db\";\n\
-	edns-udp-size 1232;\n\
+	edns-udp-size 4096;\n\
 #	fake-iquery <obsolete>;\n"
 #ifndef WIN32
 			    "	files unlimited;\n"
@@ -83,7 +83,7 @@ options {\n\
 	match-mapped-addresses no;\n\
 	max-ixfr-ratio 100%;\n\
 	max-rsa-exponent-size 0; /* no limit */\n\
-	max-udp-size 1232;\n\
+	max-udp-size 4096;\n\
 	memstatistics-file \"named.memstats\";\n\
 #	multiple-cnames <obsolete>;\n\
 #	named-xfer <obsolete>;\n\
@@ -93,9 +93,6 @@ options {\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
-	tls-port 853;\n\
-	http-port 80;\n\
-	https-port 443;\n\
 	prefetch 2 9;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
@@ -123,8 +120,6 @@ options {\n\
 	tcp-initial-timeout 300;\n\
 	tcp-keepalive-timeout 300;\n\
 	tcp-listen-queue 10;\n\
-	tcp-receive-buffer 0;\n\
-	tcp-send-buffer 0;\n\
 #	tkey-dhkey <none>\n\
 #	tkey-domain <none>\n\
 #	tkey-gssapi-credential <none>\n\
@@ -135,8 +130,7 @@ options {\n\
 #	treat-cr-as-space <obsolete>;\n\
 	trust-anchor-telemetry yes;\n\
 #	use-id-pool <obsolete>;\n\
-	udp-receive-buffer 0;\n\
-	udp-send-buffer 0;\n\
+#	use-ixfr <obsolete>;\n\
 \n\
 	/* view */\n\
 	allow-new-zones no;\n\
@@ -146,6 +140,7 @@ options {\n\
 	allow-recursion { localnets; localhost; };\n\
 	allow-recursion-on { any; };\n\
 	allow-update-forwarding {none;};\n\
+#	allow-v6-synthesis <obsolete>;\n\
 	auth-nxdomain false;\n\
 	check-dup-records warn;\n\
 	check-mx warn;\n\
@@ -174,8 +169,8 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 100;\n\
-	max-stale-ttl 86400; /* 1 day */\n\
+	max-recursion-queries 75;\n\
+	max-stale-ttl 43200; /* 12 hours */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
 	min-cache-ttl 0; /* 0 seconds */\n\
@@ -199,11 +194,9 @@ options {\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
 #	sortlist <none>\n\
-	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
-	stale-answer-ttl 30; /* 30 seconds */\n\
+	stale-answer-ttl 1; /* 1 second */\n\
 	stale-cache-enable false;\n\
-	stale-refresh-time 30; /* 30 seconds */\n\
 	synth-from-dnssec no;\n\
 #	topology <none>\n\
 	transfer-format many-answers;\n\
@@ -229,7 +222,7 @@ options {\n\
 	dnssec-update-mode maintain;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
-#	inline-signing no;\n\
+	inline-signing no;\n\
 	ixfr-from-differences false;\n\
 #	maintain-ixfr-base <obsolete>;\n\
 #	max-ixfr-log-size <obsolete>\n\
@@ -504,7 +497,7 @@ named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
 	} else if (defport != 0) {
 		port = defport;
 	} else {
-		result = named_config_getport(config, "port", &port);
+		result = named_config_getport(config, &port);
 		if (result != ISC_R_SUCCESS) {
 			return (result);
 		}
@@ -614,76 +607,10 @@ named_config_getprimariesdef(const cfg_obj_t *cctx, const char *name,
 	return (result);
 }

-static isc_result_t
-named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
-		     dns_name_t **namep) {
-	REQUIRE(namep != NULL && *namep == NULL);
-
-	const char *objstr;
-	isc_result_t result;
-	isc_buffer_t b;
-	dns_fixedname_t fname;
-
-	if (!cfg_obj_isstring(obj)) {
-		*namep = NULL;
-		return (ISC_R_SUCCESS);
-	}
-
-	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep, NULL);
-
-	objstr = cfg_obj_asstring(obj);
-	isc_buffer_constinit(&b, objstr, strlen(objstr));
-	isc_buffer_add(&b, strlen(objstr));
-	dns_fixedname_init(&fname);
-	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0, NULL);
-	if (result != ISC_R_SUCCESS) {
-		isc_mem_put(mctx, *namep, sizeof(**namep));
-		*namep = NULL;
-		return (result);
-	}
-	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);
-
-	return (ISC_R_SUCCESS);
-}
-
-#define grow_array(mctx, array, newlen, oldlen)                    \
-	if (newlen >= oldlen) {                                    \
-		size_t newsize = (newlen + 16) * sizeof(array[0]); \
-		size_t oldsize = oldlen * sizeof(array[0]);        \
-		void *tmp = isc_mem_get(mctx, newsize);            \
-		memset(tmp, 0, newsize);                           \
-		if (oldlen != 0) {                                 \
-			memmove(tmp, array, oldsize);              \
-			isc_mem_put(mctx, array, oldsize);         \
-		}                                                  \
-		array = tmp;                                       \
-		oldlen = newlen + 16;                              \
-	}
-
-#define shrink_array(mctx, array, newlen, oldlen)           \
-	if (newlen < oldlen) {                              \
-		void *tmp = NULL;                           \
-		size_t newsize = newlen * sizeof(array[0]); \
-		size_t oldsize = oldlen * sizeof(array[0]); \
-		if (newlen != 0) {                          \
-			tmp = isc_mem_get(mctx, newsize);   \
-			memset(tmp, 0, newsize);            \
-			memmove(tmp, array, newsize);       \
-		} else {                                    \
-			tmp = NULL;                         \
-		}                                           \
-		isc_mem_put(mctx, array, oldsize);          \
-		array = tmp;                                \
-		oldlen = newlen;                            \
-	}
-
 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
-	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, tlscount = 0,
-		 i = 0;
+	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
 	uint32_t listcount = 0, l = 0, j;
 	uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
@@ -691,14 +618,12 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	const cfg_obj_t *addrlist;
 	const cfg_obj_t *portobj;
 	const cfg_obj_t *dscpobj;
-	in_port_t port = (in_port_t)0;
-	in_port_t def_port;
-	in_port_t def_tlsport;
+	in_port_t port;
 	isc_dscp_t dscp = -1;
+	dns_fixedname_t fname;
 	isc_sockaddr_t *addrs = NULL;
 	isc_dscp_t *dscps = NULL;
 	dns_name_t **keys = NULL;
-	dns_name_t **tlss = NULL;
 	struct {
 		const char *name;
 	} *lists = NULL;
@@ -712,7 +637,6 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	REQUIRE(ipkl->count == 0);
 	REQUIRE(ipkl->addrs == NULL);
 	REQUIRE(ipkl->keys == NULL);
-	REQUIRE(ipkl->tlss == NULL);
 	REQUIRE(ipkl->dscps == NULL);
 	REQUIRE(ipkl->labels == NULL);
 	REQUIRE(ipkl->allocated == 0);
@@ -720,12 +644,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	/*
 	 * Get system defaults.
 	 */
-	result = named_config_getport(config, "port", &def_port);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	result = named_config_getport(config, "tls-port", &def_tlsport);
+	result = named_config_getport(config, &port);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -769,20 +688,33 @@ resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
 		const cfg_obj_t *addr;
 		const cfg_obj_t *key;
-		const cfg_obj_t *tls;
+		const char *keystr;
+		isc_buffer_t b;

 		addr = cfg_tuple_get(cfg_listelt_value(element),
 				     "primarieselement");
 		key = cfg_tuple_get(cfg_listelt_value(element), "key");
-		tls = cfg_tuple_get(cfg_listelt_value(element), "tls");

 		if (!cfg_obj_issockaddr(addr)) {
 			const char *listname = cfg_obj_asstring(addr);
 			isc_result_t tresult;

 			/* Grow lists? */
-			grow_array(mctx, lists, l, listcount);
+			if (listcount == l) {
+				void *tmp;
+				uint32_t newlen = listcount + 16;
+				size_t newsize, oldsize;

+				newsize = newlen * sizeof(*lists);
+				oldsize = listcount * sizeof(*lists);
+				tmp = isc_mem_get(mctx, newsize);
+				if (listcount != 0) {
+					memmove(tmp, lists, oldsize);
+					isc_mem_put(mctx, lists, oldsize);
+				}
+				lists = tmp;
+				listcount = newlen;
+			}
 			/* Seen? */
 			for (j = 0; j < l; j++) {
 				if (strcasecmp(lists[j].name, listname) == 0) {
@@ -808,7 +740,21 @@ resume:
 			}
 			lists[l++].name = listname;
 			/* Grow stack? */
-			grow_array(mctx, stack, pushed, stackcount);
+			if (stackcount == pushed) {
+				void *tmp;
+				uint32_t newlen = stackcount + 16;
+				size_t newsize, oldsize;
+
+				newsize = newlen * sizeof(*stack);
+				oldsize = stackcount * sizeof(*stack);
+				tmp = isc_mem_get(mctx, newsize);
+				if (stackcount != 0) {
+					memmove(tmp, stack, oldsize);
+					isc_mem_put(mctx, stack, oldsize);
+				}
+				stack = tmp;
+				stackcount = newlen;
+			}
 			/*
 			 * We want to resume processing this list on the
 			 * next element.
@@ -820,44 +766,68 @@ resume:
 			goto newlist;
 		}

-		grow_array(mctx, addrs, i, addrcount);
-		grow_array(mctx, dscps, i, dscpcount);
-		grow_array(mctx, keys, i, keycount);
-		grow_array(mctx, tlss, i, tlscount);
+		if (i == addrcount) {
+			void *tmp;
+			uint32_t newlen = addrcount + 16;
+			size_t newsize, oldsize;
+
+			newsize = newlen * sizeof(isc_sockaddr_t);
+			oldsize = addrcount * sizeof(isc_sockaddr_t);
+			tmp = isc_mem_get(mctx, newsize);
+			if (addrcount != 0) {
+				memmove(tmp, addrs, oldsize);
+				isc_mem_put(mctx, addrs, oldsize);
+			}
+			addrs = tmp;
+			addrcount = newlen;
+
+			newsize = newlen * sizeof(isc_dscp_t);
+			oldsize = dscpcount * sizeof(isc_dscp_t);
+			tmp = isc_mem_get(mctx, newsize);
+			if (dscpcount != 0) {
+				memmove(tmp, dscps, oldsize);
+				isc_mem_put(mctx, dscps, oldsize);
+			}
+			dscps = tmp;
+			dscpcount = newlen;
+
+			newsize = newlen * sizeof(dns_name_t *);
+			oldsize = keycount * sizeof(dns_name_t *);
+			tmp = isc_mem_get(mctx, newsize);
+			if (keycount != 0) {
+				memmove(tmp, keys, oldsize);
+				isc_mem_put(mctx, keys, oldsize);
+			}
+			keys = tmp;
+			keycount = newlen;
+		}

 		addrs[i] = *cfg_obj_assockaddr(addr);
+		if (isc_sockaddr_getport(&addrs[i]) == 0) {
+			isc_sockaddr_setport(&addrs[i], port);
+		}
 		dscps[i] = cfg_obj_getdscp(addr);
 		if (dscps[i] == -1) {
 			dscps[i] = dscp;
 		}
+		keys[i] = NULL;
+		i++; /* Increment here so that cleanup on error works. */
+		if (!cfg_obj_isstring(key)) {
+			continue;
+		}
+		keys[i - 1] = isc_mem_get(mctx, sizeof(dns_name_t));
+		dns_name_init(keys[i - 1], NULL);

-		result = named_config_getname(mctx, key, &keys[i]);
+		keystr = cfg_obj_asstring(key);
+		isc_buffer_constinit(&b, keystr, strlen(keystr));
+		isc_buffer_add(&b, strlen(keystr));
+		dns_fixedname_init(&fname);
+		result = dns_name_fromtext(dns_fixedname_name(&fname), &b,
+					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			i++; /* Increment here so that cleanup on error works.
-			      */
 			goto cleanup;
 		}
-
-		result = named_config_getname(mctx, tls, &tlss[i]);
-		if (result != ISC_R_SUCCESS) {
-			i++; /* Increment here so that cleanup on error works.
-			      */
-			goto cleanup;
-		}
-
-		/* Set the default port or tls-port */
-		if (port == 0) {
-			if (tlss[i] != NULL) {
-				port = def_tlsport;
-			} else {
-				port = def_port;
-			}
-		}
-
-		if (isc_sockaddr_getport(&addrs[i]) == 0) {
-			isc_sockaddr_setport(&addrs[i], port);
-		}
-		i++;
+		dns_name_dup(dns_fixedname_name(&fname), mctx, keys[i - 1]);
 	}
 	if (pushed != 0) {
 		pushed--;
@@ -866,28 +836,61 @@ resume:
 		dscp = stack[pushed].dscp;
 		goto resume;
 	}
+	if (i < addrcount) {
+		void *tmp;
+		size_t newsize, oldsize;

-	shrink_array(mctx, addrs, i, addrcount);
-	shrink_array(mctx, dscps, i, dscpcount);
-	shrink_array(mctx, keys, i, keycount);
-	shrink_array(mctx, tlss, i, tlscount);
+		newsize = i * sizeof(isc_sockaddr_t);
+		oldsize = addrcount * sizeof(isc_sockaddr_t);
+		if (i != 0) {
+			tmp = isc_mem_get(mctx, newsize);
+			memmove(tmp, addrs, newsize);
+		} else {
+			tmp = NULL;
+		}
+		isc_mem_put(mctx, addrs, oldsize);
+		addrs = tmp;
+		addrcount = i;
+
+		newsize = i * sizeof(isc_dscp_t);
+		oldsize = dscpcount * sizeof(isc_dscp_t);
+		if (i != 0) {
+			tmp = isc_mem_get(mctx, newsize);
+			memmove(tmp, dscps, newsize);
+		} else {
+			tmp = NULL;
+		}
+		isc_mem_put(mctx, dscps, oldsize);
+		dscps = tmp;
+		dscpcount = i;
+
+		newsize = i * sizeof(dns_name_t *);
+		oldsize = keycount * sizeof(dns_name_t *);
+		if (i != 0) {
+			tmp = isc_mem_get(mctx, newsize);
+			memmove(tmp, keys, newsize);
+		} else {
+			tmp = NULL;
+		}
+		isc_mem_put(mctx, keys, oldsize);
+		keys = tmp;
+		keycount = i;
+	}

 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 	}

 	INSIST(dscpcount == addrcount);
 	INSIST(keycount == addrcount);
-	INSIST(tlscount == addrcount);
 	INSIST(keycount == dscpcount);

 	ipkl->addrs = addrs;
 	ipkl->dscps = dscps;
 	ipkl->keys = keys;
-	ipkl->tlss = tlss;
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

@@ -895,10 +898,10 @@ resume:

 cleanup:
 	if (addrs != NULL) {
-		isc_mem_put(mctx, addrs, addrcount * sizeof(addrs[0]));
+		isc_mem_put(mctx, addrs, addrcount * sizeof(isc_sockaddr_t));
 	}
 	if (dscps != NULL) {
-		isc_mem_put(mctx, dscps, dscpcount * sizeof(dscps[0]));
+		isc_mem_put(mctx, dscps, dscpcount * sizeof(isc_dscp_t));
 	}
 	if (keys != NULL) {
 		for (j = 0; j < i; j++) {
@@ -908,34 +911,21 @@ cleanup:
 			if (dns_name_dynamic(keys[j])) {
 				dns_name_free(keys[j], mctx);
 			}
-			isc_mem_put(mctx, keys[j], sizeof(*keys[j]));
+			isc_mem_put(mctx, keys[j], sizeof(dns_name_t));
 		}
-		isc_mem_put(mctx, keys, keycount * sizeof(keys[0]));
-	}
-	if (tlss != NULL) {
-		for (j = 0; j < i; j++) {
-			if (tlss[j] == NULL) {
-				continue;
-			}
-			if (dns_name_dynamic(tlss[j])) {
-				dns_name_free(tlss[j], mctx);
-			}
-			isc_mem_put(mctx, tlss[j], sizeof(*tlss[j]));
-		}
-		isc_mem_put(mctx, tlss, tlscount * sizeof(tlss[0]));
+		isc_mem_put(mctx, keys, keycount * sizeof(dns_name_t *));
 	}
 	if (lists != NULL) {
-		isc_mem_put(mctx, lists, listcount * sizeof(lists[0]));
+		isc_mem_put(mctx, lists, listcount * sizeof(*lists));
 	}
 	if (stack != NULL) {
-		isc_mem_put(mctx, stack, stackcount * sizeof(stack[0]));
+		isc_mem_put(mctx, stack, stackcount * sizeof(*stack));
 	}
 	return (result);
 }

 isc_result_t
-named_config_getport(const cfg_obj_t *config, const char *type,
-		     in_port_t *portp) {
+named_config_getport(const cfg_obj_t *config, in_port_t *portp) {
 	const cfg_obj_t *maps[3];
 	const cfg_obj_t *options = NULL;
 	const cfg_obj_t *portobj = NULL;
@@ -950,7 +940,7 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	maps[i++] = named_g_defaults;
 	maps[i] = NULL;

