fixup! switch to ISC_LIST_FOREACH everywhere

use the ISC_LIST_FOREACH pattern in places where lists had
been iterated using a different pattern from the typical
`for` loop: for example, `while (!ISC_LIST_EMPTY(...))` or
`while ((e = ISC_LIST_HEAD(...)) != NULL)`.

.clang-format

@@ -78,6 +78,6 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
+ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE', 'MSG_SECTION_FOREACH' ]
 RemoveParentheses: ReturnStatement
 RemoveSemicolon: true

bin/delv/delv.c

@@ -956,10 +956,9 @@ addserver(dns_client_t *client) {
 	CHECK(dns_client_setservers(client, dns_rdataclass_in, name, &servers));
 
 cleanup:
-	while (!ISC_LIST_EMPTY(servers)) {
-		sa = ISC_LIST_HEAD(servers);
-		ISC_LIST_UNLINK(servers, sa, link);
-		isc_mem_put(mctx, sa, sizeof(*sa));
+	ISC_LIST_FOREACH_SAFE (servers, s, link) {
+		ISC_LIST_UNLINK(servers, s, link);
+		isc_mem_put(mctx, s, sizeof(*s));
 	}
 
 	if (result != ISC_R_SUCCESS) {
@@ -974,8 +973,7 @@ static isc_result_t
 findserver(dns_client_t *client) {
 	isc_result_t result;
 	irs_resconf_t *resconf = NULL;
-	isc_sockaddrlist_t *nameservers;
-	isc_sockaddr_t *sa = NULL, *next = NULL;
+	isc_sockaddrlist_t *nameservers = NULL;
 
 	result = irs_resconf_load(mctx, "/etc/resolv.conf", &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
@@ -986,9 +984,7 @@ findserver(dns_client_t *client) {
 
 	/* Get nameservers from resolv.conf */
 	nameservers = irs_resconf_getnameservers(resconf);
-	for (sa = ISC_LIST_HEAD(*nameservers); sa != NULL; sa = next) {
-		next = ISC_LIST_NEXT(sa, link);
-
+	ISC_LIST_FOREACH_SAFE (*nameservers, sa, link) {
 		/* Set destination port */
 		if (sa->type.sa.sa_family == AF_INET && use_ipv4) {
 			sa->type.sin.sin_port = htons(destport);
@@ -1009,7 +1005,7 @@ findserver(dns_client_t *client) {
 		if (use_ipv4) {
 			struct in_addr localhost;
 			localhost.s_addr = htonl(INADDR_LOOPBACK);
-			sa = isc_mem_get(mctx, sizeof(*sa));
+			isc_sockaddr_t *sa = isc_mem_get(mctx, sizeof(*sa));
 			isc_sockaddr_fromin(sa, &localhost, destport);
 
 			ISC_LINK_INIT(sa, link);
@@ -1017,7 +1013,7 @@ findserver(dns_client_t *client) {
 		}
 
 		if (use_ipv6) {
-			sa = isc_mem_get(mctx, sizeof(*sa));
+			isc_sockaddr_t *sa = isc_mem_get(mctx, sizeof(*sa));
 			isc_sockaddr_fromin6(sa, &in6addr_loopback, destport);
 
 			ISC_LINK_INIT(sa, link);
@@ -1840,7 +1836,6 @@ static void
 resolve_cb(dns_client_t *client, const dns_name_t *query_name,
 	   dns_namelist_t *namelist, isc_result_t result) {
 	char namestr[DNS_NAME_FORMATSIZE];
-	dns_rdataset_t *rdataset;
 
 	if (result != ISC_R_SUCCESS && !yaml) {
 		delv_log(ISC_LOG_ERROR, "resolution failed: %s",
@@ -1855,13 +1850,8 @@ resolve_cb(dns_client_t *client, const dns_name_t *query_name,
 		printf("records:\n");
 	}
 
-	for (dns_name_t *response_name = ISC_LIST_HEAD(*namelist);
-	     response_name != NULL;
-	     response_name = ISC_LIST_NEXT(response_name, link))
-	{
-		for (rdataset = ISC_LIST_HEAD(response_name->list);
-		     rdataset != NULL; rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+	ISC_LIST_FOREACH (*namelist, response_name, link) {
+		ISC_LIST_FOREACH (response_name->list, rdataset, link) {
 			printdata(rdataset, response_name);
 		}
 	}
@@ -1986,19 +1976,10 @@ recvresponse(void *arg) {
 		goto cleanup;
 	}
 
-	for (result = dns_message_firstname(response, DNS_SECTION_ANSWER);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(response, DNS_SECTION_ANSWER))
-	{
-		dns_name_t *name = NULL;
-		dns_rdataset_t *rdataset = NULL;
+	MSG_SECTION_FOREACH (response, DNS_SECTION_ANSWER, name) {
 		dns_rdatatype_t prevtype = 0;
 
-		dns_message_currentname(response, DNS_SECTION_ANSWER, &name);
-
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			dns_rdataset_t rds, sigs;
 			int options = 0;
 

bin/dig/dig.c

@@ -578,8 +578,6 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 static isc_result_t
 short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 	     dig_query_t *query) {
-	dns_name_t *name;
-	dns_rdataset_t *rdataset;
 	isc_result_t result, loopresult;
 	dns_name_t empty_name;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
@@ -587,20 +585,8 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 	UNUSED(flags);
 
 	dns_name_init(&empty_name);
-	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
-	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
-	} else if (result != ISC_R_SUCCESS) {
-		return result;
-	}
-
-	for (;;) {
-		name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
-
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_ANSWER, name) {
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			loopresult = dns_rdataset_first(rdataset);
 			while (loopresult == ISC_R_SUCCESS) {
 				dns_rdataset_current(rdataset, &rdata);
@@ -613,12 +599,6 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdata_reset(&rdata);
 			}
 		}
-		result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
-		if (result == ISC_R_NOMORE) {
-			break;
-		} else if (result != ISC_R_SUCCESS) {
-			return result;
-		}
 	}
 
 	return ISC_R_SUCCESS;
@@ -626,16 +606,10 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 
 static bool
 isdotlocal(dns_message_t *msg) {
-	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
 	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);
 
-	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, DNS_SECTION_QUESTION))
-	{
-		dns_name_t *name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_QUESTION, name) {
 		if (dns_name_issubdomain(name, &local)) {
 			return true;
 		}

bin/dig/dighost.c

@@ -463,16 +463,14 @@ make_server(const char *servname, const char *userarg) {
  */
 static void
 get_server_list(irs_resconf_t *resconf) {
-	isc_sockaddrlist_t *servers;
-	isc_sockaddr_t *sa;
-	dig_server_t *newsrv;
+	isc_sockaddrlist_t *servers = NULL;
+	dig_server_t *newsrv = NULL;
 	char tmp[sizeof("ffff:ffff:ffff:ffff:ffff:ffff:255.255.255.255") +
 		 sizeof("%4000000000")];
+
 	debug("get_server_list()");
 	servers = irs_resconf_getnameservers(resconf);
-	for (sa = ISC_LIST_HEAD(*servers); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link))
-	{
+	ISC_LIST_FOREACH (*servers, sa, link) {
 		int pf = isc_sockaddr_pf(sa);
 		isc_netaddr_t na;
 		isc_result_t result;
@@ -505,15 +503,10 @@ get_server_list(irs_resconf_t *resconf) {
 
 void
 flush_server_list(void) {
-	dig_server_t *s, *ps;
-
 	debug("flush_server_list()");
-	s = ISC_LIST_HEAD(server_list);
-	while (s != NULL) {
-		ps = s;
-		s = ISC_LIST_NEXT(s, link);
-		ISC_LIST_DEQUEUE(server_list, ps, link);
-		isc_mem_free(mctx, ps);
+	ISC_LIST_FOREACH_SAFE (server_list, s, link) {
+		ISC_LIST_DEQUEUE(server_list, s, link);
+		isc_mem_free(mctx, s);
 	}
 }
 
@@ -557,15 +550,12 @@ set_nameserver(char *opt) {
  */
 void
 clone_server_list(dig_serverlist_t src, dig_serverlist_t *dest) {
-	dig_server_t *srv, *newsrv;
-
 	debug("clone_server_list()");
-	srv = ISC_LIST_HEAD(src);
-	while (srv != NULL) {
-		newsrv = make_server(srv->servername, srv->userarg);
+	ISC_LIST_FOREACH_SAFE (src, srv, link) {
+		dig_server_t *newsrv = make_server(srv->servername,
+						   srv->userarg);
 		ISC_LINK_INIT(newsrv, link);
 		ISC_LIST_ENQUEUE(*dest, newsrv, link);
-		srv = ISC_LIST_NEXT(srv, link);
 	}
 }
 
@@ -1211,8 +1201,7 @@ make_searchlist_entry(char *domain) {
 
 static void
 clear_searchlist(void) {
-	dig_searchlist_t *search;
-	while ((search = ISC_LIST_HEAD(search_list)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (search_list, search, link) {
 		ISC_LIST_UNLINK(search_list, search, link);
 		isc_mem_free(mctx, search);
 	}
@@ -1220,17 +1209,14 @@ clear_searchlist(void) {
 
 static void
 create_search_list(irs_resconf_t *resconf) {
-	irs_resconf_searchlist_t *list;
-	irs_resconf_search_t *entry;
-	dig_searchlist_t *search;
+	irs_resconf_searchlist_t *list = NULL;
+	dig_searchlist_t *search = NULL;
 
 	debug("create_search_list()");
 	clear_searchlist();
 
 	list = irs_resconf_getsearchlist(resconf);
-	for (entry = ISC_LIST_HEAD(*list); entry != NULL;
-	     entry = ISC_LIST_NEXT(entry, link))
-	{
+	ISC_LIST_FOREACH (*list, entry, link) {
 		search = make_searchlist_entry(entry->domain);
 		ISC_LIST_APPEND(search_list, search, link);
 	}
@@ -1505,17 +1491,11 @@ add_question(dns_message_t *message, dns_name_t *name, dns_rdataclass_t rdclass,
  */
 static void
 check_if_done(void) {
-	dig_lookup_t *lookup = NULL;
-
 	debug("check_if_done()");
 	debug("list %s", ISC_LIST_EMPTY(lookup_list) ? "empty" : "full");
 
-	lookup = ISC_LIST_HEAD(lookup_list);
-	while (lookup != NULL) {
-		dig_lookup_t *next = NULL;
+	ISC_LIST_FOREACH (lookup_list, lookup, link) {
 		debug("pending lookup %p", lookup);
-		next = ISC_LIST_NEXT(lookup, link);
-		lookup = next;
 	}
 
 	if (ISC_LIST_EMPTY(lookup_list) && current_lookup == NULL &&
@@ -1538,18 +1518,15 @@ check_if_done(void) {
  */
 static bool
 check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
-	dig_query_t *q = ISC_LIST_HEAD(l->q);
-
 	debug("check_if_queries_done(%p)", l);
 
-	while (q != NULL) {
+	ISC_LIST_FOREACH (l->q, q, link) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
 				return false;
 			}
 		}
-		q = ISC_LIST_NEXT(q, link);
 	}
 
 	return true;
@@ -1557,9 +1534,6 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 
 static void
 _destroy_lookup(dig_lookup_t *lookup) {
-	dig_server_t *s;
-	void *ptr;
-
 	REQUIRE(lookup != NULL);
 	REQUIRE(ISC_LIST_EMPTY(lookup->q));
 
@@ -1567,14 +1541,10 @@ _destroy_lookup(dig_lookup_t *lookup) {
 
 	isc_refcount_destroy(&lookup->references);
 
-	s = ISC_LIST_HEAD(lookup->my_server_list);
-	while (s != NULL) {
+	ISC_LIST_FOREACH_SAFE (lookup->my_server_list, s, link) {
 		debug("freeing server %p belonging to %p", s, lookup);
-		ptr = s;
-		s = ISC_LIST_NEXT(s, link);
-		ISC_LIST_DEQUEUE(lookup->my_server_list, (dig_server_t *)ptr,
-				 link);
-		isc_mem_free(mctx, ptr);
+		ISC_LIST_DEQUEUE(lookup->my_server_list, s, link);
+		isc_mem_free(mctx, s);
 	}
 	if (lookup->sendmsg != NULL) {
 		dns_message_detach(&lookup->sendmsg);
@@ -1834,8 +1804,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	dig_server_t *srv = NULL;
 	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_name_t *name = NULL;
-	isc_result_t result;
+	isc_result_t result = ISC_R_NOMORE;
 	bool success = false;
 	int numLookups = 0;
 	int num;
@@ -1850,13 +1819,8 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 
 	addresses_result = ISC_R_SUCCESS;
 	bad_namestr[0] = '\0';
-	for (result = dns_message_firstname(msg, section);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, section))
-	{
-		name = NULL;
-		dns_message_currentname(msg, section, &name);
 
+	MSG_SECTION_FOREACH (msg, section, name) {
 		if (section == DNS_SECTION_AUTHORITY) {
 			rdataset = NULL;
 			result = dns_message_findtype(name, dns_rdatatype_soa,
@@ -2175,8 +2139,6 @@ bool
 setup_lookup(dig_lookup_t *lookup) {
 	isc_result_t result;
 	unsigned int len;
-	dig_server_t *serv;
-	dig_query_t *query;
 	isc_buffer_t b;
 	dns_compress_t cctx;
 	char store[MXNAME];
@@ -2643,10 +2605,9 @@ setup_lookup(dig_lookup_t *lookup) {
 
 	lookup->pending = false;
 
-	for (serv = ISC_LIST_HEAD(lookup->my_server_list); serv != NULL;
-	     serv = ISC_LIST_NEXT(serv, link))
-	{
-		query = new_query(lookup, serv->servername, serv->userarg);
+	ISC_LIST_FOREACH (lookup->my_server_list, serv, link) {
+		dig_query_t *query = new_query(lookup, serv->servername,
+					       serv->userarg);
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}
 
@@ -2753,13 +2714,9 @@ send_done(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 
 static void
 _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
-	dig_query_t *query, *next;
-
 	debug("%s:%u:%s()", file, line, __func__);
-	query = ISC_LIST_HEAD(lookup->q);
-	while (query != NULL) {
+	ISC_LIST_FOREACH_SAFE (lookup->q, query, link) {
 		REQUIRE(DIG_VALID_QUERY(query));
-		next = ISC_LIST_NEXT(query, link);
 		ISC_LIST_DEQUEUE(lookup->q, query, link);
 		debug("canceling pending query %p, belonging to %p", query,
 		      query->lookup);
@@ -2770,7 +2727,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 			isc_nm_cancelread(query->readhandle);
 		}
 		query_detach(&query);
-		query = next;
 	}
 	lookup->pending = false;
 	lookup->retries = 0;
@@ -3684,7 +3640,6 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 static bool
 check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 		    dns_message_t *msg, isc_sockaddr_t *peer, int len) {
-	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdata_soa_t soa;
 	uint32_t ixfr_serial = lookup->ixfr_serial, serial;
@@ -3709,18 +3664,13 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 
 	query->msg_count++;
 	query->byte_count += len;
-	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
-	if (result != ISC_R_SUCCESS) {
+
+	if (ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
 		puts("; Transfer failed.");
 		return true;
 	}
-	do {
-		dns_name_t *name;
-		name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_ANSWER, name) {
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			result = dns_rdataset_first(rdataset);
 			if (result != ISC_R_SUCCESS) {
 				continue;
@@ -3813,8 +3763,8 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				result = dns_rdataset_next(rdataset);
 			} while (result == ISC_R_SUCCESS);
 		}
-		result = dns_message_nextname(msg, DNS_SECTION_ANSWER);
-	} while (result == ISC_R_SUCCESS);
+	}
+
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
@@ -4247,19 +4197,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		}
 	} else {
 		match = true;
-		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
-		     result == ISC_R_SUCCESS && match;
-		     result = dns_message_nextname(msg, DNS_SECTION_QUESTION))
-		{
-			dns_name_t *name = NULL;
-			dns_rdataset_t *rdataset;
-
-			dns_message_currentname(msg, DNS_SECTION_QUESTION,
-						&name);
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-			{
+		MSG_SECTION_FOREACH (msg, DNS_SECTION_QUESTION, name) {
+			ISC_LIST_FOREACH (name->list, rdataset, link) {
 				if (l->rdtype != rdataset->type ||
 				    l->rdclass != rdataset->rdclass ||
 				    !dns_name_equal(l->name, name))
@@ -4283,22 +4222,23 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 					match = false;
 				}
 			}
-		}
 
-		if (!match) {
-			if (l->tcp_mode) {
-				goto cancel_lookup;
+			/* Break out of the loop on mismatch */
+			if (!match) {
+				if (l->tcp_mode) {
+					goto cancel_lookup;
+				}
+
+				/*
+				 * We are still attached to query and the
+				 * query->readhandle is also attached
+				 */
+				isc_refcount_increment0(&recvcount);
+				debug("recvcount=%" PRIuFAST32,
+				      isc_refcount_current(&recvcount));
+				isc_nm_read(handle, recv_done, query);
+				goto keep_query;
 			}
-
-			/*
-			 * We are still attached to query and the
-			 * query->readhandle is also attached
-			 */
-			isc_refcount_increment0(&recvcount);
-			debug("recvcount=%" PRIuFAST32,
-			      isc_refcount_current(&recvcount));
-			isc_nm_read(handle, recv_done, query);
-			goto keep_query;
 		}
 	}
 
@@ -4675,9 +4615,6 @@ run_loop(void *arg) {
  */
 void
 cancel_all(void) {
-	dig_lookup_t *l, *n;
-	dig_query_t *q, *nq;
-
 	debug("cancel_all()");
 
 	if (free_now) {
@@ -4687,8 +4624,7 @@ cancel_all(void) {
 	cancel_now = true;
 
 	while (current_lookup != NULL) {
-		for (q = ISC_LIST_HEAD(current_lookup->q); q != NULL; q = nq) {
-			nq = ISC_LIST_NEXT(q, link);
+		ISC_LIST_FOREACH_SAFE (current_lookup->q, q, link) {
 			debug("canceling pending query %p, belonging to %p", q,
 			      current_lookup);
 			q->canceled = true;
@@ -4707,12 +4643,9 @@ cancel_all(void) {
 			lookup_detach(&current_lookup);
 		}
 	}
-	l = ISC_LIST_HEAD(lookup_list);
-	while (l != NULL) {
-		n = ISC_LIST_NEXT(l, link);
+	ISC_LIST_FOREACH_SAFE (lookup_list, l, link) {
 		ISC_LIST_DEQUEUE(lookup_list, l, link);
 		lookup_detach(&l);
-		l = n;
 	}
 }
 

bin/dig/host.c

@@ -206,8 +206,7 @@ retry:
 static isc_result_t
 printsection(dns_message_t *msg, dns_section_t sectionid,
 	     const char *section_name, bool headers, dig_query_t *query) {
-	dns_name_t *name, *print_name;
-	dns_rdataset_t *rdataset;
+	dns_name_t *print_name;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	isc_buffer_t target;
 	isc_result_t result, loopresult;
@@ -223,24 +222,12 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 
 	dns_name_init(&empty_name);
 
-	result = dns_message_firstname(msg, sectionid);
-	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
-	} else if (result != ISC_R_SUCCESS) {
-		return result;
-	}
-
-	for (;;) {
-		name = NULL;
-		dns_message_currentname(msg, sectionid, &name);
-
+	MSG_SECTION_FOREACH (msg, sectionid, name) {
 		isc_buffer_init(&target, tbuf, sizeof(tbuf));
 		first = true;
 		print_name = name;
 
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			if (query->lookup->rdtype == dns_rdatatype_axfr &&
 			    !((!list_addresses &&
 			       (list_type == dns_rdatatype_any ||
@@ -314,13 +301,6 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 				printf("%.*s", (int)r.length, (char *)r.base);
 			}
 		}
-
-		result = dns_message_nextname(msg, sectionid);
-		if (result == ISC_R_NOMORE) {
-			break;
-		} else if (result != ISC_R_SUCCESS) {
-			return result;
-		}
 	}
 
 	return ISC_R_SUCCESS;

bin/dig/nslookup.c

@@ -198,9 +198,6 @@ printrdata(dns_rdata_t *rdata) {
 static isc_result_t
 printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 	     dns_section_t section) {
-	isc_result_t result, loopresult;
-	dns_name_t *name;
-	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	char namebuf[DNS_NAME_FORMATSIZE];
 
@@ -209,19 +206,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 
 	debug("printsection()");
 
-	result = dns_message_firstname(msg, section);
-	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
-	} else if (result != ISC_R_SUCCESS) {
-		return result;
-	}
-	for (;;) {
-		name = NULL;
-		dns_message_currentname(msg, section, &name);
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
-			loopresult = dns_rdataset_first(rdataset);
+	MSG_SECTION_FOREACH (msg, section, name) {
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
+			isc_result_t loopresult = dns_rdataset_first(rdataset);
 			while (loopresult == ISC_R_SUCCESS) {
 				dns_rdataset_current(rdataset, &rdata);
 				switch (rdata.type) {
@@ -253,12 +240,6 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 				loopresult = dns_rdataset_next(rdataset);
 			}
 		}
-		result = dns_message_nextname(msg, section);
-		if (result == ISC_R_NOMORE) {
-			break;
-		} else if (result != ISC_R_SUCCESS) {
-			return result;
-		}
 	}
 	return ISC_R_SUCCESS;
 }
@@ -266,9 +247,6 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 static isc_result_t
 detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 	      dns_section_t section) {
-	isc_result_t result, loopresult;
-	dns_name_t *name;
-	dns_rdataset_t *rdataset = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	char namebuf[DNS_NAME_FORMATSIZE];
 
@@ -293,18 +271,8 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		}
 	}
 
-	result = dns_message_firstname(msg, section);
-	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
-	} else if (result != ISC_R_SUCCESS) {
-		return result;
-	}
-	for (;;) {
-		name = NULL;
-		dns_message_currentname(msg, section, &name);
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_NEXT(rdataset, link))
-		{
+	MSG_SECTION_FOREACH (msg, section, name) {
+		ISC_LIST_FOREACH (name->list, rdataset, link) {
 			if (section == DNS_SECTION_QUESTION) {
 				dns_name_format(name, namebuf, sizeof(namebuf));
 				printf("\t%s, ", namebuf);
@@ -315,7 +283,7 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 						      namebuf, sizeof(namebuf));
 				printf("class = %s\n", namebuf);
 			}
-			loopresult = dns_rdataset_first(rdataset);
+			isc_result_t loopresult = dns_rdataset_first(rdataset);
 			while (loopresult == ISC_R_SUCCESS) {
 				dns_rdataset_current(rdataset, &rdata);
 
@@ -335,12 +303,6 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 				loopresult = dns_rdataset_next(rdataset);
 			}
 		}
-		result = dns_message_nextname(msg, section);
-		if (result == ISC_R_NOMORE) {
-			break;
-		} else if (result != ISC_R_SUCCESS) {
-			return result;
-		}
 	}
 	return ISC_R_SUCCESS;
 }
@@ -484,14 +446,10 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 
 static void
 show_settings(bool full, bool serv_only) {
-	dig_server_t *srv;
 	isc_sockaddr_t sockaddr;
-	dig_searchlist_t *listent;
 	isc_result_t result;
 
-	srv = ISC_LIST_HEAD(server_list);
-
-	while (srv != NULL) {
+	ISC_LIST_FOREACH (server_list, srv, link) {
 		char sockstr[ISC_SOCKADDR_FORMATSIZE];
 
 		result = get_address(srv->servername, port, &sockaddr);
@@ -503,7 +461,6 @@ show_settings(bool full, bool serv_only) {
 		if (!full) {
 			return;
 		}
-		srv = ISC_LIST_NEXT(srv, link);
 	}
 	if (serv_only) {
 		return;
@@ -517,9 +474,7 @@ show_settings(bool full, bool serv_only) {
 	       tries, port, ndots);
 	printf("  querytype = %-8s\tclass = %s\n", deftype, defclass);
 	printf("  srchlist = ");
-	for (listent = ISC_LIST_HEAD(search_list); listent != NULL;
-	     listent = ISC_LIST_NEXT(listent, link))
-	{
+	ISC_LIST_FOREACH (search_list, listent, link) {
 		printf("%s", listent->origin);
 		if (ISC_LIST_NEXT(listent, link) != NULL) {
 			printf("/");

bin/dnssec/dnssec-cds.c

@@ -209,8 +209,7 @@ freeset(dns_rdataset_t *rdataset) {
 
 static void
 freelist(dns_rdataset_t *rdataset) {
-	dns_rdatalist_t *rdlist;
-	dns_rdata_t *rdata;
+	dns_rdatalist_t *rdlist = NULL;
 
 	if (!dns_rdataset_isassociated(rdataset)) {
 		return;
@@ -218,9 +217,7 @@ freelist(dns_rdataset_t *rdataset) {
 
 	dns_rdatalist_fromrdataset(rdataset, &rdlist);
 
-	for (rdata = ISC_LIST_HEAD(rdlist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_HEAD(rdlist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (rdlist->rdata, rdata, link) {
 		ISC_LIST_UNLINK(rdlist->rdata, rdata, link);
 		isc_mem_put(mctx, rdata, sizeof(*rdata));
 	}

bin/dnssec/dnssec-keygen.c

@@ -1217,7 +1217,6 @@ main(int argc, char **argv) {
 			cfg_parser_t *parser = NULL;
 			cfg_obj_t *config = NULL;
 			dns_kasp_t *kasp = NULL;
-			dns_kasp_key_t *kaspkey = NULL;
 
 			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
 				      ISC_R_SUCCESS);
@@ -1245,10 +1244,7 @@ main(int argc, char **argv) {
 			ctx.ttl = dns_kasp_dnskeyttl(kasp);
 			ctx.setttl = true;
 
-			for (kaspkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-			     kaspkey != NULL;
-			     kaspkey = ISC_LIST_NEXT(kaspkey, link))
-			{
+			ISC_LIST_FOREACH (dns_kasp_keys(kasp), kaspkey, link) {
 				ctx.use_nsec3 = false;
 				ctx.alg = dns_kasp_key_algorithm(kaspkey);
 				ctx.size = dns_kasp_key_size(kaspkey);

bin/dnssec/dnssec-ksr.c

@@ -228,20 +228,15 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 		      isc_result_totext(ret));
 	}
 	/* Sort on keytag. */
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(keys_read); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link))
-	{
+	ISC_LIST_FOREACH (keys_read, dk, link) {
 		n++;
 	}
 	keys_sorted = isc_mem_cget(mctx, n, sizeof(dns_dnsseckey_t *));
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(keys_read); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link), i++)
-	{
-		keys_sorted[i] = dk;
+	ISC_LIST_FOREACH (keys_read, dk, link) {
+		keys_sorted[i++] = dk;
 	}
 	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
-	while (!ISC_LIST_EMPTY(keys_read)) {
-		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
+	ISC_LIST_FOREACH_SAFE (keys_read, key, link) {
 		ISC_LIST_UNLINK(keys_read, key, link);
 	}
 	/* Save sorted list in 'keys' */
@@ -268,20 +263,16 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 
 static void
 cleanup(dns_dnsseckeylist_t *keys, dns_kasp_t *kasp) {
-	while (!ISC_LIST_EMPTY(*keys)) {
-		dns_dnsseckey_t *key = ISC_LIST_HEAD(*keys);
+	ISC_LIST_FOREACH_SAFE (*keys, key, link) {
 		ISC_LIST_UNLINK(*keys, key, link);
 		dst_key_free(&key->key);
 		dns_dnsseckey_destroy(mctx, &key);
 	}
 	dns_kasp_detach(&kasp);
 
-	isc_buffer_t *cbuf = ISC_LIST_HEAD(cleanup_list);
-	while (cbuf != NULL) {
-		isc_buffer_t *nbuf = ISC_LIST_NEXT(cbuf, link);
+	ISC_LIST_FOREACH_SAFE (cleanup_list, cbuf, link) {
 		ISC_LIST_UNLINK(cleanup_list, cbuf, link);
 		isc_buffer_free(&cbuf);
-		cbuf = nbuf;
 	}
 }
 
@@ -310,8 +301,7 @@ progress(int p) {
 
 static void
 freerrset(dns_rdataset_t *rdataset) {
-	dns_rdatalist_t *rdlist;
-	dns_rdata_t *rdata;
+	dns_rdatalist_t *rdlist = NULL;
 
 	if (!dns_rdataset_isassociated(rdataset)) {
 		return;
@@ -319,9 +309,7 @@ freerrset(dns_rdataset_t *rdataset) {
 
 	dns_rdatalist_fromrdataset(rdataset, &rdlist);
 
-	for (rdata = ISC_LIST_HEAD(rdlist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_HEAD(rdlist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (rdlist->rdata, rdata, link) {
 		ISC_LIST_UNLINK(rdlist->rdata, rdata, link);
 		isc_mem_put(mctx, rdata, sizeof(*rdata));
 	}
@@ -395,9 +383,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);
 
 	/* Check existing keys. */
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link))
-	{
+	ISC_LIST_FOREACH (*keys, dk, link) {
 		isc_stdtime_t act = 0, inact = 0;
 
 		if (!dns_kasp_key_match(kaspkey, dk)) {
@@ -578,9 +564,7 @@ print_dnskeys(dns_kasp_key_t *kaspkey, dns_ttl_t ttl, dns_dnsseckeylist_t *keys,
 	rdatalist->rdclass = dns_rdataclass_in;
 	rdatalist->type = dns_rdatatype_dnskey;
 	rdatalist->ttl = ttl;
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link))
-	{
+	ISC_LIST_FOREACH (*keys, dk, link) {
 		isc_stdtime_t pub = 0, del = 0;
 
 		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
@@ -685,9 +669,7 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	rrsiglist->rdclass = dns_rdataclass_in;
 	rrsiglist->type = dns_rdatatype_rrsig;
 	rrsiglist->ttl = rrset->ttl;
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link))
-	{
+	ISC_LIST_FOREACH (*keys, dk, link) {
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf = NULL;
 		dns_rdata_t rdata = DNS_RDATA_INIT;
@@ -771,9 +753,7 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	cdslist->type = dns_rdatatype_cds;
 	cdslist->ttl = ksr->ttl;
 
-	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
-	     dk = ISC_LIST_NEXT(dk, link))
-	{
+	ISC_LIST_FOREACH (*keys, dk, link) {
 		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
@@ -862,9 +842,7 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 		isc_buffer_clear(newbuf);
 
 		/* CDS */
-		for (dns_kasp_digest_t *alg = ISC_LIST_HEAD(digests);
-		     alg != NULL; alg = ISC_LIST_NEXT(alg, link))
-		{
+		ISC_LIST_FOREACH (digests, alg, link) {
 			isc_buffer_t *newbuf2 = NULL;
 			dns_rdata_t *rdata2 = NULL;
 			dns_rdata_t cds = DNS_RDATA_INIT;
@@ -1069,9 +1047,7 @@ keygen(ksr_ctx_t *ksr) {
 	/* Set context */
 	setcontext(ksr, kasp);
 	/* Key generation */
-	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
-	{
+	ISC_LIST_FOREACH (dns_kasp_keys(kasp), kk, link) {
 		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
 			/* only ZSKs allowed */
 			continue;
@@ -1138,9 +1114,7 @@ request(ksr_ctx_t *ksr) {
 			(int)r.length, r.base, timestr);
 
 		next = ksr->end + 1;
-		for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-		     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
-		{
+		ISC_LIST_FOREACH (dns_kasp_keys(kasp), kk, link) {
 			/*
 			 * Output the DNSKEY records for the current bundle
 			 * that starts at 'inception. The 'next' variable is

bin/dnssec/dnssec-signzone.c

@@ -354,11 +354,7 @@ iszsk(dns_dnsseckey_t *key) {
  */
 static dns_dnsseckey_t *
 keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
-	dns_dnsseckey_t *key;
-
-	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (keylist, key, link) {
 		if (rrsig->keyid == dst_key_id(key->key) &&
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
@@ -485,7 +481,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	dns_rdataset_t sigset;
 	dns_rdata_t sigrdata = DNS_RDATA_INIT;
 	dns_rdata_rrsig_t rrsig;
-	dns_dnsseckey_t *key;
 	isc_result_t result;
 	bool nosigs = false;
 	bool *wassignedby, *nowsignedby;
@@ -536,6 +531,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}
 
 	while (result == ISC_R_SUCCESS) {
+		dns_dnsseckey_t *key = NULL;
 		bool expired, refresh, future, offline;
 		bool keep = false, resign = false;
 
@@ -681,9 +677,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		dns_rdataset_disassociate(&sigset);
 	}
 
-	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (keylist, key, link) {
 		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
 			continue;
 		}
@@ -701,13 +695,9 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		     set->type == dns_rdatatype_dnskey) &&
 		    dns_name_equal(name, gorigin))
 		{
-			bool have_ksk;
-			dns_dnsseckey_t *curr;
+			bool have_ksk = isksk(key);
 
-			have_ksk = isksk(key);
-			for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
-			     curr = ISC_LIST_NEXT(curr, link))
-			{
+			ISC_LIST_FOREACH (keylist, curr, link) {
 				if (dst_key_alg(key->key) !=
 				    dst_key_alg(curr->key))
 				{
@@ -732,7 +722,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			 * key that already signs this RRset.
 			 */
 			bool have_pre_sig = false;
-			dns_dnsseckey_t *curr;
 			uint32_t pre;
 			isc_result_t ret = dst_key_getnum(
 				key->key, DST_NUM_PREDECESSOR, &pre);
@@ -746,10 +735,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 				 * - Have key ID equal to the predecessor id.
 				 * - Have a successor that matches 'key' id.
 				 */
-				for (curr = ISC_LIST_HEAD(keylist);
-				     curr != NULL;
-				     curr = ISC_LIST_NEXT(curr, link))
-				{
+				ISC_LIST_FOREACH (keylist, curr, link) {
 					uint32_t suc;
 
 					if (dst_key_alg(key->key) !=
@@ -2695,12 +2681,11 @@ loadexplicitkeys(char *keyfiles[], int n, bool setksk) {
 		}
 
 		/* Skip any duplicates */
-		for (key = ISC_LIST_HEAD(keylist); key != NULL;
-		     key = ISC_LIST_NEXT(key, link))
-		{
-			if (dst_key_id(key->key) == dst_key_id(newkey) &&
-			    dst_key_alg(key->key) == dst_key_alg(newkey))
+		ISC_LIST_FOREACH (keylist, k, link) {
+			if (dst_key_id(k->key) == dst_key_id(newkey) &&
+			    dst_key_alg(k->key) == dst_key_alg(newkey))
 			{
+				key = k;
 				break;
 			}
 		}
@@ -2740,9 +2725,7 @@ report(const char *format, ...) {
 
 static void
 clear_keylist(dns_dnsseckeylist_t *list) {
-	dns_dnsseckey_t *key;
-	while (!ISC_LIST_EMPTY(*list)) {
-		key = ISC_LIST_HEAD(*list);
+	ISC_LIST_FOREACH_SAFE (*list, key, link) {
 		ISC_LIST_UNLINK(*list, key, link);
 		dns_dnsseckey_destroy(mctx, &key);
 	}
@@ -2779,9 +2762,7 @@ add_digest(char *str, size_t dlen, dns_kasp_digestlist_t *digests,
 	}
 
 	/* Suppress duplicates */
-	for (dns_kasp_digest_t *d = ISC_LIST_HEAD(*digests); d != NULL;
-	     d = ISC_LIST_NEXT(d, link))
-	{
+	ISC_LIST_FOREACH (*digests, d, link) {
 		if (d->digest == alg) {
 			return;
 		}
@@ -2803,7 +2784,6 @@ build_final_keylist(void) {
 	char name[DNS_NAME_FORMATSIZE];
 	dns_rdataset_t cdsset, cdnskeyset, soaset;
 	dns_kasp_digestlist_t digests;
-	dns_kasp_digest_t *d, *d_next;
 	bool cdnskey = false;
 
 	ISC_LIST_INIT(rmkeys);
@@ -2903,8 +2883,7 @@ findkeys:
 	clear_keylist(&rmkeys);
 	clear_keylist(&matchkeys);
 
-	for (d = ISC_LIST_HEAD(digests); d != NULL; d = d_next) {
-		d_next = ISC_LIST_NEXT(d, link);
+	ISC_LIST_FOREACH_SAFE (digests, d, link) {
 		ISC_LIST_UNLINK(digests, d, link);
 		isc_mem_put(mctx, d, sizeof(*d));
 	}
@@ -3086,7 +3065,6 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	isc_buffer_t namebuf;
 	isc_region_t r;
 	isc_result_t result;
-	dns_dnsseckey_t *key, *curr;
 	unsigned char dsbuf[DNS_DS_BUFFERSIZE];
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	unsigned int filenamelen;
@@ -3115,9 +3093,7 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 
 	name = gorigin;
 
-	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (keylist, key, link) {
 		if (REVOKE(key->key)) {
 			continue;
 		}
@@ -3128,9 +3104,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 			have_ksk = false;
 			have_non_ksk = true;
 		}
-		for (curr = ISC_LIST_HEAD(keylist); curr != NULL;
-		     curr = ISC_LIST_NEXT(curr, link))
-		{
+
+		ISC_LIST_FOREACH (keylist, curr, link) {
 			if (dst_key_alg(key->key) != dst_key_alg(curr->key)) {
 				continue;
 			}
@@ -3364,7 +3339,6 @@ main(int argc, char *argv[]) {
 	char *endp;
 	isc_time_t timer_start, timer_finish;
 	isc_time_t sign_start, sign_finish;
-	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
 	bool free_output = false;
 	int tempfilelen = 0;
@@ -3899,9 +3873,7 @@ main(int argc, char *argv[]) {
 	}
 
 	/* Now enumerate the key list */
-	for (key = ISC_LIST_HEAD(keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (keylist, key, link) {
 		key->index = keycount++;
 	}
 
@@ -4087,8 +4059,7 @@ main(int argc, char *argv[]) {
 
 	hashlist_free(&hashlist);
 
-	while (!ISC_LIST_EMPTY(keylist)) {
-		key = ISC_LIST_HEAD(keylist);
+	ISC_LIST_FOREACH_SAFE (keylist, key, link) {
 		ISC_LIST_UNLINK(keylist, key, link);
 		dns_dnsseckey_destroy(mctx, &key);
 	}

bin/dnssec/dnssectool.c

@@ -591,12 +591,11 @@ void
 kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	       const char *keydir, dns_kasp_t **kaspp) {
 	isc_result_t result = ISC_R_NOTFOUND;
-	const cfg_listelt_t *element;
+	const cfg_listelt_t *element = NULL;
 	const cfg_obj_t *kasps = NULL;
-	dns_kasp_t *kasp = NULL, *kasp_next;
 	dns_kasplist_t kasplist;
 	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next;
+	dns_keystore_t *keystore = NULL;
 	dns_keystorelist_t kslist;
 
 	ISC_LIST_INIT(kasplist);
@@ -607,7 +606,6 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		ks = NULL;
 		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure key-store '%s': %s",
@@ -616,21 +614,21 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		}
 	}
 	/* Default key-directory key store. */
-	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
-	INSIST(ks != NULL);
+	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &keystore);
+	INSIST(keystore != NULL);
 	if (keydir != NULL) {
 		/* '-K keydir' takes priority */
-		dns_keystore_setdirectory(ks, keydir);
+		dns_keystore_setdirectory(keystore, keydir);
 	}
-	dns_keystore_detach(&ks);
+	dns_keystore_detach(&keystore);
 
 	(void)cfg_map_get(config, "dnssec-policy", &kasps);
 	for (element = cfg_list_first(kasps); element != NULL;
 	     element = cfg_list_next(element))
 	{
+		dns_kasp_t *kasp = NULL;
+
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		kasp = NULL;
 		if (strcmp(cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
 			   name) != 0)
 		{
@@ -646,16 +644,15 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 		}
 		INSIST(kasp != NULL);
 		dns_kasp_freeze(kasp);
+
+		*kaspp = kasp;
 		break;
 	}
 
-	*kaspp = kasp;
-
 	/*
 	 * Cleanup kasp list.
 	 */
-	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
-		kasp_next = ISC_LIST_NEXT(kasp, link);
+	ISC_LIST_FOREACH_SAFE (kasplist, kasp, link) {
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
@@ -663,8 +660,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	/*
 	 * Cleanup keystore list.
 	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
+	ISC_LIST_FOREACH_SAFE (kslist, ks, link) {
 		ISC_LIST_UNLINK(kslist, ks, link);
 		dns_keystore_detach(&ks);
 	}

bin/named/builtin.c

@@ -792,19 +792,14 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 
 static void
 destroynode(bdbnode_t *node) {
-	dns_rdatalist_t *list = NULL;
-	dns_rdata_t *rdata = NULL;
-	isc_buffer_t *b = NULL;
 	bdb_t *bdb = NULL;
 	isc_mem_t *mctx = NULL;
 
 	bdb = node->bdb;
 	mctx = bdb->common.mctx;
 
