Use 65432 for DELEG type

WIP: DELEG resolver side
WIP: Add experimental authoritative DELEG support
2024-11-02 15:48:07 +01:00 · 2024-11-02 15:48:07 +01:00 · 2024-11-02 14:03:52 +01:00 · 2024-11-02 12:01:43 +01:00
1439 changed files with 60141 additions and 34141 deletions
@@ -79,5 +79,3 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -78,5 +78,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -1544,7 +1544,3 @@ b7de2c7cb959fa35099d72c3f9b13938348c74e6
 ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
 # Reformat sources with up-to-date clang-format-19
 ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
-# Remove redundant semicolons after the closing braces of functions
-1a19ce39db12ed4ecf59a3d0f5734656d24999a5
-# Remove redundant parentheses from the return statement
-0258850f202b7a46b52f3e3a4968c3fc68fe9a45
@@ -96,7 +96,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop
@@ -31,11 +31,11 @@ confidential!
  - [ ] [:link:][step_deputy]            **(IM)** Pick a Deputy Incident Manager
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
-  - [ ] [:link:][step_coordinate_cve_id] **(SwEng)** Check if we need to coordinate with other vendors (an industry-wide CVE identifier might be necessary)
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and the CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
+  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
@@ -48,7 +48,6 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
-  - [ ] [:link:][step_coordinate_check]  **(SwEng)** Make sure other vendors are able to release on the date that was previously agreed upon
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
@@ -69,16 +68,15 @@ confidential!
 ### On the Day of Public Disclosure

  - [ ] [:link:][step_clearance]         **(IM)** Grant QA & Marketing clearance to proceed with public release
-  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
-  - [ ] [:link:][step_bump_advisory]     **(Support)** Bump Document Version for the Security Advisory in Printing Press
-  - [ ] [:link:][step_publish_advisory]  **(Support)** Publish the Security Advisory in the Knowledge Base
  - [ ] [:link:][step_publish]           **(QA/Marketing)** Publish the releases (as outlined in the release checklist)
+  - [ ] [:link:][step_matrix]            **(Support)** (BIND 9 only) Add the new CVEs to the vulnerability matrix in the Knowledge Base
+  - [ ] [:link:][step_publish_advisory]  **(Support)** Bump Document Version for the Security Advisory and publish it in the Knowledge Base
  - [ ] [:link:][step_notifications]     **(First IM)** Send notification emails to third parties
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the appropriate announce queue in RT that the release is published
+  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published