-	result = named_config_get(maps, type, &portobj);
+	result = named_config_get(maps, "port", &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
 		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
@@ -990,15 +980,13 @@ named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp) {

 struct keyalgorithms {
 	const char *str;
-	enum {
-		hmacnone,
-		hmacmd5,
-		hmacsha1,
-		hmacsha224,
-		hmacsha256,
-		hmacsha384,
-		hmacsha512
-	} hmac;
+	enum { hmacnone,
+	       hmacmd5,
+	       hmacsha1,
+	       hmacsha224,
+	       hmacsha256,
+	       hmacsha384,
+	       hmacsha512 } hmac;
 	unsigned int type;
 	uint16_t size;
 } algorithms[] = { { "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
@@ -183,7 +183,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/* Do not flush master files */
 		named_server_flushonshutdown(named_g_server, false);
 		named_os_shutdownmsg(cmdline, *text);
-		result = ISC_R_SHUTTINGDOWN;
+		isc_app_shutdown();
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_STOP)) {
 		/*
 		 * "stop" is the same as "halt" except it does
@@ -200,7 +201,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 #endif /* ifdef HAVE_LIBSCF */
 		named_server_flushonshutdown(named_g_server, true);
 		named_os_shutdownmsg(cmdline, *text);
-		result = ISC_R_SHUTTINGDOWN;
+		isc_app_shutdown();
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_ADDZONE) ||
 		   command_compare(command, NAMED_COMMAND_MODZONE))
 	{
@@ -14,13 +14,11 @@
 #include <inttypes.h>
 #include <stdbool.h>

-#include <isc/app.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/mem.h>
-#include <isc/mutex.h>
 #include <isc/net.h>
 #include <isc/netaddr.h>
 #include <isc/netmgr.h>
@@ -95,10 +93,9 @@ struct controllistener {
 	isc_sockaddr_t address;
 	isc_nmsocket_t *sock;
 	dns_acl_t *acl;
+	bool listening;
 	bool exiting;
-	isc_refcount_t refs;
 	controlkeylist_t keys;
-	isc_mutex_t connections_lock;
 	controlconnectionlist_t connections;
 	isc_socktype_t type;
 	uint32_t perm;
@@ -111,8 +108,7 @@ struct controllistener {
 struct named_controls {
 	named_server_t *server;
 	controllistenerlist_t listeners;
-	atomic_bool shuttingdown;
-	isc_mutex_t symtab_lock;
+	bool shuttingdown;
 	isccc_symtab_t *symtab;
 };

@@ -146,10 +142,9 @@ free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
 static void
 free_listener(controllistener_t *listener) {
 	INSIST(listener->exiting);
+	INSIST(!listener->listening);
 	INSIST(ISC_LIST_EMPTY(listener->connections));

-	isc_refcount_destroy(&listener->refs);
-
 	if (listener->sock != NULL) {
 		isc_nmsocket_close(&listener->sock);
 	}
@@ -159,14 +154,15 @@ free_listener(controllistener_t *listener) {
 	if (listener->acl != NULL) {
 		dns_acl_detach(&listener->acl);
 	}
-	isc_mutex_destroy(&listener->connections_lock);

 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }

 static void
 maybe_free_listener(controllistener_t *listener) {
-	if (isc_refcount_decrement(&listener->refs) == 1) {
+	if (listener->exiting && !listener->listening &&
+	    ISC_LIST_EMPTY(listener->connections))
+	{
 		free_listener(listener);
 	}
 }
@@ -190,6 +186,7 @@ shutdown_listener(controllistener_t *listener) {
 		}
 #endif
 		listener->exiting = true;
+		listener->listening = false;
 	}

 	isc_nm_stoplistening(listener->sock);
@@ -226,14 +223,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 	conn->sending = false;

-	if (conn->result == ISC_R_SHUTTINGDOWN) {
-		isc_app_shutdown();
-		goto cleanup_sendhandle;
-	}
-
-	if (atomic_load_acquire(&listener->controls->shuttingdown) ||
-	    result == ISC_R_CANCELED)
-	{
+	if (listener->controls->shuttingdown || result == ISC_R_CANCELED) {
 		goto cleanup_sendhandle;
 	} else if (result != ISC_R_SUCCESS) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
@@ -251,7 +241,19 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 	isc_nmhandle_detach(&conn->sendhandle);

-	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
+	result = isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
+					 conn);
+	if (result != ISC_R_SUCCESS) {
+		isc_nmhandle_detach(&conn->readhandle);
+		conn->reading = false;
+
+		maybe_free_listener(listener);
+
+		return;
+	}
+
+	listener->listening = true;
+
 	return;

 cleanup_sendhandle:
@@ -290,12 +292,12 @@ conn_cleanup(controlconnection_t *conn) {
 }

 static void
-control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
+control_respond(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
+	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
 	isccc_sexpr_t *data = NULL;
 	isc_buffer_t b;
 	isc_region_t r;
-	isc_result_t result;

 	result = isccc_cc_createresponse(conn->request, conn->now,
 					 conn->now + 60, &conn->response);
@@ -303,22 +305,17 @@ control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {
 		goto cleanup;
 	}

-	if (conn->result == ISC_R_SHUTTINGDOWN) {
-		result = ISC_R_SUCCESS;
-	} else {
-		result = conn->result;
-	}
-
 	data = isccc_alist_lookup(conn->response, "_data");
 	if (data != NULL) {
-		if (isccc_cc_defineuint32(data, "result", result) == NULL) {
+		if (isccc_cc_defineuint32(data, "result", conn->result) == NULL)
+		{
 			goto cleanup;
 		}
 	}

-	if (result != ISC_R_SUCCESS) {
+	if (conn->result != ISC_R_SUCCESS) {
 		if (data != NULL) {
-			const char *estr = isc_result_totext(result);
+			const char *estr = isc_result_totext(conn->result);
 			if (isccc_cc_definestring(data, "err", estr) == NULL) {
 				goto cleanup;
 			}
@@ -367,13 +364,15 @@ control_respond(isc_nmhandle_t *handle, controlconnection_t *conn) {

 	isc_nmhandle_detach(&conn->cmdhandle);

-	isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
+	result = isc_nm_send(conn->sendhandle, &r, control_senddone, conn);
+	if (result != ISC_R_SUCCESS) {
+		isc_nmhandle_detach(&conn->sendhandle);
+		conn->sending = false;
+	}

 	return;
-
 cleanup:
 	conn_cleanup(conn);
-	isc_nmhandle_detach(&conn->cmdhandle);
 }

 static void
@@ -383,15 +382,15 @@ control_command(isc_task_t *task, isc_event_t *event) {

 	UNUSED(task);

-	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
-		conn_cleanup(conn);
+	if (listener->controls->shuttingdown) {
 		isc_nmhandle_detach(&conn->cmdhandle);
+		conn_cleanup(conn);
 		goto done;
 	}

 	conn->result = named_control_docommand(conn->request,
 					       listener->readonly, &conn->text);
-	control_respond(conn->cmdhandle, conn);
+	control_respond(conn->cmdhandle, conn->result, conn);

 done:
 	isc_event_free(&event);
@@ -410,14 +409,13 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	conn->reading = false;

 	/* Is the server shutting down? */
-	if (atomic_load_acquire(&listener->controls->shuttingdown)) {
+	if (listener->controls->shuttingdown) {
 		goto cleanup_readhandle;
 	}

 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_CANCELED) {
-			atomic_store_release(&listener->controls->shuttingdown,
-					     true);
+			listener->controls->shuttingdown = true;
 		} else if (result != ISC_R_EOF) {
 			log_invalid(&conn->ccmsg, result);
 		}
@@ -497,11 +495,9 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	/*
 	 * Duplicate suppression (required for UDP).
 	 */
-	LOCK(&listener->controls->symtab_lock);
 	isccc_cc_cleansymtab(listener->controls->symtab, conn->now);
 	result = isccc_cc_checkdup(listener->controls->symtab, conn->request,
 				   conn->now);
-	UNLOCK(&listener->controls->symtab_lock);
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_EXISTS) {
 			result = ISCCC_R_DUPLICATE;
@@ -532,7 +528,7 @@ control_recvmessage(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 			isc_nonce_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		conn->result = ISC_R_SUCCESS;
-		control_respond(handle, conn);
+		control_respond(handle, result, conn);
 		return;
 	}

@@ -573,9 +569,7 @@ conn_reset(void *arg) {
 		return;
 	}

-	LOCK(&listener->connections_lock);
 	ISC_LIST_UNLINK(listener->connections, conn, link);
-	UNLOCK(&listener->connections_lock);
 #ifdef ENABLE_AFL
 	if (named_g_fuzz_type == isc_fuzz_rndc) {
 		named_fuzz_notify();
@@ -593,12 +587,14 @@ conn_put(void *arg) {
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 		      "freeing control connection");
+
 	maybe_free_listener(listener);
 }

-static void
+static isc_result_t
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	controlconnection_t *conn = NULL;
+	isc_result_t result;

 	conn = isc_nmhandle_getdata(handle);
 	if (conn == NULL) {
@@ -607,7 +603,6 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 			      "allocate new control connection");
 		isc_nmhandle_setdata(handle, conn, conn_reset, conn_put);
-		isc_refcount_increment(&listener->refs);
 	}

 	*conn = (controlconnection_t){ .listener = listener,
@@ -619,14 +614,36 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);

-	LOCK(&listener->connections_lock);
-	ISC_LIST_INITANDAPPEND(listener->connections, conn, link);
-	UNLOCK(&listener->connections_lock);
+	ISC_LINK_INIT(conn, link);

 	isc_nmhandle_attach(handle, &conn->readhandle);
 	conn->reading = true;

-	isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage, conn);
+	result = isccc_ccmsg_readmessage(&conn->ccmsg, control_recvmessage,
+					 conn);
+	if (result != ISC_R_SUCCESS) {
+		isc_nmhandle_detach(&conn->readhandle);
+		conn->reading = false;
+		goto cleanup;
+	}
+
+	ISC_LIST_APPEND(listener->connections, conn, link);
+	return (ISC_R_SUCCESS);
+
+cleanup:
+	if (conn->buffer != NULL) {
+		isc_buffer_free(&conn->buffer);
+	}
+
+	isccc_ccmsg_invalidate(&conn->ccmsg);
+
+	isc_mem_put(listener->mctx, conn, sizeof(*conn));
+#ifdef ENABLE_AFL
+	if (named_g_fuzz_type == isc_fuzz_rndc) {
+		named_fuzz_notify();
+	}
+#endif /* ifdef ENABLE_AFL */
+	return (result);
 }

 static isc_result_t
@@ -634,6 +651,8 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	controllistener_t *listener = arg;
 	isc_sockaddr_t peeraddr;

+	listener->listening = false;
+
 	if (result != ISC_R_SUCCESS) {
 		if (result == ISC_R_CANCELED) {
 			shutdown_listener(listener);
@@ -652,7 +671,17 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		return (ISC_R_FAILURE);
 	}

-	newconnection(listener, handle);
+	result = newconnection(listener, handle);
+	if (result != ISC_R_SUCCESS) {
+		char socktext[ISC_SOCKADDR_FORMATSIZE];
+		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
+			      "dropped command channel from %s: %s", socktext,
+			      isc_result_totext(result));
+		return (result);
+	}
+
 	return (ISC_R_SUCCESS);
 }

@@ -676,7 +705,7 @@ controls_shutdown(named_controls_t *controls) {
 void
 named_controls_shutdown(named_controls_t *controls) {
 	controls_shutdown(controls);
-	atomic_store_release(&controls->shuttingdown, true);
+	controls->shuttingdown = true;
 }

 static isc_result_t
@@ -1100,11 +1129,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 					 .address = *addr,
 					 .type = type };
 	isc_mem_attach(mctx, &listener->mctx);
-	isc_mutex_init(&listener->connections_lock);
 	ISC_LINK_INIT(listener, link);
 	ISC_LIST_INIT(listener->keys);
 	ISC_LIST_INIT(listener->connections);
-	isc_refcount_init(&listener->refs, 1);

 	/*
 	 * Make the ACL.
@@ -1164,9 +1191,11 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}
 #endif

-	CHECK(isc_nm_listentcp(
-		named_g_netmgr, &listener->address, control_newconn, listener,
-		sizeof(controlconnection_t), 5, NULL, &listener->sock));
+	CHECK(isc_nm_listentcp(named_g_nm, (isc_nmiface_t *)&listener->address,
+			       control_newconn, listener,
+			       sizeof(controlconnection_t), 5, NULL,
+			       &listener->sock));
+	listener->listening = true;
 #if 0
 	/* XXX: no unix socket support yet */
 	if (type == isc_socktype_unix) {
@@ -1188,9 +1217,10 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	return;

 cleanup:
-	isc_refcount_decrement(&listener->refs);
-	listener->exiting = true;
-	free_listener(listener);
+	if (listener != NULL) {
+		listener->exiting = true;
+		free_listener(listener);
+	}

 	if (control != NULL) {
 		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
@@ -1460,20 +1490,15 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));

-	*controls = (named_controls_t){
-		.server = server,
-	};
-
+	if (controls == NULL) {
+		return (ISC_R_NOMEMORY);
+	}
+	controls->server = server;
 	ISC_LIST_INIT(controls->listeners);
-
-	atomic_init(&controls->shuttingdown, false);
-	isc_mutex_init(&controls->symtab_lock);
-	LOCK(&controls->symtab_lock);
+	controls->shuttingdown = false;
+	controls->symtab = NULL;
 	result = isccc_cc_createsymtab(&controls->symtab);
-	UNLOCK(&controls->symtab_lock);
-
 	if (result != ISC_R_SUCCESS) {
-		isc_mutex_destroy(&controls->symtab_lock);
 		isc_mem_put(server->mctx, controls, sizeof(*controls));
 		return (result);
 	}
@@ -1488,9 +1513,6 @@ named_controls_destroy(named_controls_t **ctrlsp) {

 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));

-	LOCK(&controls->symtab_lock);
 	isccc_symtab_destroy(&controls->symtab);
-	UNLOCK(&controls->symtab_lock);
-	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
 }
@@ -67,8 +67,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);

 isc_result_t
-named_config_getport(const cfg_obj_t *config, const char *type,
-		     in_port_t *portp);
+named_config_getport(const cfg_obj_t *config, in_port_t *portp);

 isc_result_t
 named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
@@ -62,7 +62,7 @@ EXTERN bool named_g_run_done INIT(false);
 */
 EXTERN isc_timermgr_t *named_g_timermgr INIT(NULL);
 EXTERN isc_socketmgr_t *named_g_socketmgr INIT(NULL);
-EXTERN isc_nm_t *named_g_netmgr INIT(NULL);
+EXTERN isc_nm_t *named_g_nm INIT(NULL);
 EXTERN cfg_parser_t *named_g_parser INIT(NULL);
 EXTERN cfg_parser_t *named_g_addparser INIT(NULL);
 EXTERN const char *named_g_version     INIT(PACKAGE_VERSION);
@@ -72,9 +72,6 @@ EXTERN const char *named_g_srcid       INIT(PACKAGE_SRCID);
 EXTERN const char *named_g_configargs  INIT(PACKAGE_CONFIGARGS);
 EXTERN const char *named_g_builder     INIT(PACKAGE_BUILDER);
 EXTERN in_port_t named_g_port	       INIT(0);
-EXTERN in_port_t named_g_tlsport       INIT(0);
-EXTERN in_port_t named_g_httpsport     INIT(0);
-EXTERN in_port_t named_g_httpport      INIT(0);
 EXTERN isc_dscp_t named_g_dscp	       INIT(-1);

 EXTERN named_server_t *named_g_server INIT(NULL);
@@ -39,7 +39,6 @@
 #define NAMED_EVENT_RELOAD  (NAMED_EVENTCLASS + 0)
 #define NAMED_EVENT_DELZONE (NAMED_EVENTCLASS + 1)
 #define NAMED_EVENT_COMMAND (NAMED_EVENTCLASS + 2)
-#define NAMED_EVENT_TATSEND (NAMED_EVENTCLASS + 3)

 /*%
 * Name server state.  Better here than in lots of separate global variables.
@@ -82,7 +81,7 @@ struct named_server {
 	uint32_t interface_interval;
 	uint32_t heartbeat_interval;

-	atomic_int reload_status;
+	named_reload_t reload_status;

 	bool flushonshutdown;