-	while (!ISC_LIST_EMPTY(node->lists)) {
-		list = ISC_LIST_HEAD(node->lists);
-		while (!ISC_LIST_EMPTY(list->rdata)) {
-			rdata = ISC_LIST_HEAD(list->rdata);
+	ISC_LIST_FOREACH_SAFE (node->lists, list, link) {
+		ISC_LIST_FOREACH_SAFE (list->rdata, rdata, link) {
 			ISC_LIST_UNLINK(list->rdata, rdata, link);
 			isc_mem_put(mctx, rdata, sizeof(dns_rdata_t));
 		}
@@ -812,8 +807,7 @@ destroynode(bdbnode_t *node) {
 		isc_mem_put(mctx, list, sizeof(dns_rdatalist_t));
 	}
 
-	while (!ISC_LIST_EMPTY(node->buffers)) {
-		b = ISC_LIST_HEAD(node->buffers);
+	ISC_LIST_FOREACH_SAFE (node->buffers, b, link) {
 		ISC_LIST_UNLINK(node->buffers, b, link);
 		isc_buffer_free(&b);
 	}
@@ -1107,7 +1101,6 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdataset_t *rdataset,
 	     dns_rdataset_t *sigrdataset DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)node;
-	dns_rdatalist_t *list = NULL;
 
 	REQUIRE(VALID_BDBNODE(bdbnode));
 
@@ -1120,20 +1113,14 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		return ISC_R_NOTIMPLEMENTED;
 	}
 
-	list = ISC_LIST_HEAD(bdbnode->lists);
-	while (list != NULL) {
+	ISC_LIST_FOREACH (bdbnode->lists, list, link) {
 		if (list->type == type) {
-			break;
+			new_rdataset(list, db, node, rdataset);
+			return ISC_R_SUCCESS;
 		}
-		list = ISC_LIST_NEXT(list, link);
-	}
-	if (list == NULL) {
-		return ISC_R_NOTFOUND;
 	}
 
-	new_rdataset(list, db, node, rdataset);
-
-	return ISC_R_SUCCESS;
+	return ISC_R_NOTFOUND;
 }
 
 static isc_result_t

bin/named/controlconf.c

@@ -170,8 +170,7 @@ free_controlkey(controlkey_t *key, isc_mem_t *mctx) {
 
 static void
 free_controlkeylist(controlkeylist_t *keylist, isc_mem_t *mctx) {
-	while (!ISC_LIST_EMPTY(*keylist)) {
-		controlkey_t *key = ISC_LIST_HEAD(*keylist);
+	ISC_LIST_FOREACH_SAFE (*keylist, key, link) {
 		ISC_LIST_UNLINK(*keylist, key, link);
 		free_controlkey(key, mctx);
 	}
@@ -202,22 +201,13 @@ ISC_REFCOUNT_IMPL(controlconnection, conn_free);
 
 static void
 shutdown_listener(controllistener_t *listener) {
-	controlconnection_t *conn = NULL;
-	controlconnection_t *next = NULL;
-
 	/* Don't shutdown the same listener twice */
 	if (listener->shuttingdown) {
 		return;
 	}
 	listener->shuttingdown = true;
 
-	for (conn = ISC_LIST_HEAD(listener->connections); conn != NULL;
-	     conn = next)
-	{
-		/*
-		 * 'conn' is likely to be freed by the conn_shutdown() call.
-		 */
-		next = ISC_LIST_NEXT(conn, link);
+	ISC_LIST_FOREACH_SAFE (listener->connections, conn, link) {
 		conn_shutdown(conn);
 	}
 
@@ -433,7 +423,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		    void *arg) {
 	controlconnection_t *conn = (controlconnection_t *)arg;
 	controllistener_t *listener = conn->listener;
-	controlkey_t *key = NULL;
+	bool match = false;
 	isccc_time_t sent;
 	isccc_time_t exp;
 	uint32_t nonce;
@@ -442,9 +432,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		goto cleanup;
 	}
 
-	for (key = ISC_LIST_HEAD(listener->keys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (listener->keys, key, link) {
 		isccc_region_t ccregion;
 
 		isccc_ccmsg_toregion(&conn->ccmsg, &ccregion);
@@ -457,13 +445,14 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		result = isccc_cc_fromwire(&ccregion, &conn->request, conn->alg,
 					   &conn->secret);
 		if (result == ISC_R_SUCCESS) {
+			match = true;
 			break;
 		}
 		isc_mem_put(listener->mctx, conn->secret.rstart,
 			    REGION_SIZE(conn->secret));
 	}
 
-	if (key == NULL) {
+	if (!match) {
 		result = ISCCC_R_BADAUTH;
 		goto cleanup;
 	}
@@ -658,16 +647,10 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 
 static void
 controls_shutdown(named_controls_t *controls) {
-	controllistener_t *listener = NULL;
-	controllistener_t *next = NULL;
-
-	for (listener = ISC_LIST_HEAD(controls->listeners); listener != NULL;
-	     listener = next)
-	{
+	ISC_LIST_FOREACH_SAFE (controls->listeners, listener, link) {
 		/*
 		 * As listeners shut down, they will call their callbacks.
 		 */
-		next = ISC_LIST_NEXT(listener, link);
 		shutdown_listener(listener);
 	}
 }
@@ -742,7 +725,6 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 static void
 register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	      controlkeylist_t *keyids, isc_mem_t *mctx, const char *socktext) {
-	controlkey_t *keyid = NULL, *next = NULL;
 	const cfg_obj_t *keydef = NULL;
 	char secret[1024];
 	isc_buffer_t b;
@@ -751,9 +733,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 	/*
 	 * Find the keys corresponding to the keyids used by this listener.
 	 */
-	for (keyid = ISC_LIST_HEAD(*keyids); keyid != NULL; keyid = next) {
-		next = ISC_LIST_NEXT(keyid, link);
-
+	ISC_LIST_FOREACH_SAFE (*keyids, keyid, link) {
 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(control, ISC_LOG_WARNING,
@@ -940,10 +920,9 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	controlkeylist_t keys;
 	isc_result_t result = ISC_R_SUCCESS;
 
-	for (listener = ISC_LIST_HEAD(cp->listeners); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-	{
-		if (isc_sockaddr_equal(addr, &listener->address)) {
+	ISC_LIST_FOREACH (cp->listeners, l, link) {
+		if (isc_sockaddr_equal(addr, &l->address)) {
+			listener = l;
 			break;
 		}
 	}

bin/named/server.c

@@ -1735,9 +1735,7 @@ setquerystats(dns_zone_t *zone, isc_mem_t *mctx, dns_zonestat_level_t level) {
 static named_cache_t *
 cachelist_find(named_cachelist_t *cachelist, const char *cachename,
 	       dns_rdataclass_t rdclass) {
-	for (named_cache_t *nsc = ISC_LIST_HEAD(*cachelist); nsc != NULL;
-	     nsc = ISC_LIST_NEXT(nsc, link))
-	{
+	ISC_LIST_FOREACH (*cachelist, nsc, link) {
 		if (nsc->rdclass == rdclass &&
 		    strcmp(dns_cache_getname(nsc->cache), cachename) == 0)
 		{
@@ -5959,7 +5957,6 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 	const cfg_listelt_t *element = NULL;
 	dns_fwdpolicy_t fwdpolicy = dns_fwdpolicy_none;
 	dns_forwarderlist_t fwdlist;
-	dns_forwarder_t *fwd = NULL;
 	isc_result_t result;
 	in_port_t port;
 	in_port_t tls_port;
@@ -6014,7 +6011,8 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 		const cfg_obj_t *forwarder = cfg_listelt_value(element);
 		const char *cur_tls = NULL;
 
-		fwd = isc_mem_get(view->mctx, sizeof(dns_forwarder_t));
+		dns_forwarder_t *fwd = isc_mem_get(view->mctx,
+						   sizeof(dns_forwarder_t));
 		fwd->tlsname = NULL;
 		cur_tls = cfg_obj_getsockaddrtls(forwarder);
 		if (cur_tls == NULL) {
@@ -6079,8 +6077,7 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 
 cleanup:
 
-	while (!ISC_LIST_EMPTY(fwdlist)) {
-		fwd = ISC_LIST_HEAD(fwdlist);
+	ISC_LIST_FOREACH_SAFE (fwdlist, fwd, link) {
 		ISC_LIST_UNLINK(fwdlist, fwd, link);
 		if (fwd->tlsname != NULL) {
 			dns_name_free(fwd->tlsname, view->mctx);
@@ -7036,12 +7033,9 @@ tat_timer_tick(void *arg) {
 	isc_result_t result;
 	named_server_t *server = (named_server_t *)arg;
 	struct dotat_arg dotat_arg = { 0 };
-	dns_view_t *view = NULL;
 	dns_keytable_t *secroots = NULL;
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (!view->trust_anchor_telemetry || !view->enablevalidation) {
 			continue;
 		}
@@ -7850,22 +7844,17 @@ load_configuration(const char *filename, named_server_t *server,
 		   bool first_time) {
 	cfg_obj_t *config = NULL, *bindkeys = NULL;
 	cfg_parser_t *conf_parser = NULL, *bindkeys_parser = NULL;
-	const cfg_listelt_t *element;
-	const cfg_obj_t *builtin_views;
+	const cfg_listelt_t *element = NULL;
+	const cfg_obj_t *builtin_views = NULL;
 	const cfg_obj_t *maps[3];
-	const cfg_obj_t *obj;
-	const cfg_obj_t *options;
-	const cfg_obj_t *kasps;
-	const cfg_obj_t *keystores;
-	dns_kasp_t *kasp = NULL;
-	dns_kasp_t *kasp_next = NULL;
+	const cfg_obj_t *obj = NULL;
+	const cfg_obj_t *options = NULL;
+	const cfg_obj_t *kasps = NULL;
+	const cfg_obj_t *keystores = NULL;
 	dns_kasp_t *default_kasp = NULL;
 	dns_kasplist_t tmpkasplist, kasplist;
-	dns_keystore_t *keystore = NULL;
-	dns_keystore_t *keystore_next = NULL;
 	dns_keystorelist_t tmpkeystorelist, keystorelist;
 	const cfg_obj_t *views = NULL;
-	dns_view_t *view_next = NULL;
 	dns_viewlist_t tmpviewlist;
 	dns_viewlist_t viewlist, builtin_viewlist;
 	in_port_t listen_port, udpport_low, udpport_high;
@@ -7882,9 +7871,8 @@ load_configuration(const char *filename, named_server_t *server,
 	uint32_t send_tcp_buffer_size;
 	uint32_t recv_udp_buffer_size;
 	uint32_t send_udp_buffer_size;
-	named_cache_t *nsc = NULL;
 	named_cachelist_t cachelist, tmpcachelist;
-	ns_altsecret_t *altsecret;
+	ns_altsecret_t *altsecret = NULL;
 	ns_altsecretlist_t altsecrets, tmpaltsecrets;
 	uint32_t softquota = 0;
 	uint32_t max;
@@ -8585,7 +8573,7 @@ load_configuration(const char *filename, named_server_t *server,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		keystore = NULL;
+
 		result = cfg_keystore_fromconfig(kconfig, named_g_mctx,
 						 &keystorelist, NULL);
 		if (result != ISC_R_SUCCESS) {
@@ -8602,8 +8590,8 @@ load_configuration(const char *filename, named_server_t *server,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
+		dns_kasp_t *kasp = NULL;
 
-		kasp = NULL;
 		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
 					     named_g_mctx, &keystorelist,
 					     &kasplist, &kasp);
@@ -8632,7 +8620,8 @@ load_configuration(const char *filename, named_server_t *server,
 	     element = cfg_list_next(element))
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
-		kasp = NULL;
+		dns_kasp_t *kasp = NULL;
+
 		result = cfg_kasp_fromconfig(kconfig, default_kasp, true,
 					     named_g_mctx, &keystorelist,
 					     &kasplist, &kasp);
@@ -8798,9 +8787,7 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Commit any dns_zone_setview() calls on all zones in the new
 	 * view.
 	 */
-	for (dns_view_t *view = ISC_LIST_HEAD(viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (viewlist, view, link) {
 		dns_view_setviewcommit(view);
 	}
 
@@ -8810,9 +8797,7 @@ load_configuration(const char *filename, named_server_t *server,
 	viewlist = tmpviewlist;
 
 	/* Make the view list available to each of the views */
-	for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		view->viewlist = &server->viewlist;
 	}
 
@@ -8848,9 +8833,7 @@ load_configuration(const char *filename, named_server_t *server,
 	 * after relinquishing privileges them.
 	 */
 	if (first_time) {
-		for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist);
-		     view != NULL; view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			nzd_env_close(view);
 		}
 	}
@@ -8881,9 +8864,7 @@ load_configuration(const char *filename, named_server_t *server,
 	 * Reopen NZD databases.
 	 */
 	if (first_time) {
-		for (dns_view_t *view = ISC_LIST_HEAD(server->viewlist);
-		     view != NULL; view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			nzd_env_reopen(view);
 		}
 	}
@@ -9242,9 +9223,9 @@ load_configuration(const char *filename, named_server_t *server,
 	 * were swapped above or not.
 	 */
 cleanup_altsecrets:
-	while ((altsecret = ISC_LIST_HEAD(altsecrets)) != NULL) {
-		ISC_LIST_UNLINK(altsecrets, altsecret, link);
-		isc_mem_put(server->sctx->mctx, altsecret, sizeof(*altsecret));
+	ISC_LIST_FOREACH_SAFE (altsecrets, as, link) {
+		ISC_LIST_UNLINK(altsecrets, as, link);
+		isc_mem_put(server->sctx->mctx, as, sizeof(*as));
 	}
 
 cleanup_logc:
@@ -9253,7 +9234,7 @@ cleanup_logc:
 	}
 
 cleanup_cachelist:
-	while ((nsc = ISC_LIST_HEAD(cachelist)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (cachelist, nsc, link) {
 		ISC_LIST_UNLINK(cachelist, nsc, link);
 		dns_cache_detach(&nsc->cache);
 		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
@@ -9262,10 +9243,7 @@ cleanup_cachelist:
 	ISC_LIST_APPENDLIST(viewlist, builtin_viewlist, link);
 
 cleanup_viewlist:
-	for (dns_view_t *view = ISC_LIST_HEAD(viewlist); view != NULL;
-	     view = view_next)
-	{
-		view_next = ISC_LIST_NEXT(view, link);
+	ISC_LIST_FOREACH_SAFE (viewlist, view, link) {
 		ISC_LIST_UNLINK(viewlist, view, link);
 		if (result == ISC_R_SUCCESS && strcmp(view->name, "_bind") != 0)
 		{
@@ -9276,17 +9254,13 @@ cleanup_viewlist:
 	}
 
 cleanup_kasplist:
-	for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL; kasp = kasp_next) {
-		kasp_next = ISC_LIST_NEXT(kasp, link);
+	ISC_LIST_FOREACH_SAFE (kasplist, kasp, link) {
 		ISC_LIST_UNLINK(kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
 
 cleanup_keystorelist:
-	for (keystore = ISC_LIST_HEAD(keystorelist); keystore != NULL;
-	     keystore = keystore_next)
-	{
-		keystore_next = ISC_LIST_NEXT(keystore, link);
+	ISC_LIST_FOREACH_SAFE (keystorelist, keystore, link) {
 		ISC_LIST_UNLINK(keystorelist, keystore, link);
 		dns_keystore_detach(&keystore);
 	}
@@ -9338,7 +9312,6 @@ view_loaded(void *arg) {
 	if (isc_refcount_decrement(&zl->refs) == 1) {
 		named_server_t *server = zl->server;
 		bool reconfig = zl->reconfig;
-		dns_view_t *view = NULL;
 
 		isc_refcount_destroy(&zl->refs);
 		isc_mem_put(server->mctx, zl, sizeof(*zl));
@@ -9359,9 +9332,7 @@ view_loaded(void *arg) {
 				      "all zones loaded");
 		}
 
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			if (view->managed_keys != NULL) {
 				result = dns_zone_synckeyzone(
 					view->managed_keys);
@@ -9410,7 +9381,6 @@ static isc_result_t
 load_zones(named_server_t *server, bool reconfig) {
 	isc_result_t result = ISC_R_SUCCESS;
 	ns_zoneload_t *zl = NULL;
-	dns_view_t *view = NULL;
 
 	zl = isc_mem_get(server->mctx, sizeof(*zl));
 	zl->server = server;
@@ -9423,9 +9393,7 @@ load_zones(named_server_t *server, bool reconfig) {
 	/*
 	 * Schedule zones to be loaded from disk.
 	 */
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (view->managed_keys != NULL) {
 			result = dns_zone_load(view->managed_keys, false);
 			if (result != ISC_R_SUCCESS &&
@@ -9528,11 +9496,7 @@ named_server_flushonshutdown(named_server_t *server, bool flush) {
 static void
 shutdown_server(void *arg) {
 	named_server_t *server = (named_server_t *)arg;
-	dns_view_t *view = NULL, *view_next = NULL;
-	dns_kasp_t *kasp = NULL, *kasp_next = NULL;
-	dns_keystore_t *keystore = NULL, *keystore_next = NULL;
 	bool flush = server->flushonshutdown;
-	named_cache_t *nsc = NULL;
 
 #if HAVE_LIBSYSTEMD
 	sd_notify(0, "STOPPING=1\n");
@@ -9572,25 +9536,17 @@ shutdown_server(void *arg) {
 
 	(void)named_server_saventa(server);
 
-	for (kasp = ISC_LIST_HEAD(server->kasplist); kasp != NULL;
-	     kasp = kasp_next)
-	{
-		kasp_next = ISC_LIST_NEXT(kasp, link);
+	ISC_LIST_FOREACH_SAFE (server->kasplist, kasp, link) {
 		ISC_LIST_UNLINK(server->kasplist, kasp, link);
 		dns_kasp_detach(&kasp);
 	}
 
-	for (keystore = ISC_LIST_HEAD(server->keystorelist); keystore != NULL;
-	     keystore = keystore_next)
-	{
-		keystore_next = ISC_LIST_NEXT(keystore, link);
+	ISC_LIST_FOREACH_SAFE (server->keystorelist, keystore, link) {
 		ISC_LIST_UNLINK(server->keystorelist, keystore, link);
 		dns_keystore_detach(&keystore);
 	}
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = view_next)
-	{
+	ISC_LIST_FOREACH_SAFE (server->viewlist, view, link) {
 		view_next = ISC_LIST_NEXT(view, link);
 		ISC_LIST_UNLINK(server->viewlist, view, link);
 		dns_view_flushonshutdown(view, flush);
@@ -9602,7 +9558,7 @@ shutdown_server(void *arg) {
 	 */
 	dns_dyndb_cleanup();
 
-	while ((nsc = ISC_LIST_HEAD(server->cachelist)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (server->cachelist, nsc, link) {
 		ISC_LIST_UNLINK(server->cachelist, nsc, link);
 		dns_cache_detach(&nsc->cache);
 		isc_mem_put(server->mctx, nsc, sizeof(*nsc));
@@ -9631,8 +9587,6 @@ static isc_result_t
 get_matching_view_sync(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 		       dns_message_t *message, dns_aclenv_t *env,
 		       isc_result_t *sigresult, dns_view_t **viewp) {
-	dns_view_t *view;
-
 	/*
 	 * We should not be running synchronous view matching if signature
 	 * checking involves SIG(0). TSIG has priority of SIG(0), so if TSIG
@@ -9641,9 +9595,7 @@ get_matching_view_sync(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
 	INSIST(message->tsigkey != NULL || message->tsig != NULL ||
 	       message->sig0 == NULL);
 
-	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (named_g_server->viewlist, view, link) {
 		if (message->rdclass == view->rdclass ||
 		    message->rdclass == dns_rdataclass_any)
 		{
@@ -11081,21 +11033,18 @@ add_zone_tolist(dns_zone_t *zone, void *uap) {
 
 static isc_result_t
 add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
-	struct viewlistentry *vle;
 	isc_result_t result = ISC_R_SUCCESS;
 
 	/*
 	 * Prevent duplicate views.
 	 */
-	for (vle = ISC_LIST_HEAD(dctx->viewlist); vle != NULL;
-	     vle = ISC_LIST_NEXT(vle, link))
-	{
+	ISC_LIST_FOREACH (dctx->viewlist, vle, link) {
 		if (vle->view == view) {
 			return ISC_R_SUCCESS;
 		}
 	}
 
-	vle = isc_mem_get(dctx->mctx, sizeof *vle);
+	struct viewlistentry *vle = isc_mem_get(dctx->mctx, sizeof *vle);
 	vle->view = NULL;
 	dns_view_attach(view, &vle->view);
 	ISC_LINK_INIT(vle, link);
@@ -11110,22 +11059,15 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 
 static void
 dumpcontext_destroy(struct dumpcontext *dctx) {
-	struct viewlistentry *vle;
-	struct zonelistentry *zle;
-
-	vle = ISC_LIST_HEAD(dctx->viewlist);
-	while (vle != NULL) {
+	ISC_LIST_FOREACH_SAFE (dctx->viewlist, vle, link) {
 		ISC_LIST_UNLINK(dctx->viewlist, vle, link);
-		zle = ISC_LIST_HEAD(vle->zonelist);
-		while (zle != NULL) {
+		ISC_LIST_FOREACH_SAFE (vle->zonelist, zle, link) {
 			ISC_LIST_UNLINK(vle->zonelist, zle, link);
 			dns_zone_detach(&zle->zone);
 			isc_mem_put(dctx->mctx, zle, sizeof *zle);
-			zle = ISC_LIST_HEAD(vle->zonelist);
 		}
 		dns_view_detach(&vle->view);
 		isc_mem_put(dctx->mctx, vle, sizeof *vle);
-		vle = ISC_LIST_HEAD(dctx->viewlist);
 	}
 	if (dctx->version != NULL) {
 		dns_db_closeversion(dctx->db, &dctx->version, false);
@@ -11295,10 +11237,9 @@ isc_result_t
 named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 		    isc_buffer_t **text) {
 	struct dumpcontext *dctx = NULL;
-	dns_view_t *view;
 	isc_result_t result;
-	char *ptr;
-	const char *sep;
+	char *ptr = NULL;
+	const char *sep = NULL;
 	bool found;
 
 	REQUIRE(text != NULL);
@@ -11365,9 +11306,7 @@ named_server_dumpdb(named_server_t *server, isc_lex_t *lex,
 
 nextview:
 	found = false;
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (ptr != NULL && strcmp(view->name, ptr) != 0) {
 			continue;
 		}
@@ -11400,11 +11339,10 @@ cleanup:
 isc_result_t
 named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 			  isc_buffer_t **text) {
-	dns_view_t *view;
 	dns_keytable_t *secroots = NULL;
 	dns_ntatable_t *ntatable = NULL;
 	isc_result_t result;
-	char *ptr;
+	char *ptr = NULL;
 	FILE *fp = NULL;
 	isc_time_t now;
 	char tbuf[64];
@@ -11441,9 +11379,7 @@ named_server_dumpsecroots(named_server_t *server, isc_lex_t *lex,
 	used = isc_buffer_usedlength(*text);
 
 	do {
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			if (ptr != NULL && strcmp(view->name, ptr) != 0) {
 				continue;
 			}
@@ -11520,7 +11456,6 @@ cleanup:
 isc_result_t
 named_server_dumprecursing(named_server_t *server) {
 	FILE *fp = NULL;
-	dns_view_t *view;
 	isc_result_t result;
 
 	CHECKMF(isc_stdio_open(server->recfile, "w", &fp),
@@ -11528,9 +11463,7 @@ named_server_dumprecursing(named_server_t *server) {
 	fprintf(fp, ";\n; Recursing Queries\n;\n");
 	ns_interfacemgr_dumprecursing(fp, server->interfacemgr);
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		fprintf(fp, ";\n; Active fetch domains [view: %s]\n;\n",
 			view->name);
 		dns_resolver_dumpfetches(view->resolver, isc_statsformat_file,
@@ -11591,8 +11524,7 @@ named_server_setdebuglevel(named_server_t *server, isc_lex_t *lex) {
 isc_result_t
 named_server_validation(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text) {
-	char *ptr;
-	dns_view_t *view;
+	char *ptr = NULL;
 	bool changed = false;
 	isc_result_t result;
 	bool enable = true, set = true, first = true;
@@ -11629,9 +11561,7 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	ptr = next_token(lex, text);
 
 	isc_loopmgr_pause(named_g_loopmgr);
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if ((ptr != NULL && strcasecmp(ptr, view->name) != 0) ||
 		    strcasecmp("_bind", view->name) == 0)
 		{
@@ -11672,12 +11602,10 @@ cleanup:
 
 isc_result_t
 named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
-	char *ptr;
-	dns_view_t *view;
+	char *ptr = NULL;
 	bool flushed;
 	bool found;
 	isc_result_t result;
-	named_cache_t *nsc;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, NULL);
@@ -11705,31 +11633,25 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 		 * much more lightweight because only a few (most typically just
 		 * one) views will match.
 		 */
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			if (strcasecmp(ptr, view->name) != 0) {
 				continue;
 			}
+
 			found = true;
-			for (nsc = ISC_LIST_HEAD(server->cachelist);
-			     nsc != NULL; nsc = ISC_LIST_NEXT(nsc, link))
-			{
+			ISC_LIST_FOREACH (server->cachelist, nsc, link) {
 				if (nsc->cache == view->cache) {
+					nsc->needflush = true;
 					break;
 				}
 			}
-			INSIST(nsc != NULL);
-			nsc->needflush = true;
 		}
 	} else {
 		found = true;
 	}
 
 	/* Perform flush */
-	for (nsc = ISC_LIST_HEAD(server->cachelist); nsc != NULL;
-	     nsc = ISC_LIST_NEXT(nsc, link))
-	{
+	ISC_LIST_FOREACH (server->cachelist, nsc, link) {
 		if (ptr != NULL && !nsc->needflush) {
 			continue;
 		}
@@ -11754,15 +11676,12 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 	 * A worst case is that we have n views and n/2 caches, each shared by
 	 * two views.  Then this will be a O(n^2/4) operation.
 	 */
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (!dns_view_iscacheshared(view)) {
 			continue;
 		}
-		for (nsc = ISC_LIST_HEAD(server->cachelist); nsc != NULL;
-		     nsc = ISC_LIST_NEXT(nsc, link))
-		{
+
+		ISC_LIST_FOREACH (server->cachelist, nsc, link) {
 			if (!nsc->needflush || nsc->cache != view->cache) {
 				continue;
 			}
@@ -11780,9 +11699,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 	}
 
 	/* Cleanup the cache list. */
-	for (nsc = ISC_LIST_HEAD(server->cachelist); nsc != NULL;
-	     nsc = ISC_LIST_NEXT(nsc, link))
-	{
+	ISC_LIST_FOREACH (server->cachelist, nsc, link) {
 		nsc->needflush = false;
 	}
 
@@ -11818,13 +11735,12 @@ isc_result_t
 named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	char *ptr, *viewname;
 	char target[DNS_NAME_FORMATSIZE];
-	dns_view_t *view;
 	bool flushed;
 	bool found;
 	isc_result_t result;
 	isc_buffer_t b;
 	dns_fixedname_t fixed;
-	dns_name_t *name;
+	dns_name_t *name = NULL;
 
 	/* Skip the command name. */
 	ptr = next_token(lex, NULL);
@@ -11853,9 +11769,7 @@ named_server_flushnode(named_server_t *server, isc_lex_t *lex, bool tree) {
 	isc_loopmgr_pause(named_g_loopmgr);
 	flushed = true;
 	found = false;
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (viewname != NULL && strcasecmp(viewname, view->name) != 0) {
 			continue;
 		}
@@ -12176,7 +12090,6 @@ synczone(dns_zone_t *zone, void *uap) {
 isc_result_t
 named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	isc_result_t result, tresult;
-	dns_view_t *view = NULL;
 	dns_zone_t *zone = NULL;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
@@ -12205,9 +12118,7 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	if (zone == NULL) {
 		isc_loopmgr_pause(named_g_loopmgr);
 		tresult = ISC_R_SUCCESS;
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			result = dns_view_apply(view, false, NULL, synczone,
 						&cleanup);
 			if (result != ISC_R_SUCCESS && tresult == ISC_R_SUCCESS)
@@ -12227,7 +12138,7 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 	result = synczone(zone, &cleanup);
 	isc_loopmgr_resume(named_g_loopmgr);
 
-	view = dns_zone_getview(zone);
+	dns_view_t *view = dns_zone_getview(zone);
 	if (strcmp(view->name, "_default") == 0 ||
 	    strcmp(view->name, "_bind") == 0)
 	{
@@ -12260,8 +12171,7 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 	dns_zonetype_t type;
 	char classstr[DNS_RDATACLASS_FORMATSIZE];
 	char zonename[DNS_NAME_FORMATSIZE];
-	dns_view_t *view;
-	const char *vname, *sep;
+	const char *vname = NULL, *sep = NULL;
 	bool frozen;
 	const char *msg = NULL;
 
@@ -12274,9 +12184,7 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 	if (mayberaw == NULL) {
 		isc_loopmgr_pause(named_g_loopmgr);
 		tresult = ISC_R_SUCCESS;
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			result = dns_view_freezezones(view, freeze);
 			if (result != ISC_R_SUCCESS && tresult == ISC_R_SUCCESS)
 			{
@@ -12353,7 +12261,7 @@ named_server_freeze(named_server_t *server, bool freeze, isc_lex_t *lex,
 		(void)putnull(text);
 	}
 
-	view = dns_zone_getview(mayberaw);
+	dns_view_t *view = dns_zone_getview(mayberaw);
 	if (strcmp(view->name, "_default") == 0 ||
 	    strcmp(view->name, "_bind") == 0)
 	{
@@ -12468,8 +12376,6 @@ static isc_result_t
 nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 	const cfg_obj_t *zl = NULL;
 	cfg_list_t *list;
-	const cfg_listelt_t *elt;
-
 	FILE *fp = NULL;
 	char tmp[1024];
 	isc_result_t result;
@@ -12492,9 +12398,7 @@ nzf_writeconf(const cfg_obj_t *config, dns_view_t *view) {
 
 	CHECK(add_comment(fp, view->name)); /* force a comment */
 
-	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link))
-	{
+	ISC_LIST_FOREACH (*list, elt, link) {
 		const cfg_obj_t *zconfig = cfg_listelt_value(elt);
 
 		CHECK(isc_stdio_write("zone ", 5, 1, fp, NULL));
@@ -13153,11 +13057,10 @@ static isc_result_t
 delete_zoneconf(dns_view_t *view, cfg_parser_t *pctx, const cfg_obj_t *config,
 		const dns_name_t *zname, nzfwriter_t nzfwriter) {
 	isc_result_t result = ISC_R_NOTFOUND;
-	const cfg_listelt_t *elt = NULL;
 	const cfg_obj_t *zl = NULL;
-	cfg_list_t *list;
+	cfg_list_t *list = NULL;
 	dns_fixedname_t myfixed;
-	dns_name_t *myname;
+	dns_name_t *myname = NULL;
 
 	REQUIRE(view != NULL);
 	REQUIRE(pctx != NULL);
@@ -13176,9 +13079,7 @@ delete_zoneconf(dns_view_t *view, cfg_parser_t *pctx, const cfg_obj_t *config,
 
 	myname = dns_fixedname_initname(&myfixed);
 
-	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link))
-	{
+	ISC_LIST_FOREACH (*list, elt, link) {
 		const cfg_obj_t *zconf = cfg_listelt_value(elt);
 		const char *zn;
 		cfg_listelt_t *e;
@@ -14468,7 +14369,6 @@ named_server_dnssec(named_server_t *server, isc_lex_t *lex,
 	dns_zone_t *zone = NULL;
 	dns_kasp_t *kasp = NULL;
 	dns_dnsseckeylist_t keys;
-	dns_dnsseckey_t *key;
 	char *ptr, *zonetext = NULL;
 	const char *msg = NULL;
 	/* variables for -checkds */
@@ -14760,8 +14660,7 @@ cleanup:
 		dns_db_detach(&db);
 	}
 
-	while (!ISC_LIST_EMPTY(keys)) {
-		key = ISC_LIST_HEAD(keys);
+	ISC_LIST_FOREACH_SAFE (keys, key, link) {
 		ISC_LIST_UNLINK(keys, key, link);
 		dns_dnsseckey_destroy(dns_zone_getmctx(zone), &key);
 	}
@@ -15077,7 +14976,6 @@ cleanup:
 isc_result_t
 named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 		 isc_buffer_t **text) {
-	dns_view_t *view;
 	dns_ntatable_t *ntatable = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	char *ptr, *nametext = NULL, *viewname;
@@ -15178,9 +15076,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 	if (dump) {
 		size_t last = 0;
 
-		for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-		     view = ISC_LIST_NEXT(view, link))
-		{
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			if (ntatable != NULL) {
 				dns_ntatable_detach(&ntatable);
 			}
@@ -15245,9 +15141,7 @@ named_server_nta(named_server_t *server, isc_lex_t *lex, bool readonly,
 	now = isc_stdtime_now();
 
 	isc_loopmgr_pause(named_g_loopmgr);
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (viewname != NULL && strcmp(view->name, viewname) != 0) {
 			continue;
 		}
@@ -15373,11 +15267,7 @@ cleanup:
 
 isc_result_t
 named_server_saventa(named_server_t *server) {
-	dns_view_t *view;
-
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		isc_result_t result = dns_view_saventa(view);
 
 		if (result != ISC_R_SUCCESS) {
@@ -15394,11 +15284,7 @@ named_server_saventa(named_server_t *server) {
 
 isc_result_t
 named_server_loadnta(named_server_t *server) {
-	dns_view_t *view;
-
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		isc_result_t result = dns_view_loadnta(view);
 
 		if ((result != ISC_R_SUCCESS) &&
@@ -15642,7 +15528,6 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 		   isc_buffer_t **text) {
 	char *cmd, *classtxt, *viewtxt = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_view_t *view = NULL;
 	dns_rdataclass_t rdclass;
 	char msg[DNS_NAME_FORMATSIZE + 500] = "";
 	enum { NONE, STAT, REFRESH, SYNC, DESTROY } opt = NONE;
@@ -15694,9 +15579,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 		viewtxt = next_token(lex, text);
 	}
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (viewtxt != NULL && (rdclass != view->rdclass ||
 					strcmp(view->name, viewtxt) != 0))
 		{
@@ -15913,7 +15796,6 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 	char *ptr, *classtxt, *viewtxt = NULL;
 	char msg[128];
 	dns_rdataclass_t rdclass = dns_rdataclass_in;
-	dns_view_t *view;
 	bool found = false;
 	dns_stale_answer_t staleanswersok = dns_stale_answer_conf;
 	bool wantstatus = false;
@@ -15977,9 +15859,7 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 
 	isc_loopmgr_pause(named_g_loopmgr);
 
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		dns_ttl_t stale_ttl = 0;
 		uint32_t stale_refresh = 0;
 		dns_db_t *db = NULL;
@@ -16077,7 +15957,6 @@ isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_view_t *view = NULL;
 	char *ptr = NULL, *viewname = NULL;
 	bool first = true;
 	dns_adb_t *adb = NULL;
@@ -16092,9 +15971,7 @@ named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 
 	/* Look for the view name. */
 	viewname = next_token(lex, text);
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		char tbuf[100];
 		unsigned int used;
 		uint32_t val;

bin/named/statschannel.c

@@ -2811,7 +2811,6 @@ cleanup:
 static isc_result_t
 generatejson(named_server_t *server, size_t *msglen, const char **msg,
 	     json_object **rootp, uint32_t flags) {
-	dns_view_t *view;
 	isc_result_t result = ISC_R_SUCCESS;
 	json_object *bindstats, *viewlist, *counters, *obj;
 	json_object *traffic = NULL;
@@ -3034,8 +3033,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 
 		json_object_object_add(bindstats, "views", viewlist);
 
-		view = ISC_LIST_HEAD(server->viewlist);
-		while (view != NULL) {
+		ISC_LIST_FOREACH (server->viewlist, view, link) {
 			json_object *za, *xa, *v = json_object_new_object();
 			dns_adb_t *adb = NULL;
 
@@ -3183,8 +3181,6 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,
 							       counters);
 				}
 			}
-
-			view = ISC_LIST_NEXT(view, link);
 		}
 	}
 
@@ -3755,15 +3751,14 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 		const cfg_obj_t *listen_params, const cfg_obj_t *config,
 		isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 		const char *socktext) {
-	named_statschannel_t *listener;
+	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
 	dns_acl_t *new_acl = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 
-	for (listener = ISC_LIST_HEAD(server->statschannels); listener != NULL;
-	     listener = ISC_LIST_NEXT(listener, link))
-	{
-		if (isc_sockaddr_equal(addr, &listener->address)) {
+	ISC_LIST_FOREACH (server->statschannels, l, link) {
+		if (isc_sockaddr_equal(addr, &l->address)) {
+			listener = l;
 			break;
 		}
 	}
@@ -3805,7 +3800,6 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 isc_result_t
 named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 			      cfg_aclconfctx_t *aclconfctx) {
-	named_statschannel_t *listener, *listener_next;
 	named_statschannellist_t new_listeners;
 	const cfg_obj_t *statschannellist = NULL;
 	const cfg_listelt_t *element, *element2;
@@ -3865,8 +3859,9 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 			     element2 != NULL;
 			     element2 = cfg_list_next(element2))
 			{
-				const cfg_obj_t *listen_params;
-				const cfg_obj_t *obj;
+				named_statschannel_t *listener = NULL;
+				const cfg_obj_t *listen_params = NULL;
+				const cfg_obj_t *obj = NULL;
 				isc_sockaddr_t addr;
 
 				listen_params = cfg_listelt_value(element2);
@@ -3930,10 +3925,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 		}
 	}
 
-	for (listener = ISC_LIST_HEAD(server->statschannels); listener != NULL;
-	     listener = listener_next)
-	{
-		listener_next = ISC_LIST_NEXT(listener, link);
+	ISC_LIST_FOREACH_SAFE (server->statschannels, listener, link) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
@@ -3944,9 +3936,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 
 void
 named_statschannels_shutdown(named_server_t *server) {
-	named_statschannel_t *listener;
-
-	while ((listener = ISC_LIST_HEAD(server->statschannels)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (server->statschannels, listener, link) {
 		ISC_LIST_UNLINK(server->statschannels, listener, link);
 		shutdown_listener(listener);
 	}
@@ -3955,7 +3945,6 @@ named_statschannels_shutdown(named_server_t *server) {
 isc_result_t
 named_stats_dump(named_server_t *server, FILE *fp) {
 	isc_result_t result;
-	dns_view_t *view;
 	dns_zone_t *zone, *next;
 	stats_dumparg_t dumparg;
 	uint64_t nsstat_values[ns_statscounter_max];
@@ -3987,9 +3976,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 			    0);
 
 	fprintf(fp, "++ Outgoing Queries ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		dns_stats_t *dstats = NULL;
 		dns_resolver_getquerystats(view->resolver, &dstats);
 		if (dstats == NULL) {
@@ -4019,9 +4006,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	(void)dump_stats(server->resolverstats, isc_statsformat_file, fp, NULL,
 			 resstats_desc, dns_resstatscounter_max, resstats_index,
 			 resstat_values, 0);
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		isc_stats_t *istats = NULL;
 		dns_resolver_getstats(view->resolver, &istats);
 		if (istats == NULL) {
@@ -4039,9 +4024,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	}
 
 	fprintf(fp, "++ Cache Statistics ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		if (strcmp(view->name, "_default") == 0) {
 			fprintf(fp, "[View: default]\n");
 		} else {
@@ -4058,9 +4041,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	}
 
 	fprintf(fp, "++ Cache DB RRsets ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		dns_stats_t *cacherrstats;
 
 		cacherrstats = dns_db_getrrsetstats(view->cachedb);
@@ -4085,9 +4066,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	}
 
 	fprintf(fp, "++ ADB stats ++\n");
-	for (view = ISC_LIST_HEAD(server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (server->viewlist, view, link) {
 		dns_adb_t *adb = NULL;
 		isc_stats_t *adbstats = NULL;
 
@@ -4123,8 +4102,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 		isc_stats_t *zonestats = dns_zone_getrequeststats(zone);
 		if (zonestats != NULL) {
 			char zonename[DNS_NAME_FORMATSIZE];
-
-			view = dns_zone_getview(zone);
+			dns_view_t *view = dns_zone_getview(zone);
 			if (view == NULL) {
 				continue;
 			}
@@ -4153,8 +4131,7 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 		isc_stats_t *gluecachestats = dns_zone_getgluecachestats(zone);
 		if (gluecachestats != NULL) {
 			char zonename[DNS_NAME_FORMATSIZE];
-
-			view = dns_zone_getview(zone);
+			dns_view_t *view = dns_zone_getview(zone);
 			if (view == NULL) {
 				continue;
 			}

bin/named/zoneconf.c

@@ -566,7 +566,6 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	dns_rdatalist_t rdatalist_ns, rdatalist_a, rdatalist_aaaa;
 	dns_rdatalist_t *rdatalists[] = { &rdatalist_ns, &rdatalist_a,
 					  &rdatalist_aaaa, NULL };
-	dns_rdata_t *rdata;
 	isc_region_t region;
 