 ### After Public Disclosure

@@ -87,13 +85,13 @@ confidential!
 [step_deputy]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#pick-a-deputy-incident-manager
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
-[step_coordinate_cve_id]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#check-if-we-need-to-coordinate-with-other-vendors-an-industry-wide-cve-identifier-might-be-necessary
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
 [step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
-[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text
-[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-ticket-in-support-portal-earliest-queue-which-will-notify-earliest-customers
+[step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
+[step_earliest_prepare]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-earliest-notification-text-and-hand-it-off-to-marketing
+[step_earliest_send]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-earliest-notification-document-in-sf-portal-and-send-bulk-email-to-earliest-customers
 [step_advisory_mr]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-a-merge-request-for-the-security-advisory-and-include-all-readily-available-information-in-it
 [step_reproducer_mr]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-private-merge-request-containing-a-system-test-reproducing-the-problem
 [step_notify_support]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-support-when-a-reproducer-is-ready
@@ -104,26 +102,25 @@ confidential!
 [step_backports]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-backports-of-the-merge-request-addressing-the-problem-for-all-affected-and-still-maintained-branches-of-a-given-product
 [step_finish_advisory]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#finish-preparing-the-security-advisory
 [step_meta_issue]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#create-or-update-the-private-issue-containing-links-to-fixes-reproducers-for-all-cves-fixed-in-a-given-release-cycle
-[step_coordinate_check]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#make-sure-other-vendors-are-able-to-release-on-the-date-that-was-previously-agreed-upon
+[step_changes]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-reserve-a-block-of-changes-placeholders-once-the-complete-set-of-vulnerabilities-fixed-in-a-given-release-cycle-is-determined
 [step_merge_fixes]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-cve-fixes-in-cve-identifier-order
 [step_patches]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-a-standalone-patch-for-the-last-stable-release-of-each-affected-and-still-maintained-product-branch
 [step_asn_releases]:      https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#prepare-asn-releases-as-outlined-in-the-release-checklist
-[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-the-support-portal-with-download-links-to-the-new-versions
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-5-day-queue-in-rt-with-the-text-of-the-advisory-earliest-and-t-5
+[step_asn_documents]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-text-on-the-t-5-from-the-printing-press-project-and-earliest-asn-documents-in-the-sf-portal
+[step_asn_links]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-update-the-bind-s-information-document-in-sf-with-download-links-to-the-new-versions
+[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bulk-email-eligible-customers-to-check-the-sf-portal
 [step_preannouncement]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-send-a-pre-announcement-email-to-the-bind-announce-mailing-list-to-alert-users-that-the-upcoming-release-will-include-security-fixes
-[step_asn_send]:          https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#notify-eligible-customers-by-adding-a-ticket-to-the-3-day-queue-in-rt-with-the-text-of-the-advisory-t-3
 [step_packager_emails]:   https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notifications-to-os-packagers
 [step_clearance]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#grant-qa-marketing-clearance-to-proceed-with-public-release
-[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
-[step_bump_advisory]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-in-printing-press
-[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-security-advisory-in-the-knowledge-base
 [step_publish]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#publish-the-releases-as-outlined-in-the-release-checklist
+[step_matrix]:            https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bind-9-only-add-the-new-cves-to-the-vulnerability-matrix-in-the-knowledge-base
+[step_publish_advisory]:  https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#bump-document-version-for-the-security-advisory-and-publish-it-in-the-knowledge-base
 [step_notifications]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#send-notification-emails-to-third-parties
 [step_mitre]:             https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#advise-mitre-about-the-disclosed-cves
 [step_merge_advisory]:    https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-the-security-advisory-merge-request
 [step_embargo_end]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#inform-original-reporter-if-external-that-the-security-disclosure-process-is-complete
-[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-tickets-in-the-asn-queues-in-rt-that-the-embargo-is-lifted
-[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#open-a-ticket-in-the-appropriate-announce-queue-in-rt-that-the-release-is-published
+[step_asn_clear]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-the-sf-portal-to-clear-the-asn
+[step_customers]:         https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#email-asn-recipients-that-the-embargo-is-lifted
 [step_regression]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#merge-a-regression-test-reproducing-the-bug-into-all-affected-and-still-maintained-branches

 /confidential
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -112,7 +112,11 @@ add(char *key, int value) {
 	}

 	if (symtab == NULL) {
-		isc_symtab_create(sym_mctx, freekey, sym_mctx, false, &symtab);
+		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
+					   false, &symtab);
+		if (result != ISC_R_SUCCESS) {
+			return;
+		}
 	}

 	key = isc_mem_strdup(sym_mctx, key);
@@ -130,92 +134,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return false;
+		return (false);
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return true;
-	}
-	return false;
-}
-
-static bool
-checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
-		const dns_name_t *name) {
-	char namebuf[DNS_NAME_FORMATSIZE + 1];
-	char ownerbuf[DNS_NAME_FORMATSIZE + 1];
-	/*
-	 * Not all getaddrinfo implementations distinguish NODATA
-	 * from NXDOMAIN with PF_INET6 so use PF_UNSPEC and look at
-	 * the returned ai_family values.
-	 */
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
-	bool has_type = false;
-	int eai;
-
-	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	/*
-	 * Turn off search.
-	 */
-	if (dns_name_countlabels(name) > 1U) {
-		strlcat(namebuf, ".", sizeof(namebuf));
-	}
-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
-
-	switch (eai) {
-	case 0:
-		cur = ai;
-		while (cur != NULL) {
-			if (cur->ai_family == AF_INET &&
-			    type == dns_rdatatype_a)
-			{
-				has_type = true;
-				break;
-			}
-			if (cur->ai_family == AF_INET6 &&
-			    type == dns_rdatatype_aaaa)
-			{
-				has_type = true;
-				break;
-			}
-			cur = cur->ai_next;
-		}
-		freeaddrinfo(ai);
-		return has_type;
-#if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
-	case EAI_NODATA:
-#endif /* if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME) */
-	case EAI_NONAME:
-		if (!logged(namebuf, ERR_NO_ADDRESSES)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_ERROR,
-				     "%s/NS '%s' (out of zone) "
-				     "has no addresses records (A or AAAA)",
-				     ownerbuf, namebuf);
-			add(namebuf, ERR_NO_ADDRESSES);
-		}
-		return false;
-	default:
-		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
-			dns_name_format(dns_zone_getorigin(zone), ownerbuf,
-					sizeof(ownerbuf));
-			dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-			dns_zone_log(zone, ISC_LOG_WARNING,
-				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
-			add(namebuf, ERR_LOOKUP_FAILURE);
-		}
-		return true;
+		return (true);
 	}
+	return (false);
 }

 static bool
@@ -223,14 +149,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa) {
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
-	isc_result_t result;
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
@@ -238,7 +157,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	bool match;
 	const char *type;
 	void *ptr = NULL;
-	int eai;
+	int result;