@@ -1,41 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#pragma once
-
-/*! \file */
-
-#include <isc/lang.h>
-#include <isc/types.h>
-
-#include <dns/transport.h>
-
-#include <isccfg/cfg.h>
-
-ISC_LANG_BEGINDECLS
-
-isc_result_t
-named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			    isc_mem_t *mctx, dns_transport_list_t **listp);
-/*%<
- * Create a list of transport objects (DoT or DoH) and configure them
- * according to 'key-file', 'cert-file', 'ca-file' or 'hostname'
- * statements.
- *
- *	Requires:
- *	\li	'config' is not NULL.
- *	\li	'vconfig' is not NULL.
- *	\li	'mctx' is not NULL
- *	\li	'listp' is not NULL, and '*listp' is NULL
- *
- */
-
-ISC_LANG_ENDDECLS
@@ -43,9 +43,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 */

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx);
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
 /*%<
 * If 'zone' can be safely reconfigured according to the configuration
 * data in 'zconfig', return true.  If the configuration data is so
@@ -53,15 +51,6 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 * and recreated, return false.
 */

-bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx);
-/*%<
- * Determine if zone uses inline-signing. This is true if inline-signing
- * is set to yes, or if there is a dnssec-policy on a non-dynamic zone.
- */
-
 isc_result_t
 named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 				   dns_rdataclass_t rdclass, dns_name_t *name);
@@ -18,10 +18,6 @@
 #include <string.h>
 #include <uv.h>

-#ifdef HAVE_DNSTAP
-#include <protobuf-c/protobuf-c.h>
-#endif
-
 #include <isc/app.h>
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
@@ -31,7 +27,6 @@
 #include <isc/hash.h>
 #include <isc/hp.h>
 #include <isc/httpd.h>
-#include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
 #include <isc/platform.h>
@@ -101,7 +96,6 @@
 #ifdef HAVE_ZLIB
 #include <zlib.h>
 #endif /* ifdef HAVE_ZLIB */
-#include <nghttp2/nghttp2.h>
 /*
 * Include header files for database drivers here.
 */
@@ -206,6 +200,8 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond) {
 	void *tracebuf[BACKTRACE_MAXFRAME];
 	int nframes;
+	isc_result_t result;
+	const char *logsuffix = "";

 	/*
 	 * Handle assertion failures.
@@ -218,23 +214,32 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 */
 		isc_assertion_setcallback(NULL);

-		nframes = isc_backtrace(tracebuf, BACKTRACE_MAXFRAME);
+		result = isc_backtrace_gettrace(tracebuf, BACKTRACE_MAXFRAME,
+						&nframes);
+		if (result == ISC_R_SUCCESS && nframes > 0) {
+			logsuffix = ", back trace";
+		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "%s:%d: %s(%s) failed%s", file, line,
-			      isc_assertion_typetotext(type), cond,
-			      (nframes > 0) ? ", back trace" : "");
-		if (nframes > 0) {
-			char **strs = isc_backtrace_symbols(tracebuf, nframes);
-			if (strs != NULL) {
-				for (int i = 0; i < nframes; i++) {
-					isc_log_write(named_g_lctx,
-						      NAMED_LOGCATEGORY_GENERAL,
-						      NAMED_LOGMODULE_MAIN,
-						      ISC_LOG_CRITICAL, "%s",
-						      strs[i]);
-				}
+			      isc_assertion_typetotext(type), cond, logsuffix);
+		if (result == ISC_R_SUCCESS) {
+#if HAVE_BACKTRACE_SYMBOLS
+			char **strs = backtrace_symbols(tracebuf, nframes);
+			for (int i = 0; i < nframes; i++) {
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
+					      NAMED_LOGMODULE_MAIN,
+					      ISC_LOG_CRITICAL, "%s", strs[i]);
 			}
+#else  /* HAVE_BACKTRACE_SYMBOLS */
+			for (int i = 0; i < nframes; i++) {
+				isc_log_write(
+					named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+					NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+					"#%d %p in ??", i, tracebuf[i]);
+			}
+#endif /* HAVE_BACKTRACE_SYMBOLS */
 		}
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
@@ -320,14 +325,11 @@ library_unexpected_error(const char *file, int line, const char *format,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment] [-E engine]\n"
-			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
-			"[-p port] [-s]\n"
-			"             [-S sockets] [-t chrootdir] [-u "
-			"username] [-U listeners]\n"
-			"             [-X lockfile] [-m "
-			"{usage|trace|record|size|mctx}]\n"
-			"             [-M fill|nofill]\n"
+			"[-E engine] [-f|-g]\n"
+			"             [-n number_of_cpus] [-p port] [-s] "
+			"[-S sockets] [-t chrootdir]\n"
+			"             [-u username] [-U listeners] "
+			"[-m {usage|trace|record|size|mctx}]\n"
 			"usage: named [-v|-V]\n");
 }

@@ -433,7 +435,8 @@ static struct flag_def {
 			{ "size", ISC_MEM_DEBUGSIZE, false },
 			{ "mctx", ISC_MEM_DEBUGCTX, false },
 			{ NULL, 0, false } },
-  mem_context_flags[] = { { "fill", ISC_MEMFLAG_FILL, false },
+  mem_context_flags[] = { { "external", ISC_MEMFLAG_INTERNAL, true },
+			  { "fill", ISC_MEMFLAG_FILL, false },
 			  { "nofill", ISC_MEMFLAG_FILL, true },
 			  { NULL, 0, false } };

@@ -485,7 +488,6 @@ printversion(bool verbose) {
 	cfg_obj_t *config = NULL;
 	const cfg_obj_t *defaults = NULL, *obj = NULL;
 #endif /* if defined(HAVE_GEOIP2) */
-	nghttp2_info *nginfo = NULL;

 	printf("%s%s <id:%s>\n", PACKAGE_STRING, PACKAGE_DESCRIPTION,
 	       PACKAGE_SRCID);
@@ -527,9 +529,6 @@ printversion(bool verbose) {
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
-	printf("compiled with libnghttp2 version: %s\n", NGHTTP2_VERSION);
-	nginfo = nghttp2_version(1);
-	printf("linked to libnghttp2 version: %s\n", nginfo->version_str);
 #ifdef HAVE_LIBXML2
 	printf("compiled with libxml2 version: %s\n", LIBXML_DOTTED_VERSION);
 	printf("linked to libxml2 version: %s\n", xmlParserVersion);
@@ -704,52 +703,10 @@ parse_T_opt(char *option) {
 	}
 }

-static void
-parse_port(char *arg) {
-	enum { DNSPORT, TLSPORT, HTTPSPORT, HTTPPORT } ptype = DNSPORT;
-	char *value = arg;
-	int port;
-
-	if (strncmp(arg, "dns=", 4) == 0) {
-		value = arg + 4;
-	} else if (strncmp(arg, "tls=", 4) == 0) {
-		value = arg + 4;
-		ptype = TLSPORT;
-	} else if (strncmp(arg, "https=", 6) == 0) {
-		value = arg + 6;
-		ptype = HTTPSPORT;
-	} else if (strncmp(arg, "http=", 5) == 0) {
-		value = arg + 6;
-		ptype = HTTPPORT;
-	}
-
-	port = parse_int(value, "port");
-	if (port < 1 || port > 65535) {
-		named_main_earlyfatal("port '%s' out of range", value);
-	}
-
-	switch (ptype) {
-	case DNSPORT:
-		named_g_port = port;
-		break;
-	case TLSPORT:
-		named_g_tlsport = port;
-		break;
-	case HTTPSPORT:
-		named_g_httpsport = port;
-		break;
-	case HTTPPORT:
-		named_g_httpport = port;
-		break;
-	default:
-		INSIST(0);
-		ISC_UNREACHABLE();
-	}
-}
-
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
+	int port;
 	const char *p;

 	save_command_line(argc, argv);
@@ -831,7 +788,12 @@ parse_command_line(int argc, char *argv[]) {
 			}
 			break;
 		case 'p':
-			parse_port(isc_commandline_argument);
+			port = parse_int(isc_commandline_argument, "port");
+			if (port < 1 || port > 65535) {
+				named_main_earlyfatal("port '%s' out of range",
+						      isc_commandline_argument);
+			}
+			named_g_port = port;
 			break;
 		case 's':
 			/* XXXRTH temporary syntax */
@@ -938,17 +900,45 @@ create_managers(void) {
 		      "using %u UDP listener%s per interface", named_g_udpdisp,
 		      named_g_udpdisp == 1 ? "" : "s");

-	result = isc_managers_create(named_g_mctx, named_g_cpus,
-				     0 /* quantum */, maxsocks, &named_g_netmgr,
-				     &named_g_taskmgr, &named_g_timermgr,
-				     &named_g_socketmgr);
-	if (result != ISC_R_SUCCESS) {
-		return (result);
+	/*
+	 * We have ncpus network threads, ncpus worker threads, ncpus
+	 * old network threads - make it 4x just to be safe. The memory
+	 * impact is negligible.
+	 */
+	isc_hp_init(4 * named_g_cpus);
+	named_g_nm = isc_nm_start(named_g_mctx, named_g_cpus);
+	if (named_g_nm == NULL) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__, "isc_nm_start() failed");
+		return (ISC_R_UNEXPECTED);
 	}

-	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
-	isc_nm_maxudp(named_g_netmgr, maxudp);
+	result = isc_taskmgr_create(named_g_mctx, named_g_cpus, 0, named_g_nm,
+				    &named_g_taskmgr);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_taskmgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}

+	result = isc_timermgr_create(named_g_mctx, &named_g_timermgr);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_timermgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+
+	result = isc_socketmgr_create2(named_g_mctx, &named_g_socketmgr,
+				       maxsocks, named_g_cpus);
+	if (result != ISC_R_SUCCESS) {
+		UNEXPECTED_ERROR(__FILE__, __LINE__,
+				 "isc_socketmgr_create() failed: %s",
+				 isc_result_totext(result));
+		return (ISC_R_UNEXPECTED);
+	}
+	isc_socketmgr_maxudp(named_g_socketmgr, maxudp);
+	isc_nm_maxudp(named_g_nm, maxudp);
 	result = isc_socketmgr_getmaxsockets(named_g_socketmgr, &socks);
 	if (result == ISC_R_SUCCESS) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -961,8 +951,25 @@ create_managers(void) {

 static void
 destroy_managers(void) {
-	isc_managers_destroy(&named_g_netmgr, &named_g_taskmgr,
-			     &named_g_timermgr, &named_g_socketmgr);
+	/*
+	 * isc_nm_closedown() closes all active connections, freeing
+	 * attached clients and other resources and preventing new
+	 * connections from being established, but it not does not
+	 * stop all processing or destroy the netmgr yet.
+	 */
+	isc_nm_closedown(named_g_nm);
+
+	/*
+	 * isc_taskmgr_destroy() will block until all tasks have exited.
+	 */
+	isc_taskmgr_destroy(&named_g_taskmgr);
+	isc_timermgr_destroy(&named_g_timermgr);
+	isc_socketmgr_destroy(&named_g_socketmgr);
+
+	/*
+	 * At this point is safe to destroy the netmgr.
+	 */
+	isc_nm_destroy(&named_g_nm);
 }

 static void
@@ -1472,6 +1479,15 @@ main(int argc, char *argv[]) {
 	pk11_result_register();
 #endif /* if USE_PKCS11 */

+#if !ISC_MEM_DEFAULTFILL
+	/*
+	 * Update the default flags to remove ISC_MEMFLAG_FILL
+	 * before we parse the command line. If disabled here,
+	 * it can be turned back on with -M fill.
+	 */
+	isc_mem_defaultflags &= ~ISC_MEMFLAG_FILL;
+#endif /* if !ISC_MEM_DEFAULTFILL */
+
 	parse_command_line(argc, argv);

 #ifdef ENABLE_AFL
@@ -1502,7 +1518,7 @@ main(int argc, char *argv[]) {
 	}

 	isc_mem_create(&named_g_mctx);
-	isc_mem_setname(named_g_mctx, "main");
+	isc_mem_setname(named_g_mctx, "main", NULL);

 	setup();

@@ -66,12 +66,9 @@ DNSSEC-POLICY
  	keys { ( csk | ksk | zsk ) [ ( key-directory ) ] lifetime
  	    duration_or_unlimited algorithm string [ integer ]; ... };
  	max-zone-ttl duration;
-  	nsec3param [ iterations integer ] [ optout boolean ] [
-  	    salt-length integer ];
  	parent-ds-ttl duration;
  	parent-propagation-delay duration;
  	publish-safety duration;
-  	purge-keys duration;
  	retire-safety duration;
  	signatures-refresh duration;
  	signatures-validity duration;
@@ -87,15 +84,6 @@ DYNDB
  dyndb string quoted_string {
      unspecified-text };

-HTTP
-^^^^
-
-::
-
-  http string {
-  	endpoints { quoted_string; ... };
-  };
-
 KEY
 ^^^

@@ -147,8 +135,7 @@ MASTERS
  masters string [ port integer ] [ dscp
      integer ] { ( primaries | ipv4_address
      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ] [ tls
-      string ]; ... };
+      integer ] ) [ key string ]; ... };

 OPTIONS
 ^^^^^^^
@@ -169,14 +156,14 @@ OPTIONS
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
+  	    integer ] ) [ key string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
  	    * ) ] [ dscp integer ];
  	answer-cookie boolean;
  	attach-cache string;
-  	auth-nxdomain boolean;
+  	auth-nxdomain boolean; // default changed
  	auto-dnssec ( allow | maintain | off );
  	automatic-interface-scan boolean;
  	avoid-v4-udp-ports { portrange; ... };
@@ -187,9 +174,8 @@ OPTIONS
  	catalog-zones { zone string [ default-masters [ port integer ]
  	    [ dscp integer ] { ( primaries | ipv4_address [ port
  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ] [ tls string ]; ... } ] [ zone-directory
-  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
-  	    duration ]; ... };
+  	    string ]; ... } ] [ zone-directory quoted_string ] [
+  	    in-memory boolean ] [ min-update-interval duration ]; ... };
  	check-dup-records ( fail | warn | ignore );
  	check-integrity boolean;
  	check-mx ( fail | warn | ignore );
@@ -274,24 +260,23 @@ OPTIONS
  	glue-cache boolean;// deprecated
  	heartbeat-interval integer;
  	hostname ( quoted_string | none );
-  	http-port integer;
-  	https-port integer;
+  	https-endpoint quoted_string https-server string;
+  	https-server string [ port integer ] tls string { (
+  	    quoted_string [ port integer ] [ dscp integer ] |
+  	    ipv4_address [ port integer ] [ dscp integer ] |
+  	    ipv6_address [ port integer ] [ dscp integer ] ); ... };
+  	inline-signing boolean;
  	interface-interval duration;
-  	ipv4only-contact string;
-  	ipv4only-enable boolean;
-  	ipv4only-server string;
  	ixfr-from-differences ( primary | master | secondary | slave |
  	    boolean );
  	keep-response-order { address_match_element; ... };
  	key-directory quoted_string;
  	lame-ttl duration;
  	listen-on [ port integer ] [ dscp
-  	    integer ] [ tls string ] [ http
-  	    string ] {
+  	    integer ] [ tls string ] {
  	    address_match_element; ... };
  	listen-on-v6 [ port integer ] [ dscp
-  	    integer ] [ tls string ] [ http
-  	    string ] {
+  	    integer ] [ tls string ] {
  	    address_match_element; ... };
  	lmdb-mapsize sizeval;
  	lock-file ( quoted_string | none );
@@ -418,11 +403,9 @@ OPTIONS
  	sig-validity-interval integer [ integer ];
  	sortlist { address_match_element; ... };
  	stacksize ( default | unlimited | sizeval );
-  	stale-answer-client-timeout ( disabled | off | integer );
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
  	stale-cache-enable boolean;
-  	stale-refresh-time duration;
  	startup-notify-rate integer;
  	statistics-file quoted_string;
  	synth-from-dnssec boolean;
@@ -432,13 +415,10 @@ OPTIONS
  	tcp-initial-timeout integer;
  	tcp-keepalive-timeout integer;
  	tcp-listen-queue integer;
-  	tcp-receive-buffer integer;
-  	tcp-send-buffer integer;
  	tkey-dhkey quoted_string integer;
  	tkey-domain quoted_string;
  	tkey-gssapi-credential quoted_string;
  	tkey-gssapi-keytab quoted_string;
-  	tls-port integer;
  	transfer-format ( many-answers | one-answer );
  	transfer-message-size integer;
  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
@@ -450,8 +430,6 @@ OPTIONS
  	transfers-per-ns integer;
  	trust-anchor-telemetry boolean; // experimental
  	try-tcp-refresh boolean;
-  	udp-receive-buffer integer;
-  	udp-send-buffer integer;
  	update-check-ksk boolean;
  	use-alt-transfer-source boolean;
  	use-v4-udp-ports { portrange; ... };
@@ -480,8 +458,7 @@ PRIMARIES
  primaries string [ port integer ] [ dscp
      integer ] { ( primaries | ipv4_address
      [ port integer ] | ipv6_address [ port
-      integer ] ) [ key string ] [ tls
-      string ]; ... };
+      integer ] ) [ key string ]; ... };