 	/* Create the DB beforehand */
@@ -678,7 +677,7 @@ cleanup:
 		dns_db_detach(&db);
 	}
 	for (i = 0; rdatalists[i] != NULL; i++) {
-		while ((rdata = ISC_LIST_HEAD(rdatalists[i]->rdata)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (rdatalists[i]->rdata, rdata, link) {
 			ISC_LIST_UNLINK(rdatalists[i]->rdata, rdata, link);
 			dns_rdata_toregion(rdata, &region);
 			isc_mem_put(mctx, rdata,
@@ -788,7 +787,6 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
        const isc_sockaddr_t *dstaddr, dns_rdataclass_t rdclass,
        void *arg ISC_ATTR_UNUSED) {
 	dns_aclenv_t *env = NULL;
-	dns_view_t *view = NULL;
 	dns_tsigkey_t *key = NULL;
 	isc_netaddr_t netsrc;
 	isc_netaddr_t netdst;
@@ -807,9 +805,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 	isc_netaddr_fromsockaddr(&netdst, dstaddr);
 	env = ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
 
-	for (view = ISC_LIST_HEAD(named_g_server->viewlist); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (named_g_server->viewlist, view, link) {
 		const dns_name_t *tsig = NULL;
 
 		if (view->matchrecursiveonly) {
@@ -840,10 +836,11 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 		    dns_acl_allowed(&netdst, tsig, view->matchdestinations,
 				    env))
 		{
-			break;
+			return view == myview;
 		}
 	}
-	return view == myview;
+
+	return false;
 }
 
 /*%

bin/nsupdate/nsupdate.c

@@ -853,7 +853,6 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 					    dnsport);
 		}
 	} else {
-		isc_sockaddr_t *sa;
 		int i;
 
 		/*
@@ -862,9 +861,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 		 * the servers array.
 		 */
 		ns_total = 0;
-		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		ISC_LIST_FOREACH (*nslist, sa, link) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -885,9 +882,7 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 		servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 
 		i = 0;
-		for (sa = ISC_LIST_HEAD(*nslist); sa != NULL;
-		     sa = ISC_LIST_NEXT(sa, link))
-		{
+		ISC_LIST_FOREACH (*nslist, sa, link) {
 			switch (sa->type.sa.sa_family) {
 			case AF_INET:
 				if (have_ipv4) {
@@ -2186,17 +2181,16 @@ evaluate_checksvcb(char *cmdline) {
 
 static void
 setzone(dns_name_t *zonename) {
-	isc_result_t result;
+	dns_namelist_t *secs = updatemsg->sections;
 	dns_name_t *name = NULL;
-	dns_rdataset_t *rdataset = NULL;
 
-	result = dns_message_firstname(updatemsg, DNS_SECTION_ZONE);
-	if (result == ISC_R_SUCCESS) {
-		dns_message_currentname(updatemsg, DNS_SECTION_ZONE, &name);
-		dns_message_removename(updatemsg, name, DNS_SECTION_ZONE);
-		for (rdataset = ISC_LIST_HEAD(name->list); rdataset != NULL;
-		     rdataset = ISC_LIST_HEAD(name->list))
-		{
+	if (!ISC_LIST_EMPTY(secs[DNS_SECTION_ZONE])) {
+		INSIST(updatemsg->from_to_wire == DNS_MESSAGE_INTENTRENDER);
+
+		name = ISC_LIST_HEAD(secs[DNS_SECTION_ZONE]);
+		ISC_LIST_UNLINK(secs[DNS_SECTION_ZONE], name, link);
+
+		ISC_LIST_FOREACH_SAFE (name->list, rdataset, link) {
 			ISC_LIST_UNLINK(name->list, rdataset, link);
 			dns_rdataset_disassociate(rdataset);
 			dns_message_puttemprdataset(updatemsg, &rdataset);
@@ -2205,6 +2199,8 @@ setzone(dns_name_t *zonename) {
 	}
 
 	if (zonename != NULL) {
+		dns_rdataset_t *rdataset = NULL;
+
 		dns_message_gettempname(updatemsg, &name);
 		dns_name_clone(zonename, name);
 		dns_message_gettemprdataset(updatemsg, &rdataset);
@@ -2824,33 +2820,30 @@ lookforsoa:
 		goto droplabel;
 	}
 
-	result = dns_message_firstname(rcvmsg, section);
-	if (result != ISC_R_SUCCESS) {
+	if (ISC_LIST_EMPTY(rcvmsg->sections[section])) {
 		pass++;
 		goto lookforsoa;
 	}
-	while (result == ISC_R_SUCCESS) {
-		name = NULL;
-		dns_message_currentname(rcvmsg, section, &name);
+
+	ISC_LIST_FOREACH (rcvmsg->sections[section], n, link) {
 		soaset = NULL;
-		result = dns_message_findtype(name, dns_rdatatype_soa, 0,
-					      &soaset);
+		result = dns_message_findtype(n, dns_rdatatype_soa, 0, &soaset);
 		if (result == ISC_R_SUCCESS) {
+			name = n;
 			break;
 		}
 		if (section == DNS_SECTION_ANSWER) {
 			dns_rdataset_t *tset = NULL;
-			if (dns_message_findtype(name, dns_rdatatype_cname, 0,
+			if (dns_message_findtype(n, dns_rdatatype_cname, 0,
 						 &tset) == ISC_R_SUCCESS ||
-			    dns_message_findtype(name, dns_rdatatype_dname, 0,
+			    dns_message_findtype(n, dns_rdatatype_dname, 0,
 						 &tset) == ISC_R_SUCCESS)
 			{
+				name = n;
 				seencname = true;
 				break;
 			}
 		}
-
-		result = dns_message_nextname(rcvmsg, section);
 	}
 
 	if (soaset == NULL && !seencname) {
@@ -2955,10 +2948,8 @@ out:
 	return;
 
 droplabel:
-	result = dns_message_firstname(soaquery, DNS_SECTION_QUESTION);
-	INSIST(result == ISC_R_SUCCESS);
-	name = NULL;
-	dns_message_currentname(soaquery, DNS_SECTION_QUESTION, &name);
+	INSIST(!ISC_LIST_EMPTY(soaquery->sections[DNS_SECTION_QUESTION]));
+	name = ISC_LIST_HEAD(soaquery->sections[DNS_SECTION_QUESTION]);
 	nlabels = dns_name_countlabels(name);
 	if (nlabels == 1) {
 		fatal("could not find enclosing zone");
@@ -3344,13 +3335,10 @@ recvgss(void *arg) {
 
 static void
 start_update(void) {
-	isc_result_t result;
 	dns_rdataset_t *rdataset = NULL;
 	dns_name_t *name = NULL;
 	dns_request_t *request = NULL;
 	dns_message_t *soaquery = NULL;
-	dns_name_t *firstname;
-	dns_section_t section = DNS_SECTION_UPDATE;
 
 	ddebug("start_update()");
 
@@ -3389,12 +3377,17 @@ start_update(void) {
 		dns_name_clone(userzone, name);
 	} else {
 		dns_rdataset_t *tmprdataset;
-		result = dns_message_firstname(updatemsg, section);
-		if (result == ISC_R_NOMORE) {
+
+		dns_namelist_t *msg_sections = updatemsg->sections;
+		dns_section_t section;
+
+		if (!ISC_LIST_EMPTY(msg_sections[DNS_SECTION_UPDATE])) {
+			section = DNS_SECTION_UPDATE;
+		} else if (!ISC_LIST_EMPTY(
+				   msg_sections[DNS_SECTION_PREREQUISITE]))
+		{
 			section = DNS_SECTION_PREREQUISITE;
-			result = dns_message_firstname(updatemsg, section);
-		}
-		if (result != ISC_R_SUCCESS) {
+		} else {
 			dns_message_puttempname(soaquery, &name);
 			dns_rdataset_disassociate(rdataset);
 			dns_message_puttemprdataset(soaquery, &rdataset);
@@ -3402,9 +3395,11 @@ start_update(void) {
 			done_update();
 			return;
 		}
-		firstname = NULL;
-		dns_message_currentname(updatemsg, section, &firstname);
+
+		dns_name_t *firstname =
+			ISC_LIST_HEAD(updatemsg->sections[section]);
 		dns_name_clone(firstname, name);
+
 		/*
 		 * Looks to see if the first name references a DS record
 		 * and if that name is not the root remove a label as DS

bin/plugins/filter-a.c

@@ -540,14 +540,14 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	isc_result_t result;
 	bool modified = false;
+	dns_name_t *n = UNCONST(name);
 
 	if (only_if_aaaa_exists) {
-		CHECK(dns_message_findtype(name, dns_rdatatype_aaaa, 0, NULL));
+		CHECK(dns_message_findtype(n, dns_rdatatype_aaaa, 0, NULL));
 	}
 
-	(void)dns_message_findtype(name, type, 0, &rdataset);
-	(void)dns_message_findtype(name, dns_rdatatype_rrsig, type,
-				   &sigrdataset);
+	(void)dns_message_findtype(n, type, 0, &rdataset);
+	(void)dns_message_findtype(n, dns_rdatatype_rrsig, type, &sigrdataset);
 
 	if (rdataset != NULL &&
 	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
@@ -591,14 +591,8 @@ process_section(const section_filter_t *filter) {
 	bool only_if_aaaa_exists = filter->only_if_aaaa_exists;
 
 	dns_message_t *message = qctx->client->message;
-	isc_result_t result;
 
-	for (result = dns_message_firstname(message, section);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(message, section))
-	{
-		dns_name_t *cur = NULL;
-		dns_message_currentname(message, section, &cur);
+	MSG_SECTION_FOREACH (message, section, cur) {
 		if (name != NULL && !dns_name_equal(name, cur)) {
 			/*
 			 * We only want to process 'name' and this is not it.

bin/plugins/filter-aaaa.c

@@ -544,14 +544,14 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	isc_result_t result;
 	bool modified = false;
+	dns_name_t *n = UNCONST(name);
 
 	if (only_if_a_exists) {
-		CHECK(dns_message_findtype(name, dns_rdatatype_a, 0, NULL));
+		CHECK(dns_message_findtype(n, dns_rdatatype_a, 0, NULL));
 	}
 
-	(void)dns_message_findtype(name, type, 0, &rdataset);
-	(void)dns_message_findtype(name, dns_rdatatype_rrsig, type,
-				   &sigrdataset);
+	(void)dns_message_findtype(n, type, 0, &rdataset);
+	(void)dns_message_findtype(n, dns_rdatatype_rrsig, type, &sigrdataset);
 
 	if (rdataset != NULL &&
 	    (sigrdataset == NULL || !WANTDNSSEC(qctx->client) ||
@@ -595,14 +595,8 @@ process_section(const section_filter_t *filter) {
 	bool only_if_a_exists = filter->only_if_a_exists;
 
 	dns_message_t *message = qctx->client->message;
-	isc_result_t result;
 
-	for (result = dns_message_firstname(message, section);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(message, section))
-	{
-		dns_name_t *cur = NULL;
-		dns_message_currentname(message, section, &cur);
+	MSG_SECTION_FOREACH (message, section, cur) {
 		if (name != NULL && !dns_name_equal(name, cur)) {
 			/*
 			 * We only want to process 'name' and this is not it.

bin/tools/mdig.c

@@ -427,8 +427,6 @@ repopulate_buffer:
 		}
 		CHECK("dns_message_sectiontotext", result);
 	} else if (display_answer) {
-		dns_name_t *name;
-		dns_rdataset_t *rdataset;
 		isc_result_t loopresult;
 		dns_name_t empty_name;
 		dns_rdata_t rdata = DNS_RDATA_INIT;
@@ -442,24 +440,9 @@ repopulate_buffer:
 		}
 
 		dns_name_init(&empty_name);
-		result = dns_message_firstname(response, DNS_SECTION_ANSWER);
-		if (result != ISC_R_NOMORE) {
-			CHECK("dns_message_firstname", result);
-		}
 
-		for (;;) {
-			if (result == ISC_R_NOMORE) {
-				break;
-			}
-			CHECK("dns_message_nextname", result);
-			name = NULL;
-			dns_message_currentname(response, DNS_SECTION_ANSWER,
-						&name);
-
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-			{
+		MSG_SECTION_FOREACH (response, DNS_SECTION_ANSWER, name) {
+			ISC_LIST_FOREACH (name->list, rdataset, link) {
 				loopresult = dns_rdataset_first(rdataset);
 				while (loopresult == ISC_R_SUCCESS) {
 					dns_rdataset_current(rdataset, &rdata);
@@ -481,8 +464,6 @@ repopulate_buffer:
 					isc_buffer_putstr(buf, "\n");
 				}
 			}
-			result = dns_message_nextname(response,
-						      DNS_SECTION_ANSWER);
 		}
 	}
 
@@ -2104,7 +2085,6 @@ setup(void *arg ISC_ATTR_UNUSED) {
 /*% Main processing routine for mdig */
 int
 main(int argc, char *argv[]) {
-	struct query *query = NULL;
 	isc_result_t result;
 	unsigned int i;
 	int ns;
@@ -2149,9 +2129,8 @@ main(int argc, char *argv[]) {
 		fatal("can't choose between IPv4 and IPv6");
 	}
 
-	query = ISC_LIST_HEAD(queries);
 	isc_loopmgr_setup(loopmgr, setup, NULL);
-	isc_loopmgr_setup(loopmgr, sendqueries, query);
+	isc_loopmgr_setup(loopmgr, sendqueries, ISC_LIST_HEAD(queries));
 	isc_loopmgr_teardown(loopmgr, teardown, NULL);
 
 	/*
@@ -2182,10 +2161,7 @@ main(int argc, char *argv[]) {
 
 	isc_loopmgr_run(loopmgr);
 
-	query = ISC_LIST_HEAD(queries);
-	while (query != NULL) {
-		struct query *next = ISC_LIST_NEXT(query, link);
-
+	ISC_LIST_FOREACH_SAFE (queries, query, link) {
 		if (query->ednsopts != NULL) {
 			for (i = 0; i < EDNSOPTS; i++) {
 				if (query->ednsopts[i].value != NULL) {
@@ -2200,7 +2176,6 @@ main(int argc, char *argv[]) {
 			query->ecs_addr = NULL;
 		}
 		isc_mem_free(mctx, query);
-		query = next;
 	}
 
 	if (default_query.ecs_addr != NULL) {

doc/dev/dev.md

@@ -588,6 +588,12 @@ Several macros are provided for this purpose, including `ISC_LIST_PREPEND`,
 
 More macros are provided for iterating the list:
 
+        ISC_LIST_FOREACH (foolist, foo, link) {
+                /* do things */
+        }
+
+... which is equivalent to:
+
         isc_foo_t *foo;
         for (foo = ISC_LIST_HEAD(foolist);
              foo != NULL;

lib/dns/acl.c

@@ -226,36 +226,30 @@ dns_acl_match_port_transport(const isc_netaddr_t *reqaddr,
 			     const dns_acl_t *acl, dns_aclenv_t *env,
 			     int *match, const dns_aclelement_t **matchelt) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_acl_port_transports_t *next;
 
 	REQUIRE(reqaddr != NULL);
 	REQUIRE(DNS_ACL_VALID(acl));
 
-	if (!ISC_LIST_EMPTY(acl->ports_and_transports)) {
+	dns_acl_t *a = UNCONST(acl); /* for ISC_LIST_FOREACH */
+	ISC_LIST_FOREACH (a->ports_and_transports, next, link) {
+		bool match_port = true;
+		bool match_transport = true;
 		result = ISC_R_FAILURE;
-		for (next = ISC_LIST_HEAD(acl->ports_and_transports);
-		     next != NULL; next = ISC_LIST_NEXT(next, link))
-		{
-			bool match_port = true;
-			bool match_transport = true;
 
-			if (next->port != 0) {
-				/* Port is specified. */
-				match_port = (local_port == next->port);
-			}
-			if (next->transports != 0) {
-				/* Transport protocol is specified. */
-				match_transport =
-					((transport & next->transports) ==
-						 transport &&
-					 next->encrypted == encrypted);
-			}
+		if (next->port != 0) {
+			/* Port is specified. */
+			match_port = (local_port == next->port);
+		}
+		if (next->transports != 0) {
+			/* Transport protocol is specified. */
+			match_transport = ((transport & next->transports) ==
+						   transport &&
+					   next->encrypted == encrypted);
+		}
 
-			if (match_port && match_transport) {
-				result = next->negative ? ISC_R_FAILURE
-							: ISC_R_SUCCESS;
-				break;
-			}
+		if (match_port && match_transport) {
+			result = next->negative ? ISC_R_FAILURE : ISC_R_SUCCESS;
+			break;
 		}
 	}
 
@@ -462,11 +456,7 @@ dns_aclelement_match(const isc_netaddr_t *reqaddr, const dns_name_t *reqsigner,
 
 static void
 dns__acl_destroy_port_transports(dns_acl_t *acl) {
-	dns_acl_port_transports_t *port_proto = NULL;
-	dns_acl_port_transports_t *next = NULL;
-	ISC_LIST_FOREACH_SAFE (acl->ports_and_transports, port_proto, link,
-			       next)
-	{
+	ISC_LIST_FOREACH_SAFE (acl->ports_and_transports, port_proto, link) {
 		ISC_LIST_DEQUEUE(acl->ports_and_transports, port_proto, link);
 		isc_mem_put(acl->mctx, port_proto, sizeof(*port_proto));
 	}
@@ -770,8 +760,6 @@ dns_acl_add_port_transports(dns_acl_t *acl, const in_port_t port,
 
 void
 dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos) {
-	dns_acl_port_transports_t *next;
-
 	REQUIRE(DNS_ACL_VALID(dest));
 	REQUIRE(DNS_ACL_VALID(source));
 
@@ -780,9 +768,7 @@ dns_acl_merge_ports_transports(dns_acl_t *dest, dns_acl_t *source, bool pos) {
 	/*
 	 * Merge ports and transports
 	 */
-	for (next = ISC_LIST_HEAD(source->ports_and_transports); next != NULL;
-	     next = ISC_LIST_NEXT(next, link))
-	{
+	ISC_LIST_FOREACH (source->ports_and_transports, next, link) {
 		const bool next_positive = !next->negative;
 		bool add_negative;
 

lib/dns/adb.c

@@ -575,7 +575,6 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		/* FIXME: Move to a separate function */
 		dns_adbnamehooklist_t *hookhead = NULL;
 		dns_adbentry_t *entry = NULL;
-		dns_adbnamehook_t *nh = NULL;
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		isc_sockaddr_t sockaddr;
 		struct in_addr ina;
@@ -602,16 +601,14 @@ import_rdataset(dns_adbname_t *adbname, dns_rdataset_t *rdataset,
 		entry = get_attached_and_locked_entry(adb, now, &sockaddr);
 		INSIST(!ENTRY_DEAD(entry));
 
-		dns_adbnamehook_t *anh = NULL;
-		for (anh = ISC_LIST_HEAD(*hookhead); anh != NULL;
-		     anh = ISC_LIST_NEXT(anh, name_link))
-		{
+		bool found = false;
+		ISC_LIST_FOREACH (*hookhead, anh, name_link) {
 			if (anh->entry == entry) {
-				break;
+				found = true;
 			}
 		}
-		if (anh == NULL) {
-			nh = new_adbnamehook(adb);
+		if (!found) {
+			dns_adbnamehook_t *nh = new_adbnamehook(adb);
 			dns_adbentry_attach(entry, &nh->entry);
 			ISC_LIST_APPEND(*hookhead, nh, name_link);
 			ISC_LIST_APPEND(entry->nhs, nh, entry_link);
@@ -734,13 +731,8 @@ maybe_expire_namehooks(dns_adbname_t *adbname, isc_stdtime_t now) {
 
 static void
 shutdown_names(dns_adb_t *adb) {
-	dns_adbname_t *next = NULL;
-
 	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
-	for (dns_adbname_t *name = ISC_LIST_HEAD(adb->names_lru); name != NULL;
-	     name = next)
-	{
-		next = ISC_LIST_NEXT(name, link);
+	ISC_LIST_FOREACH_SAFE (adb->names_lru, name, link) {
 		dns_adbname_ref(name);
 		LOCK(&name->lock);
 		/*
@@ -758,12 +750,8 @@ shutdown_names(dns_adb_t *adb) {
 
 static void
 shutdown_entries(dns_adb_t *adb) {
-	dns_adbentry_t *next = NULL;
 	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
-	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
-	     adbentry != NULL; adbentry = next)
-	{
-		next = ISC_LIST_NEXT(adbentry, link);
+	ISC_LIST_FOREACH_SAFE (adb->entries_lru, adbentry, link) {
 		expire_entry(adbentry);
 	}
 	RWUNLOCK(&adb->entries_lock, isc_rwlocktype_write);
@@ -774,10 +762,7 @@ shutdown_entries(dns_adb_t *adb) {
  */
 static void
 clean_namehooks(dns_adb_t *adb, dns_adbnamehooklist_t *namehooks) {
-	dns_adbnamehook_t *namehook = NULL;
-
-	namehook = ISC_LIST_HEAD(*namehooks);
-	while (namehook != NULL) {
+	ISC_LIST_FOREACH_SAFE (*namehooks, namehook, name_link) {
 		INSIST(DNS_ADBNAMEHOOK_VALID(namehook));
 		INSIST(DNS_ADBENTRY_VALID(namehook->entry));
 
@@ -795,8 +780,6 @@ clean_namehooks(dns_adb_t *adb, dns_adbnamehooklist_t *namehooks) {
 		dns_adbentry_detach(&adbentry);
 
 		free_adbnamehook(adb, &namehook);
-
-		namehook = ISC_LIST_HEAD(*namehooks);
 	}
 }
 
@@ -1385,12 +1368,10 @@ log_quota(dns_adbentry_t *entry, const char *fmt, ...) {
 
 static void
 copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_adbname_t *name) {
-	dns_adbnamehook_t *namehook = NULL;
 	dns_adbentry_t *entry = NULL;
 
 	if ((find->options & DNS_ADBFIND_INET) != 0) {
-		namehook = ISC_LIST_HEAD(name->v4);
-		while (namehook != NULL) {
+		ISC_LIST_FOREACH (name->v4, namehook, name_link) {
 			dns_adbaddrinfo_t *addrinfo = NULL;
 			entry = namehook->entry;
 
@@ -1398,7 +1379,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_adbname_t *name) {
 			    adbentry_overquota(entry))
 			{
 				find->options |= DNS_ADBFIND_OVERQUOTA;
-				goto nextv4;
+				continue;
 			}
 
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
@@ -1407,14 +1388,11 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_adbname_t *name) {
 			 * Found a valid entry.  Add it to the find's list.
 			 */
 			ISC_LIST_APPEND(find->list, addrinfo, publink);
-		nextv4:
-			namehook = ISC_LIST_NEXT(namehook, name_link);
 		}
 	}
 
 	if ((find->options & DNS_ADBFIND_INET6) != 0) {
-		namehook = ISC_LIST_HEAD(name->v6);
-		while (namehook != NULL) {
+		ISC_LIST_FOREACH (name->v6, namehook, name_link) {
 			dns_adbaddrinfo_t *addrinfo = NULL;
 			entry = namehook->entry;
 
@@ -1422,7 +1400,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_adbname_t *name) {
 			    adbentry_overquota(entry))
 			{
 				find->options |= DNS_ADBFIND_OVERQUOTA;
-				goto nextv6;
+				continue;
 			}
 
 			addrinfo = new_adbaddrinfo(adb, entry, find->port);
@@ -1431,8 +1409,6 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find, dns_adbname_t *name) {
 			 * Found a valid entry.  Add it to the find's list.
 			 */
 			ISC_LIST_APPEND(find->list, addrinfo, publink);
-		nextv6:
-			namehook = ISC_LIST_NEXT(namehook, name_link);
 		}
 	}
 }
@@ -1591,14 +1567,8 @@ purge_stale_names(dns_adb_t *adb, isc_stdtime_t now) {
 
 static void
 cleanup_names(dns_adb_t *adb, isc_stdtime_t now) {
-	dns_adbname_t *next = NULL;
-
 	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
-	for (dns_adbname_t *adbname = ISC_LIST_HEAD(adb->names_lru);
-	     adbname != NULL; adbname = next)
-	{
-		next = ISC_LIST_NEXT(adbname, link);
-
+	ISC_LIST_FOREACH_SAFE (adb->names_lru, adbname, link) {
 		dns_adbname_ref(adbname);
 		LOCK(&adbname->lock);
 		/*
@@ -1694,14 +1664,8 @@ purge_stale_entries(dns_adb_t *adb, isc_stdtime_t now) {
 
 static void
 cleanup_entries(dns_adb_t *adb, isc_stdtime_t now) {
-	dns_adbentry_t *next = NULL;
-
 	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
-	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
-	     adbentry != NULL; adbentry = next)
-	{
-		next = ISC_LIST_NEXT(adbentry, link);
-
+	ISC_LIST_FOREACH_SAFE (adb->entries_lru, adbentry, link) {
 		dns_adbentry_ref(adbentry);
 		LOCK(&adbentry->lock);
 		maybe_expire_entry(adbentry, now);
@@ -2158,7 +2122,6 @@ post_copy:
 void
 dns_adb_destroyfind(dns_adbfind_t **findp) {
 	dns_adbfind_t *find = NULL;
-	dns_adbaddrinfo_t *ai = NULL;
 	dns_adb_t *adb = NULL;
 
 	REQUIRE(findp != NULL && DNS_ADBFIND_VALID(*findp));
@@ -2179,11 +2142,9 @@ dns_adb_destroyfind(dns_adbfind_t **findp) {
 	 * we also need to decrement the reference counter in the
 	 * associated adbentry every time we remove one from the list.
 	 */
-	ai = ISC_LIST_HEAD(find->list);
-	while (ai != NULL) {
+	ISC_LIST_FOREACH_SAFE (find->list, ai, publink) {
 		ISC_LIST_UNLINK(find->list, ai, publink);
 		free_adbaddrinfo(adb, &ai);
-		ai = ISC_LIST_HEAD(find->list);
 	}
 	UNLOCK(&find->lock);
 
@@ -2302,9 +2263,7 @@ dump_adb(dns_adb_t *adb, FILE *f, bool debug, isc_stdtime_t now) {
 	 */
 	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
 
-	for (dns_adbname_t *name = ISC_LIST_HEAD(adb->names_lru); name != NULL;
-	     name = ISC_LIST_NEXT(name, link))
-	{
+	ISC_LIST_FOREACH (adb->names_lru, name, link) {
 		LOCK(&name->lock);
 		/*
 		 * Dump the names
@@ -2336,9 +2295,7 @@ dump_adb(dns_adb_t *adb, FILE *f, bool debug, isc_stdtime_t now) {
 
 	RWLOCK(&adb->entries_lock, isc_rwlocktype_write);
 	fprintf(f, ";\n; Unassociated entries\n;\n");
-	for (dns_adbentry_t *adbentry = ISC_LIST_HEAD(adb->entries_lru);
-	     adbentry != NULL; adbentry = ISC_LIST_NEXT(adbentry, link))
-	{
+	ISC_LIST_FOREACH (adb->entries_lru, adbentry, link) {
 		LOCK(&adbentry->lock);
 		if (ISC_LIST_EMPTY(adbentry->nhs)) {
 			dump_entry(f, adb, adbentry, debug, now);
@@ -2395,7 +2352,6 @@ static void
 dumpfind(dns_adbfind_t *find, FILE *f) {
 	char tmp[512];
 	const char *tmpp = NULL;
-	dns_adbaddrinfo_t *ai = NULL;
 	isc_sockaddr_t *sa = NULL;
 
 	/*
@@ -2411,11 +2367,10 @@ dumpfind(dns_adbfind_t *find, FILE *f) {
 		find->flags);
 	fprintf(f, ";\tname %p\n", find->adbname);
 
-	ai = ISC_LIST_HEAD(find->list);
-	if (ai != NULL) {
+	if (!ISC_LIST_EMPTY(find->list)) {
 		fprintf(f, "\tAddresses:\n");
 	}
-	while (ai != NULL) {
+	ISC_LIST_FOREACH (find->list, ai, publink) {
 		sa = &ai->sockaddr;
 		switch (sa->type.sa.sa_family) {
 		case AF_INET:
@@ -2438,8 +2393,6 @@ dumpfind(dns_adbfind_t *find, FILE *f) {
 			"\t\tentry %p, flags %08x"
 			" srtt %u addr %s\n",
 			ai->entry, ai->flags, ai->srtt, tmpp);
-
-		ai = ISC_LIST_NEXT(ai, publink);
 	}
 
 	UNLOCK(&find->lock);
@@ -2449,11 +2402,7 @@ static void
 print_namehook_list(FILE *f, const char *legend, dns_adb_t *adb,
 		    dns_adbnamehooklist_t *list, bool debug,
 		    isc_stdtime_t now) {
-	dns_adbnamehook_t *nh = NULL;
-
-	for (nh = ISC_LIST_HEAD(*list); nh != NULL;
-	     nh = ISC_LIST_NEXT(nh, name_link))
-	{
+	ISC_LIST_FOREACH (*list, nh, name_link) {
 		if (debug) {
 			fprintf(f, ";\tHook(%s) %p\n", legend, nh);
 		}
@@ -2480,12 +2429,8 @@ print_fetch_list(FILE *f, dns_adbname_t *n) {
 
 static void
 print_find_list(FILE *f, dns_adbname_t *name) {
-	dns_adbfind_t *find = NULL;
-
-	find = ISC_LIST_HEAD(name->finds);
-	while (find != NULL) {
+	ISC_LIST_FOREACH (name->finds, find, plink) {
 		dumpfind(find, f);
-		find = ISC_LIST_NEXT(find, plink);
 	}
 }
 
@@ -3365,8 +3310,6 @@ again:
 
 void
 dns_adb_flushnames(dns_adb_t *adb, const dns_name_t *name) {
-	dns_adbname_t *next = NULL;
-
 	REQUIRE(DNS_ADB_VALID(adb));
 	REQUIRE(name != NULL);
 
@@ -3375,10 +3318,7 @@ dns_adb_flushnames(dns_adb_t *adb, const dns_name_t *name) {
 	}
 
 	RWLOCK(&adb->names_lock, isc_rwlocktype_write);
-	for (dns_adbname_t *adbname = ISC_LIST_HEAD(adb->names_lru);
-	     adbname != NULL; adbname = next)
-	{
-		next = ISC_LIST_NEXT(adbname, link);
+	ISC_LIST_FOREACH_SAFE (adb->names_lru, adbname, link) {
 		dns_adbname_ref(adbname);
 		LOCK(&adbname->lock);
 		if (dns_name_issubdomain(adbname->name, name)) {

lib/dns/client.c

@@ -771,11 +771,7 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 		 * Free temporary resources
 		 */
 		if (ansname != NULL) {
-			dns_rdataset_t *rdataset;
-
-			while ((rdataset = ISC_LIST_HEAD(ansname->list)) !=
-			       NULL)
-			{
+			ISC_LIST_FOREACH_SAFE (ansname->list, rdataset, link) {
 				ISC_LIST_UNLINK(ansname->list, rdataset, link);
 				putrdataset(mctx, &rdataset);
 			}
@@ -824,9 +820,9 @@ client_resfind(resctx_t *rctx, dns_fetchresponse_t *resp) {
 	} while (want_restart);
 
 	if (send_event) {
-		while ((name = ISC_LIST_HEAD(rctx->namelist)) != NULL) {
-			ISC_LIST_UNLINK(rctx->namelist, name, link);
-			ISC_LIST_APPEND(rctx->rev->answerlist, name, link);
+		ISC_LIST_FOREACH_SAFE (rctx->namelist, n, link) {
+			ISC_LIST_UNLINK(rctx->namelist, n, link);
+			ISC_LIST_APPEND(rctx->rev->answerlist, n, link);
 		}
 
 		rctx->rev->result = result;
@@ -839,12 +835,12 @@ static void
 resolve_done(void *arg) {
 	dns_clientresume_t *rev = (dns_clientresume_t *)arg;
 	resarg_t *resarg = rev->arg;
-	dns_name_t *name = NULL;
 	isc_result_t result;
 
 	resarg->result = rev->result;
 	resarg->vresult = rev->vresult;
-	while ((name = ISC_LIST_HEAD(rev->answerlist)) != NULL) {
+
+	ISC_LIST_FOREACH_SAFE (rev->answerlist, name, link) {
 		ISC_LIST_UNLINK(rev->answerlist, name, link);
 		ISC_LIST_APPEND(*resarg->namelist, name, link);
 	}
@@ -1000,18 +996,17 @@ dns_client_resolve(dns_client_t *client, const dns_name_t *name,
 
 void
 dns_client_freeresanswer(dns_client_t *client, dns_namelist_t *namelist) {
-	dns_name_t *name;
-	dns_rdataset_t *rdataset;
-
 	REQUIRE(DNS_CLIENT_VALID(client));
 	REQUIRE(namelist != NULL);
 
-	while ((name = ISC_LIST_HEAD(*namelist)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (*namelist, name, link) {
 		ISC_LIST_UNLINK(*namelist, name, link);
-		while ((rdataset = ISC_LIST_HEAD(name->list)) != NULL) {
+
+		ISC_LIST_FOREACH_SAFE (name->list, rdataset, link) {
 			ISC_LIST_UNLINK(name->list, rdataset, link);
 			putrdataset(client->mctx, &rdataset);
 		}
+
 		dns_name_free(name, client->mctx);
 		isc_mem_put(client->mctx, name, sizeof(*name));
 	}

lib/dns/db.c

@@ -101,11 +101,7 @@ dns__db_shutdown(void) {
 
 static dns_dbimplementation_t *
 impfind(const char *name) {
-	dns_dbimplementation_t *imp;
-
-	for (imp = ISC_LIST_HEAD(implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-	{
+	ISC_LIST_FOREACH (implementations, imp, link) {
 		if (strcasecmp(name, imp->name) == 0) {
 			return imp;
 		}

lib/dns/diff.c

@@ -129,9 +129,8 @@ dns_diff_init(isc_mem_t *mctx, dns_diff_t *diff) {
 
 void
 dns_diff_clear(dns_diff_t *diff) {
-	dns_difftuple_t *t;
 	REQUIRE(DNS_DIFF_VALID(diff));
-	while ((t = ISC_LIST_HEAD(diff->tuples)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (diff->tuples, t, link) {
 		ISC_LIST_UNLINK(diff->tuples, t, link);
 		dns_difftuple_free(&t);
 	}
@@ -170,8 +169,6 @@ dns_diff_size(const dns_diff_t *diff) {
 
 void
 dns_diff_appendminimal(dns_diff_t *diff, dns_difftuple_t **tuplep) {
-	dns_difftuple_t *ot, *next_ot;
-
 	REQUIRE(DNS_DIFF_VALID(diff));
 	REQUIRE(DNS_DIFFTUPLE_VALID(*tuplep));
 
@@ -187,8 +184,7 @@ dns_diff_appendminimal(dns_diff_t *diff, dns_difftuple_t **tuplep) {
 	 * the one we are doing, there must be a programming
 	 * error.  We report it but try to continue anyway.
 	 */
-	for (ot = ISC_LIST_HEAD(diff->tuples); ot != NULL; ot = next_ot) {
-		next_ot = ISC_LIST_NEXT(ot, link);
+	ISC_LIST_FOREACH_SAFE (diff->tuples, ot, link) {
 		if (dns_name_caseequal(&ot->name, &(*tuplep)->name) &&
 		    dns_rdata_compare(&ot->rdata, &(*tuplep)->rdata) == 0 &&
 		    ot->ttl == (*tuplep)->ttl)
@@ -619,13 +615,10 @@ isc_result_t
 dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
 	unsigned int length = 0;
 	unsigned int i;
-	dns_difftuple_t **v;
-	dns_difftuple_t *p;
+	dns_difftuple_t **v = NULL;
 	REQUIRE(DNS_DIFF_VALID(diff));
 
-	for (p = ISC_LIST_HEAD(diff->tuples); p != NULL;
-	     p = ISC_LIST_NEXT(p, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, p, link) {
 		length++;
 	}
 	if (length == 0) {
@@ -633,7 +626,7 @@ dns_diff_sort(dns_diff_t *diff, dns_diff_compare_func *compare) {
 	}
 	v = isc_mem_cget(diff->mctx, length, sizeof(dns_difftuple_t *));
 	for (i = 0; i < length; i++) {
-		p = ISC_LIST_HEAD(diff->tuples);
+		dns_difftuple_t *p = ISC_LIST_HEAD(diff->tuples);
 		v[i] = p;
 		ISC_LIST_UNLINK(diff->tuples, p, link);
 	}
@@ -671,9 +664,8 @@ diff_tuple_tordataset(dns_difftuple_t *t, dns_rdata_t *rdata,
 }
 
 isc_result_t
-dns_diff_print(const dns_diff_t *diff, FILE *file) {
+dns_diff_print(dns_diff_t *diff, FILE *file) {
 	isc_result_t result;
-	dns_difftuple_t *t;
 	char *mem = NULL;
 	unsigned int size = 2048;
 	const char *op = NULL;
@@ -682,9 +674,7 @@ dns_diff_print(const dns_diff_t *diff, FILE *file) {
 
 	mem = isc_mem_get(diff->mctx, size);
 
-	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, t, link) {
 		isc_buffer_t buf;
 		isc_region_t r;
 

lib/dns/dispatch.c

@@ -731,13 +731,10 @@ tcp_recv_add(dns_displist_t *resps, dns_dispentry_t *resp,
 static void
 tcp_recv_shutdown(dns_dispatch_t *disp, dns_displist_t *resps,
 		  isc_result_t result) {
-	dns_dispentry_t *resp = NULL, *next = NULL;
-
 	/*
 	 * If there are any active responses, shut them all down.
 	 */
-	for (resp = ISC_LIST_HEAD(disp->active); resp != NULL; resp = next) {
-		next = ISC_LIST_NEXT(resp, alink);
+	ISC_LIST_FOREACH_SAFE (disp->active, resp, alink) {
 		tcp_recv_add(resps, resp, result);
 	}
 	disp->state = DNS_DISPATCHSTATE_CANCELED;
@@ -745,10 +742,7 @@ tcp_recv_shutdown(dns_dispatch_t *disp, dns_displist_t *resps,
 
 static void
 tcp_recv_processall(dns_displist_t *resps, isc_region_t *region) {
-	dns_dispentry_t *resp = NULL, *next = NULL;
-
-	for (resp = ISC_LIST_HEAD(*resps); resp != NULL; resp = next) {
-		next = ISC_LIST_NEXT(resp, rlink);
+	ISC_LIST_FOREACH_SAFE (*resps, resp, rlink) {
 		ISC_LIST_UNLINK(*resps, resp, rlink);
 
 		dispentry_log(resp, ISC_LOG_DEBUG(90), "read callback: %s",
@@ -1819,8 +1813,6 @@ resp_connected(void *arg) {
 static void
 tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	dns_dispatch_t *disp = (dns_dispatch_t *)arg;
-	dns_dispentry_t *resp = NULL;
-	dns_dispentry_t *next = NULL;
 	dns_displist_t resps = ISC_LIST_INITIALIZER;
 
 	if (isc_log_wouldlog(90)) {
@@ -1853,8 +1845,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	 * If there are pending responses, call the connect
 	 * callbacks for all of them.
 	 */
-	for (resp = ISC_LIST_HEAD(disp->pending); resp != NULL; resp = next) {
-		next = ISC_LIST_NEXT(resp, plink);
+	ISC_LIST_FOREACH_SAFE (disp->pending, resp, plink) {
 		ISC_LIST_UNLINK(disp->pending, resp, plink);
 		ISC_LIST_APPEND(resps, resp, rlink);
 		resp->result = eresult;
@@ -1872,24 +1863,23 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 	}
 
 	/* Take the oldest active response. */
-	resp = ISC_LIST_HEAD(disp->active);
-	if (resp == NULL) {
+	dns_dispentry_t *oldest = ISC_LIST_HEAD(disp->active);
+	if (oldest == NULL) {
 		/* All responses have been canceled */
 		disp->state = DNS_DISPATCHSTATE_CANCELED;
 	} else if (eresult == ISC_R_SUCCESS) {
 		disp->state = DNS_DISPATCHSTATE_CONNECTED;
 		isc_nmhandle_attach(handle, &disp->handle);
 		isc_nmhandle_cleartimeout(disp->handle);
-		if (resp->timeout != 0) {
-			isc_nmhandle_settimeout(disp->handle, resp->timeout);
+		if (oldest->timeout != 0) {
+			isc_nmhandle_settimeout(disp->handle, oldest->timeout);
 		}
-		tcp_startrecv(disp, resp);
+		tcp_startrecv(disp, oldest);
 	} else {
 		disp->state = DNS_DISPATCHSTATE_NONE;
 	}
 