 	REQUIRE(a == NULL || !dns_rdataset_isassociated(a) ||
 		a->type == dns_rdatatype_a);
@@ -246,9 +165,15 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return answer;
+		return (answer);
 	}

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -258,9 +183,9 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -297,16 +222,16 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}

 	/*
@@ -433,27 +358,25 @@ checkmissing:
 			add(namebuf, ERR_MISSING_GLUE);
 		}
 	}
-	if (ai != NULL) {
-		freeaddrinfo(ai);
-	}
-	return answer;
+	freeaddrinfo(ai);
+	return (answer);
 }

 static bool
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -463,9 +386,9 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -498,10 +421,8 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -515,34 +436,34 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

 static bool
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
-	struct addrinfo hints = {
-		.ai_flags = AI_CANONNAME,
-		.ai_family = PF_UNSPEC,
-		.ai_socktype = SOCK_STREAM,
-		.ai_protocol = IPPROTO_TCP,
-	};
-	struct addrinfo *ai = NULL, *cur;
+	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
-	int eai;
+	int result;
 	int level = ISC_LOG_ERROR;
 	bool answer = true;

+	memset(&hints, 0, sizeof(hints));
+	hints.ai_flags = AI_CANONNAME;
+	hints.ai_family = PF_UNSPEC;
+	hints.ai_socktype = SOCK_STREAM;
+	hints.ai_protocol = IPPROTO_TCP;
+
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
 	/*
 	 * Turn off search.
@@ -552,9 +473,9 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));

-	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
+	result = getaddrinfo(namebuf, NULL, &hints, &ai);
 	dns_name_format(name, namebuf, sizeof(namebuf) - 1);
-	switch (eai) {
+	switch (result) {
 	case 0:
 		/*
 		 * Work around broken getaddrinfo() implementations that
@@ -587,10 +508,8 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				}
 			}
 		}
-		if (ai != NULL) {
-			freeaddrinfo(ai);
-		}
-		return answer;
+		freeaddrinfo(ai);
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -604,16 +523,16 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
 			dns_zone_log(zone, ISC_LOG_WARNING,
 				     "getaddrinfo(%s) failed: %s", namebuf,
-				     gai_strerror(eai));
+				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

@@ -625,7 +544,7 @@ setup_logging(FILE *errout) {
 		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
 		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% load the zone */
@@ -655,18 +574,18 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	isc_buffer_constinit(&buffer, zonename, strlen(zonename));
 	isc_buffer_add(&buffer, strlen(zonename));
 	origin = dns_fixedname_initname(&fixorigin);
-	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0));
-	dns_zone_setorigin(zone, origin);
+	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
+	CHECK(dns_zone_setorigin(zone, origin));
 	dns_zone_setdbtype(zone, 1, (const char *const *)dbtype);
 	if (strcmp(filename, "-") == 0) {
-		dns_zone_setstream(zone, stdin, fileformat,
-				   &dns_master_style_default);
+		CHECK(dns_zone_setstream(zone, stdin, fileformat,
+					 &dns_master_style_default));
 	} else {
-		dns_zone_setfile(zone, filename, fileformat,
-				 &dns_master_style_default);
+		CHECK(dns_zone_setfile(zone, filename, fileformat,
+				       &dns_master_style_default));
 	}
 	if (journal != NULL) {
-		dns_zone_setjournal(zone, journal);
+		CHECK(dns_zone_setjournal(zone, journal));
 	}

 	region.base = UNCONST(classname);
@@ -684,7 +603,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	}
 	if (docheckns) {
 		dns_zone_setcheckns(zone, checkns);
-		dns_zone_setcheckisservedby(zone, checkisservedby);
 	}
 	if (dochecksrv) {
 		dns_zone_setchecksrv(zone, checksrv);
@@ -701,7 +619,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return result;
+	return (result);
 }

 /*% dump the zone */
@@ -732,7 +650,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 	}