 SERVER
 ^^^^^^
@@ -539,13 +516,8 @@ TLS
 ::

  tls string {
-  	ca-file quoted_string;
  	cert-file quoted_string;
-  	ciphers string; // experimental
-  	dh-param quoted_string; // experimental
-  	hostname quoted_string;
  	key-file quoted_string;
-  	protocols sslprotos; // experimental
  };

 TRUST-ANCHORS
@@ -588,21 +560,20 @@ VIEW
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
+  	    integer ] ) [ key string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
  	    * ) ] [ dscp integer ];
  	attach-cache string;
-  	auth-nxdomain boolean;
+  	auth-nxdomain boolean; // default changed
  	auto-dnssec ( allow | maintain | off );
  	cache-file quoted_string;
  	catalog-zones { zone string [ default-masters [ port integer ]
  	    [ dscp integer ] { ( primaries | ipv4_address [ port
  	    integer ] | ipv6_address [ port integer ] ) [ key
-  	    string ] [ tls string ]; ... } ] [ zone-directory
-  	    quoted_string ] [ in-memory boolean ] [ min-update-interval
-  	    duration ]; ... };
+  	    string ]; ... } ] [ zone-directory quoted_string ] [
+  	    in-memory boolean ] [ min-update-interval duration ]; ... };
  	check-dup-records ( fail | warn | ignore );
  	check-integrity boolean;
  	check-mx ( fail | warn | ignore );
@@ -669,9 +640,8 @@ VIEW
  	forwarders [ port integer ] [ dscp integer ] { ( ipv4_address
  	    | ipv6_address ) [ port integer ] [ dscp integer ]; ... };
  	glue-cache boolean;// deprecated
-  	ipv4only-contact string;
-  	ipv4only-enable boolean;
-  	ipv4only-server string;
+  	https-endpoint quoted_string https-server string;
+  	inline-signing boolean;
  	ixfr-from-differences ( primary | master | secondary | slave |
  	    boolean );
  	key string {
@@ -829,11 +799,9 @@ VIEW
  	sig-signing-type integer;
  	sig-validity-interval integer [ integer ];
  	sortlist { address_match_element; ... };
-  	stale-answer-client-timeout ( disabled | off | integer );
  	stale-answer-enable boolean;
  	stale-answer-ttl duration;
  	stale-cache-enable boolean;
-  	stale-refresh-time duration;
  	synth-from-dnssec boolean;
  	transfer-format ( many-answers | one-answer );
  	transfer-source ( ipv4_address | * ) [ port ( integer | * ) ] [
@@ -865,8 +833,8 @@ VIEW
  		allow-update-forwarding { address_match_element; ... };
  		also-notify [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
+  		    ipv6_address [ port integer ] ) [ key string ];
+  		    ... };
  		alt-transfer-source ( ipv4_address | * ) [ port (
  		    integer | * ) ] [ dscp integer ];
  		alt-transfer-source-v6 ( ipv6_address | * ) [ port (
@@ -906,8 +874,8 @@ VIEW
  		masterfile-style ( full | relative );
  		masters [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
+  		    ipv6_address [ port integer ] ) [ key string ];
+  		    ... };
  		max-ixfr-ratio ( unlimited | percentage );
  		max-journal-size ( default | unlimited | sizeval );
  		max-records integer;
@@ -930,8 +898,8 @@ VIEW
  		notify-to-soa boolean;
  		primaries [ port integer ] [ dscp integer ] { (
  		    primaries | ipv4_address [ port integer ] |
-  		    ipv6_address [ port integer ] ) [ key string ] [
-  		    tls string ]; ... };
+  		    ipv6_address [ port integer ] ) [ key string ];
+  		    ... };
  		request-expire boolean;
  		request-ixfr boolean;
  		serial-update-method ( date | increment | unixtime );
@@ -976,7 +944,7 @@ ZONE
  	allow-update-forwarding { address_match_element; ... };
  	also-notify [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
+  	    integer ] ) [ key string ]; ... };
  	alt-transfer-source ( ipv4_address | * ) [ port ( integer | * )
  	    ] [ dscp integer ];
  	alt-transfer-source-v6 ( ipv6_address | * ) [ port ( integer |
@@ -1014,7 +982,7 @@ ZONE
  	masterfile-style ( full | relative );
  	masters [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
+  	    integer ] ) [ key string ]; ... };
  	max-ixfr-ratio ( unlimited | percentage );
  	max-journal-size ( default | unlimited | sizeval );
  	max-records integer;
@@ -1037,7 +1005,7 @@ ZONE
  	notify-to-soa boolean;
  	primaries [ port integer ] [ dscp integer ] { ( primaries |
  	    ipv4_address [ port integer ] | ipv6_address [ port
-  	    integer ] ) [ key string ] [ tls string ]; ... };
+  	    integer ] ) [ key string ]; ... };
  	request-expire boolean;
  	request-ixfr boolean;
  	serial-update-method ( date | increment | unixtime );
@@ -72,9 +72,9 @@ Options
   When applicable, this option specifies the hardware to use for cryptographic
   operations, such as a secure key store used for signing.

-   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
-   engine identifier that drives the cryptographic accelerator or
-   hardware service module (usually ``pkcs11``). When BIND is
+   When BIND is built with OpenSSL PKCS#11 support, this defaults to the
+   string ``pkcs11``, which identifies an OpenSSL engine that can drive a
+   cryptographic accelerator or hardware service module. When BIND is
   built with native PKCS#11 cryptography (``--enable-native-pkcs11``), it
   defaults to the path of the PKCS#11 provider library specified via
   ``--with-pkcs11``.
@@ -108,18 +108,10 @@ Options
   present and creates one thread per CPU. If it is unable to determine
   the number of CPUs, a single worker thread is created.

-``-p value``
-   This option specifies the port(s) on which the server will listen
-   for queries. If ``value`` is of the form ``<portnum>`` or
-   ``dns=<portnum>``, the server will listen for DNS queries on
-   ``portnum``; if not not specified, the default is port 53. If
-   ``value`` is of the form ``tls=<portnum>``, the server will
-   listen for TLS queries on ``portnum``; the default is 853.
-   If ``value`` is of the form ``https=<portnum>``, the server will
-   listen for HTTPS queries on ``portnum``; the default is 443.
-   If ``value`` is of the form ``http=<portnum>``, the server will
-   listen for HTTP queries on ``portnum``; the default is 80.
-   
+``-p port``
+   This option listens for queries on ``port``. If not specified, the default is
+   port 53.
+
 ``-s``
   This option writes memory usage statistics to ``stdout`` on exit.