-	for (resp = ISC_LIST_HEAD(resps); resp != NULL; resp = next) {
-		next = ISC_LIST_NEXT(resp, rlink);
+	ISC_LIST_FOREACH_SAFE (resps, resp, rlink) {
 		ISC_LIST_UNLINK(resps, resp, rlink);
 
 		resp_connected(resp);

lib/dns/dlz.c

@@ -97,11 +97,7 @@ dns__dlz_shutdown(void) {
  */
 static dns_dlzimplementation_t *
 dlz_impfind(const char *name) {
-	dns_dlzimplementation_t *imp;
-
-	for (imp = ISC_LIST_HEAD(dlz_implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-	{
+	ISC_LIST_FOREACH (dlz_implementations, imp, link) {
 		if (strcasecmp(name, imp->name) == 0) {
 			return imp;
 		}
@@ -118,7 +114,6 @@ dns_dlzallowzonexfr(dns_view_t *view, const dns_name_t *name,
 		    const isc_sockaddr_t *clientaddr, dns_db_t **dbp) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	dns_dlzallowzonexfr_t allowzonexfr;
-	dns_dlzdb_t *dlzdb;
 
 	/*
 	 * Performs checks to make sure data is as we expect it to be.
@@ -129,9 +124,7 @@ dns_dlzallowzonexfr(dns_view_t *view, const dns_name_t *name,
 	/*
 	 * Find a driver in which the zone exists and transfer is supported
 	 */
-	for (dlzdb = ISC_LIST_HEAD(view->dlz_searched); dlzdb != NULL;
-	     dlzdb = ISC_LIST_NEXT(dlzdb, link))
-	{
+	ISC_LIST_FOREACH (view->dlz_searched, dlzdb, link) {
 		REQUIRE(DNS_DLZ_VALID(dlzdb));
 
 		allowzonexfr = dlzdb->implementation->methods->allowzonexfr;

lib/dns/dnssec.c

@@ -1380,7 +1380,6 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, dns_kasp_t *kasp,
 			    dns_dnsseckeylist_t *keylist) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_dnsseckeylist_t list;
-	dns_dnsseckey_t *key = NULL;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	isc_buffer_t b;
 	unsigned int len;
@@ -1399,13 +1398,8 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, dns_kasp_t *kasp,
 		RETERR(findmatchingkeys(keydir, namebuf, len, mctx, now,
 					&list));
 	} else if (keystores != NULL) {
-		for (dns_keystore_t *keystore = ISC_LIST_HEAD(*keystores);
-		     keystore != NULL; keystore = ISC_LIST_NEXT(keystore, link))
-		{
-			for (dns_kasp_key_t *kkey =
-				     ISC_LIST_HEAD(dns_kasp_keys(kasp));
-			     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
-			{
+		ISC_LIST_FOREACH (*keystores, keystore, link) {
+			ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 				if (dns_kasp_key_keystore(kkey) == keystore) {
 					const char *directory =
 						dns_keystore_directory(keystore,
@@ -1427,7 +1421,7 @@ dns_dnssec_findmatchingkeys(const dns_name_t *origin, dns_kasp_t *kasp,
 	}
 
 failure:
-	while ((key = ISC_LIST_HEAD(list)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (list, key, link) {
 		ISC_LIST_UNLINK(list, key, link);
 		INSIST(key->key != NULL);
 		dst_key_free(&key->key);
@@ -1449,14 +1443,12 @@ addkey(dns_dnsseckeylist_t *keylist, dst_key_t **newkey, bool savekeys,
 	dns_dnsseckey_t *key = NULL;
 
 	/* Skip duplicates */
-	for (key = ISC_LIST_HEAD(*keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
-		if (dst_key_id(key->key) == dst_key_id(*newkey) &&
-		    dst_key_alg(key->key) == dst_key_alg(*newkey) &&
-		    dns_name_equal(dst_key_name(key->key),
-				   dst_key_name(*newkey)))
+	ISC_LIST_FOREACH (*keylist, k, link) {
+		if (dst_key_id(k->key) == dst_key_id(*newkey) &&
+		    dst_key_alg(k->key) == dst_key_alg(*newkey) &&
+		    dns_name_equal(dst_key_name(k->key), dst_key_name(*newkey)))
 		{
+			key = k;
 			break;
 		}
 	}
@@ -1505,15 +1497,12 @@ mark_active_keys(dns_dnsseckeylist_t *keylist, dns_rdataset_t *rrsigs) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	dns_rdataset_t sigs;
-	dns_dnsseckey_t *key;
 
 	REQUIRE(rrsigs != NULL && dns_rdataset_isassociated(rrsigs));
 
 	dns_rdataset_init(&sigs);
 	dns_rdataset_clone(rrsigs, &sigs);
-	for (key = ISC_LIST_HEAD(*keylist); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (*keylist, key, link) {
 		uint16_t keyid, sigid;
 		dns_secalg_t keyalg, sigalg;
 		keyid = dst_key_id(key->key);
@@ -1560,9 +1549,7 @@ keyfromfile(dns_kasp_t *kasp, const char *keydir, dst_key_t *key, int type,
 					  dst_key_alg(key), type, directory,
 					  mctx, savekey);
 	} else {
-		for (dns_kasp_key_t *kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-		     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
-		{
+		ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 			dns_keystore_t *ks = dns_kasp_key_keystore(kkey);
 			directory = dns_keystore_directory(ks, keydir);
 			result = dst_key_fromfile(dst_key_name(key),
@@ -1965,7 +1952,6 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		      isc_mem_t *mctx) {
 	unsigned char keybuf[DST_KEY_MAXSIZE];
 	isc_result_t result;
-	dns_dnsseckey_t *key;
 	dns_ttl_t cdsttl = ttl;
 	dns_ttl_t cdnskeyttl = ttl;
 
@@ -1981,9 +1967,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 		cdnskeyttl = cdnskey->ttl;
 	}
 
-	for (key = ISC_LIST_HEAD(*keys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (*keys, key, link) {
 		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
 		dns_name_t *origin = dst_key_name(key->key);
 
@@ -1995,9 +1979,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 			char keystr[DST_KEY_FORMATSIZE];
 			dst_key_format(key->key, keystr, sizeof(keystr));
 
-			for (dns_kasp_digest_t *alg = ISC_LIST_HEAD(*digests);
-			     alg != NULL; alg = ISC_LIST_NEXT(alg, link))
-			{
+			ISC_LIST_FOREACH (*digests, alg, link) {
 				RETERR(add_cds(key, &cdnskeyrdata,
 					       (const char *)keystr, cds,
 					       alg->digest, cdsttl, diff,
@@ -2059,9 +2041,7 @@ dns_dnssec_syncupdate(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *rmkeys,
 	/*
 	 * Unconditionally remove CDS/DNSKEY records for removed keys.
 	 */
-	for (key = ISC_LIST_HEAD(*rmkeys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (*rmkeys, key, link) {
 		dns_rdata_t cdnskeyrdata = DNS_RDATA_INIT;
 		dns_name_t *origin = dst_key_name(key->key);
 
@@ -2186,7 +2166,6 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 		      void (*report)(const char *, ...)
 			      ISC_FORMAT_PRINTF(1, 2)) {
 	isc_result_t result;
-	dns_dnsseckey_t *key, *key1, *key2, *next;
 	bool found_ttl = false;
 	dns_ttl_t ttl = hint_ttl;
 
@@ -2198,9 +2177,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 	 * Also, if there are keys published in the zone already,
 	 * use their TTL for all subsequent published keys.
 	 */
-	for (key = ISC_LIST_HEAD(*keys); key != NULL;
-	     key = ISC_LIST_NEXT(key, link))
-	{
+	ISC_LIST_FOREACH (*keys, key, link) {
 		if (key->source == dns_keysource_user &&
 		    (key->hint_publish || key->force_publish))
 		{
@@ -2220,9 +2197,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 	if (!found_ttl && !ISC_LIST_EMPTY(*newkeys)) {
 		dns_ttl_t shortest = 0;
 
-		for (key = ISC_LIST_HEAD(*newkeys); key != NULL;
-		     key = ISC_LIST_NEXT(key, link))
-		{
+		ISC_LIST_FOREACH (*newkeys, key, link) {
 			dns_ttl_t thisttl = dst_key_getttl(key->key);
 			if (thisttl != 0 &&
 			    (shortest == 0 || thisttl < shortest))
@@ -2240,30 +2215,27 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 	 * Second, scan the list of newly found keys looking for matches
 	 * with known keys, and update accordingly.
 	 */
-	for (key1 = ISC_LIST_HEAD(*newkeys); key1 != NULL; key1 = next) {
+	ISC_LIST_FOREACH_SAFE (*newkeys, key1, link) {
 		bool key_revoked = false;
 		char keystr1[DST_KEY_FORMATSIZE];
 		char keystr2[DST_KEY_FORMATSIZE];
+		dns_dnsseckey_t *key2 = NULL;
 
-		next = ISC_LIST_NEXT(key1, link);
-
-		for (key2 = ISC_LIST_HEAD(*keys); key2 != NULL;
-		     key2 = ISC_LIST_NEXT(key2, link))
-		{
+		ISC_LIST_FOREACH (*keys, k2, link) {
 			int f1 = dst_key_flags(key1->key);
-			int f2 = dst_key_flags(key2->key);
+			int f2 = dst_key_flags(k2->key);
 			int nr1 = f1 & ~DNS_KEYFLAG_REVOKE;
 			int nr2 = f2 & ~DNS_KEYFLAG_REVOKE;
 			if (nr1 == nr2 &&
-			    dst_key_alg(key1->key) == dst_key_alg(key2->key) &&
-			    dst_key_pubcompare(key1->key, key2->key, true))
+			    dst_key_alg(key1->key) == dst_key_alg(k2->key) &&
+			    dst_key_pubcompare(key1->key, k2->key, true))
 			{
-				int r1, r2;
-				r1 = dst_key_flags(key1->key) &
-				     DNS_KEYFLAG_REVOKE;
-				r2 = dst_key_flags(key2->key) &
-				     DNS_KEYFLAG_REVOKE;
+				int r1 = dst_key_flags(key1->key) &
+					 DNS_KEYFLAG_REVOKE;
+				int r2 = dst_key_flags(k2->key) &
+					 DNS_KEYFLAG_REVOKE;
 				key_revoked = (r1 != r2);
+				key2 = k2;
 				break;
 			}
 		}
@@ -2400,8 +2372,7 @@ dns_dnssec_updatekeys(dns_dnsseckeylist_t *keys, dns_dnsseckeylist_t *newkeys,
 	}
 
 	/* Free any leftover keys in newkeys */
-	while (!ISC_LIST_EMPTY(*newkeys)) {
-		key1 = ISC_LIST_HEAD(*newkeys);
+	ISC_LIST_FOREACH_SAFE (*newkeys, key1, link) {
 		ISC_LIST_UNLINK(*newkeys, key1, link);
 		dns_dnsseckey_destroy(mctx, &key1);
 	}

lib/dns/dyndb.c

@@ -70,11 +70,7 @@ dns__dyndb_shutdown(void) {
 
 static dyndb_implementation_t *
 impfind(const char *name) {
-	dyndb_implementation_t *imp;
-
-	for (imp = ISC_LIST_HEAD(dyndb_implementations); imp != NULL;
-	     imp = ISC_LIST_NEXT(imp, link))
-	{
+	ISC_LIST_FOREACH (dyndb_implementations, imp, link) {
 		if (strcasecmp(name, imp->name) == 0) {
 			return imp;
 		}

lib/dns/forward.c

@@ -91,17 +91,15 @@ dns_fwdtable_addfwd(dns_fwdtable_t *fwdtable, const dns_name_t *name,
 		    dns_forwarderlist_t *fwdrs, dns_fwdpolicy_t fwdpolicy) {
 	isc_result_t result;
 	dns_forwarders_t *forwarders = NULL;
-	dns_forwarder_t *fwd = NULL, *nfwd = NULL;
 	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_FWDTABLE(fwdtable));
 
 	forwarders = new_forwarders(fwdtable->mctx, name, fwdpolicy);
 
-	for (fwd = ISC_LIST_HEAD(*fwdrs); fwd != NULL;
-	     fwd = ISC_LIST_NEXT(fwd, link))
-	{
-		nfwd = isc_mem_get(fwdtable->mctx, sizeof(*nfwd));
+	ISC_LIST_FOREACH (*fwdrs, fwd, link) {
+		dns_forwarder_t *nfwd = isc_mem_get(fwdtable->mctx,
+						    sizeof(*nfwd));
 		*nfwd = *fwd;
 
 		if (fwd->tlsname != NULL) {
@@ -131,18 +129,15 @@ dns_fwdtable_add(dns_fwdtable_t *fwdtable, const dns_name_t *name,
 		 isc_sockaddrlist_t *addrs, dns_fwdpolicy_t fwdpolicy) {
 	isc_result_t result;
 	dns_forwarders_t *forwarders = NULL;
-	dns_forwarder_t *fwd = NULL;
-	isc_sockaddr_t *sa = NULL;
 	dns_qp_t *qp = NULL;
 
 	REQUIRE(VALID_FWDTABLE(fwdtable));
 
 	forwarders = new_forwarders(fwdtable->mctx, name, fwdpolicy);
 
-	for (sa = ISC_LIST_HEAD(*addrs); sa != NULL;
-	     sa = ISC_LIST_NEXT(sa, link))
-	{
-		fwd = isc_mem_get(fwdtable->mctx, sizeof(*fwd));
+	ISC_LIST_FOREACH (*addrs, sa, link) {
+		dns_forwarder_t *fwd = isc_mem_get(fwdtable->mctx,
+						   sizeof(*fwd));
 		*fwd = (dns_forwarder_t){ .addr = *sa,
 					  .link = ISC_LINK_INITIALIZER };
 		ISC_LIST_APPEND(forwarders->fwdrs, fwd, link);
@@ -200,10 +195,7 @@ dns_fwdtable_destroy(dns_fwdtable_t **fwdtablep) {
 
 static void
 destroy_forwarders(dns_forwarders_t *forwarders) {
-	dns_forwarder_t *fwd = NULL;
-
-	while (!ISC_LIST_EMPTY(forwarders->fwdrs)) {
-		fwd = ISC_LIST_HEAD(forwarders->fwdrs);
+	ISC_LIST_FOREACH_SAFE (forwarders->fwdrs, fwd, link) {
 		ISC_LIST_UNLINK(forwarders->fwdrs, fwd, link);
 		if (fwd->tlsname != NULL) {
 			dns_name_free(fwd->tlsname, forwarders->mctx);

lib/dns/include/dns/diff.h

@@ -272,7 +272,7 @@ dns_diff_load(const dns_diff_t *diff, dns_rdatacallbacks_t *callbacks);
  */
 
 isc_result_t
-dns_diff_print(const dns_diff_t *diff, FILE *file);
+dns_diff_print(dns_diff_t *diff, FILE *file);
 
 /*%<
  * Print the differences to 'file' or if 'file' is NULL via the

lib/dns/include/dns/message.h

@@ -209,6 +209,13 @@ typedef enum dns_message_intent {
 		*   additional section. */
 /* Obsolete: DNS_MESSAGERENDER_FILTER_AAAA	0x0020	*/
 
+/* clang-format off */
+#define MSG_SECTION_FOREACH(msg, section, elt)                            \
+        for (dns_name_t *elt = ISC_LIST_HEAD((msg)->sections[(section)]); \
+             elt != NULL;                                                 \
+             elt = ISC_LIST_NEXT(elt, link))
+/* clang-format on */
+
 typedef struct dns_msgblock dns_msgblock_t;
 
 typedef struct dns_minttl {
@@ -798,7 +805,7 @@ dns_message_findname(dns_message_t *msg, dns_section_t section,
  */
 
 isc_result_t
-dns_message_findtype(const dns_name_t *name, dns_rdatatype_t type,
+dns_message_findtype(dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdatatype_t covers, dns_rdataset_t **rdataset);
 /*%<
  * Search the name for the specified type.  If it is found, *rdataset is

lib/dns/include/dns/rdatalist.h

@@ -127,7 +127,7 @@ unsigned int
 dns_rdatalist_count(dns_rdataset_t *rdataset);
 
 isc_result_t
-dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name);
+dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name);
 
 isc_result_t
 dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
@@ -135,7 +135,7 @@ dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 			 dns_rdataset_t *negsig DNS__DB_FLARG);
 
 isc_result_t
-dns_rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name);
+dns_rdatalist_addclosest(dns_rdataset_t *rdataset, dns_name_t *name);
 
 isc_result_t
 dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,

lib/dns/include/dns/rdataset.h

@@ -82,13 +82,11 @@ struct dns_rdatasetmethods {
 	void (*clone)(dns_rdataset_t	    *source,
 		      dns_rdataset_t *target DNS__DB_FLARG);
 	unsigned int (*count)(dns_rdataset_t *rdataset);
-	isc_result_t (*addnoqname)(dns_rdataset_t   *rdataset,
-				   const dns_name_t *name);
+	isc_result_t (*addnoqname)(dns_rdataset_t *rdataset, dns_name_t *name);
 	isc_result_t (*getnoqname)(dns_rdataset_t *rdataset, dns_name_t *name,
 				   dns_rdataset_t	 *neg,
 				   dns_rdataset_t *negsig DNS__DB_FLARG);
-	isc_result_t (*addclosest)(dns_rdataset_t   *rdataset,
-				   const dns_name_t *name);
+	isc_result_t (*addclosest)(dns_rdataset_t *rdataset, dns_name_t *name);
 	isc_result_t (*getclosest)(dns_rdataset_t *rdataset, dns_name_t *name,
 				   dns_rdataset_t	 *neg,
 				   dns_rdataset_t *negsig DNS__DB_FLARG);
@@ -210,8 +208,8 @@ struct dns_rdataset {
 			 * These refer to names passed in by the caller of
 			 * dns_rdataset_addnoqname() and _addclosest()
 			 */
-			const struct dns_name *noqname, *closest;
-			dns_dbnode_t	      *node;
+			struct dns_name *noqname, *closest;
+			dns_dbnode_t	*node;
 		} rdlist;
 	};
 };
@@ -589,7 +587,7 @@ dns__rdataset_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
  */
 
 isc_result_t
-dns_rdataset_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name);
+dns_rdataset_addclosest(dns_rdataset_t *rdataset, dns_name_t *name);
 /*%<
  * Associate a closest encloset proof with this record.
  * Sets #DNS_RDATASETATTR_CLOSEST if successful.

lib/dns/journal.c

@@ -1189,7 +1189,6 @@ failure:
 
 isc_result_t
 dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
-	dns_difftuple_t *t;
 	isc_buffer_t buffer;
 	void *mem = NULL;
 	uint64_t size = 0;
@@ -1208,9 +1207,7 @@ dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
 	 * Pass 1: determine the buffer size needed, and
 	 * keep track of SOA serial numbers.
 	 */
-	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, t, link) {
 		if (t->rdata.type == dns_rdatatype_soa) {
 			if (j->x.n_soa < 2) {
 				j->x.pos[j->x.n_soa].serial =
@@ -1240,9 +1237,7 @@ dns_journal_writediff(dns_journal_t *j, dns_diff_t *diff) {
 	/*
 	 * Pass 2.  Write RRs to buffer.
 	 */
-	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, t, link) {
 		/*
 		 * Write the RR header.
 		 */

lib/dns/kasp.c

@@ -67,22 +67,15 @@ dns_kasp_attach(dns_kasp_t *source, dns_kasp_t **targetp) {
 
 static void
 destroy(dns_kasp_t *kasp) {
-	dns_kasp_key_t *key, *key_next;
-	dns_kasp_digest_t *digest, *digest_next;
-
 	REQUIRE(!ISC_LINK_LINKED(kasp, link));
 
-	for (key = ISC_LIST_HEAD(kasp->keys); key != NULL; key = key_next) {
-		key_next = ISC_LIST_NEXT(key, link);
+	ISC_LIST_FOREACH_SAFE (kasp->keys, key, link) {
 		ISC_LIST_UNLINK(kasp->keys, key, link);
 		dns_kasp_key_destroy(key);
 	}
 	INSIST(ISC_LIST_EMPTY(kasp->keys));
 
-	for (digest = ISC_LIST_HEAD(kasp->digests); digest != NULL;
-	     digest = digest_next)
-	{
-		digest_next = ISC_LIST_NEXT(digest, link);
+	ISC_LIST_FOREACH_SAFE (kasp->digests, digest, link) {
 		ISC_LIST_UNLINK(kasp->digests, digest, link);
 		isc_mem_put(kasp->mctx, digest, sizeof(*digest));
 	}
@@ -349,28 +342,20 @@ dns_kasp_setparentpropagationdelay(dns_kasp_t *kasp, uint32_t value) {
 
 isc_result_t
 dns_kasplist_find(dns_kasplist_t *list, const char *name, dns_kasp_t **kaspp) {
-	dns_kasp_t *kasp = NULL;
-
 	REQUIRE(kaspp != NULL && *kaspp == NULL);
 
 	if (list == NULL) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (kasp = ISC_LIST_HEAD(*list); kasp != NULL;
-	     kasp = ISC_LIST_NEXT(kasp, link))
-	{
+	ISC_LIST_FOREACH (*list, kasp, link) {
 		if (strcmp(kasp->name, name) == 0) {
-			break;
+			dns_kasp_attach(kasp, kaspp);
+			return ISC_R_SUCCESS;
 		}
 	}
 
-	if (kasp == NULL) {
-		return ISC_R_NOTFOUND;
-	}
-
-	dns_kasp_attach(kasp, kaspp);
-	return ISC_R_SUCCESS;
+	return ISC_R_NOTFOUND;
 }
 
 dns_kasp_keylist_t
@@ -667,9 +652,7 @@ dns_kasp_adddigest(dns_kasp_t *kasp, dns_dsdigest_t alg) {
 	}
 
 	/* Suppress duplicates */
-	for (dns_kasp_digest_t *d = ISC_LIST_HEAD(kasp->digests); d != NULL;
-	     d = ISC_LIST_NEXT(d, link))
-	{
+	ISC_LIST_FOREACH (kasp->digests, d, link) {
 		if (d->digest == alg) {
 			return;
 		}

lib/dns/keymgr.c

@@ -452,9 +452,7 @@ keymgr_keyid_conflict(dst_key_t *newkey, uint16_t min, uint16_t max,
 		return true;
 	}
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keys); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keys, dkey, link) {
 		if (dst_key_alg(dkey->key) != alg) {
 			continue;
 		}
@@ -659,9 +657,7 @@ keymgr_direct_dep(dst_key_t *d, dst_key_t *k) {
  */
 static bool
 keymgr_dep(dst_key_t *k, dns_dnsseckeylist_t *keyring, uint32_t *dep) {
-	for (dns_dnsseckey_t *d = ISC_LIST_HEAD(*keyring); d != NULL;
-	     d = ISC_LIST_NEXT(d, link))
-	{
+	ISC_LIST_FOREACH (*keyring, d, link) {
 		/*
 		 * Check if k is a direct successor of d, e.g. d depends on k.
 		 */
@@ -736,9 +732,7 @@ keymgr_key_is_successor(dst_key_t *x, dst_key_t *z, dst_key_t *key, int type,
 		zst[i] = state;
 	}
 
-	for (dns_dnsseckey_t *y = ISC_LIST_HEAD(*keyring); y != NULL;
-	     y = ISC_LIST_NEXT(y, link))
-	{
+	ISC_LIST_FOREACH (*keyring, y, link) {
 		if (dst_key_id(y->key) == dst_key_id(z)) {
 			continue;
 		}
@@ -781,9 +775,7 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 			     dst_key_state_t states[NUM_KEYSTATES],
 			     dst_key_state_t states2[NUM_KEYSTATES],
 			     bool check_successor, bool match_algorithms) {
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		if (match_algorithms &&
 		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
 		{
@@ -805,9 +797,7 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 		 * We have to make sure that the key we are checking, also
 		 * has a successor relationship with another key.
 		 */
-		for (dns_dnsseckey_t *skey = ISC_LIST_HEAD(*keyring);
-		     skey != NULL; skey = ISC_LIST_NEXT(skey, link))
-		{
+		ISC_LIST_FOREACH (*keyring, skey, link) {
 			if (skey == dkey) {
 				continue;
 			}
@@ -839,9 +829,7 @@ keymgr_key_exists_with_state(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 static bool
 keymgr_key_has_successor(dns_dnsseckey_t *predecessor,
 			 dns_dnsseckeylist_t *keyring) {
-	for (dns_dnsseckey_t *successor = ISC_LIST_HEAD(*keyring);
-	     successor != NULL; successor = ISC_LIST_NEXT(successor, link))
-	{
+	ISC_LIST_FOREACH (*keyring, successor, link) {
 		if (keymgr_direct_dep(predecessor->key, successor->key)) {
 			return true;
 		}
@@ -869,9 +857,7 @@ keymgr_ds_hidden_or_chained(dns_dnsseckeylist_t *keyring, dns_dnsseckey_t *key,
 	/* successor n/a */
 	dst_key_state_t na[NUM_KEYSTATES] = { NA, NA, NA, NA };
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		if (match_algorithms &&
 		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
 		{
@@ -938,9 +924,7 @@ keymgr_dnskey_hidden_or_chained(dns_dnsseckeylist_t *keyring,
 	/* successor n/a */
 	dst_key_state_t na[NUM_KEYSTATES] = { NA, NA, NA, NA };
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		if (match_algorithms &&
 		    (dst_key_alg(dkey->key) != dst_key_alg(key->key)))
 		{
@@ -1472,9 +1456,7 @@ transition:
 	changed = false;
 
 	/* For all keys in the zone. */
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		char keystr[DST_KEY_FORMATSIZE];
 		dst_key_format(dkey->key, keystr, sizeof(keystr));
 
@@ -1739,8 +1721,8 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 	char keystr[DST_KEY_FORMATSIZE];
 	isc_stdtime_t retire = 0, active = 0, prepub = 0;
 	dns_dnsseckey_t *new_key = NULL;
-	dns_dnsseckey_t *candidate = NULL;
 	dst_key_t *dst_key = NULL;
+	bool keycreated = false;
 
 	/* Do we need to create a successor for the active key? */
 	if (active_key != NULL) {
@@ -1838,18 +1820,17 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 	 * Check if there is a key available in pool because keys
 	 * may have been pregenerated with dnssec-keygen.
 	 */
-	for (candidate = ISC_LIST_HEAD(*keyring); candidate != NULL;
-	     candidate = ISC_LIST_NEXT(candidate, link))
-	{
+	ISC_LIST_FOREACH (*keyring, candidate, link) {
 		if (dns_kasp_key_match(kaspkey, candidate) &&
 		    dst_key_is_unused(candidate->key))
 		{
 			/* Found a candidate in keyring. */
+			new_key = candidate;
 			break;
 		}
 	}
 
-	if (candidate == NULL) {
+	if (new_key == NULL) {
 		/* No key available in keyring, create a new one. */
 		bool csk = (dns_kasp_key_ksk(kaspkey) &&
 			    dns_kasp_key_zsk(kaspkey));
@@ -1864,8 +1845,7 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 		dst_key_settime(dst_key, DST_TIME_CREATED, now);
 		dns_dnsseckey_create(mctx, &dst_key, &new_key);
 		keymgr_key_init(new_key, kasp, now, csk);
-	} else {
-		new_key = candidate;
+		keycreated = true;
 	}
 	dst_key_setnum(new_key->key, DST_NUM_LIFETIME, lifetime);
 
@@ -1936,7 +1916,7 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 	dns_dnssec_get_hints(new_key, now);
 	new_key->source = dns_keysource_repository;
 	INSIST(!new_key->legacy);
-	if (candidate == NULL) {
+	if (keycreated) {
 		ISC_LIST_APPEND(*newkeys, new_key, link);
 	}
 
@@ -1945,7 +1925,7 @@ keymgr_key_rollover(dns_kasp_key_t *kaspkey, dns_dnsseckey_t *active_key,
 	isc_log_write(DNS_LOGCATEGORY_DNSSEC, DNS_LOGMODULE_DNSSEC,
 		      ISC_LOG_INFO, "keymgr: DNSKEY %s (%s) %s for policy %s",
 		      keystr, keymgr_keyrole(new_key->key),
-		      (candidate != NULL) ? "selected" : "created",
+		      keycreated ? "created" : "selected",
 		      dns_kasp_getname(kasp));
 	return ISC_R_SUCCESS;
 }
@@ -2042,9 +2022,7 @@ static bool
 dst_key_doublematch(dns_dnsseckey_t *key, dns_kasp_t *kasp) {
 	int matches = 0;
 
-	for (dns_kasp_key_t *kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-	     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
-	{
+	ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 		if (dns_kasp_key_match(kkey, key)) {
 			matches++;
 		}
@@ -2063,8 +2041,6 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 	       dns_kasp_t *kasp, isc_stdtime_t now, isc_stdtime_t *nexttime) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_dnsseckeylist_t newkeys;
-	dns_kasp_key_t *kkey;
-	dns_dnsseckey_t *newkey = NULL;
 	bool secure_to_insecure = false;
 	int numkeys = 0;
 	int options = (DST_TYPE_PRIVATE | DST_TYPE_PUBLIC | DST_TYPE_STATE);
@@ -2091,18 +2067,14 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 				      namebuf, dns_kasp_getname(kasp));
 		}
 
-		for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring);
-		     dkey != NULL; dkey = ISC_LIST_NEXT(dkey, link))
-		{
+		ISC_LIST_FOREACH (*keyring, dkey, link) {
 			dst_key_format(dkey->key, keystr, sizeof(keystr));
 			isc_log_write(DNS_LOGCATEGORY_DNSSEC,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_DEBUG(1),
 				      "keymgr: keyring: %s (policy %s)", keystr,
 				      dns_kasp_getname(kasp));
 		}
-		for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*dnskeys);
-		     dkey != NULL; dkey = ISC_LIST_NEXT(dkey, link))
-		{
+		ISC_LIST_FOREACH (*dnskeys, dkey, link) {
 			dst_key_format(dkey->key, keystr, sizeof(keystr));
 			isc_log_write(DNS_LOGCATEGORY_DNSSEC,
 				      DNS_LOGMODULE_DNSSEC, ISC_LOG_DEBUG(1),
@@ -2111,23 +2083,17 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 		}
 	}
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*dnskeys); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*dnskeys, dkey, link) {
 		numkeys++;
 	}
 
 	/* Do we need to remove keys? */
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		bool found_match = false;
 
 		keymgr_key_init(dkey, kasp, now, (numkeys == 1));
 
-		for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
-		     kkey = ISC_LIST_NEXT(kkey, link))
-		{
+		ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 			if (dns_kasp_key_match(kkey, dkey)) {
 				found_match = true;
 				break;
@@ -2159,17 +2125,13 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 	}
 
 	/* Create keys according to the policy, if come in short. */
-	for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
-	     kkey = ISC_LIST_NEXT(kkey, link))
-	{
+	ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 		uint32_t lifetime = dns_kasp_key_lifetime(kkey);
 		dns_dnsseckey_t *active_key = NULL;
 		bool rollover_allowed = true;
 
 		/* Do we have keys available for this kasp key? */
-		for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring);
-		     dkey != NULL; dkey = ISC_LIST_NEXT(dkey, link))
-		{
+		ISC_LIST_FOREACH (*keyring, dkey, link) {
 			if (dns_kasp_key_match(kkey, dkey)) {
 				/* Found a match. */
 				dst_key_format(dkey->key, keystr,
@@ -2229,10 +2191,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 			 * a successor key. Check if we have an appropriate
 			 * state file.
 			 */
-			for (dns_dnsseckey_t *dnskey = ISC_LIST_HEAD(*dnskeys);
-			     dnskey != NULL;
-			     dnskey = ISC_LIST_NEXT(dnskey, link))
-			{
+			ISC_LIST_FOREACH (*dnskeys, dnskey, link) {
 				if (dns_kasp_key_match(kkey, dnskey)) {
 					/* Found a match. */
 					dst_key_format(dnskey->key, keystr,
@@ -2275,9 +2234,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 	keymgr_update(keyring, kasp, now, nexttime, secure_to_insecure);
 
 	/* Store key states and update hints. */
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		bool modified = dst_key_ismodified(dkey->key);
 		if (dst_key_getttl(dkey->key) != dns_kasp_dnskeyttl(kasp)) {
 			dst_key_setttl(dkey->key, dns_kasp_dnskeyttl(kasp));
@@ -2311,7 +2268,7 @@ dns_keymgr_run(const dns_name_t *origin, dns_rdataclass_t rdclass,
 
 failure:
 	if (result != ISC_R_SUCCESS) {
-		while ((newkey = ISC_LIST_HEAD(newkeys)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (newkeys, newkey, link) {
 			ISC_LIST_UNLINK(newkeys, newkey, link);
 			INSIST(newkey->key != NULL);
 			dst_key_free(&newkey->key);
@@ -2340,9 +2297,7 @@ keymgr_checkds(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 	REQUIRE(DNS_KASP_VALID(kasp));
 	REQUIRE(keyring != NULL);
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		isc_result_t ret;
 		bool ksk = false;
 
@@ -2589,9 +2544,7 @@ dns_keymgr_status(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 	isc_stdtime_tostring(now, timestr, sizeof(timestr));
 	RETERR(isc_buffer_printf(&buf, "%s\n", timestr));
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		char algstr[DNS_NAME_FORMATSIZE];
 		bool ksk = false, zsk = false;
 
@@ -2659,9 +2612,7 @@ dns_keymgr_rollover(dns_kasp_t *kasp, dns_dnsseckeylist_t *keyring,
 	REQUIRE(DNS_KASP_VALID(kasp));
 	REQUIRE(keyring != NULL);
 
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		if (dst_key_id(dkey->key) != id) {
 			continue;
 		}
@@ -2734,9 +2685,7 @@ dns_keymgr_offline(const dns_name_t *origin, dns_dnsseckeylist_t *keyring,
 	*nexttime = 0;
 
 	/* Store key states and update hints. */
-	for (dns_dnsseckey_t *dkey = ISC_LIST_HEAD(*keyring); dkey != NULL;
-	     dkey = ISC_LIST_NEXT(dkey, link))
-	{
+	ISC_LIST_FOREACH (*keyring, dkey, link) {
 		bool modified;
 		bool ksk = false, zsk = false;
 		isc_stdtime_t active = 0, published = 0, inactive = 0,

lib/dns/keystore.c

@@ -255,26 +255,18 @@ dns_keystore_keygen(dns_keystore_t *keystore, const dns_name_t *origin,
 isc_result_t
 dns_keystorelist_find(dns_keystorelist_t *list, const char *name,
 		      dns_keystore_t **kspp) {
-	dns_keystore_t *keystore = NULL;
-
 	REQUIRE(kspp != NULL && *kspp == NULL);
 
 	if (list == NULL) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (keystore = ISC_LIST_HEAD(*list); keystore != NULL;
-	     keystore = ISC_LIST_NEXT(keystore, link))
-	{
+	ISC_LIST_FOREACH (*list, keystore, link) {
 		if (strcmp(keystore->name, name) == 0) {
-			break;
+			dns_keystore_attach(keystore, kspp);
+			return ISC_R_SUCCESS;
 		}
 	}
 
-	if (keystore == NULL) {
-		return ISC_R_NOTFOUND;
-	}
-
-	dns_keystore_attach(keystore, kspp);
-	return ISC_R_SUCCESS;
+	return ISC_R_NOTFOUND;
 }

lib/dns/keytable.c

@@ -101,13 +101,9 @@ static dns_rdatasetmethods_t methods = {
 
 static void
 destroy_keynode(dns_keynode_t *knode) {
-	dns_rdata_t *rdata = NULL;
-
 	isc_rwlock_destroy(&knode->rwlock);
 	if (knode->dslist != NULL) {
-		for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
-		     rdata = ISC_LIST_HEAD(knode->dslist->rdata))
-		{
+		ISC_LIST_FOREACH_SAFE (knode->dslist->rdata, rdata, link) {
 			ISC_LIST_UNLINK(knode->dslist->rdata, rdata, link);
 			isc_mem_put(knode->mctx, rdata->data,
 				    DNS_DS_BUFFERSIZE);
@@ -171,7 +167,7 @@ ISC_REFCOUNT_IMPL(dns_keytable, destroy_keytable);
 static void
 add_ds(dns_keynode_t *knode, dns_rdata_ds_t *ds, isc_mem_t *mctx) {
 	isc_result_t result;
-	dns_rdata_t *dsrdata = NULL, *rdata = NULL;
+	dns_rdata_t *dsrdata = NULL;
 	void *data = NULL;
 	bool exists = false;
 	isc_buffer_t b;
@@ -205,9 +201,7 @@ add_ds(dns_keynode_t *knode, dns_rdata_ds_t *ds, isc_mem_t *mctx) {
 		knode->dsset.trust = dns_trust_ultimate;
 	}
 
-	for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_NEXT(rdata, link))
-	{
+	ISC_LIST_FOREACH (knode->dslist->rdata, rdata, link) {
 		if (dns_rdata_compare(rdata, dsrdata) == 0) {
 			exists = true;
 			break;
@@ -229,7 +223,6 @@ delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
 	  dns_rdata_ds_t *ds) {
 	isc_result_t result;
 	dns_rdata_t dsrdata = DNS_RDATA_INIT;
-	dns_rdata_t *rdata = NULL;
 	dns_keynode_t *newnode = NULL;
 	unsigned char data[DNS_DS_BUFFERSIZE];
 	bool found = false;
@@ -251,9 +244,7 @@ delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
 		return result;
 	}
 
-	for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_NEXT(rdata, link))
-	{
+	ISC_LIST_FOREACH (knode->dslist->rdata, rdata, link) {
 		if (dns_rdata_compare(rdata, &dsrdata) == 0) {
 			found = true;
 			break;
@@ -274,9 +265,7 @@ delete_ds(dns_qp_t *qp, dns_keytable_t *keytable, dns_keynode_t *knode,
 	 */
 	newnode = new_keynode(&knode->name, NULL, keytable, knode->managed,
 			      knode->initial);
-	for (rdata = ISC_LIST_HEAD(knode->dslist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_NEXT(rdata, link))
-	{
+	ISC_LIST_FOREACH (knode->dslist->rdata, rdata, link) {
 		if (dns_rdata_compare(rdata, &dsrdata) != 0) {
 			dns_rdata_ds_t ds0;
 			result = dns_rdata_tostruct(rdata, &ds0, NULL);

lib/dns/master.c

@@ -1015,7 +1015,6 @@ load_text(dns_loadctx_t *lctx) {
 	isc_result_t result = ISC_R_UNEXPECTED;
 	rdatalist_head_t glue_list;
 	rdatalist_head_t current_list;
-	dns_rdatalist_t *this = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
 	dns_rdatalist_t *new_rdatalist = NULL;
 	int rdlcount = 0;
@@ -1082,6 +1081,8 @@ load_text(dns_loadctx_t *lctx) {
 	}
 	source = isc_lex_getsourcename(lctx->lex);
 	while (true) {
+		dns_rdatalist_t *this = NULL;
+
 		if (atomic_load_acquire(&lctx->canceled)) {
 			result = ISC_R_CANCELED;
 			goto log_and_cleanup;
@@ -2115,10 +2116,10 @@ cleanup:
 		callbacks->commit(callbacks->add_private);
 	}
 
-	while ((this = ISC_LIST_HEAD(current_list)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (current_list, this, link) {
 		ISC_LIST_UNLINK(current_list, this, link);
 	}
-	while ((this = ISC_LIST_HEAD(glue_list)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (glue_list, this, link) {
 		ISC_LIST_UNLINK(glue_list, this, link);
 	}
 	if (rdatalist != NULL) {
@@ -2752,16 +2753,15 @@ grow_rdatalist(int new_len, dns_rdatalist_t *oldlist, int old_len,
 	dns_rdatalist_t *newlist;
 	int rdlcount = 0;
 	ISC_LIST(dns_rdatalist_t) save;
-	dns_rdatalist_t *this;
 
 	newlist = isc_mem_cget(mctx, new_len, sizeof(newlist[0]));
 
 	ISC_LIST_INIT(save);
-	while ((this = ISC_LIST_HEAD(*current)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (*current, this, link) {
 		ISC_LIST_UNLINK(*current, this, link);
 		ISC_LIST_APPEND(save, this, link);
 	}
-	while ((this = ISC_LIST_HEAD(save)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (save, this, link) {
 		ISC_LIST_UNLINK(save, this, link);
 		INSIST(rdlcount < new_len);
 		newlist[rdlcount] = *this;
@@ -2770,11 +2770,11 @@ grow_rdatalist(int new_len, dns_rdatalist_t *oldlist, int old_len,
 	}
 