@@ -239,4 +231,4 @@ Files
 See Also
 ~~~~~~~~

-:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :manpage:`named-checkconf(8)`, :manpage:`named-checkzone(8)`, :manpage:`rndc(8)`, :manpage:`named.conf(5)`, BIND 9 Administrator Reference Manual.
+:rfc:`1033`, :rfc:`1034`, :rfc:`1035`, :manpage:`named-checkconf(8)`, :manpage:`named-checkzone(8)`, :manpage:`rndc(8), :manpage:`named.conf(5)`, BIND 9 Administrator Reference Manual.
@@ -2336,12 +2336,12 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	TRY0(xmlTextWriterEndElement(writer)); /* /statistics */
 	TRY0(xmlTextWriterEndDocument(writer));

+	xmlFreeTextWriter(writer);
+
 	xmlDocDumpFormatMemoryEnc(doc, buf, buflen, "UTF-8", 0);
 	if (*buf == NULL) {
 		goto cleanup;
 	}
-
-	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
 	return (ISC_R_SUCCESS);

@@ -3612,7 +3612,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 		CHECK(ISC_R_FAMILYNOSUPPORT);
 	}

-	CHECK(isc_httpdmgr_create(named_g_netmgr, server->mctx, addr, client_ok,
+	CHECK(isc_httpdmgr_create(named_g_nm, server->mctx, addr, client_ok,
 				  destroy_listener, listener,
 				  &listener->httpdmgr));

@@ -1,201 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <inttypes.h>
-
-#include <isc/buffer.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-#include <dns/name.h>
-#include <dns/transport.h>
-
-#include <isccfg/cfg.h>
-
-#include <named/log.h>
-#include <named/transportconf.h>
-
-#define create_name(id, name)                                      \
-	isc_buffer_t namesrc, namebuf;                             \
-	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
-	dns_name_init(name, NULL);                                 \
-	isc_buffer_constinit(&namesrc, id, strlen(id));            \
-	isc_buffer_add(&namesrc, strlen(id));                      \
-	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
-				    DNS_NAME_DOWNCASE, &namebuf)); \
-	if (result != ISC_R_SUCCESS) {                             \
-		goto failure;                                      \
-	}
-
-#define parse_transport_option(map, transport, name, setter)      \
-	{                                                         \
-		const cfg_obj_t *obj = NULL;                      \
-		cfg_map_get(map, name, &obj);                     \
-		if (obj != NULL) {                                \
-			setter(transport, cfg_obj_asstring(obj)); \
-		}                                                 \
-	}
-
-static isc_result_t
-add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
-	const cfg_obj_t *doh = NULL;
-	const char *dohid = NULL;
-	isc_result_t result;
-
-	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
-	     element != NULL; element = cfg_list_next(element))
-	{
-		dns_name_t dohname;
-		dns_transport_t *transport;
-
-		doh = cfg_listelt_value(element);
-		dohid = cfg_obj_asstring(cfg_map_getname(doh));
-
-		create_name(dohid, &dohname);
-
-		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
-					      list);
-
-		parse_transport_option(doh, transport, "key-file",
-				       dns_transport_set_keyfile);
-		parse_transport_option(doh, transport, "cert-file",
-				       dns_transport_set_certfile);
-		parse_transport_option(doh, transport, "ca-file",
-				       dns_transport_set_cafile);
-		parse_transport_option(doh, transport, "hostname",
-				       dns_transport_set_hostname);
-	}
-
-	return (ISC_R_SUCCESS);
-failure:
-	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring DoH '%s': %s", dohid,
-		    isc_result_totext(result));
-
-	return (result);
-}
-
-static isc_result_t
-add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
-	const cfg_obj_t *tls = NULL;
-	const char *tlsid = NULL;
-	isc_result_t result;
-
-	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
-	     element != NULL; element = cfg_list_next(element))
-	{
-		dns_name_t tlsname;
-		dns_transport_t *transport;
-
-		tls = cfg_listelt_value(element);
-		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
-
-		if (!strcmp(tlsid, "ephemeral")) {
-			result = ISC_R_UNEXPECTEDTOKEN;
-			goto failure;
-		}
-
-		create_name(tlsid, &tlsname);
-
-		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
-					      list);
-
-		parse_transport_option(tls, transport, "key-file",
-				       dns_transport_set_keyfile);
-		parse_transport_option(tls, transport, "cert-file",
-				       dns_transport_set_certfile);
-		parse_transport_option(tls, transport, "ca-file",
-				       dns_transport_set_cafile);
-		parse_transport_option(tls, transport, "hostname",
-				       dns_transport_set_hostname);
-	}
-
-	return (ISC_R_SUCCESS);
-failure:
-	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
-		    "configuring tls '%s': %s", tlsid,
-		    isc_result_totext(result));
-
-	return (result);
-}
-
-#define CHECK(f)                             \
-	if ((result = f) != ISC_R_SUCCESS) { \
-		goto failure;                \
-	}
-
-static isc_result_t
-transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
-	const cfg_obj_t *obj = NULL;
-	isc_result_t result = ISC_R_SUCCESS;
-
-	if (result == ISC_R_SUCCESS &&
-	    cfg_map_get(config, "tls", &obj) == ISC_R_SUCCESS)
-	{
-		result = add_tls_transports(obj, list);
-		obj = NULL;
-	}
-
-	if (result == ISC_R_SUCCESS &&
-	    cfg_map_get(config, "doh", &obj) == ISC_R_SUCCESS)
-	{
-		result = add_doh_transports(obj, list);
-		obj = NULL;
-	}
-
-	return (result);
-}
-
-static void
-transport_list_add_ephemeral(dns_transport_list_t *list) {
-	isc_result_t result;
-	dns_name_t tlsname;
-
-	create_name("ephemeral", &tlsname);
-
-	(void)dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
-
-	return;
-failure:
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-}
-
-isc_result_t
-named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
-			    isc_mem_t *mctx, dns_transport_list_t **listp) {
-	isc_result_t result;
-	dns_transport_list_t *list = dns_transport_list_new(mctx);
-
-	REQUIRE(listp != NULL && *listp == NULL);
-
-	transport_list_add_ephemeral(list);
-
-	if (config != NULL) {
-		result = transport_list_fromconfig(config, list);
-		if (result != ISC_R_SUCCESS) {
-			goto failure;
-		}
-	}
-
-	if (vconfig != NULL) {
-		config = cfg_tuple_get(vconfig, "options");
-		transport_list_fromconfig(config, list);
-	}
-
-	*listp = list;
-	return (ISC_R_SUCCESS);
-failure:
-	dns_transport_list_detach(&list);
-	return (result);
-}
@@ -10,11 +10,11 @@
 */

 #include <inttypes.h>
+#include <ltdl.h>
 #include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
-#include <uv.h>

 #include <isc/mem.h>
 #include <isc/print.h>
@@ -34,7 +34,7 @@ typedef struct dlopen_data {
 	isc_mem_t *mctx;
 	char *dl_path;
 	char *dlzname;
-	uv_lib_t dl_handle;
+	void *dl_handle;
 	void *dbdata;
 	unsigned int flags;
 	isc_mutex_t lock;
@@ -180,10 +180,9 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 */
 static void *
 dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
-	void *ptr = NULL;
-	int r = uv_dlsym(&cd->dl_handle, symbol, &ptr);
-	if (r != 0) {
-		const char *errmsg = uv_dlerror(&cd->dl_handle);
+	void *ptr = lt_dlsym((lt_dlhandle)cd->dl_handle, symbol);
+	if (ptr == NULL) {
+		const char *errmsg = lt_dlerror();
 		if (errmsg == NULL) {
 			errmsg = "returned function pointer is NULL";
 		}
@@ -194,13 +193,11 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 				   cd->dl_path, symbol, errmsg);
 		}
 	}
-
+	/* Cleanup any errors */
+	(void)lt_dlerror();
 	return (ptr);
 }

-static void
-dlopen_dlz_destroy(void *driverarg, void *dbdata);
-
 /*
 * Called at startup for each dlopen zone in named.conf
 */
@@ -210,7 +207,6 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	dlopen_data_t *cd;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_FAILURE;
-	int r;

 	UNUSED(driverarg);

@@ -222,6 +218,10 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		return (ISC_R_FAILURE);
 	}

+	if (lt_dlinit() != 0) {
+		return (ISC_R_FAILURE);
+	}
+
 	isc_mem_create(&mctx);
 	cd = isc_mem_get(mctx, sizeof(*cd));
 	memset(cd, 0, sizeof(*cd));
@@ -234,19 +234,17 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	/* Initialize the lock */
 	isc_mutex_init(&cd->lock);

-	r = uv_dlopen(cd->dl_path, &cd->dl_handle);
-	if (r != 0) {
-		const char *errmsg = uv_dlerror(&cd->dl_handle);
-		if (errmsg == NULL) {
-			errmsg = "unknown error";
-		}
+	cd->dl_handle = lt_dlopenext(cd->dl_path);
+	if (cd->dl_handle == NULL) {
 		dlopen_log(ISC_LOG_ERROR,
 			   "dlz_dlopen failed to open library '%s': %s",
-			   cd->dl_path, errmsg);
+			   cd->dl_path, lt_dlerror());
 		result = ISC_R_FAILURE;
 		goto failed;
 	}

+	(void)lt_dlerror();
+
 	/* Find the symbols */
 	cd->dlz_version =
 		(dlz_dlopen_version_t *)dl_load_symbol(cd, "dlz_version", true);
@@ -325,8 +323,15 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

-	dlopen_dlz_destroy(NULL, cd);
+	isc_mem_free(mctx, cd->dl_path);
+	isc_mem_free(mctx, cd->dlzname);

+	isc_mutex_destroy(&cd->lock);
+	if (cd->dl_handle) {
+		(void)lt_dlclose(cd->dl_handle);
+	}
+	isc_mem_put(mctx, cd, sizeof(*cd));
+	isc_mem_destroy(&mctx);
 	return (result);
 }

@@ -336,20 +341,32 @@ failed:
 static void
 dlopen_dlz_destroy(void *driverarg, void *dbdata) {
 	dlopen_data_t *cd = (dlopen_data_t *)dbdata;
+	isc_mem_t *mctx;

 	UNUSED(driverarg);

-	if (cd->dlz_destroy && cd->dbdata) {
+	if (cd->dlz_destroy) {
 		MAYBE_LOCK(cd);
 		cd->dlz_destroy(cd->dbdata);
 		MAYBE_UNLOCK(cd);
 	}

-	uv_dlclose(&cd->dl_handle);
+	if (cd->dl_path) {
+		isc_mem_free(cd->mctx, cd->dl_path);
+	}
+	if (cd->dlzname) {
+		isc_mem_free(cd->mctx, cd->dlzname);
+	}
+
+	if (cd->dl_handle) {
+		lt_dlclose(cd->dl_handle);
+	}
+
 	isc_mutex_destroy(&cd->lock);
-	isc_mem_free(cd->mctx, cd->dl_path);
-	isc_mem_free(cd->mctx, cd->dlzname);
-	isc_mem_putanddetach(&cd->mctx, cd, sizeof(*cd));
+
+	mctx = cd->mctx;
+	isc_mem_put(mctx, cd, sizeof(*cd));
+	isc_mem_destroy(&mctx);
 }

 /*
@@ -379,7 +379,7 @@ all_digits(const char *s) {
 		return (false);
 	}
 	while (*s != '\0') {
-		if (!isdigit((unsigned char)(*s))) {
+		if (!isdigit((*s) & 0xff)) {
 			return (false);
 		}
 		s++;
@@ -59,9 +59,6 @@
    <ClCompile Include="..\tkeyconf.c">
      <Filter>Source Files</Filter>
    </ClCompile>
-    <ClCompile Include="..\transportconf.c">
-      <Filter>Source Files</Filter>
-    </ClCompile>
    <ClCompile Include="..\tsigconf.c">
      <Filter>Source Files</Filter>
    </ClCompile>
@@ -114,9 +111,6 @@
    <ClInclude Include="..\include\named\tkeyconf.h">
      <Filter>Header Files</Filter>
    </ClInclude>
-    <ClInclude Include="..\include\named\transportconf.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
    <ClInclude Include="..\include\named\tsigconf.h">
      <Filter>Header Files</Filter>
    </ClInclude>
@@ -67,7 +67,7 @@
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@NGHTTP2_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@NGHTTP2_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -103,7 +103,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
-      <AdditionalIncludeDirectories>@LIBUV_INC@@NGHTTP2_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <AdditionalIncludeDirectories>@LIBUV_INC@@OPENSSL_INC@@GSSAPI_INC@@GEOIP_INC@.\;..\..\..\;@LIBXML2_INC@..\win32\include;..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;..\..\..\lib\bind9\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -114,7 +114,7 @@ perl -e "print \";\";" &gt;&gt; xsl.c
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@LIBUV_LIB@@NGHTTP2_LIB@@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@LIBUV_LIB@@OPENSSL_LIB@@LIBXML2_LIB@@GSSAPI_LIB@@GEOIP_LIB@libisc.lib;libdns.lib;libisccc.lib;libisccfg.lib;libbind9.lib;libns.lib;version.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PreBuildEvent>
      <Command>cd ..
@@ -138,7 +138,6 @@ perl -e "print \";\";" &gt;&gt; xsl.c
    <ClCompile Include="..\server.c" />
    <ClCompile Include="..\statschannel.c" />
    <ClCompile Include="..\tkeyconf.c" />
-    <ClCompile Include="..\transportconf.c" />
    <ClCompile Include="..\tsigconf.c" />
    <ClCompile Include="..\xsl.c" />
    <ClCompile Include="..\zoneconf.c" />
@@ -160,7 +159,6 @@ perl -e "print \";\";" &gt;&gt; xsl.c
    <ClInclude Include="..\include\named\server.h" />
    <ClInclude Include="..\include\named\statschannel.h" />
    <ClInclude Include="..\include\named\tkeyconf.h" />
-    <ClInclude Include="..\include\named\transportconf.h" />
    <ClInclude Include="..\include\named\tsigconf.h" />
    <ClInclude Include="..\include\named\types.h" />
    <ClInclude Include="..\xsl_p.h" />
@@ -29,7 +29,6 @@
 #include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
-#include <dns/nsec3.h>
 #include <dns/rdata.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -176,7 +175,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,

 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
-				    named_g_mctx, 0, &acl);
+				    dns_zone_getmctx(zone), 0, &acl);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -272,8 +271,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		dns_fixedname_init(&fname);
 		if (usezone) {
-			dns_name_copy(dns_zone_getorigin(zone),
-				      dns_fixedname_name(&fname));
+			dns_name_copynf(dns_zone_getorigin(zone),
+					dns_fixedname_name(&fname));
 		} else {
 			str = cfg_obj_asstring(dname);
 			isc_buffer_constinit(&b, str, strlen(str));
@@ -913,7 +912,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	bool check = false, fail = false;
 	bool warn = false, ignore = false;
 	bool ixfrdiff;
-	bool use_kasp = false;
 	dns_masterformat_t masterformat;
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
@@ -1253,20 +1251,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				result = dns_kasplist_find(kasplist, kaspname,
 							   &kasp);
 				if (result != ISC_R_SUCCESS) {
-					cfg_obj_log(
-						obj, named_g_lctx,
-						ISC_LOG_ERROR,
-						"dnssec-policy '%s' not found ",
-						kaspname);
+					cfg_obj_log(obj, named_g_lctx,
+						    ISC_LOG_ERROR,
+						    "'dnssec-policy '%s' not "
+						    "found ",
+						    kaspname);
 					RETERR(result);
 				}
 				dns_zone_setkasp(zone, kasp);
-				use_kasp = true;
 			}
 		}
-		if (!use_kasp) {
-			dns_zone_setkasp(zone, NULL);
-		}

 		obj = NULL;
 		result = named_config_get(maps, "notify", &obj);
@@ -1310,14 +1304,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setalsonotify(zone, ipkl.addrs,
-							ipkl.dscps, ipkl.keys,
-							ipkl.tlss, ipkl.count);
+			result = dns_zone_setalsonotifydscpkeys(
+				zone, ipkl.addrs, ipkl.dscps, ipkl.keys,
+				ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			RETERR(dns_zone_setalsonotify(zone, NULL, NULL, NULL,
-						      NULL, 0));
+			RETERR(dns_zone_setalsonotify(zone, NULL, 0));
 		}

 		obj = NULL;
@@ -1567,21 +1560,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		bool allow = false, maint = false;
 		bool sigvalinsecs;

-		if (use_kasp) {
-			if (dns_kasp_nsec3(kasp)) {
-				result = dns_zone_setnsec3param(
-					zone, 1, dns_kasp_nsec3flags(kasp),
-					dns_kasp_nsec3iter(kasp),
-					dns_kasp_nsec3saltlen(kasp), NULL, true,
-					false);
-			} else {
-				result = dns_zone_setnsec3param(
-					zone, 0, 0, 0, 0, NULL, true, false);
-			}
-			INSIST(result == ISC_R_SUCCESS);
-		}
-
-		if (use_kasp) {
+		if (kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity_dnskey(kasp);
 		} else {
 			obj = NULL;
@@ -1592,7 +1571,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setkeyvalidityinterval(zone, seconds);

-		if (use_kasp) {
+		if (kasp) {
 			seconds = (uint32_t)dns_kasp_sigvalidity(kasp);
 			dns_zone_setsigvalidityinterval(zone, seconds);
 			seconds = (uint32_t)dns_kasp_sigrefresh(kasp);
@@ -1679,11 +1658,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		obj = NULL;
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
-		if (kasp != NULL) {
-			bool s2i = (strcmp(dns_kasp_getname(kasp),
-					   "insecure") != 0);
+		if (dns_zone_getkasp(zone) != NULL) {
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, true);
-			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, !s2i);
+			dns_zone_setkeyopt(zone, DNS_ZONEKEY_CREATE, true);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, true);
 		} else if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
@@ -1915,15 +1892,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 			RETERR(named_config_getipandkeylist(config, obj, mctx,
 							    &ipkl));
-			result = dns_zone_setprimaries(mayberaw, ipkl.addrs,
-						       ipkl.keys, ipkl.tlss,
-						       ipkl.count);
+			result = dns_zone_setprimarieswithkeys(
+				mayberaw, ipkl.addrs, ipkl.keys, ipkl.count);
 			count = ipkl.count;
 			dns_ipkeylist_clear(mctx, &ipkl);
 			RETERR(result);
 		} else {
-			result = dns_zone_setprimaries(mayberaw, NULL, NULL,
-						       NULL, 0);
+			result = dns_zone_setprimaries(mayberaw, NULL, 0);
 		}
 		RETERR(result);

@@ -2074,15 +2049,13 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 }

 bool
-named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
-		    const cfg_obj_t *vconfig, const cfg_obj_t *config,
-		    cfg_aclconfctx_t *actx) {
+named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
 	const char *zfilename;
 	dns_zone_t *raw = NULL;
-	bool has_raw, inline_signing;
+	bool has_raw;
 	dns_zonetype_t ztype;

 	zoptions = cfg_tuple_get(zconfig, "options");
@@ -2110,13 +2083,13 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 		has_raw = false;
 	}

-	inline_signing = named_zone_inlinesigning(zone, zconfig, vconfig,
-						  config, actx);
-	if (!inline_signing && has_raw) {
+	obj = NULL;
+	(void)cfg_map_get(zoptions, "inline-signing", &obj);
+	if ((obj == NULL || !cfg_obj_asboolean(obj)) && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
 		return (false);
-	} else if (inline_signing && !has_raw) {
+	} else if ((obj != NULL && cfg_obj_asboolean(obj)) && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
 		return (false);
@@ -2146,82 +2119,3 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,

 	return (true);
 }
-
-bool
-named_zone_inlinesigning(dns_zone_t *zone, const cfg_obj_t *zconfig,
-			 const cfg_obj_t *vconfig, const cfg_obj_t *config,
-			 cfg_aclconfctx_t *actx) {
-	isc_result_t res;
-	const cfg_obj_t *zoptions = NULL;
-	const cfg_obj_t *voptions = NULL;
-	const cfg_obj_t *options = NULL;
-	const cfg_obj_t *signing = NULL;
-	const cfg_obj_t *allowupdate = NULL;
-	const cfg_obj_t *updatepolicy = NULL;
-	bool zone_is_dynamic = false;
-	bool inline_signing = false;
-
-	(void)cfg_map_get(config, "options", &options);
-
-	zoptions = cfg_tuple_get(zconfig, "options");
-	if (vconfig != NULL) {
-		voptions = cfg_tuple_get(vconfig, "options");
-	}
-
-	inline_signing = (cfg_map_get(zoptions, "inline-signing", &signing) ==
-				  ISC_R_SUCCESS &&
-			  cfg_obj_asboolean(signing));
-	if (inline_signing) {
-		return (true);
-	}
-
-	if (cfg_map_get(zoptions, "update-policy", &updatepolicy) ==
-	    ISC_R_SUCCESS) {
-		zone_is_dynamic = true;
-	} else {
-		res = cfg_map_get(zoptions, "allow-update", &allowupdate);
-		if (res != ISC_R_SUCCESS && voptions != NULL) {
-			res = cfg_map_get(voptions, "allow-update",
-					  &allowupdate);
-		}
-		if (res != ISC_R_SUCCESS && options != NULL) {
-			res = cfg_map_get(options, "allow-update",
-					  &allowupdate);
-		}
-		if (res == ISC_R_SUCCESS) {
-			dns_acl_t *acl = NULL;
-			res = cfg_acl_fromconfig(
-				allowupdate, config, named_g_lctx, actx,
-				dns_zone_getmctx(zone), 0, &acl);
-			if (res == ISC_R_SUCCESS && acl != NULL &&
-			    !dns_acl_isnone(acl)) {
-				zone_is_dynamic = true;
-			}
-			if (acl != NULL) {
-				dns_acl_detach(&acl);
-			}
-		}
-	}
-
-	/*
-	 * If inline-signing is not set, perhaps implictly through a
-	 * dnssec-policy.  Since automated DNSSEC maintenance requires
-	 * a dynamic zone, or inline-siging to be enabled, check if
-	 * the zone with dnssec-policy allows updates.  If not, enable
-	 * inline-signing.
-	 */
-	signing = NULL;
-	if (!inline_signing && !zone_is_dynamic &&
-	    cfg_map_get(zoptions, "dnssec-policy", &signing) == ISC_R_SUCCESS &&
-	    signing != NULL)
-	{
-		if (strcmp(cfg_obj_asstring(signing), "none") != 0) {
-			inline_signing = true;
-			dns_zone_log(zone, ISC_LOG_DEBUG(1),
-				     "inline-signing: "
-				     "implicitly through dnssec-policy");
-		}
-	}
-
-	return (inline_signing);
-}
@@ -7,8 +7,7 @@ AM_CPPFLAGS +=			\
 	$(LIBIRS_CFLAGS)	\
 	$(LIBBIND9_CFLAGS)	\
 	$(GSSAPI_CFLAGS)	\
-	$(KRB5_CFLAGS)		\
-	$(READLINE_CFLAGS)
+	$(KRB5_CFLAGS)

 AM_CPPFLAGS += \
 	-DSESSION_KEYFILE=\"${localstatedir}/run/named/session.key\"
@@ -28,7 +27,3 @@ LDADD +=			\
 endif

 bin_PROGRAMS = nsupdate
-
-nsupdate_SOURCES =		\
-	nsupdate.c		\
-	../dig/readline.h
@@ -29,7 +29,6 @@
 #include <isc/hash.h>
 #include <isc/lex.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/nonce.h>
 #include <isc/parseint.h>
@@ -37,6 +36,7 @@
 #include <isc/portset.h>
 #include <isc/print.h>
 #include <isc/random.h>
+#include <isc/readline.h>
 #include <isc/region.h>
 #include <isc/sockaddr.h>
 #include <isc/socket.h>
@@ -58,7 +58,6 @@
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
-#include <dns/nsec3.h>
 #include <dns/rcode.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -96,8 +95,6 @@

 #include <bind9/getaddresses.h>

-#include "../dig/readline.h"
-
 #define MAXCMD	     (128 * 1024)
 #define MAXWIRE	     (64 * 1024)
 #define PACKETSIZE   ((64 * 1024) - 1)
@@ -127,7 +124,6 @@ static bool usegsstsig = false;
 static bool use_win2k_gsstsig = false;
 static bool tried_other_gsstsig = false;
 static bool local_only = false;
-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *global_task = NULL;
 static isc_event_t *global_event = NULL;
@@ -354,12 +350,16 @@ nsu_strsep(char **stringp, const char *delim) {

 static void
 reset_system(void) {
+	isc_result_t result;
+
 	ddebug("reset_system()");
 	/* If the update message is still around, destroy it */
 	if (updatemsg != NULL) {
 		dns_message_reset(updatemsg, DNS_MESSAGE_INTENTRENDER);
 	} else {
-		dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &updatemsg);
+		result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER,
+					    &updatemsg);
+		check_result(result, "dns_message_create");
 	}
 	updatemsg->opcode = dns_opcode_update;
 	if (usegsstsig) {
@@ -720,7 +720,7 @@ doshutdown(void) {
 	}

 	if (updatemsg != NULL) {
-		dns_message_detach(&updatemsg);
+		dns_message_destroy(&updatemsg);
 	}

 	if (is_dst_up) {
@@ -924,8 +924,14 @@ setup_system(void) {
 	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

-	isc_managers_create(gmctx, 1, 0, 0, &netmgr, &taskmgr, &timermgr,
-			    &socketmgr);
+	result = isc_socketmgr_create(gmctx, &socketmgr);
+	check_result(result, "dns_socketmgr_create");
+
+	result = isc_timermgr_create(gmctx, &timermgr);
+	check_result(result, "dns_timermgr_create");
+
+	result = isc_taskmgr_create(gmctx, 1, 0, NULL, &taskmgr);
+	check_result(result, "isc_taskmgr_create");

 	result = isc_task_create(taskmgr, 0, &global_task);
 	check_result(result, "isc_task_create");
@@ -1264,6 +1270,7 @@ static uint16_t
 parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	isc_result_t result;
 	char *word;
+	isc_buffer_t *namebuf = NULL;
 	isc_buffer_t source;

 	word = nsu_strsep(cmdlinep, " \t\r\n");
@@ -1274,6 +1281,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {

 	result = dns_message_gettempname(msg, namep);
 	check_result(result, "dns_message_gettempname");
+	isc_buffer_allocate(gmctx, &namebuf, DNS_NAME_MAXWIRE);
+	dns_name_init(*namep, NULL);
+	dns_name_setbuffer(*namep, namebuf);
+	dns_message_takebuffer(msg, &namebuf);
 	isc_buffer_init(&source, word, strlen(word));
 	isc_buffer_add(&source, strlen(word));
 	result = dns_name_fromtext(*namep, &source, dns_rootname, 0, NULL);
@@ -1957,19 +1968,6 @@ parseclass:
 		}
 	}

-	if (!isdelete && rdata->type == dns_rdatatype_nsec3param) {
-		dns_rdata_nsec3param_t nsec3param;
-
-		result = dns_rdata_tostruct(rdata, &nsec3param, NULL);
-		check_result(result, "dns_rdata_tostruct");
-		if (nsec3param.iterations > dns_nsec3_maxiterations()) {
-			fprintf(stderr,
-				"NSEC3PARAM has excessive iterations (> %u)\n",
-				dns_nsec3_maxiterations());
-			goto failure;
-		}
-	}
-
 doneparsing:

 	result = dns_message_gettemprdatalist(updatemsg, &rdatalist);
@@ -2068,6 +2066,7 @@ setzone(dns_name_t *zonename) {
 	if (zonename != NULL) {
 		result = dns_message_gettempname(updatemsg, &name);
 		check_result(result, "dns_message_gettempname");
+		dns_name_init(name, NULL);
 		dns_name_clone(zonename, name);
 		result = dns_message_gettemprdataset(updatemsg, &rdataset);
 		check_result(result, "dns_message_gettemprdataset");
@@ -2414,7 +2413,8 @@ update_completed(isc_task_t *task, isc_event_t *event) {
 	}

 	LOCK(&answer_lock);
-	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
+	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &answer);
+	check_result(result, "dns_message_create");
 	result = dns_request_getresponse(request, answer,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	switch (result) {
@@ -2580,7 +2580,7 @@ recvsoa(isc_task_t *task, isc_event_t *event) {

 	if (shuttingdown) {
 		dns_request_destroy(&request);
-		dns_message_detach(&soaquery);
+		dns_message_destroy(&soaquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_requestinfo_t));
 		isc_event_free(&event);
 		maybeshutdown();
@@ -2606,11 +2606,12 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 	reqev = NULL;

 	ddebug("About to create rcvmsg");
-	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
+	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
+	check_result(result, "dns_message_create");
 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
 	if (result == DNS_R_TSIGERRORSET && servers != NULL) {
-		dns_message_detach(&rcvmsg);
+		dns_message_destroy(&rcvmsg);
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
 		reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t));
@@ -2649,9 +2650,9 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		char namebuf[DNS_NAME_FORMATSIZE];
 		dns_name_format(userzone, namebuf, sizeof(namebuf));
 		error("specified zone '%s' does not exist (NXDOMAIN)", namebuf);
-		dns_message_detach(&rcvmsg);
+		dns_message_destroy(&rcvmsg);
 		dns_request_destroy(&request);
-		dns_message_detach(&soaquery);
+		dns_message_destroy(&soaquery);
 		ddebug("Out of recvsoa");
 		done_update();
 		seenerror = true;
@@ -2730,7 +2731,7 @@ lookforsoa:
 		 * address.
 		 */
 		zname = dns_fixedname_initname(&fzname);
-		dns_name_copy(name, zname);
+		dns_name_copynf(name, zname);
 	}

 	if (debugging) {
@@ -2785,11 +2786,11 @@ lookforsoa:
 	setzoneclass(dns_rdataclass_none);
 #endif /* HAVE_GSSAPI */

-	dns_message_detach(&soaquery);
+	dns_message_destroy(&soaquery);
 	dns_request_destroy(&request);

 out:
-	dns_message_detach(&rcvmsg);
+	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvsoa");
 	return;

@@ -2905,7 +2906,7 @@ failed_gssrequest(void) {

 static void
 start_gssrequest(dns_name_t *master) {
-	dns_gss_ctx_id_t context;
+	gss_ctx_id_t context;
 	isc_buffer_t buf;
 	isc_result_t result;
 	uint32_t val = 0;
@@ -2976,7 +2977,11 @@ start_gssrequest(dns_name_t *master) {
 	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;

 	rmsg = NULL;
-	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
+	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &rmsg);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dns_message_create failed: %s",
+		      isc_result_totext(result));
+	}

 	/* Build first request. */
 	context = GSS_C_NO_CONTEXT;
@@ -2998,7 +3003,7 @@ start_gssrequest(dns_name_t *master) {

 failure:
 	if (rmsg != NULL) {
-		dns_message_detach(&rmsg);
+		dns_message_destroy(&rmsg);
 	}
 	if (err_message != NULL) {
 		isc_mem_free(gmctx, err_message);
@@ -3050,7 +3055,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	nsu_gssinfo_t *reqinfo;
 	dns_message_t *tsigquery = NULL;
 	isc_sockaddr_t *addr;
-	dns_gss_ctx_id_t context;
+	gss_ctx_id_t context;
 	isc_buffer_t buf;
 	dns_name_t *servname;
 	dns_fixedname_t fname;
@@ -3073,7 +3078,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {

 	if (shuttingdown) {
 		dns_request_destroy(&request);
-		dns_message_detach(&tsigquery);
+		dns_message_destroy(&tsigquery);
 		isc_mem_put(gmctx, reqinfo, sizeof(nsu_gssinfo_t));
 		isc_event_free(&event);
 		maybeshutdown();
@@ -3084,7 +3089,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 		ddebug("Destroying request [%p]", request);
 		dns_request_destroy(&request);
 		if (!next_master("recvgss", addr, eresult)) {
-			dns_message_detach(&tsigquery);
+			dns_message_destroy(&tsigquery);
 			failed_gssrequest();
 		} else {
 			dns_message_renderreset(tsigquery);
@@ -3102,7 +3107,8 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 	reqev = NULL;

 	ddebug("recvgss creating rcvmsg");
-	dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
+	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTPARSE, &rcvmsg);
+	check_result(result, "dns_message_create");

 	result = dns_request_getresponse(request, rcvmsg,
 					 DNS_MESSAGEPARSE_PRESERVEORDER);
@@ -3143,7 +3149,7 @@ recvgss(isc_task_t *task, isc_event_t *event) {
 				       &err_message);
 	switch (result) {
 	case DNS_R_CONTINUE:
-		dns_message_detach(&rcvmsg);
+		dns_message_destroy(&rcvmsg);
 		dns_request_destroy(&request);
 		send_gssrequest(kserver, tsigquery, &request, context);
 		ddebug("Out of recvgss");
@@ -3190,9 +3196,9 @@ recvgss(isc_task_t *task, isc_event_t *event) {

 done:
 	dns_request_destroy(&request);
-	dns_message_detach(&tsigquery);
+	dns_message_destroy(&tsigquery);

-	dns_message_detach(&rcvmsg);
+	dns_message_destroy(&rcvmsg);
 	ddebug("Out of recvgss");
 }
 #endif /* HAVE_GSSAPI */
@@ -3211,7 +3217,7 @@ start_update(void) {

 	LOCK(&answer_lock);
 	if (answer != NULL) {
-		dns_message_detach(&answer);
+		dns_message_destroy(&answer);
 	}
 	UNLOCK(&answer_lock);

@@ -3227,7 +3233,8 @@ start_update(void) {
 		return;
 	}

-	dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &soaquery);
+	result = dns_message_create(gmctx, DNS_MESSAGE_INTENTRENDER, &soaquery);
+	check_result(result, "dns_message_create");

 	if (default_servers) {
 		soaquery->flags |= DNS_MESSAGEFLAG_RD;
@@ -3242,6 +3249,7 @@ start_update(void) {
 	dns_rdataset_makequestion(rdataset, getzoneclass(), dns_rdatatype_soa);

 	if (userzone != NULL) {
+		dns_name_init(name, NULL);
 		dns_name_clone(userzone, name);
 	} else {
 		dns_rdataset_t *tmprdataset;
@@ -3254,12 +3262,13 @@ start_update(void) {
 			dns_message_puttempname(soaquery, &name);
 			dns_rdataset_disassociate(rdataset);
 			dns_message_puttemprdataset(soaquery, &rdataset);
-			dns_message_detach(&soaquery);
+			dns_message_destroy(&soaquery);
 			done_update();
 			return;
 		}
 		firstname = NULL;
 		dns_message_currentname(updatemsg, section, &firstname);
+		dns_name_init(name, NULL);
 		dns_name_clone(firstname, name);
 		/*
 		 * Looks to see if the first name references a DS record
@@ -3291,7 +3300,7 @@ cleanup(void) {

 	LOCK(&answer_lock);
 	if (answer != NULL) {
-		dns_message_detach(&answer);
+		dns_message_destroy(&answer);
 	}
 	UNLOCK(&answer_lock);

@@ -3310,12 +3319,18 @@ cleanup(void) {
 		dst_key_free(&sig0key);
 	}

-	ddebug("Shutting down managers");
-	isc_managers_destroy(&netmgr, &taskmgr, &timermgr, &socketmgr);
+	ddebug("Shutting down task manager");
+	isc_taskmgr_destroy(&taskmgr);

 	ddebug("Destroying event");
 	isc_event_free(&global_event);

+	ddebug("Shutting down socket manager");
+	isc_socketmgr_destroy(&socketmgr);
+
+	ddebug("Shutting down timer manager");
+	isc_timermgr_destroy(&timermgr);
+
 #ifdef HAVE_GSSAPI
 	/*
 	 * Cleanup GSSAPI resources after taskmgr has been destroyed.
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@GSSAPI_LIB@@KRB5_LIB@libisc.lib;libdns.lib;libbind9.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -77,7 +77,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -109,7 +109,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -7,9 +7,6 @@ AM_CPPFLAGS +=			\
 	$(LIBISCCFG_CFLAGS)

 pkglib_LTLIBRARIES = filter-aaaa.la
-pkglib_LTLIBRARIES += filter-a.la

 filter_aaaa_la_SOURCES = filter-aaaa.c
-filter_a_la_SOURCES = filter-a.c
 filter_aaaa_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
-filter_a_la_LDFLAGS = -avoid-version -module -shared -export-dynamic
@@ -1,906 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, you can obtain one at https://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-/* aliases for the exported symbols */
-
-#include <inttypes.h>
-#include <stdbool.h>
-#include <string.h>
-
-#include <isc/buffer.h>
-#include <isc/hash.h>
-#include <isc/ht.h>
-#include <isc/lib.h>
-#include <isc/log.h>
-#include <isc/mem.h>
-#include <isc/netaddr.h>
-#include <isc/result.h>
-#include <isc/types.h>
-#include <isc/util.h>
-
-#include <dns/acl.h>
-#include <dns/db.h>
-#include <dns/enumtype.h>
-#include <dns/log.h>
-#include <dns/message.h>
-#include <dns/rdataset.h>
-#include <dns/result.h>
-#include <dns/types.h>
-#include <dns/view.h>
-
-#include <isccfg/aclconf.h>
-#include <isccfg/cfg.h>
-#include <isccfg/grammar.h>
-
-#include <ns/client.h>
-#include <ns/hooks.h>
-#include <ns/log.h>
-#include <ns/query.h>
-#include <ns/types.h>
-
-#define CHECK(op)                              \
-	do {                                   \
-		result = (op);                 \
-		if (result != ISC_R_SUCCESS) { \
-			goto cleanup;          \
-		}                              \
-	} while (0)
-
-/*
- * Possible values for the settings of filter-a-on-v6 and
- * filter-a-on-v4: "no" is NONE, "yes" is FILTER, "break-dnssec"
- * is BREAK_DNSSEC.
- */
-typedef enum { NONE = 0, FILTER = 1, BREAK_DNSSEC = 2 } filter_a_t;
-
-/*
- * Persistent data for use by this module. This will be associated
- * with client object address in the hash table, and will remain
- * accessible until the client object is detached.
- */
-typedef struct filter_data {
-	filter_a_t mode;
-	uint32_t flags;
-} filter_data_t;
-
-typedef struct filter_instance {
-	ns_plugin_t *module;
-	isc_mem_t *mctx;
-
-	/*
-	 * Memory pool for use with persistent data.
-	 */
-	isc_mempool_t *datapool;
-	isc_mutex_t plock;
-
-	/*
-	 * Hash table associating a client object with its persistent data.
-	 */
-	isc_ht_t *ht;
-	isc_mutex_t hlock;
-
-	/*
-	 * Values configured when the module is loaded.
-	 */
-	filter_a_t v4_a;
-	filter_a_t v6_a;
-	dns_acl_t *a_acl;
-} filter_instance_t;
-
-/*