 	ISC_LIST_INIT(save);
-	while ((this = ISC_LIST_HEAD(*glue)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (*glue, this, link) {
 		ISC_LIST_UNLINK(*glue, this, link);
 		ISC_LIST_APPEND(save, this, link);
 	}
-	while ((this = ISC_LIST_HEAD(save)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (save, this, link) {
 		ISC_LIST_UNLINK(save, this, link);
 		INSIST(rdlcount < new_len);
 		newlist[rdlcount] = *this;
@@ -2799,49 +2799,43 @@ grow_rdata(int new_len, dns_rdata_t *oldlist, int old_len,
 	dns_rdata_t *newlist;
 	int rdcount = 0;
 	ISC_LIST(dns_rdata_t) save;
-	dns_rdatalist_t *this;
-	dns_rdata_t *rdata;
 
 	newlist = isc_mem_cget(mctx, new_len, sizeof(*newlist));
 
 	/*
 	 * Copy current relinking.
 	 */
-	this = ISC_LIST_HEAD(*current);
-	while (this != NULL) {
+	ISC_LIST_FOREACH (*current, this, link) {
 		ISC_LIST_INIT(save);
-		while ((rdata = ISC_LIST_HEAD(this->rdata)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (this->rdata, rdata, link) {
 			ISC_LIST_UNLINK(this->rdata, rdata, link);
 			ISC_LIST_APPEND(save, rdata, link);
 		}
-		while ((rdata = ISC_LIST_HEAD(save)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (save, rdata, link) {
 			ISC_LIST_UNLINK(save, rdata, link);
 			INSIST(rdcount < new_len);
 			newlist[rdcount] = *rdata;
 			ISC_LIST_APPEND(this->rdata, &newlist[rdcount], link);
 			rdcount++;
 		}
-		this = ISC_LIST_NEXT(this, link);
 	}
 
 	/*
 	 * Copy glue relinking.
 	 */
-	this = ISC_LIST_HEAD(*glue);
-	while (this != NULL) {
+	ISC_LIST_FOREACH (*glue, this, link) {
 		ISC_LIST_INIT(save);
-		while ((rdata = ISC_LIST_HEAD(this->rdata)) != NULL) {
+		ISC_LIST_FOREACH (this->rdata, rdata, link) {
 			ISC_LIST_UNLINK(this->rdata, rdata, link);
 			ISC_LIST_APPEND(save, rdata, link);
 		}
-		while ((rdata = ISC_LIST_HEAD(save)) != NULL) {
+		ISC_LIST_FOREACH (save, rdata, link) {
 			ISC_LIST_UNLINK(save, rdata, link);
 			INSIST(rdcount < new_len);
 			newlist[rdcount] = *rdata;
 			ISC_LIST_APPEND(this->rdata, &newlist[rdcount], link);
 			rdcount++;
 		}
-		this = ISC_LIST_NEXT(this, link);
 	}
 	INSIST(rdcount == old_len || rdcount == 0);
 	if (oldlist != NULL) {
@@ -2887,16 +2881,14 @@ static isc_result_t
 commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
        rdatalist_head_t *head, dns_name_t *owner, const char *source,
        unsigned int line) {
-	dns_rdatalist_t *this;
 	dns_rdataset_t dataset;
 	isc_result_t result = ISC_R_SUCCESS;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	void (*error)(struct dns_rdatacallbacks *, const char *, ...);
 
-	this = ISC_LIST_HEAD(*head);
 	error = callbacks->error;
 
-	while (this != NULL) {
+	ISC_LIST_FOREACH_SAFE (*head, this, link) {
 		dns_rdataset_init(&dataset);
 		dns_rdatalist_tordataset(this, &dataset);
 		dataset.trust = dns_trust_ultimate;
@@ -2929,7 +2921,6 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 			break;
 		}
 		ISC_LIST_UNLINK(*head, this, link);
-		this = ISC_LIST_HEAD(*head);
 	}
 
 	return result;
@@ -2941,34 +2932,30 @@ commit(dns_rdatacallbacks_t *callbacks, dns_loadctx_t *lctx,
 
 static bool
 is_glue(rdatalist_head_t *head, dns_name_t *owner) {
-	dns_rdatalist_t *this;
-	dns_rdata_t *rdata;
+	dns_rdatalist_t *nslist = NULL;
 	isc_region_t region;
 	dns_name_t name;
 
 	/*
 	 * Find NS rrset.
 	 */
-	this = ISC_LIST_HEAD(*head);
-	while (this != NULL) {
+	ISC_LIST_FOREACH (*head, this, link) {
 		if (this->type == dns_rdatatype_ns) {
+			nslist = this;
 			break;
 		}
-		this = ISC_LIST_NEXT(this, link);
 	}
-	if (this == NULL) {
+	if (nslist == NULL) {
 		return false;
 	}
 
-	rdata = ISC_LIST_HEAD(this->rdata);
-	while (rdata != NULL) {
+	ISC_LIST_FOREACH (nslist->rdata, rdata, link) {
 		dns_name_init(&name);
 		dns_rdata_toregion(rdata, &region);
 		dns_name_fromregion(&name, &region);
 		if (dns_name_equal(&name, owner)) {
 			return true;
 		}
-		rdata = ISC_LIST_NEXT(rdata, link);
 	}
 	return false;
 }

lib/dns/message.c

@@ -440,11 +440,8 @@ msginit(dns_message_t *m) {
 
 static void
 msgresetname(dns_message_t *msg, dns_name_t *name) {
-	dns_rdataset_t *rds = NULL, *next_rds = NULL;
-
-	ISC_LIST_FOREACH_SAFE (name->list, rds, link, next_rds) {
+	ISC_LIST_FOREACH_SAFE (name->list, rds, link) {
 		ISC_LIST_UNLINK(name->list, rds, link);
-
 		dns__message_putassociatedrdataset(msg, &rds);
 	}
 }
@@ -453,14 +450,9 @@ static void
 msgresetnames(dns_message_t *msg, unsigned int first_section) {
 	/* Clean up name lists. */
 	for (size_t i = first_section; i < DNS_SECTION_MAX; i++) {
-		dns_name_t *name = NULL, *next_name = NULL;
-
-		ISC_LIST_FOREACH_SAFE (msg->sections[i], name, link, next_name)
-		{
+		ISC_LIST_FOREACH_SAFE (msg->sections[i], name, link) {
 			ISC_LIST_UNLINK(msg->sections[i], name, link);
-
 			msgresetname(msg, name);
-
 			dns_message_puttempname(msg, &name);
 		}
 	}
@@ -522,8 +514,6 @@ static void
 msgreset(dns_message_t *msg, bool everything) {
 	dns_msgblock_t *msgblock = NULL, *next_msgblock = NULL;
 	isc_buffer_t *dynbuf = NULL, *next_dynbuf = NULL;
-	dns_rdata_t *rdata = NULL;
-	dns_rdatalist_t *rdatalist = NULL;
 
 	msgresetnames(msg, 0);
 	msgresetopt(msg);
@@ -538,15 +528,11 @@ msgreset(dns_message_t *msg, bool everything) {
 	 * The memory isn't lost since these are part of message blocks we
 	 * have allocated.
 	 */
-	rdata = ISC_LIST_HEAD(msg->freerdata);
-	while (rdata != NULL) {
+	ISC_LIST_FOREACH_SAFE (msg->freerdata, rdata, link) {
 		ISC_LIST_UNLINK(msg->freerdata, rdata, link);
-		rdata = ISC_LIST_HEAD(msg->freerdata);
 	}
-	rdatalist = ISC_LIST_HEAD(msg->freerdatalist);
-	while (rdatalist != NULL) {
+	ISC_LIST_FOREACH_SAFE (msg->freerdatalist, rdatalist, link) {
 		ISC_LIST_UNLINK(msg->freerdatalist, rdatalist, link);
-		rdatalist = ISC_LIST_HEAD(msg->freerdatalist);
 	}
 
 	dynbuf = ISC_LIST_HEAD(msg->scratchpad);
@@ -763,8 +749,6 @@ name_match(void *node, const void *key) {
 static isc_result_t
 findname(dns_name_t **foundname, const dns_name_t *target,
 	 dns_namelist_t *section) {
-	dns_name_t *name = NULL;
-
 	ISC_LIST_FOREACH_REV (*section, name, link) {
 		if (dns_name_equal(name, target)) {
 			if (foundname != NULL) {
@@ -799,17 +783,14 @@ rds_match(void *node, const void *key0) {
 }
 
 isc_result_t
-dns_message_findtype(const dns_name_t *name, dns_rdatatype_t type,
+dns_message_findtype(dns_name_t *name, dns_rdatatype_t type,
 		     dns_rdatatype_t covers, dns_rdataset_t **rdatasetp) {
-	dns_rdataset_t *rds = NULL;
-
 	REQUIRE(name != NULL);
 	REQUIRE(rdatasetp == NULL || *rdatasetp == NULL);
 
 	ISC_LIST_FOREACH_REV (name->list, rds, link) {
 		if (rds->type == type && rds->covers == covers) {
 			SET_IF_NOT_NULL(rdatasetp, rds);
-
 			return ISC_R_SUCCESS;
 		}
 	}
@@ -921,7 +902,6 @@ getrdata(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 
 static void
 cleanup_name_hashmaps(dns_namelist_t *section) {
-	dns_name_t *name = NULL;
 	ISC_LIST_FOREACH (*section, name, link) {
 		if (name->hashmap != NULL) {
 			isc_hashmap_destroy(&name->hashmap);
@@ -1881,9 +1861,9 @@ update_min_section_ttl(dns_message_t *restrict msg,
 isc_result_t
 dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 			  unsigned int options) {
-	dns_namelist_t *section;
-	dns_name_t *name, *next_name;
-	dns_rdataset_t *rdataset, *next_rdataset;
+	dns_namelist_t *section = NULL;
+	dns_name_t *name = NULL;
+	dns_rdataset_t *rdataset = NULL;
 	unsigned int count, total;
 	isc_result_t result;
 	isc_buffer_t st; /* for rollbacks */
@@ -1987,26 +1967,20 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 			return ISC_R_SUCCESS;
 		}
 
-		while (name != NULL) {
-			next_name = ISC_LIST_NEXT(name, link);
-
-			rdataset = ISC_LIST_HEAD(name->list);
-			while (rdataset != NULL) {
-				next_rdataset = ISC_LIST_NEXT(rdataset, link);
-
-				if ((rdataset->attributes &
+		ISC_LIST_FOREACH_SAFE (*section, n, link) {
+			ISC_LIST_FOREACH_SAFE (n->list, rds, link) {
+				if ((rds->attributes &
 				     DNS_RDATASETATTR_RENDERED) != 0)
 				{
-					goto next;
+					continue;
 				}
 
 				if (((options & DNS_MESSAGERENDER_ORDERED) ==
 				     0) &&
 				    (sectionid == DNS_SECTION_ADDITIONAL) &&
-				    wrong_priority(rdataset, pass,
-						   preferred_glue))
+				    wrong_priority(rds, pass, preferred_glue))
 				{
-					goto next;
+					continue;
 				}
 
 				st = *(msg->buffer);
@@ -2014,14 +1988,12 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 				count = 0;
 				if (partial) {
 					result = dns_rdataset_towirepartial(
-						rdataset, name, msg->cctx,
-						msg->buffer, rd_options, &count,
-						NULL);
+						rds, n, msg->cctx, msg->buffer,
+						rd_options, &count, NULL);
 				} else {
 					result = dns_rdataset_towire(
-						rdataset, name, msg->cctx,
-						msg->buffer, rd_options,
-						&count);
+						rds, n, msg->cctx, msg->buffer,
+						rd_options, &count);
 				}
 
 				total += count;
@@ -2059,27 +2031,20 @@ dns_message_rendersection(dns_message_t *msg, dns_section_t sectionid,
 				 * If we have rendered non-validated data,
 				 * ensure that the AD bit is not set.
 				 */
-				if (rdataset->trust != dns_trust_secure &&
+				if (rds->trust != dns_trust_secure &&
 				    (sectionid == DNS_SECTION_ANSWER ||
 				     sectionid == DNS_SECTION_AUTHORITY))
 				{
 					msg->flags &= ~DNS_MESSAGEFLAG_AD;
 				}
-				if (OPTOUT(rdataset)) {
+				if (OPTOUT(rds)) {
 					msg->flags &= ~DNS_MESSAGEFLAG_AD;
 				}
 
-				update_min_section_ttl(msg, sectionid,
-						       rdataset);
+				update_min_section_ttl(msg, sectionid, rds);
 
-				rdataset->attributes |=
-					DNS_RDATASETATTR_RENDERED;
-
-			next:
-				rdataset = next_rdataset;
+				rds->attributes |= DNS_RDATASETATTR_RENDERED;
 			}
-
-			name = next_name;
 		}
 	} while (--pass != 0);
 
@@ -2304,12 +2269,9 @@ dns_message_renderreset(dns_message_t *msg) {
 	msg->buffer = NULL;
 
 	for (size_t i = 0; i < DNS_SECTION_MAX; i++) {
-		dns_name_t *name = NULL;
-
 		msg->cursors[i] = NULL;
 		msg->counts[i] = 0;
-		ISC_LIST_FOREACH (msg->sections[i], name, link) {
-			dns_rdataset_t *rds = NULL;
+		MSG_SECTION_FOREACH (msg, i, name) {
 			ISC_LIST_FOREACH (name->list, rds, link) {
 				rds->attributes &= ~DNS_RDATASETATTR_RENDERED;
 			}
@@ -3304,18 +3266,13 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 	}
 
 	dns_name_init(&empty_name);
-	result = dns_message_firstname(msg, section);
-	if (result != ISC_R_SUCCESS) {
+	if (ISC_LIST_EMPTY(msg->sections[section])) {
 		goto cleanup;
 	}
-	if ((sflags & DNS_STYLEFLAG_YAML) != 0) {
-		msg->indent.count++;
-	}
-	do {
-		dns_name_t *name = NULL;
-		dns_message_currentname(msg, section, &name);
+	bool has_yaml = (sflags & DNS_STYLEFLAG_YAML) != 0;
+	msg->indent.count += has_yaml;
 
-		dns_rdataset_t *rds = NULL;
+	MSG_SECTION_FOREACH (msg, section, name) {
 		ISC_LIST_FOREACH (name->list, rds, link) {
 			if (section == DNS_SECTION_ANSWER &&
 			    rds->type == dns_rdatatype_soa)
@@ -3346,11 +3303,9 @@ dns_message_sectiontotext(dns_message_t *msg, dns_section_t section,
 				goto cleanup;
 			}
 		}
-		result = dns_message_nextname(msg, section);
-	} while (result == ISC_R_SUCCESS);
-	if ((sflags & DNS_STYLEFLAG_YAML) != 0) {
-		msg->indent.count--;
 	}
+	msg->indent.count -= has_yaml;
+
 	if ((flags & DNS_MESSAGETEXTFLAG_NOHEADERS) == 0 &&
 	    (flags & DNS_MESSAGETEXTFLAG_NOCOMMENTS) == 0 &&
 	    (sflags & DNS_STYLEFLAG_YAML) == 0)
@@ -4872,14 +4827,7 @@ message_authority_soa_min(dns_message_t *msg, dns_ttl_t *ttlp) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (result = dns_message_firstname(msg, DNS_SECTION_AUTHORITY);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, DNS_SECTION_AUTHORITY))
-	{
-		dns_name_t *name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_AUTHORITY, &name);
-
-		dns_rdataset_t *rds = NULL;
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_AUTHORITY, name) {
 		ISC_LIST_FOREACH (name->list, rds, link) {
 			if ((rds->attributes & DNS_RDATASETATTR_RENDERED) == 0)
 			{

lib/dns/ncache.c

@@ -126,12 +126,9 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	  dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl,
 	  dns_ttl_t maxttl, bool optout, bool secure,
 	  dns_rdataset_t *addedrdataset) {
-	isc_result_t result;
 	isc_buffer_t buffer;
 	isc_region_t r;
-	dns_rdataset_t *rdataset;
 	dns_rdatatype_t type;
-	dns_name_t *name;
 	dns_ttl_t ttl;
 	dns_trust_t trust;
 	dns_rdata_t rdata[DNS_NCACHE_RDATA];
@@ -166,19 +163,12 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 	ttl = maxttl;
 	trust = 0xffff;
 	isc_buffer_init(&buffer, data, sizeof(data));
-	if (message->counts[DNS_SECTION_AUTHORITY]) {
-		result = dns_message_firstname(message, DNS_SECTION_AUTHORITY);
-	} else {
-		result = ISC_R_NOMORE;
-	}
-	while (result == ISC_R_SUCCESS) {
-		name = NULL;
-		dns_message_currentname(message, DNS_SECTION_AUTHORITY, &name);
+
+	MSG_SECTION_FOREACH (message, DNS_SECTION_AUTHORITY, name) {
+		isc_result_t result = ISC_R_SUCCESS;
+
 		if (name->attributes.ncache) {
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-			{
+			ISC_LIST_FOREACH (name->list, rdataset, link) {
 				if ((rdataset->attributes &
 				     DNS_RDATASETATTR_NCACHE) == 0)
 				{
@@ -249,10 +239,6 @@ addoptout(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node,
 				}
 			}
 		}
-		result = dns_message_nextname(message, DNS_SECTION_AUTHORITY);
-	}
-	if (result != ISC_R_NOMORE) {
-		return result;
 	}
 
 	if (trust == 0xffff) {

lib/dns/nsec.c

@@ -285,11 +285,7 @@ dns_nsec_nseconly(dns_db_t *db, dns_dbversion_t *version, dns_diff_t *diff,
 		{
 			bool deleted = false;
 			if (diff != NULL) {
-				for (dns_difftuple_t *tuple =
-					     ISC_LIST_HEAD(diff->tuples);
-				     tuple != NULL;
-				     tuple = ISC_LIST_NEXT(tuple, link))
-				{
+				ISC_LIST_FOREACH (diff->tuples, tuple, link) {
 					if (tuple->rdata.type !=
 						    dns_rdatatype_dnskey ||
 					    tuple->op != DNS_DIFFOP_DEL)

lib/dns/order.c

@@ -100,12 +100,9 @@ match(const dns_name_t *name1, const dns_name_t *name2) {
 unsigned int
 dns_order_find(dns_order_t *order, const dns_name_t *name,
 	       dns_rdatatype_t rdtype, dns_rdataclass_t rdclass) {
-	dns_order_ent_t *ent;
 	REQUIRE(DNS_ORDER_VALID(order));
 
-	for (ent = ISC_LIST_HEAD(order->ents); ent != NULL;
-	     ent = ISC_LIST_NEXT(ent, link))
-	{
+	ISC_LIST_FOREACH (order->ents, ent, link) {
 		if (ent->rdtype != rdtype && ent->rdtype != dns_rdatatype_any) {
 			continue;
 		}
@@ -132,15 +129,13 @@ dns_order_attach(dns_order_t *source, dns_order_t **target) {
 void
 dns_order_detach(dns_order_t **orderp) {
 	REQUIRE(orderp != NULL && DNS_ORDER_VALID(*orderp));
-	dns_order_t *order;
-	order = *orderp;
+	dns_order_t *order = *orderp;
 	*orderp = NULL;
 
 	if (isc_refcount_decrement(&order->references) == 1) {
 		isc_refcount_destroy(&order->references);
 		order->magic = 0;
-		dns_order_ent_t *ent;
-		while ((ent = ISC_LIST_HEAD(order->ents)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (order->ents, ent, link) {
 			ISC_LIST_UNLINK(order->ents, ent, link);
 			isc_mem_put(order->mctx, ent, sizeof(*ent));
 		}

lib/dns/peer.c

@@ -155,8 +155,7 @@ dns_peerlist_detach(dns_peerlist_t **list) {
 
 static void
 peerlist_delete(dns_peerlist_t **list) {
-	dns_peerlist_t *l;
-	dns_peer_t *server, *stmp;
+	dns_peerlist_t *l = NULL;
 
 	REQUIRE(list != NULL);
 	REQUIRE(DNS_PEERLIST_VALID(*list));
@@ -166,12 +165,9 @@ peerlist_delete(dns_peerlist_t **list) {
 
 	isc_refcount_destroy(&l->refs);
 
-	server = ISC_LIST_HEAD(l->elements);
-	while (server != NULL) {
-		stmp = ISC_LIST_NEXT(server, next);
+	ISC_LIST_FOREACH_SAFE (l->elements, server, next) {
 		ISC_LIST_UNLINK(l->elements, server, next);
 		dns_peer_detach(&server);
-		server = stmp;
 	}
 
 	l->magic = 0;
@@ -180,56 +176,36 @@ peerlist_delete(dns_peerlist_t **list) {
 
 void
 dns_peerlist_addpeer(dns_peerlist_t *peers, dns_peer_t *peer) {
-	dns_peer_t *p = NULL;
-
-	dns_peer_attach(peer, &p);
-
 	/*
 	 * More specifics to front of list.
 	 */
-	for (p = ISC_LIST_HEAD(peers->elements); p != NULL;
-	     p = ISC_LIST_NEXT(p, next))
-	{
+	dns_peer_attach(peer, &(dns_peer_t *){ NULL });
+	ISC_LIST_FOREACH (peers->elements, p, next) {
 		if (p->prefixlen < peer->prefixlen) {
-			break;
+			ISC_LIST_INSERTBEFORE(peers->elements, p, peer, next);
+			return;
 		}
 	}
 
-	if (p != NULL) {
-		ISC_LIST_INSERTBEFORE(peers->elements, p, peer, next);
-	} else {
-		ISC_LIST_APPEND(peers->elements, peer, next);
-	}
+	ISC_LIST_APPEND(peers->elements, peer, next);
 }
 
 isc_result_t
 dns_peerlist_peerbyaddr(dns_peerlist_t *servers, const isc_netaddr_t *addr,
 			dns_peer_t **retval) {
-	dns_peer_t *server;
-	isc_result_t res;
-
 	REQUIRE(retval != NULL);
 	REQUIRE(DNS_PEERLIST_VALID(servers));
 
-	server = ISC_LIST_HEAD(servers->elements);
-	while (server != NULL) {
+	ISC_LIST_FOREACH (servers->elements, server, next) {
 		if (isc_netaddr_eqprefix(addr, &server->address,
 					 server->prefixlen))
 		{
-			break;
+			*retval = server;
+			return ISC_R_SUCCESS;
 		}
-
-		server = ISC_LIST_NEXT(server, next);
 	}
 
-	if (server != NULL) {
-		*retval = server;
-		res = ISC_R_SUCCESS;
-	} else {
-		res = ISC_R_NOTFOUND;
-	}
-
-	return res;
+	return ISC_R_NOTFOUND;
 }
 
 isc_result_t

lib/dns/qp.c

@@ -790,9 +790,7 @@ marksweep_chunks(dns_qpmulti_t *multi) {
 
 	dns_qp_t *qpw = &multi->writer;
 
-	for (dns_qpsnap_t *qps = ISC_LIST_HEAD(multi->snapshots); qps != NULL;
-	     qps = ISC_LIST_NEXT(qps, link))
-	{
+	ISC_LIST_FOREACH (multi->snapshots, qps, link) {
 		for (dns_qpchunk_t chunk = 0; chunk < qps->chunk_max; chunk++) {
 			if (qps->base->ptr[chunk] != NULL) {
 				INSIST(qps->base->ptr[chunk] ==

lib/dns/qpzone.c

@@ -1111,8 +1111,6 @@ unlock:
 
 static void
 cleanup_nondirty(qpz_version_t *version, qpz_changedlist_t *cleanup_list) {
-	qpz_changed_t *changed = NULL, *next_changed = NULL;
-
 	/*
 	 * If the changed record is dirty, then an update created multiple
 	 * versions of a given rdataset.  We keep this list until we're the
@@ -1124,10 +1122,7 @@ cleanup_nondirty(qpz_version_t *version, qpz_changedlist_t *cleanup_list) {
 	 *
 	 * The caller must be holding the database lock.
 	 */
-	for (changed = ISC_LIST_HEAD(version->changed_list); changed != NULL;
-	     changed = next_changed)
-	{
-		next_changed = ISC_LIST_NEXT(changed, link);
+	ISC_LIST_FOREACH_SAFE (version->changed_list, changed, link) {
 		if (!changed->dirty) {
 			ISC_LIST_UNLINK(version->changed_list, changed, link);
 			ISC_LIST_APPEND(*cleanup_list, changed, link);
@@ -1322,10 +1317,8 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 	qpz_version_t *least_greater = NULL;
 	qpznode_t *node = NULL;
 	bool rollback = false;
-	qpz_changed_t *changed = NULL, *next_changed = NULL;
 	qpz_changedlist_t cleanup_list;
 	dns_slabheaderlist_t resigned_list;
-	dns_slabheader_t *header = NULL;
 	uint32_t serial, least_serial;
 
 	REQUIRE(VALID_QPZONE(qpdb));
@@ -1499,9 +1492,7 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 	/*
 	 * Commit/rollback re-signed headers.
 	 */
-	for (header = ISC_LIST_HEAD(resigned_list); header != NULL;
-	     header = ISC_LIST_HEAD(resigned_list))
-	{
+	ISC_LIST_FOREACH_SAFE (resigned_list, header, link) {
 		isc_rwlock_t *nlock = NULL;
 		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
@@ -1522,13 +1513,10 @@ closeversion(dns_db_t *db, dns_dbversion_t **versionp,
 		return;
 	}
 
-	for (changed = ISC_LIST_HEAD(cleanup_list); changed != NULL;
-	     changed = next_changed)
-	{
+	ISC_LIST_FOREACH_SAFE (cleanup_list, changed, link) {
 		isc_rwlock_t *nlock = NULL;
 		isc_rwlocktype_t nlocktype = isc_rwlocktype_none;
 
-		next_changed = ISC_LIST_NEXT(changed, link);
 		node = changed->node;
 		nlock = &qpdb->buckets[node->locknum].lock;
 

lib/dns/rdatalist.c

@@ -155,8 +155,7 @@ dns_rdatalist_clone(dns_rdataset_t *source,
 
 unsigned int
 dns_rdatalist_count(dns_rdataset_t *rdataset) {
-	dns_rdatalist_t *rdatalist;
-	dns_rdata_t *rdata;
+	dns_rdatalist_t *rdatalist = NULL;
 	unsigned int count;
 
 	REQUIRE(rdataset != NULL);
@@ -164,9 +163,7 @@ dns_rdatalist_count(dns_rdataset_t *rdataset) {
 	rdatalist = rdataset->rdlist.list;
 
 	count = 0;
-	for (rdata = ISC_LIST_HEAD(rdatalist->rdata); rdata != NULL;
-	     rdata = ISC_LIST_NEXT(rdata, link))
-	{
+	ISC_LIST_FOREACH (rdatalist->rdata, rdata, link) {
 		count++;
 	}
 
@@ -174,17 +171,14 @@ dns_rdatalist_count(dns_rdataset_t *rdataset) {
 }
 
 isc_result_t
-dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rdataset_t *neg = NULL;
 	dns_rdataset_t *negsig = NULL;
-	dns_rdataset_t *rdset;
 	dns_ttl_t ttl;
 
 	REQUIRE(rdataset != NULL);
 
-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
-	     rdset = ISC_LIST_NEXT(rdset, link))
-	{
+	ISC_LIST_FOREACH (name->list, rdset, link) {
 		if (rdset->rdclass != rdataset->rdclass) {
 			continue;
 		}
@@ -198,9 +192,7 @@ dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
-	     rdset = ISC_LIST_NEXT(rdset, link))
-	{
+	ISC_LIST_FOREACH (name->list, rdset, link) {
 		if (rdset->type == dns_rdatatype_rrsig &&
 		    rdset->covers == neg->type)
 		{
@@ -211,6 +203,7 @@ dns_rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) {
 	if (negsig == NULL) {
 		return ISC_R_NOTFOUND;
 	}
+
 	/*
 	 * Minimise ttl.
 	 */
@@ -234,7 +227,7 @@ dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 	dns_rdataclass_t rdclass;
 	dns_rdataset_t *tneg = NULL;
 	dns_rdataset_t *tnegsig = NULL;
-	const dns_name_t *noqname;
+	dns_name_t *noqname = NULL;
 
 	REQUIRE(rdataset != NULL);
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_NOQNAME) != 0);
@@ -244,29 +237,25 @@ dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 
 	(void)dns_name_dynamic(noqname); /* Sanity Check. */
 
-	for (rdataset = ISC_LIST_HEAD(noqname->list); rdataset != NULL;
-	     rdataset = ISC_LIST_NEXT(rdataset, link))
-	{
-		if (rdataset->rdclass != rdclass) {
+	ISC_LIST_FOREACH (noqname->list, rdset, link) {
+		if (rdset->rdclass != rdclass) {
 			continue;
 		}
-		if (rdataset->type == dns_rdatatype_nsec ||
-		    rdataset->type == dns_rdatatype_nsec3)
+		if (rdset->type == dns_rdatatype_nsec ||
+		    rdset->type == dns_rdatatype_nsec3)
 		{
-			tneg = rdataset;
+			tneg = rdset;
 		}
 	}
 	if (tneg == NULL) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (rdataset = ISC_LIST_HEAD(noqname->list); rdataset != NULL;
-	     rdataset = ISC_LIST_NEXT(rdataset, link))
-	{
-		if (rdataset->type == dns_rdatatype_rrsig &&
-		    rdataset->covers == tneg->type)
+	ISC_LIST_FOREACH (noqname->list, rdset, link) {
+		if (rdset->type == dns_rdatatype_rrsig &&
+		    rdset->covers == tneg->type)
 		{
-			tnegsig = rdataset;
+			tnegsig = rdset;
 		}
 	}
 	if (tnegsig == NULL) {
@@ -280,17 +269,14 @@ dns_rdatalist_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 }
 
 isc_result_t
-dns_rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdatalist_addclosest(dns_rdataset_t *rdataset, dns_name_t *name) {
 	dns_rdataset_t *neg = NULL;
 	dns_rdataset_t *negsig = NULL;
-	dns_rdataset_t *rdset;
 	dns_ttl_t ttl;
 
 	REQUIRE(rdataset != NULL);
 
-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
-	     rdset = ISC_LIST_NEXT(rdset, link))
-	{
+	ISC_LIST_FOREACH (name->list, rdset, link) {
 		if (rdset->rdclass != rdataset->rdclass) {
 			continue;
 		}
@@ -304,9 +290,7 @@ dns_rdatalist_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL;
-	     rdset = ISC_LIST_NEXT(rdset, link))
-	{
+	ISC_LIST_FOREACH (name->list, rdset, link) {
 		if (rdset->type == dns_rdatatype_rrsig &&
 		    rdset->covers == neg->type)
 		{
@@ -340,7 +324,7 @@ dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 	dns_rdataclass_t rdclass;
 	dns_rdataset_t *tneg = NULL;
 	dns_rdataset_t *tnegsig = NULL;
-	const dns_name_t *closest;
+	dns_name_t *closest = NULL;
 
 	REQUIRE(rdataset != NULL);
 	REQUIRE((rdataset->attributes & DNS_RDATASETATTR_CLOSEST) != 0);
@@ -350,29 +334,25 @@ dns_rdatalist_getclosest(dns_rdataset_t *rdataset, dns_name_t *name,
 
 	(void)dns_name_dynamic(closest); /* Sanity Check. */
 
-	for (rdataset = ISC_LIST_HEAD(closest->list); rdataset != NULL;
-	     rdataset = ISC_LIST_NEXT(rdataset, link))
-	{
-		if (rdataset->rdclass != rdclass) {
+	ISC_LIST_FOREACH (closest->list, rdset, link) {
+		if (rdset->rdclass != rdclass) {
 			continue;
 		}
-		if (rdataset->type == dns_rdatatype_nsec ||
-		    rdataset->type == dns_rdatatype_nsec3)
+		if (rdset->type == dns_rdatatype_nsec ||
+		    rdset->type == dns_rdatatype_nsec3)
 		{
-			tneg = rdataset;
+			tneg = rdset;
 		}
 	}
 	if (tneg == NULL) {
 		return ISC_R_NOTFOUND;
 	}
 
-	for (rdataset = ISC_LIST_HEAD(closest->list); rdataset != NULL;
-	     rdataset = ISC_LIST_NEXT(rdataset, link))
-	{
-		if (rdataset->type == dns_rdatatype_rrsig &&
-		    rdataset->covers == tneg->type)
+	ISC_LIST_FOREACH (closest->list, rdset, link) {
+		if (rdset->type == dns_rdatatype_rrsig &&
+		    rdset->covers == tneg->type)
 		{
-			tnegsig = rdataset;
+			tnegsig = rdset;
 		}
 	}
 	if (tnegsig == NULL) {

lib/dns/rdataset.c

@@ -540,7 +540,7 @@ dns__rdataset_getnoqname(dns_rdataset_t *rdataset, dns_name_t *name,
 }
 
 isc_result_t
-dns_rdataset_addclosest(dns_rdataset_t *rdataset, const dns_name_t *name) {
+dns_rdataset_addclosest(dns_rdataset_t *rdataset, dns_name_t *name) {
 	REQUIRE(DNS_RDATASET_VALID(rdataset));
 	REQUIRE(rdataset->methods != NULL);
 	if (rdataset->methods->addclosest == NULL) {

lib/dns/request.c

@@ -172,10 +172,9 @@ dns_requestmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 static void
 requests_shutdown(void *arg) {
 	dns_requestmgr_t *requestmgr = arg;
-	dns_request_t *request = NULL, *next = NULL;
 	uint32_t tid = isc_tid();
 
-	ISC_LIST_FOREACH_SAFE (requestmgr->requests[tid], request, link, next) {
+	ISC_LIST_FOREACH_SAFE (requestmgr->requests[tid], request, link) {
 		req_log(ISC_LOG_DEBUG(3), "%s(%" PRIu32 ": request %p",
 			__func__, tid, request);
 		if (DNS_REQUEST_COMPLETE(request)) {

lib/dns/resconf.c

@@ -348,9 +348,7 @@ resconf_parsedomain(irs_resconf_t *conf, FILE *fp) {
 
 static void
 free_search(irs_resconf_t *conf) {
-	irs_resconf_search_t *searchentry;
-
-	while ((searchentry = ISC_LIST_HEAD(conf->searchlist)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (conf->searchlist, searchentry, link) {
 		ISC_LIST_UNLINK(conf->searchlist, searchentry, link);
 		isc_mem_free(conf->mctx, searchentry->domain);
 		isc_mem_put(conf->mctx, searchentry, sizeof(*searchentry));
@@ -636,8 +634,7 @@ error:
 
 void
 irs_resconf_destroy(irs_resconf_t **confp) {
-	irs_resconf_t *conf;
-	isc_sockaddr_t *address;
+	irs_resconf_t *conf = NULL;
 
 	REQUIRE(confp != NULL);
 	conf = *confp;
@@ -646,7 +643,7 @@ irs_resconf_destroy(irs_resconf_t **confp) {
 
 	free_search(conf);
 
-	while ((address = ISC_LIST_HEAD(conf->nameservers)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (conf->nameservers, address, link) {
 		ISC_LIST_UNLINK(conf->nameservers, address, link);
 		isc_mem_put(conf->mctx, address, sizeof(*address));
 	}

lib/dns/rrl.c

@@ -263,14 +263,12 @@ static void
 free_old_hash(dns_rrl_t *rrl) {
 	dns_rrl_hash_t *old_hash;
 	dns_rrl_bin_t *old_bin;
-	dns_rrl_entry_t *e, *e_next;
 
 	old_hash = rrl->old_hash;
 	for (old_bin = &old_hash->bins[0];
 	     old_bin < &old_hash->bins[old_hash->length]; ++old_bin)
 	{
-		for (e = ISC_LIST_HEAD(*old_bin); e != NULL; e = e_next) {
-			e_next = ISC_LIST_NEXT(e, hlink);
+		ISC_LIST_FOREACH_SAFE (*old_bin, e, hlink) {
 			ISC_LINK_INIT(e, hlink);
 		}
 	}
@@ -511,9 +509,8 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 	  bool create, char *log_buf, unsigned int log_buf_len) {
 	dns_rrl_key_t key;
 	uint32_t hval;
-	dns_rrl_entry_t *e;
-	dns_rrl_hash_t *hash;
-	dns_rrl_bin_t *new_bin, *old_bin;
+	dns_rrl_hash_t *hash = NULL;
+	dns_rrl_bin_t *new_bin = NULL, *old_bin = NULL;
 	int probes, age;
 
 	make_key(rrl, &key, client_addr, zone, qtype, qname, qclass, rtype);
@@ -524,14 +521,12 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 	 */
 	new_bin = get_bin(rrl->hash, hval);
 	probes = 1;
-	e = ISC_LIST_HEAD(*new_bin);
-	while (e != NULL) {
+	ISC_LIST_FOREACH (*new_bin, e, hlink) {
 		if (key_cmp(&e->key, &key)) {
 			ref_entry(rrl, e, probes, now);
 			return e;
 		}
 		++probes;
-		e = ISC_LIST_NEXT(e, hlink);
 	}
 
 	/*
@@ -539,8 +534,7 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 	 */
 	if (rrl->old_hash != NULL) {
 		old_bin = get_bin(rrl->old_hash, hval);
-		e = ISC_LIST_HEAD(*old_bin);
-		while (e != NULL) {
+		ISC_LIST_FOREACH (*old_bin, e, hlink) {
 			if (key_cmp(&e->key, &key)) {
 				ISC_LIST_UNLINK(*old_bin, e, hlink);
 				ISC_LIST_PREPEND(*new_bin, e, hlink);
@@ -548,7 +542,6 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 				ref_entry(rrl, e, probes, now);
 				return e;
 			}
-			e = ISC_LIST_NEXT(e, hlink);
 		}
 
 		/*
@@ -570,42 +563,44 @@ get_entry(dns_rrl_t *rrl, const isc_sockaddr_t *client_addr, dns_zone_t *zone,
 	 * Try to make more entries if none are idle.
 	 * Steal the oldest entry if we cannot create more.
 	 */
-	for (e = ISC_LIST_TAIL(rrl->lru); e != NULL; e = ISC_LIST_PREV(e, lru))
-	{
+	dns_rrl_entry_t *entry = NULL;
+	ISC_LIST_FOREACH_REV (rrl->lru, e, lru) {
+		entry = e;
 		if (!ISC_LINK_LINKED(e, hlink)) {
 			break;
 		}
 		age = get_age(rrl, e, now);
 		if (age <= 1) {
-			e = NULL;
+			entry = NULL;
 			break;
 		}
 		if (!e->logged && response_balance(rrl, e, age) > 0) {
 			break;
 		}
 	}
-	if (e == NULL) {
+
+	if (entry == NULL) {
 		expand_entries(rrl, ISC_MIN((rrl->num_entries + 1) / 2, 1000));
-		e = ISC_LIST_TAIL(rrl->lru);
+		entry = ISC_LIST_TAIL(rrl->lru);
 	}
-	if (e->logged) {
-		log_end(rrl, e, true, log_buf, log_buf_len);
+	if (entry->logged) {
+		log_end(rrl, entry, true, log_buf, log_buf_len);
 	}
-	if (ISC_LINK_LINKED(e, hlink)) {
-		if (e->hash_gen == rrl->hash_gen) {
+	if (ISC_LINK_LINKED(entry, hlink)) {
+		if (entry->hash_gen == rrl->hash_gen) {
 			hash = rrl->hash;
 		} else {
 			hash = rrl->old_hash;
 		}
-		old_bin = get_bin(hash, hash_key(&e->key));
-		ISC_LIST_UNLINK(*old_bin, e, hlink);
+		old_bin = get_bin(hash, hash_key(&entry->key));
+		ISC_LIST_UNLINK(*old_bin, entry, hlink);
 	}
-	ISC_LIST_PREPEND(*new_bin, e, hlink);
-	e->hash_gen = rrl->hash_gen;
-	e->key = key;
-	e->ts_valid = false;
-	ref_entry(rrl, e, probes, now);
-	return e;
+	ISC_LIST_PREPEND(*new_bin, entry, hlink);
+	entry->hash_gen = rrl->hash_gen;
+	entry->key = key;
+	entry->ts_valid = false;
+	ref_entry(rrl, entry, probes, now);
+	return entry;
 }
 
 static void
@@ -1254,9 +1249,8 @@ dns_rrl(dns_view_t *view, dns_zone_t *zone, const isc_sockaddr_t *client_addr,
 
 void
 dns_rrl_view_destroy(dns_view_t *view) {
-	dns_rrl_t *rrl;
-	dns_rrl_block_t *b;
-	dns_rrl_hash_t *h;
+	dns_rrl_t *rrl = NULL;
+	dns_rrl_hash_t *h = NULL;
 	char log_buf[DNS_RRL_LOG_BUF_LEN];
 	int i;
 
@@ -1287,8 +1281,7 @@ dns_rrl_view_destroy(dns_view_t *view) {
 
 	isc_mutex_destroy(&rrl->lock);
 
-	while (!ISC_LIST_EMPTY(rrl->blocks)) {
-		b = ISC_LIST_HEAD(rrl->blocks);
+	ISC_LIST_FOREACH_SAFE (rrl->blocks, b, link) {
 		ISC_LIST_UNLINK(rrl->blocks, b, link);
 		isc_mem_put(rrl->mctx, b, b->size);
 	}

lib/dns/skr.c

@@ -166,12 +166,10 @@ dns_skrbundle_getsig(dns_skrbundle_t *bundle, dst_key_t *key,
 	REQUIRE(DNS_SKRBUNDLE_VALID(bundle));
 	REQUIRE(DNS_DIFF_VALID(&bundle->diff));
 