- * Per-client flags set by this module
- */
-#define FILTER_A_RECURSING 0x0001 /* Recursing for AAAA */
-#define FILTER_A_FILTERED  0x0002 /* A was removed from answer */
-
-/*
- * Client attribute tests.
- */
-#define WANTDNSSEC(c)  (((c)->attributes & NS_CLIENTATTR_WANTDNSSEC) != 0)
-#define RECURSIONOK(c) (((c)->query.attributes & NS_QUERYATTR_RECURSIONOK) != 0)
-
-/*
- * Forward declarations of functions referenced in install_hooks().
- */
-static ns_hookresult_t
-filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp);
-static ns_hookresult_t
-filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp);
-static ns_hookresult_t
-filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp);
-static ns_hookresult_t
-filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp);
-static ns_hookresult_t
-filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp);
-static ns_hookresult_t
-filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp);
-
-/*%
- * Register the functions to be called at each hook point in 'hooktable', using
- * memory context 'mctx' for allocating copies of stack-allocated structures
- * passed to ns_hook_add().  Make sure 'inst' will be passed as the 'cbdata'
- * argument to every callback.
- */
-static void
-install_hooks(ns_hooktable_t *hooktable, isc_mem_t *mctx,
-	      filter_instance_t *inst) {
-	const ns_hook_t filter_init = {
-		.action = filter_qctx_initialize,
-		.action_data = inst,
-	};
-
-	const ns_hook_t filter_respbegin = {
-		.action = filter_respond_begin,
-		.action_data = inst,
-	};
-
-	const ns_hook_t filter_respanyfound = {
-		.action = filter_respond_any_found,
-		.action_data = inst,
-	};
-
-	const ns_hook_t filter_prepresp = {
-		.action = filter_prep_response_begin,
-		.action_data = inst,
-	};
-
-	const ns_hook_t filter_donesend = {
-		.action = filter_query_done_send,
-		.action_data = inst,
-	};
-
-	const ns_hook_t filter_destroy = {
-		.action = filter_qctx_destroy,
-		.action_data = inst,
-	};
-
-	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_INITIALIZED, &filter_init);
-	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_BEGIN, &filter_respbegin);
-	ns_hook_add(hooktable, mctx, NS_QUERY_RESPOND_ANY_FOUND,
-		    &filter_respanyfound);
-	ns_hook_add(hooktable, mctx, NS_QUERY_PREP_RESPONSE_BEGIN,
-		    &filter_prepresp);
-	ns_hook_add(hooktable, mctx, NS_QUERY_DONE_SEND, &filter_donesend);
-	ns_hook_add(hooktable, mctx, NS_QUERY_QCTX_DESTROYED, &filter_destroy);
-}
-
-/**
-** Support for parsing of parameters and configuration of the module.
-**/
-
-/*
- * Support for parsing of parameters.
- */
-static const char *filter_a_enums[] = { "break-dnssec", NULL };
-
-static isc_result_t
-parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
-}
-
-static void
-doc_filter_a(cfg_printer_t *pctx, const cfg_type_t *type) {
-	cfg_doc_enum_or_other(pctx, type, &cfg_type_boolean);
-}
-
-static cfg_type_t cfg_type_filter_a = {
-	"filter_a",   parse_filter_a,  cfg_print_ustring,
-	doc_filter_a, &cfg_rep_string, filter_a_enums,
-};
-
-static cfg_clausedef_t param_clauses[] = {
-	{ "filter-a", &cfg_type_bracketed_aml, 0 },
-	{ "filter-a-on-v6", &cfg_type_filter_a, 0 },
-	{ "filter-a-on-v4", &cfg_type_filter_a, 0 },
-};
-
-static cfg_clausedef_t *param_clausesets[] = { param_clauses, NULL };
-
-static cfg_type_t cfg_type_parameters = { "filter-a-params", cfg_parse_mapbody,
-					  cfg_print_mapbody, cfg_doc_mapbody,
-					  &cfg_rep_map,	     param_clausesets };
-
-static isc_result_t
-parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
-		  filter_a_t *dstp) {
-	const cfg_obj_t *obj = NULL;
-	isc_result_t result;
-
-	result = cfg_map_get(param_obj, param_name, &obj);
-	if (result != ISC_R_SUCCESS) {
-		return (ISC_R_SUCCESS);
-	}
-
-	if (cfg_obj_isboolean(obj)) {
-		if (cfg_obj_asboolean(obj)) {
-			*dstp = FILTER;
-		} else {
-			*dstp = NONE;
-		}
-	} else if (strcasecmp(cfg_obj_asstring(obj), "break-dnssec") == 0) {
-		*dstp = BREAK_DNSSEC;
-	} else {
-		result = ISC_R_UNEXPECTED;
-	}
-
-	return (result);
-}
-
-static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	const cfg_obj_t *aclobj = NULL;
-	dns_acl_t *acl = NULL;
-	filter_a_t f4 = NONE, f6 = NONE;
-
-	cfg_map_get(fmap, "filter-a", &aclobj);
-	if (aclobj == NULL) {
-		return (result);
-	}
-
-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
-				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));
-
-	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
-	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));
-
-	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
-			    "\"filter-a\" is 'none;' but "
-			    "either filter-a-on-v6 or filter-a-on-v4 "
-			    "is enabled");
-		result = ISC_R_FAILURE;
-	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
-			    "\"filter-a\" is set but "
-			    "neither filter-a-on-v6 or filter-a-on-v4 "
-			    "is enabled");
-		result = ISC_R_FAILURE;
-	}
-
-cleanup:
-	if (acl != NULL) {
-		dns_acl_detach(&acl);
-	}
-
-	return (result);
-}
-
-static isc_result_t
-parse_parameters(filter_instance_t *inst, const char *parameters,
-		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	cfg_parser_t *parser = NULL;
-	cfg_obj_t *param_obj = NULL;
-	const cfg_obj_t *obj = NULL;
-	isc_buffer_t b;
-
-	CHECK(cfg_parser_create(mctx, lctx, &parser));
-
-	isc_buffer_constinit(&b, parameters, strlen(parameters));
-	isc_buffer_add(&b, strlen(parameters));
-	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
-			       &cfg_type_parameters, 0, &param_obj));
-
-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
-
-	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
-	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));
-
-	result = cfg_map_get(param_obj, "filter-a", &obj);
-	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
-					 (cfg_aclconfctx_t *)actx, mctx, 0,
-					 &inst->a_acl));
-	} else {
-		CHECK(dns_acl_any(mctx, &inst->a_acl));
-	}
-
-cleanup:
-	if (param_obj != NULL) {
-		cfg_obj_destroy(parser, &param_obj);
-	}
-	if (parser != NULL) {
-		cfg_parser_destroy(&parser);
-	}
-	return (result);
-}
-
-/**
-** Mandatory plugin API functions:
-**
-** - plugin_destroy
-** - plugin_register
-** - plugin_version
-** - plugin_check
-**/
-
-/*
- * Called by ns_plugin_register() to initialize the plugin and
- * register hook functions into the view hook table.
- */
-isc_result_t
-plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-		void *actx, ns_hooktable_t *hooktable, void **instp) {
-	filter_instance_t *inst = NULL;
-	isc_result_t result;
-
-	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
-		      ISC_LOG_INFO,
-		      "registering 'filter-a' "
-		      "module from %s:%lu, %s parameters",
-		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
-
-	inst = isc_mem_get(mctx, sizeof(*inst));
-	memset(inst, 0, sizeof(*inst));
-	isc_mem_attach(mctx, &inst->mctx);
-
-	if (parameters != NULL) {
-		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, lctx, actx));
-	}
-
-	isc_mempool_create(mctx, sizeof(filter_data_t), &inst->datapool);
-	CHECK(isc_ht_init(&inst->ht, mctx, 16));
-	isc_mutex_init(&inst->hlock);
-
-	/*
-	 * Fill the mempool with 1K filter_a state objects at
-	 * a time; ideally after a single allocation, the mempool will
-	 * have enough to handle all the simultaneous queries the system
-	 * requires and it won't be necessary to allocate more.
-	 *
-	 * We don't set any limit on the number of free state objects
-	 * so that they'll always be returned to the pool and not
-	 * freed until the pool is destroyed on shutdown.
-	 */
-	isc_mempool_setfillcount(inst->datapool, 1024);
-	isc_mempool_setfreemax(inst->datapool, UINT_MAX);
-	isc_mutex_init(&inst->plock);
-	isc_mempool_associatelock(inst->datapool, &inst->plock);
-
-	/*
-	 * Set hook points in the view's hooktable.
-	 */
-	install_hooks(hooktable, mctx, inst);
-
-	*instp = inst;
-
-cleanup:
-	if (result != ISC_R_SUCCESS && inst != NULL) {
-		plugin_destroy((void **)&inst);
-	}
-
-	return (result);
-}
-
-isc_result_t
-plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
-	     void *actx) {
-	isc_result_t result = ISC_R_SUCCESS;
-	cfg_parser_t *parser = NULL;
-	cfg_obj_t *param_obj = NULL;
-	isc_buffer_t b;
-
-	CHECK(cfg_parser_create(mctx, lctx, &parser));
-
-	isc_buffer_constinit(&b, parameters, strlen(parameters));
-	isc_buffer_add(&b, strlen(parameters));
-	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
-			       &cfg_type_parameters, 0, &param_obj));
-
-	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));
-
-cleanup:
-	if (param_obj != NULL) {
-		cfg_obj_destroy(parser, &param_obj);
-	}
-	if (parser != NULL) {
-		cfg_parser_destroy(&parser);
-	}
-	return (result);
-}
-
-/*
- * Called by ns_plugins_free(); frees memory allocated by
- * the module when it was registered.
- */
-void
-plugin_destroy(void **instp) {
-	filter_instance_t *inst = (filter_instance_t *)*instp;
-
-	if (inst->ht != NULL) {
-		isc_ht_destroy(&inst->ht);
-		isc_mutex_destroy(&inst->hlock);
-	}
-	if (inst->datapool != NULL) {
-		isc_mempool_destroy(&inst->datapool);
-		isc_mutex_destroy(&inst->plock);
-	}
-	if (inst->a_acl != NULL) {
-		dns_acl_detach(&inst->a_acl);
-	}
-
-	isc_mem_putanddetach(&inst->mctx, inst, sizeof(*inst));
-	*instp = NULL;
-
-	return;
-}
-
-/*
- * Returns plugin API version for compatibility checks.
- */
-int
-plugin_version(void) {
-	return (NS_PLUGIN_VERSION);
-}
-
-/**
-** "filter-a" feature implementation begins here.
-**/
-
-/*%
- * Structure describing the filtering to be applied by process_section().
- */
-typedef struct section_filter {
-	query_ctx_t *qctx;
-	filter_a_t mode;
-	dns_section_t section;
-	const dns_name_t *name;
-	dns_rdatatype_t type;
-	bool only_if_aaaa_exists;
-} section_filter_t;
-
-/*
- * Check whether this is an IPv4 client.
- */
-static bool
-is_v4_client(ns_client_t *client) {
-	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return (true);
-	}
-	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
-	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
-	{
-		return (true);
-	}
-	return (false);
-}
-
-/*
- * Check whether this is an IPv6 client.
- */
-static bool
-is_v6_client(ns_client_t *client) {
-	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
-	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
-	{
-		return (true);
-	}
-	return (false);
-}
-
-static filter_data_t *
-client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
-	filter_data_t *client_state = NULL;
-	isc_result_t result;
-
-	LOCK(&inst->hlock);
-	result = isc_ht_find(inst->ht, (const unsigned char *)&qctx->client,
-			     sizeof(qctx->client), (void **)&client_state);
-	UNLOCK(&inst->hlock);
-
-	return (result == ISC_R_SUCCESS ? client_state : NULL);
-}
-
-static void
-client_state_create(const query_ctx_t *qctx, filter_instance_t *inst) {
-	filter_data_t *client_state;
-	isc_result_t result;
-
-	client_state = isc_mempool_get(inst->datapool);
-	if (client_state == NULL) {
-		return;
-	}
-
-	client_state->mode = NONE;
-	client_state->flags = 0;
-
-	LOCK(&inst->hlock);
-	result = isc_ht_add(inst->ht, (const unsigned char *)&qctx->client,
-			    sizeof(qctx->client), client_state);
-	UNLOCK(&inst->hlock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-}
-
-static void
-client_state_destroy(const query_ctx_t *qctx, filter_instance_t *inst) {
-	filter_data_t *client_state = client_state_get(qctx, inst);
-	isc_result_t result;
-
-	if (client_state == NULL) {
-		return;
-	}
-
-	LOCK(&inst->hlock);
-	result = isc_ht_delete(inst->ht, (const unsigned char *)&qctx->client,
-			       sizeof(qctx->client));
-	UNLOCK(&inst->hlock);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	isc_mempool_put(inst->datapool, client_state);
-}
-
-/*%
- * Mark 'rdataset' and 'sigrdataset' as rendered, gracefully handling NULL
- * pointers and non-associated rdatasets.
- */
-static void
-mark_as_rendered(dns_rdataset_t *rdataset, dns_rdataset_t *sigrdataset) {
-	if (rdataset != NULL && dns_rdataset_isassociated(rdataset)) {
-		rdataset->attributes |= DNS_RDATASETATTR_RENDERED;
-	}
-	if (sigrdataset != NULL && dns_rdataset_isassociated(sigrdataset)) {
-		sigrdataset->attributes |= DNS_RDATASETATTR_RENDERED;
-	}
-}
-
-/*%
- * Check whether an RRset of given 'type' is present at given 'name'.  If
- * it is found and either it is not signed or the combination of query
- * flags and configured processing 'mode' allows it, mark the RRset and its
- * associated signatures as already rendered to prevent them from appearing
- * in the response message stored in 'qctx'.  If 'only_if_aaaa_exists' is
- * true, an RRset of type AAAA must also exist at 'name' in order for the
- * above processing to happen.
- */
-static bool
-process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
-	     dns_rdatatype_t type, bool only_if_aaaa_exists) {
-	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
-	isc_result_t result;
-	bool modified = false;
-
-	if (only_if_aaaa_exists) {
-		CHECK(dns_message_findtype(name, dns_rdatatype_aaaa, 0, NULL));
-	}
-
-	(void)dns_message_findtype(name, type, 0, &rdataset);
-	(void)dns_message_findtype(name, dns_rdatatype_rrsig, type,
-				   &sigrdataset);
-
-	if (rdataset != NULL &&
-	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
-	     mode == BREAK_DNSSEC))
-	{
-		/*
-		 * An RRset of given 'type' was found at 'name' and at least
-		 * one of the following is true:
-		 *
-		 *   - the RRset is not signed,
-		 *   - the client did not set the DO bit in its request,
-		 *   - configuration allows us to tamper with signed responses.
-		 *
-		 * This means it is okay to filter out this RRset and its
-		 * signatures, if any, from the response.
-		 */
-		mark_as_rendered(rdataset, sigrdataset);
-		modified = true;
-	}
-
-cleanup:
-	return (modified);
-}
-
-/*%
- * Apply the requested section filter, i.e. prevent (when possible, as
- * determined by process_name()) RRsets of given 'type' from being rendered
- * in the given 'section' of the response message stored in 'qctx'.  Clear
- * the AD bit if the answer and/or authority section was modified.  If
- * 'name' is NULL, all names in the given 'section' are processed;
- * otherwise, only 'name' is.  'only_if_aaaa_exists' is passed through to
- * process_name().
- */
-static void
-process_section(const section_filter_t *filter) {
-	query_ctx_t *qctx = filter->qctx;
-	filter_a_t mode = filter->mode;
-	dns_section_t section = filter->section;
-	const dns_name_t *name = filter->name;
-	dns_rdatatype_t type = filter->type;
-	bool only_if_aaaa_exists = filter->only_if_aaaa_exists;
-
-	dns_message_t *message = qctx->client->message;
-	isc_result_t result;
-
-	for (result = dns_message_firstname(message, section);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(message, section))
-	{
-		dns_name_t *cur = NULL;
-		dns_message_currentname(message, section, &cur);
-		if (name != NULL && !dns_name_equal(name, cur)) {
-			/*
-			 * We only want to process 'name' and this is not it.
-			 */
-			continue;
-		}
-
-		if (!process_name(qctx, mode, cur, type, only_if_aaaa_exists)) {
-			/*
-			 * Response was not modified, do not touch the AD bit.
-			 */
-			continue;
-		}
-
-		if (section == DNS_SECTION_ANSWER ||
-		    section == DNS_SECTION_AUTHORITY) {
-			message->flags &= ~DNS_MESSAGEFLAG_AD;
-		}
-	}
-}
-
-/*
- * Initialize filter state, fetching it from a memory pool and storing it
- * in a hash table keyed according to the client object; this enables us to
- * retrieve persistent data related to a client query for as long as the
- * object persists.
- */
-static ns_hookresult_t
-filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-	filter_data_t *client_state;
-
-	*resp = ISC_R_UNSET;
-
-	client_state = client_state_get(qctx, inst);
-	if (client_state == NULL) {
-		client_state_create(qctx, inst);
-	}
-
-	return (NS_HOOK_CONTINUE);
-}
-
-/*
- * Determine whether this client should have A filtered or not, based on
- * the client address family and the settings of filter-a-on-v6 and
- * filter-a-on-v4.
- */
-static ns_hookresult_t
-filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-	filter_data_t *client_state = client_state_get(qctx, inst);
-	isc_result_t result;
-
-	*resp = ISC_R_UNSET;
-
-	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
-	}
-
-	if (inst->v4_a != NONE || inst->v6_a != NONE) {
-		result = ns_client_checkaclsilent(qctx->client, NULL,
-						  inst->a_acl, true);
-		if (result == ISC_R_SUCCESS && inst->v4_a != NONE &&
-		    is_v4_client(qctx->client)) {
-			client_state->mode = inst->v4_a;
-		} else if (result == ISC_R_SUCCESS && inst->v6_a != NONE &&
-			   is_v6_client(qctx->client))
-		{
-			client_state->mode = inst->v6_a;
-		}
-	}
-
-	return (NS_HOOK_CONTINUE);
-}
-
-/*
- * Hide A rrsets if there is a matching AAAA. Trigger recursion if
- * necessary to find out whether an AAAA exists.
- *
- * (This version is for processing answers to explicit A queries; ANY
- * queries are handled in filter_respond_any_found().)
- */
-static ns_hookresult_t
-filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-	filter_data_t *client_state = client_state_get(qctx, inst);
-	isc_result_t result = ISC_R_UNSET;
-
-	*resp = ISC_R_UNSET;
-
-	if (client_state == NULL) {
-		return (NS_HOOK_CONTINUE);