-	dns_difftuple_t *tuple = ISC_LIST_HEAD(bundle->diff.tuples);
-	while (tuple != NULL) {
+	ISC_LIST_FOREACH_SAFE (bundle->diff.tuples, tuple, link) {
 		dns_rdata_rrsig_t rrsig;
 
 		if (tuple->op != DNS_DIFFOP_ADDRESIGN) {
-			tuple = ISC_LIST_NEXT(tuple, link);
 			continue;
 		}
 		INSIST(tuple->rdata.type == dns_rdatatype_rrsig);
@@ -191,8 +189,6 @@ dns_skrbundle_getsig(dns_skrbundle_t *bundle, dst_key_t *key,
 			dns_rdata_clone(&tuple->rdata, sigrdata);
 			return ISC_R_SUCCESS;
 		}
-
-		tuple = ISC_LIST_NEXT(tuple, link);
 	}
 
 	return ISC_R_NOTFOUND;
@@ -393,20 +389,14 @@ failure:
 
 dns_skrbundle_t *
 dns_skr_lookup(dns_skr_t *skr, isc_stdtime_t time, uint32_t sigval) {
-	dns_skrbundle_t *b, *next;
-
 	REQUIRE(DNS_SKR_VALID(skr));
 
-	for (b = ISC_LIST_HEAD(skr->bundles); b != NULL; b = next) {
-		next = ISC_LIST_NEXT(b, link);
-		if (next == NULL) {
-			isc_stdtime_t expired = b->inception + sigval;
-			if (b->inception <= time && time < expired) {
-				return b;
-			}
-			return NULL;
-		}
-		if (b->inception <= time && time < next->inception) {
+	ISC_LIST_FOREACH (skr->bundles, b, link) {
+		dns_skrbundle_t *next = ISC_LIST_NEXT(b, link);
+		isc_stdtime_t expired = (next != NULL)
+						? next->inception
+						: (b->inception + sigval);
+		if (b->inception <= time && time < expired) {
 			return b;
 		}
 	}
@@ -437,12 +427,9 @@ dns_skr_detach(dns_skr_t **skrp) {
 
 void
 dns_skr_destroy(dns_skr_t *skr) {
-	dns_skrbundle_t *b, *next;
-
 	REQUIRE(DNS_SKR_VALID(skr));
 
-	for (b = ISC_LIST_HEAD(skr->bundles); b != NULL; b = next) {
-		next = ISC_LIST_NEXT(b, link);
+	ISC_LIST_FOREACH_SAFE (skr->bundles, b, link) {
 		ISC_LIST_UNLINK(skr->bundles, b, link);
 		dns_diff_clear(&b->diff);
 		isc_mem_put(skr->mctx, b, sizeof(*b));

lib/dns/ssu.c

@@ -82,8 +82,7 @@ destroy(dns_ssutable_t *table) {
 	REQUIRE(VALID_SSUTABLE(table));
 
 	mctx = table->mctx;
-	while (!ISC_LIST_EMPTY(table->rules)) {
-		dns_ssurule_t *rule = ISC_LIST_HEAD(table->rules);
+	ISC_LIST_FOREACH_SAFE (table->rules, rule, link) {
 		if (rule->identity != NULL) {
 			dns_name_free(rule->identity, mctx);
 			isc_mem_put(mctx, rule->identity,
@@ -332,7 +331,6 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 	dns_name_t *stfself;
 	dns_name_t *tcpself;
 	dns_name_t *wildcard;
-	dns_ssurule_t *rule;
 	const dns_name_t *tname;
 	int match;
 	isc_result_t result;
@@ -375,9 +373,7 @@ dns_ssutable_checkrules(dns_ssutable_t *table, const dns_name_t *signer,
 		return false;
 	}
 
-	for (rule = ISC_LIST_HEAD(table->rules); rule != NULL;
-	     rule = ISC_LIST_NEXT(rule, link))
-	{
+	ISC_LIST_FOREACH (table->rules, rule, link) {
 		if (logit) {
 			isc_log_write(DNS_LOGCATEGORY_UPDATE_POLICY,
 				      DNS_LOGMODULE_SSU, ISC_LOG_DEBUG(99),

lib/dns/tkey.c

@@ -154,12 +154,9 @@ add_rdata_to_list(dns_message_t *msg, dns_name_t *name, dns_rdata_t *rdata,
 
 static void
 free_namelist(dns_message_t *msg, dns_namelist_t *namelist) {
-	dns_name_t *name = NULL;
-
-	while ((name = ISC_LIST_HEAD(*namelist)) != NULL) {
-		dns_rdataset_t *set = NULL;
+	ISC_LIST_FOREACH_SAFE (*namelist, name, link) {
 		ISC_LIST_UNLINK(*namelist, name, link);
-		while ((set = ISC_LIST_HEAD(name->list)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (name->list, set, link) {
 			ISC_LIST_UNLINK(name->list, set, link);
 			if (dns_rdataset_isassociated(set)) {
 				dns_rdataset_disassociate(set);
@@ -353,7 +350,7 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 		      dns_tsigkeyring_t *ring) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdata_tkey_t tkeyin, tkeyout;
-	dns_name_t *qname = NULL, *name = NULL;
+	dns_name_t *qname = NULL;
 	dns_name_t *keyname = NULL, *signer = NULL;
 	dns_name_t tsigner = DNS_NAME_INITEMPTY;
 	dns_fixedname_t fkeyname;
@@ -371,18 +368,16 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 	/*
 	 * Interpret the question section.
 	 */
-	result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
-	if (result != ISC_R_SUCCESS) {
+	if (ISC_LIST_EMPTY(msg->sections[DNS_SECTION_QUESTION])) {
 		return DNS_R_FORMERR;
 	}
 
-	dns_message_currentname(msg, DNS_SECTION_QUESTION, &qname);
+	qname = ISC_LIST_HEAD(msg->sections[DNS_SECTION_QUESTION]);
 
-	/*
-	 * Look for a TKEY record that matches the question.
+	/* * Look for a TKEY record that matches the question.
 	 */
 	result = dns_message_findname(msg, DNS_SECTION_ADDITIONAL, qname,
-				      dns_rdatatype_tkey, 0, &name, &tkeyset);
+				      dns_rdatatype_tkey, 0, NULL, &tkeyset);
 	if (result != ISC_R_SUCCESS) {
 		result = DNS_R_FORMERR;
 		tkey_log("dns_tkey_processquery: couldn't find a TKEY "
@@ -508,7 +503,8 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 
 	RETERR(dns_message_reply(msg, true));
 	add_rdata_to_list(msg, keyname, &rdata, 0, &namelist);
-	while ((name = ISC_LIST_HEAD(namelist)) != NULL) {
+
+	ISC_LIST_FOREACH_SAFE (namelist, name, link) {
 		ISC_LIST_UNLINK(namelist, name, link);
 		dns_message_addname(msg, name, DNS_SECTION_ANSWER);
 	}
@@ -617,30 +613,23 @@ find_tkey(dns_message_t *msg, dns_name_t **name, dns_rdata_t *rdata,
 	  int section) {
 	isc_result_t result;
 
-	result = dns_message_firstname(msg, section);
-	while (result == ISC_R_SUCCESS) {
+	MSG_SECTION_FOREACH (msg, section, cur) {
 		dns_rdataset_t *tkeyset = NULL;
-		dns_name_t *cur = NULL;
-
-		dns_message_currentname(msg, section, &cur);
 		result = dns_message_findtype(cur, dns_rdatatype_tkey, 0,
 					      &tkeyset);
 		if (result == ISC_R_SUCCESS) {
 			result = dns_rdataset_first(tkeyset);
 			if (result != ISC_R_SUCCESS) {
-				break;
+				return result;
 			}
 
 			dns_rdataset_current(tkeyset, rdata);
 			*name = cur;
 			return ISC_R_SUCCESS;
 		}
-		result = dns_message_nextname(msg, section);
 	}
-	if (result == ISC_R_NOMORE) {
-		return ISC_R_NOTFOUND;
-	}
-	return result;
+
+	return ISC_R_NOTFOUND;
 }
 
 isc_result_t

lib/dns/update.c

@@ -810,21 +810,18 @@ name_order(const void *av, const void *bv) {
 static isc_result_t
 uniqify_name_list(dns_diff_t *list) {
 	isc_result_t result;
-	dns_difftuple_t *p, *q;
 
 	CHECK(dns_diff_sort(list, name_order));
 
-	p = ISC_LIST_HEAD(list->tuples);
-	while (p != NULL) {
+	ISC_LIST_FOREACH (list->tuples, p, link) {
 		do {
-			q = ISC_LIST_NEXT(p, link);
+			dns_difftuple_t *q = ISC_LIST_NEXT(p, link);
 			if (q == NULL || !dns_name_equal(&p->name, &q->name)) {
 				break;
 			}
 			ISC_LIST_UNLINK(list->tuples, q, link);
 			dns_difftuple_free(&q);
 		} while (1);
-		p = ISC_LIST_NEXT(p, link);
 	}
 failure:
 	return result;
@@ -1044,7 +1041,6 @@ static isc_result_t
 find_zone_keys(dns_zone_t *zone, isc_mem_t *mctx, unsigned int maxkeys,
 	       dst_key_t **keys, unsigned int *nkeys) {
 	dns_dnsseckeylist_t keylist;
-	dns_dnsseckey_t *k = NULL;
 	unsigned int count = 0;
 	isc_result_t result;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -1070,10 +1066,12 @@ find_zone_keys(dns_zone_t *zone, isc_mem_t *mctx, unsigned int maxkeys,
 	}
 
 	/* Add new 'dnskeys' to 'keys' */
-	while ((k = ISC_LIST_HEAD(keylist)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (keylist, k, link) {
 		if (count >= maxkeys) {
+			ISC_LIST_UNLINK(keylist, k, link);
+			dns_dnsseckey_destroy(mctx, &k);
 			result = ISC_R_NOSPACE;
-			goto next;
+			break;
 		}
 
 		/* Detect inactive keys */
@@ -1085,7 +1083,6 @@ find_zone_keys(dns_zone_t *zone, isc_mem_t *mctx, unsigned int maxkeys,
 		k->key = NULL;
 		count++;
 
-	next:
 		ISC_LIST_UNLINK(keylist, k, link);
 		dns_dnsseckey_destroy(mctx, &k);
 	}
@@ -1521,9 +1518,8 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 			 dns_diff_t *diff, uint32_t sigvalidityinterval,
 			 dns_update_state_t **statep) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_update_state_t mystate, *state;
-
-	dns_difftuple_t *t, *next;
+	dns_update_state_t mystate, *state = NULL;
+	dns_difftuple_t *tuple = NULL;
 	bool flag, build_nsec;
 	unsigned int i;
 	dns_rdata_soa_t soa;
@@ -1612,19 +1608,22 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 next_state:
 	switch (state->state) {
 	case sign_updates:
-		t = ISC_LIST_HEAD(diff->tuples);
-		while (t != NULL) {
-			dns_name_t *name = &t->name;
+		tuple = ISC_LIST_HEAD(diff->tuples);
+		while (tuple != NULL) {
+			dns_name_t *name = &tuple->name;
+			dns_difftuple_t *next = NULL;
+
 			/*
 			 * Now "name" is a new, unique name affected by the
 			 * update.
 			 */
-
 			namelist_append_name(&state->diffnames, name);
 
-			while (t != NULL && dns_name_equal(&t->name, name)) {
+			while (tuple != NULL &&
+			       dns_name_equal(&tuple->name, name))
+			{
 				dns_rdatatype_t type;
-				type = t->rdata.type;
+				type = tuple->rdata.type;
 
 				/*
 				 * Now "name" and "type" denote a new unique
@@ -1682,15 +1681,16 @@ next_state:
 				}
 			skip:
 				/* Skip any other updates to the same RRset. */
-				while (t != NULL &&
-				       dns_name_equal(&t->name, name) &&
-				       t->rdata.type == type)
+				while (tuple != NULL &&
+				       dns_name_equal(&tuple->name, name) &&
+				       tuple->rdata.type == type)
 				{
-					next = ISC_LIST_NEXT(t, link);
-					ISC_LIST_UNLINK(diff->tuples, t, link);
-					ISC_LIST_APPEND(state->work.tuples, t,
+					next = ISC_LIST_NEXT(tuple, link);
+					ISC_LIST_UNLINK(diff->tuples, tuple,
 							link);
-					t = next;
+					ISC_LIST_APPEND(state->work.tuples,
+							tuple, link);
+					tuple = next;
 				}
 			}
 			if (state != &mystate && sigs > maxsigs) {
@@ -1706,9 +1706,7 @@ next_state:
 		state->state = remove_orphaned;
 
 		/* Remove orphaned NSECs and RRSIG NSECs. */
-		for (t = ISC_LIST_HEAD(state->diffnames.tuples); t != NULL;
-		     t = ISC_LIST_NEXT(t, link))
-		{
+		ISC_LIST_FOREACH (state->diffnames.tuples, t, link) {
 			CHECK(non_nsec_rrset_exists(db, newver, &t->name,
 						    &flag));
 			if (!flag) {
@@ -1740,9 +1738,7 @@ next_state:
 		 * When a name is created or deleted, its predecessor needs to
 		 * have its NSEC updated.
 		 */
-		for (t = ISC_LIST_HEAD(state->diffnames.tuples); t != NULL;
-		     t = ISC_LIST_NEXT(t, link))
-		{
+		ISC_LIST_FOREACH (state->diffnames.tuples, t, link) {
 			bool existed, exists;
 			dns_fixedname_t fixedname;
 			dns_name_t *prevname;
@@ -1781,9 +1777,7 @@ next_state:
 		 * (obscured by adding an NS or DNAME, or unobscured by
 		 * removing one).
 		 */
-		for (t = ISC_LIST_HEAD(state->diffnames.tuples); t != NULL;
-		     t = ISC_LIST_NEXT(t, link))
-		{
+		ISC_LIST_FOREACH (state->diffnames.tuples, t, link) {
 			bool ns_existed, dname_existed;
 			bool ns_exists, dname_exists;
 
@@ -1835,7 +1829,7 @@ next_state:
 		 * contents to indicate that their respective owner names
 		 * should be part of the NSEC chain.
 		 */
-		while ((t = ISC_LIST_HEAD(state->affected.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->affected.tuples, t, link) {
 			bool exists;
 			dns_name_t *name = &t->name;
 
@@ -1896,9 +1890,7 @@ next_state:
 		 * Now we know which names are part of the NSEC chain.
 		 * Make them all point at their correct targets.
 		 */
-		for (t = ISC_LIST_HEAD(state->affected.tuples); t != NULL;
-		     t = ISC_LIST_NEXT(t, link))
-		{
+		ISC_LIST_FOREACH (state->affected.tuples, t, link) {
 			CHECK(rrset_exists(db, newver, &t->name,
 					   dns_rdatatype_nsec, 0, &flag));
 			if (flag) {
@@ -1932,7 +1924,7 @@ next_state:
 		 * have to regenerate the RRSIG NSECs for NSECs that were
 		 * replaced with identical ones.
 		 */
-		while ((t = ISC_LIST_HEAD(state->nsec_diff.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->nsec_diff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->nsec_diff.tuples, t, link);
 			dns_diff_appendminimal(&state->nsec_mindiff, &t);
 		}
@@ -1944,8 +1936,7 @@ next_state:
 	case sign_nsec:
 		state->state = sign_nsec;
 		/* Update RRSIG NSECs. */
-		while ((t = ISC_LIST_HEAD(state->nsec_mindiff.tuples)) != NULL)
-		{
+		ISC_LIST_FOREACH_SAFE (state->nsec_mindiff.tuples, t, link) {
 			if (t->op == DNS_DIFFOP_DEL) {
 				CHECK(delete_if(true_p, db, newver, &t->name,
 						dns_rdatatype_rrsig,
@@ -1975,12 +1966,11 @@ next_state:
 		state->state = update_nsec3;
 
 		/* Record our changes for the journal. */
-		while ((t = ISC_LIST_HEAD(state->sig_diff.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->sig_diff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->sig_diff.tuples, t, link);
 			dns_diff_appendminimal(diff, &t);
 		}
-		while ((t = ISC_LIST_HEAD(state->nsec_mindiff.tuples)) != NULL)
-		{
+		ISC_LIST_FOREACH_SAFE (state->nsec_mindiff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			dns_diff_appendminimal(diff, &t);
 		}
@@ -2008,18 +1998,18 @@ next_state:
 		 * (obscured by adding an NS or DNAME, or unobscured by
 		 * removing one).
 		 */
-		t = ISC_LIST_HEAD(diff->tuples);
-		while (t != NULL) {
-			dns_name_t *name = &t->name;
+		tuple = ISC_LIST_HEAD(diff->tuples);
+		while (tuple != NULL) {
+			dns_name_t *name = &tuple->name;
 
 			bool ns_existed, dname_existed;
 			bool ns_exists, dname_exists;
 			bool exists, existed;
 
-			if (t->rdata.type == dns_rdatatype_nsec ||
-			    t->rdata.type == dns_rdatatype_rrsig)
+			if (tuple->rdata.type == dns_rdatatype_nsec ||
+			    tuple->rdata.type == dns_rdatatype_rrsig)
 			{
-				t = ISC_LIST_NEXT(t, link);
+				tuple = ISC_LIST_NEXT(tuple, link);
 				continue;
 			}
 
@@ -2052,21 +2042,23 @@ next_state:
 			}
 			/*
 			 * There was a delegation change.  Mark all subdomains
-			 * of t->name as potentially needing a NSEC3 update.
+			 * of tuple->name as potentially needing a NSEC3 update.
 			 */
 			CHECK(namelist_append_subdomain(db, name,
 							&state->affected));
 
 		nextname:
-			while (t != NULL && dns_name_equal(&t->name, name)) {
-				t = ISC_LIST_NEXT(t, link);
+			while (tuple != NULL &&
+			       dns_name_equal(&tuple->name, name))
+			{
+				tuple = ISC_LIST_NEXT(tuple, link);
 			}
 		}
 
 		FALLTHROUGH;
 	case process_nsec3:
 		state->state = process_nsec3;
-		while ((t = ISC_LIST_HEAD(state->affected.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->affected.tuples, t, link) {
 			dns_name_t *name = &t->name;
 
 			unsecure = false; /* Silence compiler warning. */
@@ -2106,7 +2098,7 @@ next_state:
 		 * have to regenerate the RRSIG NSEC3s for NSEC3s that were
 		 * replaced with identical ones.
 		 */
-		while ((t = ISC_LIST_HEAD(state->nsec_diff.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->nsec_diff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->nsec_diff.tuples, t, link);
 			dns_diff_appendminimal(&state->nsec_mindiff, &t);
 		}
@@ -2118,8 +2110,7 @@ next_state:
 	case sign_nsec3:
 		state->state = sign_nsec3;
 		/* Update RRSIG NSEC3s. */
-		while ((t = ISC_LIST_HEAD(state->nsec_mindiff.tuples)) != NULL)
-		{
+		ISC_LIST_FOREACH_SAFE (state->nsec_mindiff.tuples, t, link) {
 			if (t->op == DNS_DIFFOP_DEL) {
 				CHECK(delete_if(true_p, db, newver, &t->name,
 						dns_rdatatype_rrsig,
@@ -2146,12 +2137,11 @@ next_state:
 				    state->work.tuples, link);
 
 		/* Record our changes for the journal. */
-		while ((t = ISC_LIST_HEAD(state->sig_diff.tuples)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (state->sig_diff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->sig_diff.tuples, t, link);
 			dns_diff_appendminimal(diff, &t);
 		}
-		while ((t = ISC_LIST_HEAD(state->nsec_mindiff.tuples)) != NULL)
-		{
+		ISC_LIST_FOREACH_SAFE (state->nsec_mindiff.tuples, t, link) {
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			dns_diff_appendminimal(diff, &t);
 		}

lib/dns/view.c

@@ -165,8 +165,7 @@ dns_view_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr,
 
 static void
 destroy(dns_view_t *view) {
-	dns_dns64_t *dns64;
-	dns_dlzdb_t *dlzdb;
+	dns_dns64_t *dns64 = NULL;
 
 	REQUIRE(!ISC_LINK_LINKED(view, link));
 
@@ -233,15 +232,11 @@ destroy(dns_view_t *view) {
 		dns_catz_zones_shutdown(view->catzs);
 		dns_catz_zones_detach(&view->catzs);
 	}
-	for (dlzdb = ISC_LIST_HEAD(view->dlz_searched); dlzdb != NULL;
-	     dlzdb = ISC_LIST_HEAD(view->dlz_searched))
-	{
+	ISC_LIST_FOREACH_SAFE (view->dlz_searched, dlzdb, link) {
 		ISC_LIST_UNLINK(view->dlz_searched, dlzdb, link);
 		dns_dlzdestroy(&dlzdb);
 	}
-	for (dlzdb = ISC_LIST_HEAD(view->dlz_unsearched); dlzdb != NULL;
-	     dlzdb = ISC_LIST_HEAD(view->dlz_unsearched))
-	{
+	ISC_LIST_FOREACH_SAFE (view->dlz_unsearched, dlzdb, link) {
 		ISC_LIST_UNLINK(view->dlz_unsearched, dlzdb, link);
 		dns_dlzdestroy(&dlzdb);
 	}
@@ -1228,40 +1223,29 @@ cleanup:
 isc_result_t
 dns_viewlist_find(dns_viewlist_t *list, const char *name,
 		  dns_rdataclass_t rdclass, dns_view_t **viewp) {
-	dns_view_t *view;
-
 	REQUIRE(list != NULL);
 
-	for (view = ISC_LIST_HEAD(*list); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (*list, view, link) {
 		if (strcmp(view->name, name) == 0 && view->rdclass == rdclass) {
-			break;
+			dns_view_attach(view, viewp);
+			return ISC_R_SUCCESS;
 		}
 	}
-	if (view == NULL) {
-		return ISC_R_NOTFOUND;
-	}
 
-	dns_view_attach(view, viewp);
-
-	return ISC_R_SUCCESS;
+	return ISC_R_NOTFOUND;
 }
 
 isc_result_t
 dns_viewlist_findzone(dns_viewlist_t *list, const dns_name_t *name,
 		      bool allclasses, dns_rdataclass_t rdclass,
 		      dns_zone_t **zonep) {
-	dns_view_t *view;
 	isc_result_t result;
 	dns_zone_t *zone1 = NULL, *zone2 = NULL;
 
 	REQUIRE(list != NULL);
 	REQUIRE(zonep != NULL && *zonep == NULL);
 
-	for (view = ISC_LIST_HEAD(*list); view != NULL;
-	     view = ISC_LIST_NEXT(view, link))
-	{
+	ISC_LIST_FOREACH (*list, view, link) {
 		dns_zt_t *zonetable = NULL;
 		if (!allclasses && view->rdclass != rdclass) {
 			continue;
@@ -1884,7 +1868,6 @@ dns_view_searchdlz(dns_view_t *view, const dns_name_t *name,
 	unsigned int i;
 	isc_result_t result;
 	dns_dlzfindzone_t findzone;
-	dns_dlzdb_t *dlzdb;
 	dns_db_t *db, *best = NULL;
 
 	/*
@@ -1900,9 +1883,7 @@ dns_view_searchdlz(dns_view_t *view, const dns_name_t *name,
 	/* count the number of labels in the name */
 	namelabels = dns_name_countlabels(name);
 
-	for (dlzdb = ISC_LIST_HEAD(view->dlz_searched); dlzdb != NULL;
-	     dlzdb = ISC_LIST_NEXT(dlzdb, link))
-	{
+	ISC_LIST_FOREACH (view->dlz_searched, dlzdb, link) {
 		REQUIRE(DNS_DLZ_VALID(dlzdb));
 
 		/*

lib/dns/xfrin.c

@@ -1796,7 +1796,6 @@ static void
 xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
 	dns_xfrin_t *xfr = (dns_xfrin_t *)arg;
 	dns_message_t *msg = NULL;
-	dns_name_t *name = NULL;
 	const dns_name_t *tsigowner = NULL;
 	isc_buffer_t buffer;
 
@@ -1919,16 +1918,11 @@ xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
 		goto failure;
 	}
 
-	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, DNS_SECTION_QUESTION))
-	{
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_QUESTION, name) {
 		dns_rdataset_t *rds = NULL;
 
 		LIBDNS_XFRIN_RECV_QUESTION(xfr, xfr->info, msg);
 
-		name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (!dns_name_equal(name, &xfr->name)) {
 			xfrin_log(xfr, ISC_LOG_NOTICE,
 				  "question name mismatch");
@@ -1950,9 +1944,6 @@ xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
 			goto failure;
 		}
 	}
-	if (result != ISC_R_NOMORE) {
-		goto failure;
-	}
 
 	/*
 	 * Does the server know about IXFR?  If it doesn't we will get
@@ -1983,22 +1974,13 @@ xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
 		goto failure;
 	}
 
-	for (result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(msg, DNS_SECTION_ANSWER))
-	{
-		dns_rdataset_t *rds = NULL;
-
+	MSG_SECTION_FOREACH (msg, DNS_SECTION_ANSWER, name) {
 		LIBDNS_XFRIN_RECV_ANSWER(xfr, xfr->info, msg);
 
-		name = NULL;
-		dns_message_currentname(msg, DNS_SECTION_ANSWER, &name);
-		for (rds = ISC_LIST_HEAD(name->list); rds != NULL;
-		     rds = ISC_LIST_NEXT(rds, link))
-		{
-			for (result = dns_rdataset_first(rds);
-			     result == ISC_R_SUCCESS;
-			     result = dns_rdataset_next(rds))
+		ISC_LIST_FOREACH (name->list, rds, link) {
+			for (isc_result_t iter = dns_rdataset_first(rds);
+			     iter == ISC_R_SUCCESS;
+			     iter = dns_rdataset_next(rds))
 			{
 				dns_rdata_t rdata = DNS_RDATA_INIT;
 				dns_rdataset_current(rds, &rdata);
@@ -2019,9 +2001,6 @@ xfrin_recv_done(isc_result_t result, isc_region_t *region, void *arg) {
 			}
 		}
 	}
-	if (result == ISC_R_NOMORE) {
-		result = ISC_R_SUCCESS;
-	}
 	CHECK(result);
 
 	if (dns_message_gettsig(msg, &tsigowner) != NULL) {

lib/isc/httpd.c

@@ -290,8 +290,7 @@ destroy_httpdmgr(isc_httpdmgr_t *httpdmgr) {
 	 * Clear out the list of all actions we know about.  Just free the
 	 * memory.
 	 */
-	isc_httpdurl_t *url, *next;
-	ISC_LIST_FOREACH_SAFE (httpdmgr->urls, url, link, next) {
+	ISC_LIST_FOREACH_SAFE (httpdmgr->urls, url, link) {
 		isc_mem_free(httpdmgr->mctx, url->url);
 		ISC_LIST_UNLINK(httpdmgr->urls, url, link);
 		isc_mem_put(httpdmgr->mctx, url, sizeof(isc_httpdurl_t));
@@ -780,8 +779,9 @@ prepare_response(void *arg) {
 	}
 
 	LOCK(&mgr->lock);
-	ISC_LIST_FOREACH (mgr->urls, url, link) {
-		if (strncmp(path, url->url, path_len) == 0) {
+	ISC_LIST_FOREACH (mgr->urls, u, link) {
+		if (strncmp(path, u->url, path_len) == 0) {
+			url = u;
 			break;
 		}
 	}
@@ -978,8 +978,7 @@ isc_httpdmgr_shutdown(isc_httpdmgr_t **httpdmgrp) {
 
 	LOCK(&httpdmgr->lock);
 
-	isc_httpd_t *httpd = NULL, *next = NULL;
-	ISC_LIST_FOREACH_SAFE (httpdmgr->running, httpd, link, next) {
+	ISC_LIST_FOREACH_SAFE (httpdmgr->running, httpd, link) {
 		if (httpd->handle != NULL) {
 			httpd_request(httpd->handle, ISC_R_SUCCESS, NULL,
 				      httpd);

lib/isc/include/isc/list.h

@@ -230,29 +230,33 @@
 	}
 
 /* clang-format off */
-#define ISC_LIST_FOREACH(list, elt, link)	\
-	for (elt = ISC_LIST_HEAD(list);		\
-	     elt != NULL;			\
+#define ISC_LIST_FOREACH(list, elt, link)			      \
+	for (typeof((list).head) elt = ISC_LIST_HEAD(list);           \
+	     elt != NULL;					      \
 	     elt = ISC_LIST_NEXT(elt, link))
 /* clang-format on */
 
 /* clang-format off */
-#define ISC_LIST_FOREACH_SAFE(list, elt, link, next)						\
-	for (elt = ISC_LIST_HEAD(list), next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL;	\
-	     elt != NULL;									\
-	     elt = next, next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL)
+#define ISC_LIST_FOREACH_SAFE(list, elt, link)                             \
+	for (typeof((list).head) elt = ISC_LIST_HEAD(list),                \
+	     elt##_next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL; \
+	     elt != NULL;                                                  \
+	     elt = elt##_next,                                             \
+	      elt##_next = (elt != NULL) ? ISC_LIST_NEXT(elt, link) : NULL)
 /* clang-format on */
 
 /* clang-format off */
-#define ISC_LIST_FOREACH_REV(list, elt, link)	\
-	for (elt = ISC_LIST_TAIL(list);		\
-	     elt != NULL;			\
+#define ISC_LIST_FOREACH_REV(list, elt, link)			      \
+	for (typeof((list).tail) elt = ISC_LIST_TAIL(list);           \
+	     elt != NULL;					      \
 	     elt = ISC_LIST_PREV(elt, link))
 /* clang-format on */
 
 /* clang-format off */
-#define ISC_LIST_FOREACH_REV_SAFE(list, elt, link, prev)						\
-	for (elt = ISC_LIST_TAIL(list), prev = (elt != NULL) ? ISC_LIST_PREV(elt, link) : NULL;	\
-	     elt != NULL;									\
-	     elt = prev, prev = (elt != NULL) ? ISC_LIST_PREV(elt, link) : NULL)
+#define ISC_LIST_FOREACH_REV_SAFE(list, elt, link)                         \
+	for (typeof((list).tail) elt = ISC_LIST_TAIL(list),                \
+	     elt##_prev = (elt != NULL) ? ISC_LIST_PREV(elt, link) : NULL; \
+	     elt != NULL;                                                  \
+	     elt = elt##_prev,                                             \
+	      elt##_prev = (elt != NULL) ? ISC_LIST_PREV(elt, link) : NULL)
 /* clang-format on */

lib/isc/job.c

@@ -64,12 +64,7 @@ isc__job_cb(uv_idle_t *handle) {
 
 	ISC_LIST_MOVE(jobs, loop->run_jobs);
 
-	isc_job_t *job, *next;
-	for (job = ISC_LIST_HEAD(jobs),
-	    next = (job != NULL) ? ISC_LIST_NEXT(job, link) : NULL;
-	     job != NULL;
-	     job = next, next = job ? ISC_LIST_NEXT(job, link) : NULL)
-	{
+	ISC_LIST_FOREACH_SAFE (jobs, job, link) {
 		isc_job_cb cb = job->cb;
 		void *cbarg = job->cbarg;
 		ISC_LIST_UNLINK(jobs, job, link);

lib/isc/log.c

@@ -391,10 +391,9 @@ isc_logconfig_set(isc_logconfig_t *lcfg) {
 
 void
 isc_logconfig_destroy(isc_logconfig_t **lcfgp) {
-	isc_logconfig_t *lcfg;
-	isc_mem_t *mctx;
-	isc_logchannel_t *channel;
-	char *filename;
+	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *mctx = NULL;
+	char *filename = NULL;
 
 	REQUIRE(lcfgp != NULL && VALID_CONFIG(*lcfgp));
 
@@ -413,9 +412,7 @@ isc_logconfig_destroy(isc_logconfig_t **lcfgp) {
 
 	mctx = lcfg->lctx->mctx;
 
-	while ((channel = ISC_LIST_HEAD(lcfg->channels)) != NULL) {
-		ISC_LIST_UNLINK(lcfg->channels, channel, link);
-
+	ISC_LIST_FOREACH_SAFE (lcfg->channels, channel, link) {
 		if (channel->type == ISC_LOG_TOFILE) {
 			/*
 			 * The filename for the channel may have ultimately
@@ -436,9 +433,7 @@ isc_logconfig_destroy(isc_logconfig_t **lcfgp) {
 	}
 
 	for (size_t i = 0; i < ARRAY_SIZE(lcfg->channellists); i++) {
-		isc_logchannellist_t *item = NULL, *next = NULL;
-		ISC_LIST_FOREACH_SAFE (lcfg->channellists[i], item, link, next)
-		{
+		ISC_LIST_FOREACH_SAFE (lcfg->channellists[i], item, link) {
 			ISC_LIST_UNLINK(lcfg->channellists[i], item, link);
 			isc_mem_put(mctx, item, sizeof(*item));
 		}
@@ -555,17 +550,17 @@ isc_result_t
 isc_log_usechannel(isc_logconfig_t *lcfg, const char *name,
 		   const isc_logcategory_t category,
 		   const isc_logmodule_t module) {
+	isc_logchannel_t *channel = NULL;
+
 	REQUIRE(VALID_CONFIG(lcfg));
 	REQUIRE(name != NULL);
 	REQUIRE(category >= ISC_LOGCATEGORY_DEFAULT &&
 		category < ISC_LOGCATEGORY_MAX);
 	REQUIRE(module >= ISC_LOGMODULE_DEFAULT && module < ISC_LOGMODULE_MAX);
 
-	isc_logchannel_t *channel;
-	for (channel = ISC_LIST_HEAD(lcfg->channels); channel != NULL;
-	     channel = ISC_LIST_NEXT(channel, link))
-	{
-		if (strcmp(name, channel->name) == 0) {
+	ISC_LIST_FOREACH (lcfg->channels, c, link) {
+		if (strcmp(name, c->name) == 0) {
+			channel = c;
 			break;
 		}
 	}
@@ -648,11 +643,7 @@ isc_log_setdebuglevel(unsigned int level) {
 		isc_logconfig_t *lcfg = rcu_dereference(isc__lctx->logconfig);
 		if (lcfg != NULL) {
 			LOCK(&isc__lctx->lock);
-			for (isc_logchannel_t *channel =
-				     ISC_LIST_HEAD(lcfg->channels);
-			     channel != NULL;
-			     channel = ISC_LIST_NEXT(channel, link))
-			{
+			ISC_LIST_FOREACH (lcfg->channels, channel, link) {
 				if (channel->type == ISC_LOG_TOFILE &&
 				    (channel->flags & ISC_LOG_DEBUGONLY) != 0 &&
 				    FILE_STREAM(channel) != NULL)
@@ -712,9 +703,7 @@ isc_log_closefilelogs(void) {
 	isc_logconfig_t *lcfg = rcu_dereference(isc__lctx->logconfig);
 	if (lcfg != NULL) {
 		LOCK(&isc__lctx->lock);
-		for (isc_logchannel_t *channel = ISC_LIST_HEAD(lcfg->channels);
-		     channel != NULL; channel = ISC_LIST_NEXT(channel, link))
-		{
+		ISC_LIST_FOREACH (lcfg->channels, channel, link) {
 			if (channel->type == ISC_LOG_TOFILE &&
 			    FILE_STREAM(channel) != NULL)
 			{

lib/isc/mem.c

@@ -239,7 +239,6 @@ unlock:
 
 static void
 delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
-	debuglink_t *dl = NULL;
 	uint32_t hash;
 	uint32_t idx;
 
@@ -266,14 +265,12 @@ delete_trace_entry(isc_mem_t *mctx, const void *ptr, size_t size FLARG) {
 #endif
 	idx = hash % DEBUG_TABLE_COUNT;
 
-	dl = ISC_LIST_HEAD(mctx->debuglist[idx]);
-	while (dl != NULL) {
+	ISC_LIST_FOREACH (mctx->debuglist[idx], dl, link) {
 		if (dl->ptr == ptr) {
 			ISC_LIST_UNLINK(mctx->debuglist[idx], dl, link);
 			sdallocx(dl, sizeof(*dl), mctx->jemalloc_flags);
 			goto unlock;
 		}
-		dl = ISC_LIST_NEXT(dl, link);
 	}
 
 	/*
@@ -517,11 +514,8 @@ mem_destroy(isc_mem_t *ctx) {
 
 #if ISC_MEM_TRACKLINES
 	if (ctx->debuglist != NULL) {
-		debuglink_t *dl;
 		for (size_t i = 0; i < DEBUG_TABLE_COUNT; i++) {
-			for (dl = ISC_LIST_HEAD(ctx->debuglist[i]); dl != NULL;
-			     dl = ISC_LIST_HEAD(ctx->debuglist[i]))
-			{
+			ISC_LIST_FOREACH_SAFE (ctx->debuglist[i], dl, link) {
 				if (ctx->checkfree && dl->ptr != NULL) {
 					print_active(ctx, stderr);
 				}
@@ -613,7 +607,6 @@ isc__mem_put(isc_mem_t *ctx, void *ptr, size_t size, int flags FLARG) {
 static void
 print_active(isc_mem_t *mctx, FILE *out) {
 	if (mctx->debuglist != NULL) {
-		debuglink_t *dl;
 		unsigned int i;
 		bool found;
 
@@ -621,13 +614,8 @@ print_active(isc_mem_t *mctx, FILE *out) {
 			     "allocations:\n");
 		found = false;
 		for (i = 0; i < DEBUG_TABLE_COUNT; i++) {
-			dl = ISC_LIST_HEAD(mctx->debuglist[i]);
-
-			if (dl != NULL) {
+			ISC_LIST_FOREACH (mctx->debuglist[i], dl, link) {
 				found = true;
-			}
-
-			while (dl != NULL) {
 				if (dl->ptr != NULL) {
 					fprintf(out,
 						"\tptr %p size %zu "
@@ -636,7 +624,6 @@ print_active(isc_mem_t *mctx, FILE *out) {
 						dl->ptr, dl->size, dl->file,
 						dl->line);
 				}
-				dl = ISC_LIST_NEXT(dl, link);
 			}
 		}
 
@@ -652,8 +639,6 @@ print_active(isc_mem_t *mctx, FILE *out) {
  */
 void
 isc_mem_stats(isc_mem_t *ctx, FILE *out) {
-	isc_mempool_t *pool = NULL;
-
 	REQUIRE(VALID_CONTEXT(ctx));
 
 	MCTXLOCK(ctx);
@@ -665,20 +650,18 @@ isc_mem_stats(isc_mem_t *ctx, FILE *out) {
 	 * isc_mem_t's lock, however, so walking this list and
 	 * extracting integers from stats fields is always safe.
 	 */
-	pool = ISC_LIST_HEAD(ctx->pools);
-	if (pool != NULL) {
+	if (!ISC_LIST_EMPTY(ctx->pools)) {
 		fprintf(out, "[Pool statistics]\n");
 		fprintf(out, "%15s %10s %10s %10s %10s %10s %10s %1s\n", "name",
 			"size", "allocated", "freecount", "freemax",
 			"fillcount", "gets", "L");
 	}
-	while (pool != NULL) {
+	ISC_LIST_FOREACH (ctx->pools, pool, link) {
 		fprintf(out,
 			"%15s %10zu %10zu %10zu %10zu %10zu %10zu %10zu %s\n",
 			pool->name, pool->size, (size_t)0, pool->allocated,
 			pool->freecount, pool->freemax, pool->fillcount,
 			pool->gets, "N");
-		pool = ISC_LIST_NEXT(pool, link);
 	}
 
 #if ISC_MEM_TRACKLINES
@@ -1176,11 +1159,7 @@ isc_mempool_getfillcount(isc_mempool_t *restrict mpctx) {
 #if ISC_MEM_TRACKLINES
 static void
 print_contexts(FILE *file) {
-	isc_mem_t *ctx;
-
-	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link))
-	{
+	ISC_LIST_FOREACH (contexts, ctx, link) {
 		fprintf(file, "context: %p (%s): %" PRIuFAST32 " references\n",
 			ctx, ctx->name[0] == 0 ? "<unknown>" : ctx->name,
 			isc_refcount_current(&ctx->references));
@@ -1292,7 +1271,6 @@ error:
 
 int
 isc_mem_renderxml(void *writer0) {
-	isc_mem_t *ctx;
 	size_t inuse = 0;
 	int xmlrc;
 	xmlTextWriterPtr writer = (xmlTextWriterPtr)writer0;
@@ -1300,9 +1278,7 @@ isc_mem_renderxml(void *writer0) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "contexts"));
 
 	LOCK(&contextslock);
-	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link))
-	{
+	ISC_LIST_FOREACH (contexts, ctx, link) {
 		xmlrc = xml_renderctx(ctx, &inuse, writer);
 		if (xmlrc < 0) {
 			UNLOCK(&contextslock);
@@ -1393,7 +1369,6 @@ json_renderctx(isc_mem_t *ctx, size_t *inuse, json_object *array) {
 isc_result_t
 isc_mem_renderjson(void *memobj0) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_mem_t *ctx;
 	size_t inuse = 0;
 	json_object *ctxarray, *obj;
 	json_object *memobj = (json_object *)memobj0;
@@ -1402,9 +1377,7 @@ isc_mem_renderjson(void *memobj0) {
 	CHECKMEM(ctxarray);
 
 	LOCK(&contextslock);
-	for (ctx = ISC_LIST_HEAD(contexts); ctx != NULL;
-	     ctx = ISC_LIST_NEXT(ctx, link))
-	{
+	ISC_LIST_FOREACH (contexts, ctx, link) {
 		result = json_renderctx(ctx, &inuse, ctxarray);
 		if (result != ISC_R_SUCCESS) {
 			UNLOCK(&contextslock);

lib/isc/netmgr/http.c

@@ -294,7 +294,7 @@ server_call_cb(isc_nmsocket_t *socket, const isc_result_t result,
 
 static isc_nm_httphandler_t *
 http_endpoints_find(const char *request_path,
-		    const isc_nm_http_endpoints_t *restrict eps);
+		    isc_nm_http_endpoints_t *restrict eps);
 
 static void
 http_init_listener_endpoints(isc_nmsocket_t *listener,
@@ -424,28 +424,27 @@ isc__nm_httpsession_handle(isc_nm_http_session_t *session) {
 
 static http_cstream_t *
 find_http_cstream(int32_t stream_id, isc_nm_http_session_t *session) {
-	http_cstream_t *cstream = NULL;
 	REQUIRE(VALID_HTTP2_SESSION(session));
 
 	if (ISC_LIST_EMPTY(session->cstreams)) {
 		return NULL;
 	}
 
-	for (cstream = ISC_LIST_HEAD(session->cstreams); cstream != NULL;
-	     cstream = ISC_LIST_NEXT(cstream, link))
-	{
+	ISC_LIST_FOREACH (session->cstreams, cstream, link) {
 		if (cstream->stream_id == stream_id) {
-			break;
+			/* LRU-like behaviour */
+			if (ISC_LIST_HEAD(session->cstreams) != cstream) {
+				ISC_LIST_UNLINK(session->cstreams, cstream,
+						link);
+				ISC_LIST_PREPEND(session->cstreams, cstream,
+						 link);
+			}
+
+			return cstream;
 		}
 	}
 
-	/* LRU-like behaviour */
-	if (cstream && ISC_LIST_HEAD(session->cstreams) != cstream) {
-		ISC_LIST_UNLINK(session->cstreams, cstream, link);
-		ISC_LIST_PREPEND(session->cstreams, cstream, link);
-	}
-
-	return cstream;
+	return NULL;
 }
 
 static isc_result_t
@@ -1312,12 +1311,9 @@ done:
 static void
 call_pending_callbacks(isc__nm_http_pending_callbacks_t pending_callbacks,
 		       isc_result_t result) {
-	isc__nm_uvreq_t *cbreq = ISC_LIST_HEAD(pending_callbacks);
-	while (cbreq != NULL) {
-		isc__nm_uvreq_t *next = ISC_LIST_NEXT(cbreq, link);
+	ISC_LIST_FOREACH_SAFE (pending_callbacks, cbreq, link) {
 		ISC_LIST_UNLINK(pending_callbacks, cbreq, link);
 		isc__nm_sendcb(cbreq->handle->sock, cbreq, result, true);
-		cbreq = next;
 	}
 }
 
@@ -3042,7 +3038,6 @@ void
 isc_nm_http_endpoints_detach(isc_nm_http_endpoints_t **restrict epsp) {
 	isc_nm_http_endpoints_t *restrict eps;
 	isc_mem_t *mctx;
-	isc_nm_httphandler_t *handler = NULL;
 
 	REQUIRE(epsp != NULL);
 	eps = *epsp;
@@ -3056,16 +3051,11 @@ isc_nm_http_endpoints_detach(isc_nm_http_endpoints_t **restrict epsp) {
 	mctx = eps->mctx;
 
 	/* Delete all handlers */
-	handler = ISC_LIST_HEAD(eps->handlers);
-	while (handler != NULL) {
-		isc_nm_httphandler_t *next = NULL;
-
-		next = ISC_LIST_NEXT(handler, link);
+	ISC_LIST_FOREACH_SAFE (eps->handlers, handler, link) {
 		ISC_LIST_DEQUEUE(eps->handlers, handler, link);
 		isc_mem_free(mctx, handler->path);
 		handler->magic = 0;
 		isc_mem_put(mctx, handler, sizeof(*handler));
-		handler = next;
 	}
 
 	eps->magic = 0;
@@ -3087,26 +3077,22 @@ isc_nm_http_endpoints_attach(isc_nm_http_endpoints_t *source,
 
 static isc_nm_httphandler_t *
 http_endpoints_find(const char *request_path,
-		    const isc_nm_http_endpoints_t *restrict eps) {
-	isc_nm_httphandler_t *handler = NULL;
-
+		    isc_nm_http_endpoints_t *restrict eps) {
 	REQUIRE(VALID_HTTP_ENDPOINTS(eps));
 
 	if (request_path == NULL || *request_path == '\0') {
 		return NULL;
 	}
 
-	for (handler = ISC_LIST_HEAD(eps->handlers); handler != NULL;
-	     handler = ISC_LIST_NEXT(handler, link))
-	{
+	ISC_LIST_FOREACH (eps->handlers, handler, link) {
 		if (!strcmp(request_path, handler->path)) {
 			INSIST(VALID_HTTP_HANDLER(handler));
 			INSIST(handler->cb != NULL);
-			break;
+			return handler;
 		}
 	}
 
-	return handler;
+	return NULL;
 }
 
 isc_result_t
@@ -3229,15 +3215,10 @@ failed_httpstream_read_cb(isc_nmsocket_t *sock, isc_result_t result,
 static void
 client_call_failed_read_cb(isc_result_t result,
 			   isc_nm_http_session_t *session) {
-	http_cstream_t *cstream = NULL;
-
 	REQUIRE(VALID_HTTP2_SESSION(session));
 	REQUIRE(result != ISC_R_SUCCESS);
 
-	cstream = ISC_LIST_HEAD(session->cstreams);
-	while (cstream != NULL) {
-		http_cstream_t *next = ISC_LIST_NEXT(cstream, link);
-
+	ISC_LIST_FOREACH_SAFE (session->cstreams, cstream, link) {
 		/*
 		 * read_cb could be NULL if cstream was allocated and added
 		 * to the tracking list, but was not properly initialized due
@@ -3258,35 +3239,26 @@ client_call_failed_read_cb(isc_result_t result,
 			ISC_LIST_DEQUEUE(session->cstreams, cstream, link);
 			put_http_cstream(session->mctx, cstream);
 		}
-
-		cstream = next;
 	}
 }
 
 static void
 server_call_failed_read_cb(isc_result_t result,
 			   isc_nm_http_session_t *session) {
-	isc_nmsocket_h2_t *h2data = NULL; /* stream socket */
-
 	REQUIRE(VALID_HTTP2_SESSION(session));
 	REQUIRE(result != ISC_R_SUCCESS);
 
-	for (h2data = ISC_LIST_HEAD(session->sstreams); h2data != NULL;
-	     h2data = ISC_LIST_NEXT(h2data, link))
-	{
+	ISC_LIST_FOREACH (session->sstreams, h2data, link) {
 		failed_httpstream_read_cb(h2data->psock, result, session);
 	}
 
-	h2data = ISC_LIST_HEAD(session->sstreams);
-	while (h2data != NULL) {
-		isc_nmsocket_h2_t *next = ISC_LIST_NEXT(h2data, link);
+	ISC_LIST_FOREACH_SAFE (session->sstreams, h2data, link) {
 		ISC_LIST_DEQUEUE(session->sstreams, h2data, link);
+
 		/* Cleanup socket in place */
 		h2data->psock->active = false;
 		h2data->psock->closed = true;
 		isc__nmsocket_detach(&h2data->psock);
-
-		h2data = next;
 	}
 }
 

lib/isc/netmgr/netmgr.c

@@ -428,7 +428,6 @@ nmsocket_cleanup(void *arg) {
 	REQUIRE(VALID_NMSOCK(sock));
 	REQUIRE(!isc__nmsocket_active(sock));
 
-	isc_nmhandle_t *handle = NULL;
 	isc__networker_t *worker = sock->worker;
 
 	isc_refcount_destroy(&sock->references);
@@ -467,7 +466,7 @@ nmsocket_cleanup(void *arg) {
 		isc__nmsocket_detach(&sock->outer);
 	}
 
-	while ((handle = ISC_LIST_HEAD(sock->inactive_handles)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (sock->inactive_handles, handle, inactive_link) {
 		ISC_LIST_DEQUEUE(sock->inactive_handles, handle, inactive_link);
 		nmhandle_free(sock, handle);
 	}
@@ -2944,8 +2943,6 @@ nmhandle_dump(isc_nmhandle_t *handle) {
 
 static void
 nmsocket_dump(isc_nmsocket_t *sock) {
-	isc_nmhandle_t *handle = NULL;
-
 	fprintf(stderr, "\n=================\n");
 	fprintf(stderr, "Active %s socket %p, type %s, refs %" PRIuFAST32 "\n",
 		sock->client ? "client" : "server", sock,
@@ -2965,9 +2962,7 @@ nmsocket_dump(isc_nmsocket_t *sock) {
 				 STDERR_FILENO);
 	fprintf(stderr, "\n");
 
-	for (handle = ISC_LIST_HEAD(sock->active_handles); handle != NULL;
-	     handle = ISC_LIST_NEXT(handle, active_link))
-	{
+	ISC_LIST_FOREACH (sock->active_handles, handle, active_link) {
 		static bool first = true;
 		if (first) {
 			fprintf(stderr, "Active handles:\n");
@@ -2981,12 +2976,9 @@ nmsocket_dump(isc_nmsocket_t *sock) {
 
 void
 isc__nm_dump_active(isc__networker_t *worker) {
-	isc_nmsocket_t *sock = NULL;
 	bool first = true;
 
-	for (sock = ISC_LIST_HEAD(worker->active_sockets); sock != NULL;
-	     sock = ISC_LIST_NEXT(sock, active_link))
-	{
+	ISC_LIST_FOREACH (worker->active_sockets, sock, active_link) {
 		if (first) {
 			fprintf(stderr, "Outstanding sockets\n");
 			first = false;

lib/isc/ratelimiter.c

@@ -218,7 +218,6 @@ isc_ratelimiter_dequeue(isc_ratelimiter_t *restrict rl, isc_rlevent_t **rlep) {
 static void
 isc__ratelimiter_tick(void *arg) {
 	isc_ratelimiter_t *rl = (isc_ratelimiter_t *)arg;
-	isc_rlevent_t *rle = NULL;
 	uint32_t pertic;
 	ISC_LIST(isc_rlevent_t) pending;
 
@@ -237,7 +236,7 @@ isc__ratelimiter_tick(void *arg) {
 
 	pertic = rl->pertic;
 	while (pertic != 0) {
-		rle = ISC_LIST_HEAD(rl->pending);
+		isc_rlevent_t *rle = ISC_LIST_HEAD(rl->pending);
 		if (rle != NULL) {
 			/* There is work to do.  Let's do it after unlocking. */
 			ISC_LIST_UNLINK(rl->pending, rle, link);
@@ -263,7 +262,7 @@ isc__ratelimiter_tick(void *arg) {
 unlock:
 	UNLOCK(&rl->lock);
 
-	while ((rle = ISC_LIST_HEAD(pending)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (pending, rle, link) {
 		ISC_LIST_UNLINK(pending, rle, link);
 		isc_async_run(rle->loop, rle->cb, rle->arg);
 	}
@@ -288,7 +287,6 @@ isc__ratelimiter_doshutdown(void *arg) {
 
 void
 isc_ratelimiter_shutdown(isc_ratelimiter_t *restrict rl) {
-	isc_rlevent_t *rle = NULL;
 	ISC_LIST(isc_rlevent_t) pending;
 
 	REQUIRE(VALID_RATELIMITER(rl));
@@ -304,7 +302,7 @@ isc_ratelimiter_shutdown(isc_ratelimiter_t *restrict rl) {
 	}
 	UNLOCK(&rl->lock);
 
-	while ((rle = ISC_LIST_HEAD(pending)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (pending, rle, link) {
 		ISC_LIST_UNLINK(pending, rle, link);
 		rle->canceled = true;
 		isc_async_run(rl->loop, rle->cb, rle->arg);

lib/isc/tls.c

@@ -1338,7 +1338,6 @@ void
 isc_tlsctx_client_session_cache_detach(
 	isc_tlsctx_client_session_cache_t **cachep) {
 	isc_tlsctx_client_session_cache_t *cache = NULL;
-	client_session_cache_entry_t *entry = NULL, *next = NULL;
 
 	REQUIRE(cachep != NULL);
 
@@ -1355,11 +1354,8 @@ isc_tlsctx_client_session_cache_detach(
 
 	isc_refcount_destroy(&cache->references);
 
-	entry = ISC_LIST_HEAD(cache->lru_entries);
-	while (entry != NULL) {
-		next = ISC_LIST_NEXT(entry, cache_link);
+	ISC_LIST_FOREACH_SAFE (cache->lru_entries, entry, cache_link) {
 		client_cache_entry_delete(cache, entry);
-		entry = next;
 	}
 
 	RUNTIME_CHECK(isc_ht_count(cache->buckets) == 0);

lib/isccfg/aclconf.c

@@ -70,16 +70,14 @@ cfg_aclconfctx_attach(cfg_aclconfctx_t *src, cfg_aclconfctx_t **dest) {
 void
 cfg_aclconfctx_detach(cfg_aclconfctx_t **actxp) {
 	REQUIRE(actxp != NULL && *actxp != NULL);
+
 	cfg_aclconfctx_t *actx = *actxp;
 	*actxp = NULL;
 
 	if (isc_refcount_decrement(&actx->references) == 1) {
-		dns_acl_t *dacl, *next;
 		isc_refcount_destroy(&actx->references);
-		for (dacl = ISC_LIST_HEAD(actx->named_acl_cache); dacl != NULL;
-		     dacl = next)
+		ISC_LIST_FOREACH_SAFE (actx->named_acl_cache, dacl, nextincache)
 		{
-			next = ISC_LIST_NEXT(dacl, nextincache);
 			ISC_LIST_UNLINK(actx->named_acl_cache, dacl,
 					nextincache);
 			dns_acl_detach(&dacl);
@@ -122,14 +120,11 @@ convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
 		  unsigned int nest_level, dns_acl_t **target) {
 	isc_result_t result;
 	const cfg_obj_t *cacl = NULL;
-	dns_acl_t *dacl;
-	dns_acl_t loop;
+	dns_acl_t loop, *acl = NULL;
 	const char *aclname = cfg_obj_asstring(nameobj);
 
 	/* Look for an already-converted version. */
-	for (dacl = ISC_LIST_HEAD(ctx->named_acl_cache); dacl != NULL;
-	     dacl = ISC_LIST_NEXT(dacl, nextincache))
-	{
+	ISC_LIST_FOREACH (ctx->named_acl_cache, dacl, nextincache) {
 		if (strcasecmp(aclname, dacl->name) == 0) {
 			if (ISC_MAGIC_VALID(dacl, LOOP_MAGIC)) {
 				cfg_obj_log(nameobj, ISC_LOG_ERROR,
@@ -155,16 +150,16 @@ convert_named_acl(const cfg_obj_t *nameobj, const cfg_obj_t *cctx,
 	loop.name = UNCONST(aclname);
 	loop.magic = LOOP_MAGIC;
 	ISC_LIST_APPEND(ctx->named_acl_cache, &loop, nextincache);
-	result = cfg_acl_fromconfig(cacl, cctx, ctx, mctx, nest_level, &dacl);
+	result = cfg_acl_fromconfig(cacl, cctx, ctx, mctx, nest_level, &acl);
 	ISC_LIST_UNLINK(ctx->named_acl_cache, &loop, nextincache);
 	loop.magic = 0;
 	loop.name = NULL;
 	if (result != ISC_R_SUCCESS) {
 		return result;
 	}
-	dacl->name = isc_mem_strdup(dacl->mctx, aclname);
-	ISC_LIST_APPEND(ctx->named_acl_cache, dacl, nextincache);
-	dns_acl_attach(dacl, target);
+	acl->name = isc_mem_strdup(acl->mctx, aclname);
+	ISC_LIST_APPEND(ctx->named_acl_cache, acl, nextincache);
+	dns_acl_attach(acl, target);
 	return ISC_R_SUCCESS;
 }
 

lib/isccfg/check.c

@@ -1193,7 +1193,6 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	isc_buffer_t b;
 	uint32_t lifetime = 3600;
 	dns_keystorelist_t kslist;
-	dns_keystore_t *ks = NULL, *ks_next = NULL;
 	const char *ccalg = "siphash24";
 	cfg_aclconfctx_t *actx = NULL;
 	static const char *sources[] = {
@@ -1428,7 +1427,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 			bad_kasp = true;
 		} else if (optlevel == optlevel_config) {
 			dns_kasplist_t list;
-			dns_kasp_t *kasp = NULL, *kasp_next = NULL;
+			dns_kasp_t *kasp = NULL;
 
 			ISC_LIST_INIT(list);
 
@@ -1465,12 +1464,9 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 				}
 			}
 
-			for (kasp = ISC_LIST_HEAD(list); kasp != NULL;
-			     kasp = kasp_next)
-			{
-				kasp_next = ISC_LIST_NEXT(kasp, link);
-				ISC_LIST_UNLINK(list, kasp, link);
-				dns_kasp_detach(&kasp);
+			ISC_LIST_FOREACH_SAFE (list, k, link) {
+				ISC_LIST_UNLINK(list, k, link);
+				dns_kasp_detach(&k);
 			}
 		}
 
@@ -1496,8 +1492,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	/*
 	 * Cleanup key-store.
 	 */
-	for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-		ks_next = ISC_LIST_NEXT(ks, link);
+	ISC_LIST_FOREACH_SAFE (kslist, ks, link) {
 		ISC_LIST_UNLINK(kslist, ks, link);
 		dns_keystore_detach(&ks);
 	}
@@ -2888,13 +2883,10 @@ check_keydir(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	bool do_cleanup = false;
 	bool done = false;
 	bool keystore = false;
-
 	const cfg_obj_t *kasps = NULL;
-	dns_kasp_t *kasp = NULL, *kasp_next = NULL;
+	dns_kasp_t *kasp = NULL;
 	dns_kasplist_t kasplist;
-
 	const cfg_obj_t *keystores = NULL;
-	dns_keystore_t *ks = NULL, *ks_next = NULL;
 	dns_keystorelist_t kslist;
 
 	/* If no dnssec-policy or key-store, use the dir (key-directory) */
@@ -2951,9 +2943,7 @@ check_keydir(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 
 	/* Check key-stores of keys */
 	dns_kasp_freeze(kasp);
-	for (dns_kasp_key_t *kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp));
-	     kkey != NULL; kkey = ISC_LIST_NEXT(kkey, link))
-	{
+	ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 		dns_keystore_t *kks = dns_kasp_key_keystore(kkey);
 		dir = dns_keystore_directory(kks, keydir);
 		keystore = (kks != NULL && strcmp(DNS_KEYSTORE_KEYDIRECTORY,
@@ -2983,15 +2973,11 @@ check:
 		if (kasp != NULL) {
 			dns_kasp_detach(&kasp);
 		}
-		for (kasp = ISC_LIST_HEAD(kasplist); kasp != NULL;
-		     kasp = kasp_next)
-		{
-			kasp_next = ISC_LIST_NEXT(kasp, link);
-			ISC_LIST_UNLINK(kasplist, kasp, link);
-			dns_kasp_detach(&kasp);
+		ISC_LIST_FOREACH_SAFE (kasplist, k, link) {
+			ISC_LIST_UNLINK(kasplist, k, link);
+			dns_kasp_detach(&k);
 		}
-		for (ks = ISC_LIST_HEAD(kslist); ks != NULL; ks = ks_next) {
-			ks_next = ISC_LIST_NEXT(ks, link);
+		ISC_LIST_FOREACH_SAFE (kslist, ks, link) {
 			ISC_LIST_UNLINK(kslist, ks, link);
 			dns_keystore_detach(&ks);
 		}

lib/isccfg/kaspconf.c

@@ -334,7 +334,6 @@ cleanup:
 
 static isc_result_t
 cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp) {
-	dns_kasp_key_t *kkey;
 	unsigned int min_keysize = 4096;
 	const cfg_obj_t *obj = NULL;
 	uint32_t iter = DEFAULT_NSEC3PARAM_ITER;
@@ -348,9 +347,7 @@ cfg_nsec3param_fromconfig(const cfg_obj_t *config, dns_kasp_t *kasp) {
 		iter = cfg_obj_asuint32(obj);
 	}
 	dns_kasp_freeze(kasp);
-	for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
-	     kkey = ISC_LIST_NEXT(kkey, link))
-	{
+	ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 		unsigned int keysize = dns_kasp_key_size(kkey);
 		uint32_t keyalg = dns_kasp_key_algorithm(kkey);
 
@@ -632,7 +629,6 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
 	if (keys != NULL) {
 		char role[256] = { 0 };
 		bool warn[256][2] = { { false } };
-		dns_kasp_key_t *kkey = NULL;
 
 		for (element = cfg_list_first(keys); element != NULL;
 		     element = cfg_list_next(element))
@@ -651,9 +647,7 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
 			}
 		}
 		dns_kasp_freeze(kasp);
-		for (kkey = ISC_LIST_HEAD(dns_kasp_keys(kasp)); kkey != NULL;
-		     kkey = ISC_LIST_NEXT(kkey, link))
-		{
+		ISC_LIST_FOREACH (dns_kasp_keys(kasp), kkey, link) {
 			uint32_t keyalg = dns_kasp_key_algorithm(kkey);
 			INSIST(keyalg < ARRAY_SIZE(role));
 
@@ -704,17 +698,15 @@ cfg_kasp_fromconfig(const cfg_obj_t *config, dns_kasp_t *default_kasp,
 			goto cleanup;
 		}
 	} else if (default_kasp) {
-		dns_kasp_key_t *key, *new_key;
 		/*
 		 * If there are no specific keys configured in the policy,
 		 * inherit from the default policy (except for the built-in
 		 * "insecure" policy).
 		 */
-		for (key = ISC_LIST_HEAD(dns_kasp_keys(default_kasp));
-		     key != NULL; key = ISC_LIST_NEXT(key, link))
-		{
+		ISC_LIST_FOREACH (dns_kasp_keys(default_kasp), key, link) {
+			dns_kasp_key_t *new_key = NULL;
+
 			/* Create a new key reference. */
-			new_key = NULL;
 			dns_kasp_key_create(kasp, &new_key);
 			if (dns_kasp_key_ksk(key)) {
 				new_key->role |= DNS_KASP_KEY_ROLE_KSK;

lib/isccfg/parser.c

@@ -1949,9 +1949,7 @@ free_listelt(cfg_parser_t *pctx, cfg_listelt_t *elt) {
 
 static void
 free_list(cfg_parser_t *pctx, cfg_obj_t *obj) {
-	cfg_listelt_t *elt, *next;
-	for (elt = ISC_LIST_HEAD(obj->value.list); elt != NULL; elt = next) {
-		next = ISC_LIST_NEXT(elt, link);
+	ISC_LIST_FOREACH_SAFE (obj->value.list, elt, link) {
 		free_listelt(pctx, elt);
 	}
 }
@@ -2022,12 +2020,9 @@ cleanup:
 
 static void
 print_list(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	const cfg_list_t *list = &obj->value.list;
-	const cfg_listelt_t *elt;
+	cfg_list_t *list = UNCONST(&obj->value.list);
 
-	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link))
-	{
+	ISC_LIST_FOREACH (*list, elt, link) {
 		if ((pctx->flags & CFG_PRINTER_ONELINE) != 0) {
 			cfg_print_obj(pctx, elt->obj);
 			cfg_print_cstr(pctx, "; ");
@@ -2117,17 +2112,14 @@ cleanup:
 
 void
 cfg_print_spacelist(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	const cfg_list_t *list = NULL;
-	const cfg_listelt_t *elt = NULL;
+	cfg_list_t *list = NULL;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(obj != NULL);
 
-	list = &obj->value.list;
+	list = UNCONST(&obj->value.list);
 
-	for (elt = ISC_LIST_HEAD(*list); elt != NULL;
-	     elt = ISC_LIST_NEXT(elt, link))
-	{
+	ISC_LIST_FOREACH (*list, elt, link) {
 		cfg_print_obj(pctx, elt->obj);
 		if (ISC_LIST_NEXT(elt, link) != NULL) {
 			cfg_print_cstr(pctx, " ");
@@ -2551,11 +2543,7 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 				if (symobj->type == &cfg_type_implicitlist) {
 					/* Multivalued. */
 					cfg_list_t *list = &symobj->value.list;
-					cfg_listelt_t *elt;
-					for (elt = ISC_LIST_HEAD(*list);
-					     elt != NULL;
-					     elt = ISC_LIST_NEXT(elt, link))
-					{
+					ISC_LIST_FOREACH (*list, elt, link) {
 						print_symval(pctx, clause->name,
 							     elt->obj);
 					}

lib/ns/client.c

@@ -1284,7 +1284,6 @@ compute_cookie(ns_client_t *client, uint32_t when, const unsigned char *secret,
 
 static void
 process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
-	ns_altsecret_t *altsecret;
 	unsigned char dbuf[COOKIE_SIZE];
 	unsigned char *old;
 	isc_stdtime_t now;
@@ -1371,9 +1370,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		return;
 	}
 
-	for (altsecret = ISC_LIST_HEAD(client->manager->sctx->altsecrets);
-	     altsecret != NULL; altsecret = ISC_LIST_NEXT(altsecret, link))
-	{
+	ISC_LIST_FOREACH (client->manager->sctx->altsecrets, altsecret, link) {
 		isc_buffer_init(&db, dbuf, sizeof(dbuf));
 		compute_cookie(client, when, altsecret->secret, &db);
 		if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
@@ -2624,16 +2621,12 @@ ns_clientmgr_create(ns_server_t *sctx, isc_loopmgr_t *loopmgr,
 
 void
 ns_clientmgr_shutdown(ns_clientmgr_t *manager) {
-	ns_client_t *client;
-
 	REQUIRE(VALID_MANAGER(manager));
 
 	MTRACE("destroy");
 
 	LOCK(&manager->reclock);
-	for (client = ISC_LIST_HEAD(manager->recursing); client != NULL;
-	     client = ISC_LIST_NEXT(client, rlink))
-	{
+	ISC_LIST_FOREACH (manager->recursing, client, rlink) {
 		ns_query_cancel(client);
 	}
 	UNLOCK(&manager->reclock);
@@ -2847,7 +2840,6 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 
 void
 ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
-	ns_client_t *client;
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char original[DNS_NAME_FORMATSIZE];
 	char peerbuf[ISC_SOCKADDR_FORMATSIZE];
@@ -2861,8 +2853,7 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 	REQUIRE(VALID_MANAGER(manager));
 
 	LOCK(&manager->reclock);
-	client = ISC_LIST_HEAD(manager->recursing);
-	while (client != NULL) {
+	ISC_LIST_FOREACH (manager->recursing, client, rlink) {
 		INSIST(client->state == NS_CLIENTSTATE_RECURSING);
 
 		ns_client_name(client, peerbuf, sizeof(peerbuf));
@@ -2912,7 +2903,6 @@ ns_client_dumprecursing(FILE *f, ns_clientmgr_t *manager) {
 			sep, name, client->message->id, namebuf, typebuf,
 			classbuf, origfor, original,
 			isc_time_seconds(&client->requesttime));
-		client = ISC_LIST_NEXT(client, rlink);
 	}
 	UNLOCK(&manager->reclock);
 }
@@ -3096,28 +3086,21 @@ client_getdbversion(ns_client_t *client) {
 
 ns_dbversion_t *
 ns_client_findversion(ns_client_t *client, dns_db_t *db) {
-	ns_dbversion_t *dbversion;
-
-	for (dbversion = ISC_LIST_HEAD(client->query.activeversions);
-	     dbversion != NULL; dbversion = ISC_LIST_NEXT(dbversion, link))
-	{
+	ISC_LIST_FOREACH (client->query.activeversions, dbversion, link) {
 		if (dbversion->db == db) {
-			break;
+			return dbversion;
 		}
 	}
 
-	if (dbversion == NULL) {
-		/*
-		 * This is a new zone for this query.  Add it to
-		 * the active list.
-		 */
-		dbversion = client_getdbversion(client);
-		dns_db_attach(db, &dbversion->db);
-		dns_db_currentversion(db, &dbversion->version);
-		dbversion->acl_checked = false;
-		dbversion->queryok = false;
-		ISC_LIST_APPEND(client->query.activeversions, dbversion, link);
-	}
-
+	/*
+	 * This is a new zone for this query.  Add it to
+	 * the active list.
+	 */
+	ns_dbversion_t *dbversion = client_getdbversion(client);
+	dns_db_attach(db, &dbversion->db);
+	dns_db_currentversion(db, &dbversion->version);
+	dbversion->acl_checked = false;
+	dbversion->queryok = false;
+	ISC_LIST_APPEND(client->query.activeversions, dbversion, link);
 	return dbversion;
 }

lib/ns/hooks.c

@@ -280,7 +280,6 @@ ns_hooktable_create(isc_mem_t *mctx, ns_hooktable_t **tablep) {
 void
 ns_hooktable_free(isc_mem_t *mctx, void **tablep) {
 	ns_hooktable_t *table = NULL;
-	ns_hook_t *hook = NULL, *next = NULL;
 	int i = 0;
 
 	REQUIRE(tablep != NULL && *tablep != NULL);
@@ -289,10 +288,7 @@ ns_hooktable_free(isc_mem_t *mctx, void **tablep) {
 	*tablep = NULL;
 
 	for (i = 0; i < NS_HOOKPOINTS_COUNT; i++) {
-		for (hook = ISC_LIST_HEAD((*table)[i]); hook != NULL;
-		     hook = next)
-		{
-			next = ISC_LIST_NEXT(hook, link);
+		ISC_LIST_FOREACH_SAFE ((*table)[i], hook, link) {
 			ISC_LIST_UNLINK((*table)[i], hook, link);
 			if (hook->mctx != NULL) {
 				isc_mem_putanddetach(&hook->mctx, hook,
@@ -341,15 +337,13 @@ ns_plugins_create(isc_mem_t *mctx, ns_plugins_t **listp) {
 void
 ns_plugins_free(isc_mem_t *mctx, void **listp) {
 	ns_plugins_t *list = NULL;
-	ns_plugin_t *plugin = NULL, *next = NULL;
 
 	REQUIRE(listp != NULL && *listp != NULL);
 
 	list = *listp;
 	*listp = NULL;
 
-	for (plugin = ISC_LIST_HEAD(*list); plugin != NULL; plugin = next) {
-		next = ISC_LIST_NEXT(plugin, link);
+	ISC_LIST_FOREACH_SAFE (*list, plugin, link) {
 		ISC_LIST_UNLINK(*list, plugin, link);
 		unload_plugin(&plugin);
 	}

lib/ns/interfacemgr.c

@@ -119,7 +119,6 @@ need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
 				bool existed = false;
 				bool was_listening = false;
 				isc_netaddr_t addr = { 0 };
-				ns_interface_t *ifp = NULL;
 
 				isc_netaddr_fromin6(&addr, RTA_DATA(rth));
 				INSIST(isc_netaddr_getzone(&addr) == 0);
@@ -133,10 +132,7 @@ need_rescan(ns_interfacemgr_t *mgr, struct MSGHDR *rtm, size_t len) {
 				 * router advertisements?)
 				 */
 				LOCK(&mgr->lock);
-				for (ifp = ISC_LIST_HEAD(mgr->interfaces);
-				     ifp != NULL;
-				     ifp = ISC_LIST_NEXT(ifp, link))
-				{
+				ISC_LIST_FOREACH (mgr->interfaces, ifp, link) {
 					isc_netaddr_t tmp = { 0 };
 					isc_netaddr_fromsockaddr(&tmp,
 								 &ifp->addr);
@@ -792,17 +788,16 @@ interface_destroy(ns_interface_t **interfacep) {
  */
 static ns_interface_t *
 find_matching_interface(ns_interfacemgr_t *mgr, isc_sockaddr_t *addr) {
-	ns_interface_t *ifp;
 	LOCK(&mgr->lock);
-	for (ifp = ISC_LIST_HEAD(mgr->interfaces); ifp != NULL;
-	     ifp = ISC_LIST_NEXT(ifp, link))
-	{
+	ISC_LIST_FOREACH (mgr->interfaces, ifp, link) {
 		if (isc_sockaddr_equal(&ifp->addr, addr)) {
-			break;
+			UNLOCK(&mgr->lock);
+			return ifp;
 		}
 	}
 	UNLOCK(&mgr->lock);
-	return ifp;
+
+	return NULL;
 }
 
 static void
@@ -818,15 +813,13 @@ log_interface_shutdown(const ns_interface_t *ifp) {
  */
 static void
 purge_old_interfaces(ns_interfacemgr_t *mgr) {
-	ns_interface_t *ifp = NULL, *next = NULL;
 	ISC_LIST(ns_interface_t) interfaces;
 
 	ISC_LIST_INIT(interfaces);
 
 	LOCK(&mgr->lock);
-	for (ifp = ISC_LIST_HEAD(mgr->interfaces); ifp != NULL; ifp = next) {
+	ISC_LIST_FOREACH_SAFE (mgr->interfaces, ifp, link) {
 		INSIST(NS_INTERFACE_VALID(ifp));
-		next = ISC_LIST_NEXT(ifp, link);
 		if (ifp->generation != mgr->generation) {
 			ISC_LIST_UNLINK(ifp->mgr->interfaces, ifp, link);
 			ISC_LIST_APPEND(interfaces, ifp, link);
@@ -834,8 +827,7 @@ purge_old_interfaces(ns_interfacemgr_t *mgr) {
 	}
 	UNLOCK(&mgr->lock);
 
-	for (ifp = ISC_LIST_HEAD(interfaces); ifp != NULL; ifp = next) {
-		next = ISC_LIST_NEXT(ifp, link);
+	ISC_LIST_FOREACH_SAFE (interfaces, ifp, link) {
 		if (LISTENING(ifp)) {
 			log_interface_shutdown(ifp);
 			ns_interface_shutdown(ifp);
@@ -902,16 +894,12 @@ static void
 setup_listenon(ns_interfacemgr_t *mgr, isc_interface_t *interface,
 	       in_port_t port) {
 	isc_sockaddr_t *addr;
-	isc_sockaddr_t *old;
 
 	addr = isc_mem_get(mgr->mctx, sizeof(*addr));
-
 	isc_sockaddr_fromnetaddr(addr, &interface->address, port);
 
 	LOCK(&mgr->lock);
-	for (old = ISC_LIST_HEAD(mgr->listenon); old != NULL;
-	     old = ISC_LIST_NEXT(old, link))
-	{
+	ISC_LIST_FOREACH (mgr->listenon, old, link) {
 		if (isc_sockaddr_equal(addr, old)) {
 			/* We found an existing address */
 			isc_mem_put(mgr->mctx, addr, sizeof(*addr));
@@ -926,20 +914,15 @@ unlock:
 
 static void
 clearlistenon(ns_interfacemgr_t *mgr) {
-	ISC_LIST(isc_sockaddr_t) listenon;
-	isc_sockaddr_t *old;
-
-	ISC_LIST_INIT(listenon);
+	ISC_LIST(isc_sockaddr_t) listenon = ISC_LIST_INITIALIZER;
 
 	LOCK(&mgr->lock);
 	ISC_LIST_MOVE(listenon, mgr->listenon);
 	UNLOCK(&mgr->lock);
 
-	old = ISC_LIST_HEAD(listenon);
-	while (old != NULL) {
+	ISC_LIST_FOREACH_SAFE (listenon, old, link) {
 		ISC_LIST_UNLINK(listenon, old, link);
 		isc_mem_put(mgr->mctx, old, sizeof(*old));
-		old = ISC_LIST_HEAD(listenon);
 	}
 }
 
@@ -1081,7 +1064,6 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
 	bool scan_ipv6 = false;
 	isc_result_t result;
 	isc_netaddr_t zero_address, zero_address6;
-	ns_listenelt_t *le = NULL;
 	ns_interface_t *ifp = NULL;
 	bool dolistenon;
 	char sabuf[ISC_SOCKADDR_FORMATSIZE];
@@ -1180,9 +1162,7 @@ do_scan(ns_interfacemgr_t *mgr, bool verbose, bool config) {
 	listenon:
 		ll = (family == AF_INET) ? mgr->listenon4 : mgr->listenon6;
 		dolistenon = true;
-		for (le = ISC_LIST_HEAD(ll->elts); le != NULL;
-		     le = ISC_LIST_NEXT(le, link))
-		{
+		ISC_LIST_FOREACH (ll->elts, le, link) {
 			int match;
 			bool addr_in_use = false;
 			isc_sockaddr_t listen_sockaddr;
@@ -1347,7 +1327,6 @@ ns_interfacemgr_dumprecursing(FILE *f, ns_interfacemgr_t *mgr) {
 bool
 ns_interfacemgr_listeningon(ns_interfacemgr_t *mgr,
 			    const isc_sockaddr_t *addr) {
-	isc_sockaddr_t *old;
 	bool result = false;
 
 	REQUIRE(NS_INTERFACEMGR_VALID(mgr));
@@ -1359,9 +1338,7 @@ ns_interfacemgr_listeningon(ns_interfacemgr_t *mgr,
 		return true;
 	}
 	LOCK(&mgr->lock);
-	for (old = ISC_LIST_HEAD(mgr->listenon); old != NULL;
-	     old = ISC_LIST_NEXT(old, link))
-	{
+	ISC_LIST_FOREACH (mgr->listenon, old, link) {
 		if (isc_sockaddr_equal(old, addr)) {
 			result = true;
 			break;

lib/ns/listenlist.c

@@ -297,9 +297,7 @@ ns_listenlist_create(isc_mem_t *mctx, ns_listenlist_t **target) {
 
 static void
 destroy(ns_listenlist_t *list) {
-	ns_listenelt_t *elt, *next;
-	for (elt = ISC_LIST_HEAD(list->elts); elt != NULL; elt = next) {
-		next = ISC_LIST_NEXT(elt, link);
+	ISC_LIST_FOREACH_SAFE (list->elts, elt, link) {
 		ns_listenelt_destroy(elt);
 	}
 	isc_mem_put(list->mctx, list, sizeof(*list));

lib/ns/notify.c

@@ -88,8 +88,7 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	/*
 	 * Interpret the question section.
 	 */
-	result = dns_message_firstname(request, DNS_SECTION_QUESTION);
-	if (result != ISC_R_SUCCESS) {
+	if (ISC_LIST_EMPTY(request->sections[DNS_SECTION_QUESTION])) {
 		notify_log(client, ISC_LOG_NOTICE,
 			   "notify question section empty");
 		result = DNS_R_FORMERR;
@@ -99,8 +98,7 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	/*
 	 * The question section must contain exactly one question.
 	 */
-	zonename = NULL;
-	dns_message_currentname(request, DNS_SECTION_QUESTION, &zonename);
+	zonename = ISC_LIST_HEAD(request->sections[DNS_SECTION_QUESTION]);
 	zone_rdataset = ISC_LIST_HEAD(zonename->list);
 	if (ISC_LIST_NEXT(zone_rdataset, link) != NULL) {
 		notify_log(client, ISC_LOG_NOTICE,
@@ -110,8 +108,7 @@ ns_notify_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	}
 
 	/* The zone section must have exactly one name. */
-	result = dns_message_nextname(request, DNS_SECTION_ZONE);
-	if (result != ISC_R_NOMORE) {
+	if (ISC_LIST_NEXT(zonename, link) != NULL) {
 		notify_log(client, ISC_LOG_NOTICE,
 			   "notify question section contains multiple RRs");
 		result = DNS_R_FORMERR;

lib/ns/query.c

@@ -22,6 +22,7 @@
 #include <isc/async.h>
 #include <isc/counter.h>
 #include <isc/hex.h>
+#include <isc/list.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/once.h>
@@ -729,18 +730,14 @@ query_next(ns_client_t *client, isc_result_t result) {
 
 static void
 query_freefreeversions(ns_client_t *client, bool everything) {
-	ns_dbversion_t *dbversion, *dbversion_next;
-	unsigned int i;
+	unsigned int i = 0;
 