-	}
-
-	if (client_state->mode != BREAK_DNSSEC &&
-	    (client_state->mode != FILTER ||
-	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
-	      dns_rdataset_isassociated(qctx->sigrdataset))))
-	{
-		return (NS_HOOK_CONTINUE);
-	}
-
-	if (qctx->qtype == dns_rdatatype_a) {
-		dns_rdataset_t *trdataset;
-		trdataset = ns_client_newrdataset(qctx->client);
-		result = dns_db_findrdataset(
-			qctx->db, qctx->node, qctx->version, dns_rdatatype_aaaa,
-			0, qctx->client->now, trdataset, NULL);
-		if (dns_rdataset_isassociated(trdataset)) {
-			dns_rdataset_disassociate(trdataset);
-		}
-		ns_client_putrdataset(qctx->client, &trdataset);
-
-		/*
-		 * We found an A. If we also found an AAAA, then the A
-		 * must not be rendered.
-		 *
-		 * If the AAAA is not in our cache, then any result other than
-		 * DNS_R_DELEGATION or ISC_R_NOTFOUND means there is no AAAAA,
-		 * and so AAAAs are okay.
-		 *
-		 * We assume there is no AAAA if we can't recurse for this
-		 * client. That might be the wrong answer, but what else
-		 * can we do?  Besides, the fact that we have the A and
-		 * are using this mechanism in the first place suggests
-		 * that we care more about AAAAs than As, and would have
-		 * cached an AAAA if it existed.
-		 */
-		if (result == ISC_R_SUCCESS) {
-			mark_as_rendered(qctx->rdataset, qctx->sigrdataset);
-			qctx->client->message->flags &= ~DNS_MESSAGEFLAG_AD;
-			client_state->flags |= FILTER_A_FILTERED;
-		} else if (!qctx->authoritative && RECURSIONOK(qctx->client) &&
-			   (result == DNS_R_DELEGATION ||
-			    result == ISC_R_NOTFOUND))
-		{
-			/*
-			 * This is an ugly kludge to recurse
-			 * for the AAAA and discard the result.???
-			 *
-			 * Continue to add the A now.
-			 * We'll make a note to not render it
-			 * if the recursion for the AAAA succeeds.
-			 */
-			result = ns_query_recurse(qctx->client,
-						  dns_rdatatype_aaaa,
-						  qctx->client->query.qname,
-						  NULL, NULL, qctx->resuming);
-			if (result == ISC_R_SUCCESS) {
-				client_state->flags |= FILTER_A_RECURSING;
-				qctx->client->query.attributes |=
-					NS_QUERYATTR_RECURSING;
-			}
-		}
-	} else if (qctx->qtype == dns_rdatatype_aaaa &&
-		   (client_state->flags & FILTER_A_RECURSING) != 0)
-	{
-		const section_filter_t filter_answer = {
-			.qctx = qctx,
-			.mode = client_state->mode,
-			.section = DNS_SECTION_ANSWER,
-			.name = qctx->fname,
-			.type = dns_rdatatype_a,
-		};
-		process_section(&filter_answer);
-
-		client_state->flags &= ~FILTER_A_RECURSING;
-
-		result = ns_query_done(qctx);
-
-		*resp = result;
-
-		return (NS_HOOK_RETURN);
-	}
-
-	*resp = result;
-	return (NS_HOOK_CONTINUE);
-}
-
-/*
- * When answering an ANY query, remove A if AAAA is present.
- */
-static ns_hookresult_t
-filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-	filter_data_t *client_state = client_state_get(qctx, inst);
-
-	*resp = ISC_R_UNSET;
-
-	if (client_state != NULL && client_state->mode != NONE) {
-		/*
-		 * If we are authoritative, require an AAAA record to be
-		 * present before filtering out A records; otherwise,
-		 * just assume an AAAA record exists even if it was not in the
-		 * cache (and therefore is not in the response message),
-		 * thus proceeding with filtering out A records.
-		 */
-		const section_filter_t filter_answer = {
-			.qctx = qctx,
-			.mode = client_state->mode,
-			.section = DNS_SECTION_ANSWER,
-			.name = qctx->tname,
-			.type = dns_rdatatype_a,
-			.only_if_aaaa_exists = qctx->authoritative,
-		};
-		process_section(&filter_answer);
-	}
-
-	return (NS_HOOK_CONTINUE);
-}
-
-/*
- * Hide A rrsets in the additional section if there is a matching AAAA, and
- * hide NS in the authority section if A was filtered in the answer
- * section.
- */
-static ns_hookresult_t
-filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-	filter_data_t *client_state = client_state_get(qctx, inst);
-
-	*resp = ISC_R_UNSET;
-
-	if (client_state != NULL && client_state->mode != NONE) {
-		const section_filter_t filter_additional = {
-			.qctx = qctx,
-			.mode = client_state->mode,
-			.section = DNS_SECTION_ADDITIONAL,
-			.type = dns_rdatatype_a,
-			.only_if_aaaa_exists = true,
-		};
-		process_section(&filter_additional);
-
-		if ((client_state->flags & FILTER_A_FILTERED) != 0) {
-			const section_filter_t filter_authority = {
-				.qctx = qctx,
-				.mode = client_state->mode,
-				.section = DNS_SECTION_AUTHORITY,
-				.type = dns_rdatatype_ns,
-			};
-			process_section(&filter_authority);
-		}
-	}
-
-	return (NS_HOOK_CONTINUE);
-}
-
-/*
- * If the client is being detached, then we can delete our persistent data
- * from hash table and return it to the memory pool.
- */
-static ns_hookresult_t
-filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
-	query_ctx_t *qctx = (query_ctx_t *)arg;
-	filter_instance_t *inst = (filter_instance_t *)cbdata;
-
-	*resp = ISC_R_UNSET;
-
-	if (!qctx->detach_client) {
-		return (NS_HOOK_CONTINUE);
-	}
-
-	client_state_destroy(qctx, inst);
-
-	return (NS_HOOK_CONTINUE);
-}
@@ -1,95 +0,0 @@
-.. 
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-   
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, you can obtain one at https://mozilla.org/MPL/2.0/.
-   
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-..
-   Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-
-   This Source Code Form is subject to the terms of the Mozilla Public
-   License, v. 2.0. If a copy of the MPL was not distributed with this
-   file, You can obtain one at http://mozilla.org/MPL/2.0/.
-
-   See the COPYRIGHT file distributed with this work for additional
-   information regarding copyright ownership.
-
-
-.. highlight: console
-
-.. _man_filter-a:
-
-filter-a.so - filter A in DNS responses when AAAA is present
---------------------------------------------------------------
-
-Synopsis
-~~~~~~~~
-
-:program:`plugin query` "filter-a.so" [{ parameters }];
-
-Description
-~~~~~~~~~~~
-
-``filter-a.so`` is a query plugin module for ``named``, enabling
-``named`` to omit some IPv4 addresses when responding to clients.
-
-For example:
-
-::
-
-   plugin query "/usr/local/lib/filter-a.so" {
-           filter-a-on-v6 yes;
-           filter-a-on-v4 yes;
-           filter-a { 192.0.2.1; 2001:db8:2::1; };
-   };
-
-This module is intended to aid transition from IPv4 to IPv6 by
-withholding IPv4 addresses from DNS clients which are not connected to
-the IPv4 Internet, when the name being looked up has an IPv6 address
-available. Use of this module is not recommended unless absolutely
-necessary.
-
-Note: This mechanism can erroneously cause other servers not to give
-A records to their clients. If a recursing server with both IPv6 and
-IPv4 network connections queries an authoritative server using this
-mechanism via IPv6, it is denied A records even if its client is
-using IPv4.
-
-Options
-~~~~~~~
-
-``filter-a``
-   This option specifies a list of client addresses for which A filtering is to
-   be applied. The default is ``any``.
-
-``filter-a-on-v6``
-   If set to ``yes``, this option indicates that the DNS client is at an IPv6 address, in
-   ``filter-a``. If the response does not include DNSSEC
-   signatures, then all A records are deleted from the response. This
-   filtering applies to all responses, not only authoritative
-   ones.
-
-   If set to ``break-dnssec``, then A records are deleted even when
-   DNSSEC is enabled. As suggested by the name, this causes the response
-   to fail to verify, because the DNSSEC protocol is designed to detect
-   deletions.
-
-   This mechanism can erroneously cause other servers not to give A
-   records to their clients. If a recursing server with both IPv6 and IPv4
-   network connections queries an authoritative server using this
-   mechanism via IPv6, it is denied A records even if its client is
-   using IPv4.
-
-``filter-a-on-v4``
-   This option is identical to ``filter-a-on-v6``, except that it filters A responses
-   to queries from IPv4 clients instead of IPv6 clients. To filter all
-   responses, set both options to ``yes``.
-
-See Also
-~~~~~~~~
-
-BIND 9 Administrator Reference Manual.
@@ -13,6 +13,11 @@

 /* aliases for the exported symbols */

+#define plugin_destroy	filter_aaaa_LTX_plugin_destroy
+#define plugin_register filter_aaaa_LTX_plugin_register
+#define plugin_version	filter_aaaa_LTX_plugin_version
+#define plugin_check	filter_aaaa_LTX_plugin_check
+
 #include <inttypes.h>
 #include <stdbool.h>
 #include <string.h>
@@ -9,10 +9,26 @@
 * information regarding copyright ownership.
 */

-#pragma once
+/*! \file */

-void
-isc__tls_initialize(void);
+#ifndef RNDC_OS_H
+#define RNDC_OS_H 1

-void
-isc__tls_shutdown(void);
+#include <stdio.h>
+
+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
+int
+set_user(FILE *fd, const char *user);
+/*%<
+ * Set the owner of the file referenced by 'fd' to 'user'.
+ * Returns:
+ *   0 		success
+ *   -1 	insufficient permissions, or 'user' does not exist.
+ */
+
+ISC_LANG_ENDDECLS
+
+#endif /* ifndef RNDC_OS_H */
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/log.h>
-#include <isc/managers.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/netmgr.h>
@@ -60,7 +59,6 @@
 const char *progname = NULL;
 bool verbose;

-static isc_nm_t *netmgr = NULL;
 static isc_taskmgr_t *taskmgr = NULL;
 static isc_task_t *rndc_task = NULL;

@@ -74,6 +72,7 @@ static bool local4set = false, local6set = false;
 static int nserveraddrs;
 static int currentaddr = 0;
 static unsigned int remoteport = 0;
+static isc_nm_t *netmgr = NULL;
 static isc_buffer_t *databuf = NULL;
 static isccc_ccmsg_t rndc_ccmsg;
 static uint32_t algorithm;
@@ -112,15 +111,12 @@ command is one of the following:\n\
 		Add zone to given view. Requires allow-new-zones option.\n\
  delzone [-clean] zone [class [view]]\n\
 		Removes zone from given view.\n\
-  dnssec -checkds [-key id [-alg algorithm]] [-when time] (published|withdrawn) zone [class [view]]\n\
+  dnssec -checkds [-key id [-alg algorithm] [-when time] (published|withdrawn) zone [class [view]]\n\
 		Mark the DS record for the KSK of the given zone as seen\n\
 		in the parent.  If the zone has multiple KSKs, select a\n\
 		specific key by providing the keytag with -key id and\n\
 		optionally the key's algorithm with -alg algorithm.\n\
 		Requires the zone to have a dnssec-policy.\n\
-  dnssec -rollover -key id [-alg algorithm] [-when time] zone [class [view]]\n\
-		Rollover key with id of the given zone. Requires the zone\n\
-		to have a dnssec-policy.\n\
  dnssec -status zone [class [view]]\n\
 		Show the DNSSEC signing state for the specified zone.\n\
 		Requires the zone to have a dnssec-policy.\n\
@@ -128,7 +124,7 @@ command is one of the following:\n\
 		Close, truncate and re-open the DNSTAP output file.\n\
  dnstap -roll count\n\
 		Close, rename and re-open the DNSTAP output file(s).\n\
-  dumpdb [-all|-cache|-zones|-adb|-bad|-expired|-fail] [view ...]\n\
+  dumpdb [-all|-cache|-zones|-adb|-bad|-fail] [view ...]\n\
 		Dump cache(s) to the dump file (named_dump.db).\n\
  flush         Flushes all of the server's caches.\n\
  flush [view]	Flushes the server's cache for a view.\n\
@@ -403,14 +399,13 @@ static void
 rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
 	isccc_sexpr_t *response = NULL;
-	isc_nmhandle_t *sendhandle = NULL;
-	isccc_sexpr_t *_ctrl = NULL;
+	isccc_sexpr_t *_ctrl;
 	isccc_region_t source;
 	uint32_t nonce;
 	isccc_sexpr_t *request = NULL;
 	isccc_time_t now;
 	isc_region_t r;
-	isccc_sexpr_t *data = NULL;
+	isccc_sexpr_t *data;
 	isc_buffer_t b;

 	REQUIRE(ccmsg != NULL);
@@ -486,11 +481,13 @@ rndc_recvnonce(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 	isc_nmhandle_attach(handle, &recvdone_handle);
 	atomic_fetch_add_relaxed(&recvs, 1);
-	isccc_ccmsg_readmessage(ccmsg, rndc_recvdone, ccmsg);
+	DO("schedule recv",
+	   isccc_ccmsg_readmessage(ccmsg, rndc_recvdone, ccmsg));

+	isc_nmhandle_t *sendhandle = NULL;
 	isc_nmhandle_attach(handle, &sendhandle);
 	atomic_fetch_add_relaxed(&sends, 1);
-	isc_nm_send(handle, &r, rndc_senddone, sendhandle);
+	DO("send message", isc_nm_send(handle, &r, rndc_senddone, sendhandle));

 	REQUIRE(recvnonce_handle == handle);
 	isc_nmhandle_detach(&recvnonce_handle);
@@ -506,12 +503,11 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	isccc_ccmsg_t *ccmsg = (isccc_ccmsg_t *)arg;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isccc_sexpr_t *request = NULL;
-	isccc_sexpr_t *data = NULL;
+	isccc_sexpr_t *data;
 	isccc_time_t now;
 	isc_region_t r;
 	isc_buffer_t b;
 	isc_nmhandle_t *connhandle = NULL;
-	isc_nmhandle_t *sendhandle = NULL;

 	REQUIRE(ccmsg != NULL);

@@ -561,11 +557,13 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 	isc_nmhandle_attach(handle, &recvnonce_handle);
 	atomic_fetch_add_relaxed(&recvs, 1);
-	isccc_ccmsg_readmessage(ccmsg, rndc_recvnonce, ccmsg);
+	DO("schedule recv",
+	   isccc_ccmsg_readmessage(ccmsg, rndc_recvnonce, ccmsg));

+	isc_nmhandle_t *sendhandle = NULL;
 	isc_nmhandle_attach(handle, &sendhandle);
 	atomic_fetch_add_relaxed(&sends, 1);
-	isc_nm_send(handle, &r, rndc_senddone, sendhandle);
+	DO("send message", isc_nm_send(handle, &r, rndc_senddone, sendhandle));

 	isc_nmhandle_detach(&connhandle);
 	atomic_fetch_sub_release(&connects, 1);
@@ -575,6 +573,7 @@ rndc_connected(isc_nmhandle_t *handle, isc_result_t result, void *arg) {

 static void
 rndc_startconnect(isc_sockaddr_t *addr) {
+	isc_result_t result;
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_t *local = NULL;

@@ -600,8 +599,10 @@ rndc_startconnect(isc_sockaddr_t *addr) {
 	}

 	atomic_fetch_add_relaxed(&connects, 1);
-	isc_nm_tcpconnect(netmgr, local, addr, rndc_connected, &rndc_ccmsg,
-			  60000, 0);
+	DO("create connection",
+	   isc_nm_tcpconnect(netmgr, (isc_nmiface_t *)local,
+			     (isc_nmiface_t *)addr, rndc_connected, &rndc_ccmsg,
+			     0));
 }

 static void
@@ -1031,7 +1032,9 @@ main(int argc, char **argv) {
 	serial = isc_random32();

 	isc_mem_create(&rndc_mctx);
-	isc_managers_create(rndc_mctx, 1, 0, 0, &netmgr, &taskmgr, NULL, NULL);
+	netmgr = isc_nm_start(rndc_mctx, 1);
+	DO("create task manager",
+	   isc_taskmgr_create(rndc_mctx, 1, 0, netmgr, &taskmgr));
 	DO("create task", isc_task_create(taskmgr, 0, &rndc_task));
 	isc_log_create(rndc_mctx, &log, &logconfig);
 	isc_log_setcontext(log);
@@ -1088,7 +1091,9 @@ main(int argc, char **argv) {
 	}

 	isc_task_detach(&rndc_task);
-	isc_managers_destroy(&netmgr, &taskmgr, NULL, NULL);
+	isc_taskmgr_destroy(&taskmgr);
+
+	isc_nm_closedown(netmgr);

 	/*
 	 * Note: when TCP connections are shut down, there will be a final
@@ -1098,6 +1103,8 @@ main(int argc, char **argv) {
 	 */
 	isccc_ccmsg_invalidate(&rndc_ccmsg);

+	isc_nm_destroy(&netmgr);
+
 	isc_log_destroy(&log);
 	isc_log_setcontext(NULL);

@@ -136,7 +136,7 @@ Currently supported commands are:
   This sample ``addzone`` command adds the zone ``example.com`` to
   the default view:

-   ``rndc addzone example.com '{ type master; file "example.com.db"; };'``
+   ``$ \ rndc addzone example.com '{ type master; file "example.com.db"; };'``

   (Note the brackets around and semi-colon after the zone configuration
   text.)
@@ -161,16 +161,13 @@ Currently supported commands are:

   See also ``rndc addzone`` and ``rndc modzone``.

-``dnssec`` ( **-status** | **-rollover** **-key** id [**-alg** *algorithm*] [**-when** *time*] | **-checkds** [**-key** *id* [**-alg** *algorithm*]] [**-when** *time*] ( *published* | *withdrawn* )) *zone* [*class* [*view*]]
+``dnssec`` ( **-status** | **-checkds** [**-key** *id* [**-alg** *algorithm*]] [**-when** *time*] ( *published* | *withdrawn* )) *zone* [*class* [*view*]]
   This command allows you to interact with the "dnssec-policy" of a given
   zone.

   ``rndc dnssec -status`` show the DNSSEC signing state for the specified
   zone.

-   ``rndc dnssec -rollover`` allows you to schedule key rollover for a
-   specific key (overriding the original key lifetime).
-
   ``rndc dnssec -checkds`` will let ``named`` know that the DS for the given
   key has been seen published into or withdrawn from the parent.  This is
   required in order to complete a KSK rollover.  If the ``-key id`` argument
@@ -189,7 +186,7 @@ Currently supported commands are:
   output file is moved to ".1", and so on. If ``number`` is specified, then
   the number of backup log files is limited to that number.

-``dumpdb`` [**-all** | **-cache** | **-zones** | **-adb** | **-bad** | **-expired** | **-fail**] [*view ...*]
+``dumpdb`` [**-all** | **-cache** | **-zones** | **-adb** | **-bad** | **-fail**] [*view ...*]
   This command dumps the server's caches (default) and/or zones to the dump file for
   the specified views. If no view is specified, all views are dumped.
   (See the ``dump-file`` option in the BIND 9 Administrator Reference
@@ -75,7 +75,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -107,7 +107,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIBCRYPTO@@OPENSSL_LIBSSL@libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,4 +1,5 @@
 .libs
+headerdep_test.sh
 nxtify
 sdig
 *_test
@@ -8,6 +9,3 @@ dlopen
 keycreate
 keydelete
 gssapi_krb
-/wire_test
-/test_client
-/test_server
--- a/Show More
+++ b/Show More