-	for (dbversion = ISC_LIST_HEAD(client->query.freeversions), i = 0;
-	     dbversion != NULL; dbversion = dbversion_next, i++)
-	{
-		dbversion_next = ISC_LIST_NEXT(dbversion, link);
+	ISC_LIST_FOREACH_SAFE (client->query.freeversions, dbversion, link) {
 		/*
 		 * If we're not freeing everything, we keep the first three
 		 * dbversions structures around.
 		 */
-		if (i > 3 || everything) {
+		if (i++ > 3 || everything) {
 			ISC_LIST_UNLINK(client->query.freeversions, dbversion,
 					link);
 			isc_mem_put(client->manager->mctx, dbversion,
@@ -770,9 +767,6 @@ ns_query_cancel(ns_client_t *client) {
 
 static void
 query_reset(ns_client_t *client, bool everything) {
-	isc_buffer_t *dbuf, *dbuf_next;
-	ns_dbversion_t *dbversion, *dbversion_next;
-
 	CTRACE(ISC_LOG_DEBUG(3), "query_reset");
 
 	/*%
@@ -787,10 +781,7 @@ query_reset(ns_client_t *client, bool everything) {
 	/*
 	 * Cleanup any active versions.
 	 */
-	for (dbversion = ISC_LIST_HEAD(client->query.activeversions);
-	     dbversion != NULL; dbversion = dbversion_next)
-	{
-		dbversion_next = ISC_LIST_NEXT(dbversion, link);
+	ISC_LIST_FOREACH_SAFE (client->query.activeversions, dbversion, link) {
 		dns_db_closeversion(dbversion->db, &dbversion->version, false);
 		dns_db_detach(&dbversion->db);
 		ISC_LIST_INITANDAPPEND(client->query.freeversions, dbversion,
@@ -833,11 +824,8 @@ query_reset(ns_client_t *client, bool everything) {
 
 	query_freefreeversions(client, everything);
 
-	for (dbuf = ISC_LIST_HEAD(client->query.namebufs); dbuf != NULL;
-	     dbuf = dbuf_next)
-	{
-		dbuf_next = ISC_LIST_NEXT(dbuf, link);
-		if (dbuf_next != NULL || everything) {
+	ISC_LIST_FOREACH_SAFE (client->query.namebufs, dbuf, link) {
+		if (ISC_LIST_NEXT(dbuf, link) != NULL || everything) {
 			ISC_LIST_UNLINK(client->query.namebufs, dbuf, link);
 			isc_buffer_free(&dbuf);
 		}
@@ -6027,29 +6015,20 @@ cleanup:
 static void
 message_clearrdataset(dns_message_t *msg, unsigned int attr) {
 	unsigned int i;
-	dns_name_t *name, *next_name;
-	dns_rdataset_t *rds, *next_rds;
 
 	/*
 	 * Clean up name lists by calling the rdataset disassociate function.
 	 */
 	for (i = DNS_SECTION_ANSWER; i < DNS_SECTION_MAX; i++) {
-		name = ISC_LIST_HEAD(msg->sections[i]);
-		while (name != NULL) {
-			next_name = ISC_LIST_NEXT(name, link);
-
-			rds = ISC_LIST_HEAD(name->list);
-			while (rds != NULL) {
-				next_rds = ISC_LIST_NEXT(rds, link);
+		ISC_LIST_FOREACH_SAFE (msg->sections[i], name, link) {
+			ISC_LIST_FOREACH_SAFE (name->list, rds, link) {
 				if ((rds->attributes & attr) != attr) {
-					rds = next_rds;
 					continue;
 				}
 				ISC_LIST_UNLINK(name->list, rds, link);
 				INSIST(dns_rdataset_isassociated(rds));
 				dns_rdataset_disassociate(rds);
 				isc_mempool_put(msg->rdspool, rds);
-				rds = next_rds;
 			}
 
 			if (ISC_LIST_EMPTY(name->list)) {
@@ -6059,8 +6038,6 @@ message_clearrdataset(dns_message_t *msg, unsigned int attr) {
 				}
 				isc_mempool_put(msg->namepool, name);
 			}
-
-			name = next_name;
 		}
 	}
 }
@@ -8132,18 +8109,15 @@ static isc_result_t
 query_dns64(query_ctx_t *qctx) {
 	ns_client_t *client = qctx->client;
 	dns_aclenv_t *env = client->manager->aclenv;
-	dns_name_t *name, *mname;
-	dns_rdata_t *dns64_rdata;
-	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdatalist_t *dns64_rdatalist;
-	dns_rdataset_t *dns64_rdataset;
-	dns_rdataset_t *mrdataset;
-	isc_buffer_t *buffer;
+	dns_name_t *name = NULL, *mname = NULL;
+	dns_rdatalist_t *dns64_rdatalist = NULL;
+	dns_rdataset_t *dns64_rdataset = NULL;
+	dns_rdataset_t *mrdataset = NULL;
+	isc_buffer_t *buffer = NULL;
 	isc_region_t r;
 	isc_result_t result;
 	dns_view_t *view = client->view;
 	isc_netaddr_t netaddr;
-	dns_dns64_t *dns64;
 	unsigned int flags = 0;
 	const dns_section_t section = DNS_SECTION_ANSWER;
 
@@ -8166,7 +8140,6 @@ query_dns64(query_ctx_t *qctx) {
 	mname = NULL;
 	mrdataset = NULL;
 	buffer = NULL;
-	dns64_rdata = NULL;
 	dns64_rdataset = NULL;
 	dns64_rdatalist = NULL;
 	result = dns_message_findname(
@@ -8240,9 +8213,12 @@ query_dns64(query_ctx_t *qctx) {
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(qctx->rdataset))
 	{
-		for (dns64 = ISC_LIST_HEAD(client->view->dns64); dns64 != NULL;
-		     dns64 = dns_dns64_next(dns64))
+		for (dns_dns64_t *dns64 = ISC_LIST_HEAD(client->view->dns64);
+		     dns64 != NULL; dns64 = dns_dns64_next(dns64))
 		{
+			dns_rdata_t rdata = DNS_RDATA_INIT;
+			dns_rdata_t *drd = NULL;
+
 			dns_rdataset_current(qctx->rdataset, &rdata);
 			isc_buffer_availableregion(buffer, &r);
 			INSIST(r.length >= 16);
@@ -8256,14 +8232,11 @@ query_dns64(query_ctx_t *qctx) {
 			isc_buffer_add(buffer, 16);
 			isc_buffer_remainingregion(buffer, &r);
 			isc_buffer_forward(buffer, 16);
-			dns_message_gettemprdata(client->message, &dns64_rdata);
-			dns_rdata_init(dns64_rdata);
-			dns_rdata_fromregion(dns64_rdata, dns_rdataclass_in,
+			dns_message_gettemprdata(client->message, &drd);
+			dns_rdata_init(drd);
+			dns_rdata_fromregion(drd, dns_rdataclass_in,
 					     dns_rdatatype_aaaa, &r);
-			ISC_LIST_APPEND(dns64_rdatalist->rdata, dns64_rdata,
-					link);
-			dns64_rdata = NULL;
-			dns_rdata_reset(&rdata);
+			ISC_LIST_APPEND(dns64_rdatalist->rdata, drd, link);
 		}
 	}
 	if (result != ISC_R_NOMORE) {
@@ -8298,13 +8271,9 @@ cleanup:
 	}
 
 	if (dns64_rdatalist != NULL) {
-		for (dns64_rdata = ISC_LIST_HEAD(dns64_rdatalist->rdata);
-		     dns64_rdata != NULL;
-		     dns64_rdata = ISC_LIST_HEAD(dns64_rdatalist->rdata))
-		{
-			ISC_LIST_UNLINK(dns64_rdatalist->rdata, dns64_rdata,
-					link);
-			dns_message_puttemprdata(client->message, &dns64_rdata);
+		ISC_LIST_FOREACH_SAFE (dns64_rdatalist->rdata, rd, link) {
+			ISC_LIST_UNLINK(dns64_rdatalist->rdata, rd, link);
+			dns_message_puttemprdata(client->message, &rd);
 		}
 		dns_message_puttemprdatalist(client->message, &dns64_rdatalist);
 	}
@@ -8316,12 +8285,11 @@ cleanup:
 static void
 query_filter64(query_ctx_t *qctx) {
 	ns_client_t *client = qctx->client;
-	dns_name_t *name, *mname;
-	dns_rdata_t *myrdata;
+	dns_name_t *name = NULL, *mname = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	dns_rdatalist_t *myrdatalist;
-	dns_rdataset_t *myrdataset;
-	isc_buffer_t *buffer;
+	dns_rdatalist_t *myrdatalist = NULL;
+	dns_rdataset_t *myrdataset = NULL;
+	isc_buffer_t *buffer = NULL;
 	isc_region_t r;
 	isc_result_t result;
 	unsigned int i;
@@ -8334,11 +8302,6 @@ query_filter64(query_ctx_t *qctx) {
 	       dns_rdataset_count(qctx->rdataset));
 
 	name = qctx->fname;
-	mname = NULL;
-	buffer = NULL;
-	myrdata = NULL;
-	myrdataset = NULL;
-	myrdatalist = NULL;
 	result = dns_message_findname(
 		client->message, section, name, dns_rdatatype_aaaa,
 		qctx->rdataset->covers, &mname, &myrdataset);
@@ -8383,6 +8346,8 @@ query_filter64(query_ctx_t *qctx) {
 	     result == ISC_R_SUCCESS;
 	     result = dns_rdataset_next(qctx->rdataset))
 	{
+		dns_rdata_t *myrdata = NULL;
+
 		if (!client->query.dns64_aaaaok[i++]) {
 			continue;
 		}
@@ -8396,7 +8361,6 @@ query_filter64(query_ctx_t *qctx) {
 		dns_rdata_fromregion(myrdata, dns_rdataclass_in,
 				     dns_rdatatype_aaaa, &r);
 		ISC_LIST_APPEND(myrdatalist->rdata, myrdata, link);
-		myrdata = NULL;
 		dns_rdata_reset(&rdata);
 	}
 	if (result != ISC_R_NOMORE) {
@@ -8432,10 +8396,7 @@ cleanup:
 	}
 
 	if (myrdatalist != NULL) {
-		for (myrdata = ISC_LIST_HEAD(myrdatalist->rdata);
-		     myrdata != NULL;
-		     myrdata = ISC_LIST_HEAD(myrdatalist->rdata))
-		{
+		ISC_LIST_FOREACH_SAFE (myrdatalist->rdata, myrdata, link) {
 			ISC_LIST_UNLINK(myrdatalist->rdata, myrdata, link);
 			dns_message_puttemprdata(client->message, &myrdata);
 		}
@@ -8852,7 +8813,6 @@ query_addds(query_ctx_t *qctx) {
 	ns_client_t *client = qctx->client;
 	dns_fixedname_t fixed;
 	dns_name_t *fname = NULL;
-	dns_name_t *rname = NULL;
 	dns_name_t *name;
 	dns_rdataset_t *rdataset = NULL, *sigrdataset = NULL;
 	isc_buffer_t *dbuf, b;
@@ -8897,41 +8857,24 @@ query_addds(query_ctx_t *qctx) {
 		goto addnsec3;
 	}
 
-	/*
-	 * We've already added the NS record, so if the name's not there,
-	 * we have other problems.
-	 */
-	result = dns_message_firstname(client->message, DNS_SECTION_AUTHORITY);
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
 	/*
 	 * Find the delegation in the response message - it is not necessarily
 	 * the first name in the AUTHORITY section when wildcard processing is
 	 * involved.
 	 */
-	while (result == ISC_R_SUCCESS) {
-		rname = NULL;
-		dns_message_currentname(client->message, DNS_SECTION_AUTHORITY,
-					&rname);
+	MSG_SECTION_FOREACH (client->message, DNS_SECTION_AUTHORITY, rname) {
 		result = dns_message_findtype(rname, dns_rdatatype_ns, 0, NULL);
 		if (result == ISC_R_SUCCESS) {
+			/*
+			 * Add the relevant RRset (DS or NSEC) to the
+			 * delegation.
+			 */
+			query_addrrset(qctx, &rname, &rdataset, &sigrdataset,
+				       NULL, DNS_SECTION_AUTHORITY);
 			break;
 		}
-		result = dns_message_nextname(client->message,
-					      DNS_SECTION_AUTHORITY);
 	}
 
-	if (result != ISC_R_SUCCESS) {
-		goto cleanup;
-	}
-
-	/*
-	 * Add the relevant RRset (DS or NSEC) to the delegation.
-	 */
-	query_addrrset(qctx, &rname, &rdataset, &sigrdataset, NULL,
-		       DNS_SECTION_AUTHORITY);
 	goto cleanup;
 
 addnsec3:
@@ -11317,9 +11260,7 @@ static void
 query_glueanswer(query_ctx_t *qctx) {
 	const dns_namelist_t *secs = qctx->client->message->sections;
 	const dns_section_t section = DNS_SECTION_ADDITIONAL;
-	dns_name_t *name;
 	dns_message_t *msg;
-	dns_rdataset_t *rdataset = NULL;
 
 	if (!ISC_LIST_EMPTY(secs[DNS_SECTION_ANSWER]) ||
 	    qctx->client->message->rcode != dns_rcode_noerror ||
@@ -11329,28 +11270,26 @@ query_glueanswer(query_ctx_t *qctx) {
 	}
 
 	msg = qctx->client->message;
-	for (name = ISC_LIST_HEAD(msg->sections[section]); name != NULL;
-	     name = ISC_LIST_NEXT(name, link))
-	{
+	MSG_SECTION_FOREACH (msg, section, name) {
 		if (dns_name_equal(name, qctx->client->query.qname)) {
-			for (rdataset = ISC_LIST_HEAD(name->list);
-			     rdataset != NULL;
-			     rdataset = ISC_LIST_NEXT(rdataset, link))
-			{
+			ISC_LIST_FOREACH (name->list, rdataset, link) {
 				if (rdataset->type == qctx->qtype) {
+					ISC_LIST_UNLINK(msg->sections[section],
+							name, link);
+					ISC_LIST_PREPEND(msg->sections[section],
+							 name, link);
+					ISC_LIST_UNLINK(name->list, rdataset,
+							link);
+					ISC_LIST_PREPEND(name->list, rdataset,
+							 link);
+					rdataset->attributes |=
+						DNS_RDATASETATTR_REQUIRED;
 					break;
 				}
 			}
 			break;
 		}
 	}
-	if (rdataset != NULL) {
-		ISC_LIST_UNLINK(msg->sections[section], name, link);
-		ISC_LIST_PREPEND(msg->sections[section], name, link);
-		ISC_LIST_UNLINK(name->list, rdataset, link);
-		ISC_LIST_PREPEND(name->list, rdataset, link);
-		rdataset->attributes |= DNS_RDATASETATTR_REQUIRED;
-	}
 }
 
 isc_result_t
@@ -11748,25 +11687,21 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	/*
 	 * Get the question name.
 	 */
-	result = dns_message_firstname(message, DNS_SECTION_QUESTION);
-	if (result != ISC_R_SUCCESS) {
-		query_error(client, result, __LINE__);
+	if (ISC_LIST_EMPTY(message->sections[DNS_SECTION_QUESTION])) {
+		query_error(client, ISC_R_NOMORE, __LINE__);
 		return;
 	}
-	dns_message_currentname(message, DNS_SECTION_QUESTION,
-				&client->query.qname);
+
+	client->query.qname =
+		ISC_LIST_HEAD(message->sections[DNS_SECTION_QUESTION]);
 	client->query.origqname = client->query.qname;
-	result = dns_message_nextname(message, DNS_SECTION_QUESTION);
-	if (result != ISC_R_NOMORE) {
-		if (result == ISC_R_SUCCESS) {
-			/*
-			 * There's more than one QNAME in the question
-			 * section.
-			 */
-			query_error(client, DNS_R_FORMERR, __LINE__);
-		} else {
-			query_error(client, result, __LINE__);
-		}
+
+	if (ISC_LIST_NEXT(client->query.qname, link) != NULL) {
+		/*
+		 * There's more than one QNAME in the question
+		 * section.
+		 */
+		query_error(client, DNS_R_FORMERR, __LINE__);
 		return;
 	}
 

lib/ns/server.c

@@ -127,10 +127,7 @@ ns_server_detach(ns_server_t **sctxp) {
 	*sctxp = NULL;
 
 	if (isc_refcount_decrement(&sctx->references) == 1) {
-		ns_altsecret_t *altsecret;
-		isc_quota_t *http_quota;
-
-		while ((altsecret = ISC_LIST_HEAD(sctx->altsecrets)) != NULL) {
+		ISC_LIST_FOREACH_SAFE (sctx->altsecrets, altsecret, link) {
 			ISC_LIST_UNLINK(sctx->altsecrets, altsecret, link);
 			isc_mem_put(sctx->mctx, altsecret, sizeof(*altsecret));
 		}
@@ -145,16 +142,11 @@ ns_server_detach(ns_server_t **sctxp) {
 		isc_quota_destroy(&sctx->tcpquota);
 		isc_quota_destroy(&sctx->xfroutquota);
 
-		http_quota = ISC_LIST_HEAD(sctx->http_quotas);
-		while (http_quota != NULL) {
-			isc_quota_t *next = NULL;
-
-			next = ISC_LIST_NEXT(http_quota, link);
+		ISC_LIST_FOREACH_SAFE (sctx->http_quotas, http_quota, link) {
 			ISC_LIST_DEQUEUE(sctx->http_quotas, http_quota, link);
 			isc_quota_destroy(http_quota);
 			isc_mem_put(sctx->mctx, http_quota,
 				    sizeof(*http_quota));
-			http_quota = next;
 		}
 		isc_mutex_destroy(&sctx->http_quotas_lock);
 

lib/ns/update.c

@@ -484,8 +484,7 @@ static isc_result_t
 do_diff(dns_diff_t *updates, dns_db_t *db, dns_dbversion_t *ver,
 	dns_diff_t *diff) {
 	isc_result_t result;
-	while (!ISC_LIST_EMPTY(updates->tuples)) {
-		dns_difftuple_t *t = ISC_LIST_HEAD(updates->tuples);
+	ISC_LIST_FOREACH_SAFE (updates->tuples, t, link) {
 		ISC_LIST_UNLINK(updates->tuples, t, link);
 		CHECK(do_one_tuple(&t, db, ver, diff));
 	}
@@ -1517,14 +1516,12 @@ add_rr_prepare_action(void *data, rr_t *rr) {
  * 'rdata', and 'ttl', respectively.
  */
 static void
-get_current_rr(dns_message_t *msg, dns_section_t section,
-	       dns_rdataclass_t zoneclass, dns_name_t **name,
-	       dns_rdata_t *rdata, dns_rdatatype_t *covers, dns_ttl_t *ttl,
+get_current_rr(dns_rdataclass_t zoneclass, dns_name_t *name, dns_rdata_t *rdata,
+	       dns_rdatatype_t *covers, dns_ttl_t *ttl,
 	       dns_rdataclass_t *update_class) {
 	dns_rdataset_t *rdataset;
 	isc_result_t result;
-	dns_message_currentname(msg, section, name);
-	rdataset = ISC_LIST_HEAD((*name)->list);
+	rdataset = ISC_LIST_HEAD(name->list);
 	INSIST(rdataset != NULL);
 	INSIST(ISC_LIST_NEXT(rdataset, link) == NULL);
 	*covers = rdataset->covers;
@@ -1688,20 +1685,15 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
 					 sizeof(*maxbytype));
 	}
 
-	for (update = 0,
-	    result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-	     result == ISC_R_SUCCESS; update++,
-	    result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-	{
-		dns_name_t *name = NULL;
+	update = 0;
+	MSG_SECTION_FOREACH (request, DNS_SECTION_UPDATE, name) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 
 		INSIST(ssutable == NULL || update < maxbytypelen);
-
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
-			       &rdata, &covers, &ttl, &update_class);
+		get_current_rr(zoneclass, name, &rdata, &covers, &ttl,
+			       &update_class);
 
 		if (!dns_name_issubdomain(name, zonename)) {
 			FAILC(DNS_R_NOTZONE, "update RR is outside zone");
@@ -1859,9 +1851,7 @@ send_update(ns_client_t *client, dns_zone_t *zone) {
 				}
 			}
 		}
-	}
-	if (result != ISC_R_NOMORE) {
-		FAIL(result);
+		update++;
 	}
 
 	update_log(client, zone, LOGLEVEL_DEBUG, "update section prescan OK");
@@ -1944,8 +1934,8 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 	/*
 	 * Interpret the zone section.
 	 */
-	result = dns_message_firstname(request, DNS_SECTION_ZONE);
-	if (result != ISC_R_SUCCESS) {
+
+	if (ISC_LIST_EMPTY(request->sections[DNS_SECTION_ZONE])) {
 		FAILC(DNS_R_FORMERR, "update zone section empty");
 	}
 
@@ -1953,8 +1943,7 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 	 * The zone section must contain exactly one "question", and
 	 * it must be of type SOA.
 	 */
-	zonename = NULL;
-	dns_message_currentname(request, DNS_SECTION_ZONE, &zonename);
+	zonename = ISC_LIST_HEAD(request->sections[DNS_SECTION_ZONE]);
 	zone_rdataset = ISC_LIST_HEAD(zonename->list);
 	if (zone_rdataset->type != dns_rdatatype_soa) {
 		FAILC(DNS_R_FORMERR, "update zone section contains non-SOA");
@@ -1965,8 +1954,7 @@ ns_update_start(ns_client_t *client, isc_nmhandle_t *handle,
 	}
 
 	/* The zone section must have exactly one name. */
-	result = dns_message_nextname(request, DNS_SECTION_ZONE);
-	if (result != ISC_R_NOMORE) {
+	if (ISC_LIST_NEXT(zonename, link) != NULL) {
 		FAILC(DNS_R_FORMERR,
 		      "update zone section contains multiple RRs");
 	}
@@ -2044,14 +2032,11 @@ static isc_result_t
 remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
 	isc_result_t result;
 	bool ns_exists;
-	dns_difftuple_t *tuple;
 	dns_diff_t temp_diff;
 
 	dns_diff_init(diff->mctx, &temp_diff);
 
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, tuple, link) {
 		if (!((tuple->op == DNS_DIFFOP_DEL &&
 		       tuple->rdata.type == dns_rdatatype_ns) ||
 		      (tuple->op == DNS_DIFFOP_ADD &&
@@ -2072,9 +2057,7 @@ remove_orphaned_ds(dns_db_t *db, dns_dbversion_t *newver, dns_diff_t *diff) {
 	result = ISC_R_SUCCESS;
 
 failure:
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_HEAD(temp_diff.tuples))
-	{
+	ISC_LIST_FOREACH_SAFE (temp_diff.tuples, tuple, link) {
 		ISC_LIST_UNLINK(temp_diff.tuples, tuple, link);
 		dns_diff_appendminimal(diff, &tuple);
 	}
@@ -2091,9 +2074,8 @@ check_mx(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char namebuf[DNS_NAME_FORMATSIZE];
 	char altbuf[DNS_NAME_FORMATSIZE];
-	dns_difftuple_t *t;
 	dns_fixedname_t fixed;
-	dns_name_t *foundname;
+	dns_name_t *foundname = NULL;
 	dns_rdata_mx_t mx;
 	dns_rdata_t rdata;
 	bool ok = true;
@@ -2107,9 +2089,7 @@ check_mx(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	dns_rdata_init(&rdata);
 	options = dns_zone_getoptions(zone);
 
-	for (t = ISC_LIST_HEAD(diff->tuples); t != NULL;
-	     t = ISC_LIST_NEXT(t, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, t, link) {
 		if (t->op != DNS_DIFFOP_ADD ||
 		    t->rdata.type != dns_rdatatype_mx)
 		{
@@ -2380,7 +2360,7 @@ static isc_result_t
 add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		       dns_dbversion_t *ver, dns_diff_t *diff) {
 	isc_result_t result = ISC_R_SUCCESS;
-	dns_difftuple_t *tuple, *newtuple = NULL, *next;
+	dns_difftuple_t *newtuple = NULL;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	unsigned char buf[DNS_NSEC3PARAM_BUFFERSIZE + 1];
 	dns_diff_t temp_diff;
@@ -2399,9 +2379,7 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	/*
 	 * Extract NSEC3PARAM tuples from list.
 	 */
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; tuple = next) {
-		next = ISC_LIST_NEXT(tuple, link);
-
+	ISC_LIST_FOREACH_SAFE (diff->tuples, tuple, link) {
 		if (tuple->rdata.type != dns_rdatatype_nsec3param ||
 		    !dns_name_equal(name, &tuple->name))
 		{
@@ -2415,8 +2393,9 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * Extract TTL changes pairs, we don't need to convert these to
 	 * delayed changes.
 	 */
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next)
+	for (dns_difftuple_t *tuple = ISC_LIST_HEAD(temp_diff.tuples),
+			     *next = NULL;
+	     tuple != NULL; tuple = next)
 	{
 		if (tuple->op == DNS_DIFFOP_ADD) {
 			if (!ttl_good) {
@@ -2475,10 +2454,7 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * in managing and should not be touched so revert such changes
 	 * taking into account any TTL change of the NSEC3PARAM RRset.
 	 */
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next)
-	{
-		next = ISC_LIST_NEXT(tuple, link);
+	ISC_LIST_FOREACH_SAFE (temp_diff.tuples, tuple, link) {
 		if ((tuple->rdata.data[1] & ~DNS_NSEC3FLAG_OPTOUT) != 0) {
 			/*
 			 * If we haven't had any adds then the tuple->ttl must
@@ -2504,8 +2480,9 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 	 * Convert the adds to delayed adds and the deletions into delayed
 	 * deletions.
 	 */
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next)
+	for (dns_difftuple_t *tuple = ISC_LIST_HEAD(temp_diff.tuples),
+			     *next = NULL;
+	     tuple != NULL; tuple = next)
 	{
 		/*
 		 * If we haven't had any adds then the tuple->ttl must be the
@@ -2609,8 +2586,9 @@ add_nsec3param_records(ns_client_t *client, dns_zone_t *zone, dns_db_t *db,
 		}
 	}
 
-	for (tuple = ISC_LIST_HEAD(temp_diff.tuples); tuple != NULL;
-	     tuple = next)
+	for (dns_difftuple_t *tuple = ISC_LIST_HEAD(temp_diff.tuples),
+			     *next = NULL;
+	     tuple != NULL; tuple = next)
 	{
 		INSIST(ttl_good);
 
@@ -2653,7 +2631,7 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
 		 dns_dbversion_t *ver, dns_diff_t *diff) {
 	dns_diff_t temp_diff;
 	dns_diffop_t op;
-	dns_difftuple_t *tuple, *newtuple = NULL, *next;
+	dns_difftuple_t *newtuple = NULL;
 	dns_name_t *name = dns_db_origin(db);
 	isc_mem_t *mctx = diff->mctx;
 	isc_result_t result;
@@ -2667,9 +2645,7 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
 	/*
 	 * Extract the changes to be rolled back.
 	 */
-	for (tuple = ISC_LIST_HEAD(diff->tuples); tuple != NULL; tuple = next) {
-		next = ISC_LIST_NEXT(tuple, link);
-
+	ISC_LIST_FOREACH_SAFE (diff->tuples, tuple, link) {
 		if (tuple->rdata.type != privatetype ||
 		    !dns_name_equal(name, &tuple->name))
 		{
@@ -2693,7 +2669,7 @@ rollback_private(dns_db_t *db, dns_rdatatype_t privatetype,
 	/*
 	 * Rollback the changes.
 	 */
-	while ((tuple = ISC_LIST_HEAD(temp_diff.tuples)) != NULL) {
+	ISC_LIST_FOREACH_SAFE (temp_diff.tuples, tuple, link) {
 		op = (tuple->op == DNS_DIFFOP_DEL) ? DNS_DIFFOP_ADD
 						   : DNS_DIFFOP_DEL;
 		dns_difftuple_create(mctx, op, name, tuple->ttl, &tuple->rdata,
@@ -2775,18 +2751,14 @@ update_action(void *arg) {
 	 * Check prerequisites.
 	 */
 
-	for (result = dns_message_firstname(request, DNS_SECTION_PREREQUISITE);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(request, DNS_SECTION_PREREQUISITE))
-	{
-		dns_name_t *name = NULL;
+	MSG_SECTION_FOREACH (request, DNS_SECTION_PREREQUISITE, name) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
 		bool flag;
 
-		get_current_rr(request, DNS_SECTION_PREREQUISITE, zoneclass,
-			       &name, &rdata, &covers, &ttl, &update_class);
+		get_current_rr(zoneclass, name, &rdata, &covers, &ttl,
+			       &update_class);
 
 		if (ttl != 0) {
 			PREREQFAILC(DNS_R_FORMERR,
@@ -2856,9 +2828,6 @@ update_action(void *arg) {
 			PREREQFAILC(DNS_R_FORMERR, "malformed prerequisite");
 		}
 	}
-	if (result != ISC_R_NOMORE) {
-		FAIL(result);
-	}
 
 	/*
 	 * Perform the final check of the "rrset exists (value dependent)"
@@ -2892,12 +2861,9 @@ update_action(void *arg) {
 	 * Process the Update Section.
 	 */
 	INSIST(ssutable == NULL || maxbytype != NULL);
-	for (update = 0,
-	    result = dns_message_firstname(request, DNS_SECTION_UPDATE);
-	     result == ISC_R_SUCCESS; update++,
-	    result = dns_message_nextname(request, DNS_SECTION_UPDATE))
-	{
-		dns_name_t *name = NULL;
+
+	update = 0;
+	MSG_SECTION_FOREACH (request, DNS_SECTION_UPDATE, name) {
 		dns_rdata_t rdata = DNS_RDATA_INIT;
 		dns_ttl_t ttl;
 		dns_rdataclass_t update_class;
@@ -2905,8 +2871,8 @@ update_action(void *arg) {
 
 		INSIST(ssutable == NULL || update < maxbytypelen);
 
-		get_current_rr(request, DNS_SECTION_UPDATE, zoneclass, &name,
-			       &rdata, &covers, &ttl, &update_class);
+		get_current_rr(zoneclass, name, &rdata, &covers, &ttl,
+			       &update_class);
 
 		if (update_class == zoneclass) {
 			/*
@@ -3254,9 +3220,8 @@ update_action(void *arg) {
 			CHECK(delete_if(rr_equal_p, db, ver, name, rdata.type,
 					covers, &rdata, &diff));
 		}
-	}
-	if (result != ISC_R_NOMORE) {
-		FAIL(result);
+
+		++update;
 	}
 
 	/*

lib/ns/xfrout.c

@@ -15,6 +15,7 @@
 #include <stdbool.h>
 
 #include <isc/formatcheck.h>
+#include <isc/list.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/netmgr.h>
@@ -731,8 +732,6 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	rrstream_t *data_stream = NULL;
 	rrstream_t *stream = NULL;
 	dns_difftuple_t *current_soa_tuple = NULL;
-	dns_name_t *soa_name;
-	dns_rdataset_t *soa_rdataset;
 	dns_rdata_t soa_rdata = DNS_RDATA_INIT;
 	bool have_soa = false;
 	const char *mnemonic = NULL;
@@ -779,23 +778,21 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Interpret the question section.
 	 */
-	result = dns_message_firstname(request, DNS_SECTION_QUESTION);
-	INSIST(result == ISC_R_SUCCESS);
+	INSIST(!ISC_LIST_EMPTY(request->sections[DNS_SECTION_QUESTION]));
 
 	/*
 	 * The question section must contain exactly one question, and
 	 * it must be for AXFR/IXFR as appropriate.
 	 */
-	question_name = NULL;
-	dns_message_currentname(request, DNS_SECTION_QUESTION, &question_name);
+	question_name = ISC_LIST_HEAD(request->sections[DNS_SECTION_QUESTION]);
 	question_rdataset = ISC_LIST_HEAD(question_name->list);
 	question_class = question_rdataset->rdclass;
 	INSIST(question_rdataset->type == reqtype);
 	if (ISC_LIST_NEXT(question_rdataset, link) != NULL) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
 	}
-	result = dns_message_nextname(request, DNS_SECTION_QUESTION);
-	if (result != ISC_R_NOMORE) {
+
+	if (ISC_LIST_NEXT(question_name, link) != NULL) {
 		FAILC(DNS_R_FORMERR, "multiple questions");
 	}
 
@@ -870,14 +867,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	 * Check the authority section.  Look for a SOA record with
 	 * the same name and class as the question.
 	 */
-	for (result = dns_message_firstname(request, DNS_SECTION_AUTHORITY);
-	     result == ISC_R_SUCCESS;
-	     result = dns_message_nextname(request, DNS_SECTION_AUTHORITY))
-	{
-		soa_name = NULL;
-		dns_message_currentname(request, DNS_SECTION_AUTHORITY,
-					&soa_name);
-
+	MSG_SECTION_FOREACH (request, DNS_SECTION_AUTHORITY, soa_name) {
 		/*
 		 * Ignore data whose owner name is not the zone apex.
 		 */
@@ -885,10 +875,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 			continue;
 		}
 
-		for (soa_rdataset = ISC_LIST_HEAD(soa_name->list);
-		     soa_rdataset != NULL;
-		     soa_rdataset = ISC_LIST_NEXT(soa_rdataset, link))
-		{
+		ISC_LIST_FOREACH (soa_name->list, soa_rdataset, link) {
 			/*
 			 * Ignore non-SOA data.
 			 */

tests/dns/dbdiff_test.c

@@ -76,7 +76,6 @@ ISC_RUN_TEST_IMPL(diffx_same) {
 /* dns_db_diffx of zone with record added */
 ISC_RUN_TEST_IMPL(diffx_add) {
 	dns_db_t *newdb = NULL, *olddb = NULL;
-	dns_difftuple_t *tuple;
 	isc_result_t result;
 	dns_diff_t diff;
 	int count = 0;
@@ -92,9 +91,7 @@ ISC_RUN_TEST_IMPL(diffx_add) {
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	assert_false(ISC_LIST_EMPTY(diff.tuples));
-	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
+	ISC_LIST_FOREACH (diff.tuples, tuple, link) {
 		assert_int_equal(tuple->op, DNS_DIFFOP_ADD);
 		count++;
 	}
@@ -108,7 +105,6 @@ ISC_RUN_TEST_IMPL(diffx_add) {
 /* dns_db_diffx of zone with record removed */
 ISC_RUN_TEST_IMPL(diffx_remove) {
 	dns_db_t *newdb = NULL, *olddb = NULL;
-	dns_difftuple_t *tuple;
 	isc_result_t result;
 	dns_diff_t diff;
 	int count = 0;
@@ -124,9 +120,7 @@ ISC_RUN_TEST_IMPL(diffx_remove) {
 	assert_int_equal(result, ISC_R_SUCCESS);
 
 	assert_false(ISC_LIST_EMPTY(diff.tuples));
-	for (tuple = ISC_LIST_HEAD(diff.tuples); tuple != NULL;
-	     tuple = ISC_LIST_NEXT(tuple, link))
-	{
+	ISC_LIST_FOREACH (diff.tuples, tuple, link) {
 		assert_int_equal(tuple->op, DNS_DIFFOP_DEL);
 		count++;
 	}

tests/dns/diff_test.c

@@ -47,13 +47,10 @@ unsigned char data_nodup[] = "\006name_1";
 dns_name_t name_nodup = DNS_NAME_INITABSOLUTE(data_nodup);
 
 static size_t
-count_elements(const dns_diff_t *diff) {
-	dns_difftuple_t *ot = NULL;
+count_elements(dns_diff_t *diff) {
 	size_t count = 0;
 
-	for (ot = ISC_LIST_HEAD(diff->tuples); ot != NULL;
-	     ot = ISC_LIST_NEXT(ot, link))
-	{
+	ISC_LIST_FOREACH (diff->tuples, ot, link) {
 		++count;
 	}
 

tests/dns/sigs_test.c

@@ -175,8 +175,7 @@ updatesigs_test(const updatesigs_test_params_t *test, dns_zone_t *zone,
 	size_t tuples_expected, tuples_found, index;
 	dns_dbversion_t *version = NULL;
 	dns_diff_t raw_diff, zone_diff;
-	const zonediff_t *expected;
-	dns_difftuple_t *found;
+	const zonediff_t *expected = NULL;
 	isc_result_t result;
 
 	dns__zonediff_t zonediff = {
@@ -235,9 +234,7 @@ updatesigs_test(const updatesigs_test_params_t *test, dns_zone_t *zone,
 	}
 
 	tuples_found = 0;
-	for (found = ISC_LIST_HEAD(zone_diff.tuples); found != NULL;
-	     found = ISC_LIST_NEXT(found, link))
-	{
+	ISC_LIST_FOREACH (zone_diff.tuples, found, link) {
 		tuples_found++;
 	}
 
@@ -248,9 +245,7 @@ updatesigs_test(const updatesigs_test_params_t *test, dns_zone_t *zone,
 	 */
 	expected = test->zonediff;
 	index = 1;
-	for (found = ISC_LIST_HEAD(zone_diff.tuples); found != NULL;
-	     found = ISC_LIST_NEXT(found, link))
-	{
+	ISC_LIST_FOREACH (zone_diff.tuples, found, link) {
 		compare_tuples(expected, found, index);
 		expected++;
 		index++;

tests/dns/skr_test.c

@@ -129,9 +129,7 @@ print_rdata(FILE *fp, dns_rdata_t *rdata) {
 	isc_buffer_usedregion(&target, &r);
 	fprintf(fp, "%.*s", (int)r.length, (char *)r.base);
 
-	for (dns_rdata_t *rd = ISC_LIST_HEAD(rdatalist->rdata); rd != NULL;
-	     rd = ISC_LIST_HEAD(rdatalist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (rdatalist->rdata, rd, link) {
 		ISC_LIST_UNLINK(rdatalist->rdata, rdata, link);
 	}
 	isc_mem_put(mctx, rdatalist, sizeof(*rdatalist));
@@ -241,9 +239,7 @@ create_bundle(FILE *fp, isc_stdtime_t btime, int bnum) {
 	sign_rrset(fp, btime, (btime + LIFETIME), dnskeyset,
 		   test_bundles[bnum].rrsig1buf,
 		   &test_bundles[bnum].dnskey_rrsig);
-	for (dns_rdata_t *rd = ISC_LIST_HEAD(dnskeylist->rdata); rd != NULL;
-	     rd = ISC_LIST_HEAD(dnskeylist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (dnskeylist->rdata, rd, link) {
 		ISC_LIST_UNLINK(dnskeylist->rdata, rd, link);
 	}
 	isc_mem_put(mctx, dnskeylist, sizeof(*dnskeylist));
@@ -268,9 +264,7 @@ create_bundle(FILE *fp, isc_stdtime_t btime, int bnum) {
 	sign_rrset(fp, btime, (btime + LIFETIME), cdnskeyset,
 		   test_bundles[bnum].rrsig2buf,
 		   &test_bundles[bnum].cdnskey_rrsig);
-	for (dns_rdata_t *rd = ISC_LIST_HEAD(cdnskeylist->rdata); rd != NULL;
-	     rd = ISC_LIST_HEAD(cdnskeylist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (cdnskeylist->rdata, rd, link) {
 		ISC_LIST_UNLINK(cdnskeylist->rdata, rd, link);
 	}
 	isc_mem_put(mctx, cdnskeylist, sizeof(*cdnskeylist));
@@ -293,9 +287,7 @@ create_bundle(FILE *fp, isc_stdtime_t btime, int bnum) {
 	dns_rdata_init(&test_bundles[bnum].cds_rrsig);
 	sign_rrset(fp, btime, (btime + LIFETIME), cdsset,
 		   test_bundles[bnum].rrsig3buf, &test_bundles[bnum].cds_rrsig);
-	for (dns_rdata_t *rd = ISC_LIST_HEAD(cdslist->rdata); rd != NULL;
-	     rd = ISC_LIST_HEAD(cdslist->rdata))
-	{
+	ISC_LIST_FOREACH_SAFE (cdslist->rdata, rd, link) {
 		ISC_LIST_UNLINK(cdslist->rdata, rd, link);
 	}
 	isc_mem_put(mctx, cdslist, sizeof(*cdslist));
@@ -467,9 +459,7 @@ ISC_RUN_TEST_IMPL(skr_read) {
 	isc_file_remove(testskr);
 
 	/* Test bundles */
-	for (dns_skrbundle_t *bundle = ISC_LIST_HEAD(skr->bundles);
-	     bundle != NULL; bundle = ISC_LIST_NEXT(bundle, link))
-	{
+	ISC_LIST_FOREACH (skr->bundles, bundle, link) {
 		count++;
 	}
 	assert_int_equal(count, 42);

tests/libtest/qp.c

@@ -167,9 +167,8 @@ qp_test_dumpmulti(dns_qpmulti_t *multi) {
 	       qpr.base);
 	printf("qpmulti->reader %p whence %p\n", reader, whence);
 	unsigned int snapshots = 0;
-	for (dns_qpsnap_t *snap = ISC_LIST_HEAD(multi->snapshots); //
-	     snap != NULL; snap = ISC_LIST_NEXT(snap, link), snapshots++)
-	{
+	ISC_LIST_FOREACH (multi->snapshots, snap, link) {
+		snapshots++;
 	}
 	printf("qpmulti %p snapshots %u\n", multi, snapshots);
 	fflush(stdout);