@@ -742,5 +660,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return result;
+	return (result);
 }
@@ -18,6 +18,7 @@
 #include <inttypes.h>
 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

@@ -25,6 +26,8 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 setup_logging(FILE *errout);

@@ -45,3 +48,5 @@ extern bool docheckmx;
 extern bool docheckns;
 extern bool dochecksrv;
 extern dns_zoneopt_t zone_options;
+
+ISC_LANG_ENDDECLS
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -31,7 +30,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -85,10 +83,10 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 		cfg_obj_log(obj, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
@@ -96,10 +94,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return true;
+			return (true);
 		}
 	}
 }
@@ -115,7 +113,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -124,7 +122,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return true;
+			return (true);
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -138,7 +136,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return true;
+			return (true);
 		}
 	}
 }
@@ -151,23 +149,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_db_detach(&db);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% configure the zone */
@@ -223,18 +221,18 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -244,12 +242,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -263,12 +261,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return configure_hint(zfile, zclass, mctx);
+		return (configure_hint(zfile, zclass, mctx));
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -281,12 +279,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	obj = NULL;
@@ -464,7 +462,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 /*% configure a view */
@@ -499,7 +497,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -509,11 +507,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return dns_rdataclass_fromtext(classp, &r);
+	return (dns_rdataclass_fromtext(classp, &r));
 }

 /*% load zones from the configuration */
@@ -571,7 +569,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return result;
+	return (result);
 }

 static void
@@ -761,8 +759,8 @@ cleanup:
 	}

 	if (mctx != NULL) {
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -73,9 +73,7 @@ Options

 .. option:: -n

-   Do not print errors when encountering options that are disabled in
-   this build. This allows checking of configuration files for other
-   builds, in which those options are enabled.
+   Do not error on options that are disabled in this build.

 .. option:: -p

@@ -22,7 +22,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -32,7 +31,6 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -577,7 +575,7 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS) ? 0 : 1;
+	return ((result == ISC_R_SUCCESS) ? 0 : 1);
 }
@@ -91,13 +91,9 @@ Options
   (both in-zone and out-of-zone hostnames). Mode ``local`` only
   checks SRV records which refer to in-zone hostnames.

-   Mode ``full`` checks that a zone that has A or AAAA records it is served
-   by a server with the same type of address records.
-
   Mode ``full`` checks that delegation NS records refer to A or AAAA
   records (both in-zone and out-of-zone hostnames). It also checks that
   glue address records in the zone match those advertised by the child.
-
   Mode ``local`` only checks NS records which refer to in-zone
   hostnames or verifies that some required glue exists, i.e., when the
   name server is in a child zone.
@@ -17,6 +17,10 @@

 #include <stdio.h>

+#include <isc/lang.h>
+
+ISC_LANG_BEGINDECLS
+
 int
 set_user(FILE *fd, const char *user);
 /*%<
@@ -25,3 +29,5 @@ set_user(FILE *fd, const char *user);
 *   0 		success
 *   -1 	insufficient permissions, or 'user' does not exist.
 */
+
+ISC_LANG_ENDDECLS
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return DST_ALG_HMACMD5;
+		return (DST_ALG_HMACMD5);
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return DST_ALG_HMACSHA1;
+		return (DST_ALG_HMACSHA1);
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return DST_ALG_HMACSHA224;
+		return (DST_ALG_HMACSHA224);
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return DST_ALG_HMACSHA256;
+		return (DST_ALG_HMACSHA256);
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return DST_ALG_HMACSHA384;
+		return (DST_ALG_HMACSHA384);
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return DST_ALG_HMACSHA512;
+		return (DST_ALG_HMACSHA512);
 	}
-	return DST_ALG_UNKNOWN;
+	return (DST_ALG_UNKNOWN);
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return 128;
+		return (128);
 	case DST_ALG_HMACSHA1:
-		return 160;
+		return (160);
 	case DST_ALG_HMACSHA224:
-		return 224;
+		return (224);
 	case DST_ALG_HMACSHA256:
-		return 256;
+		return (256);
 	case DST_ALG_HMACSHA384:
-		return 384;
+		return (384);
 	case DST_ALG_HMACSHA512:
-		return 512;
+		return (512);
 	default:
-		return 0;
+		return (0);
 	}
 }

@@ -16,10 +16,13 @@
 /*! \file */

 #include <isc/buffer.h>
+#include <isc/lang.h>
 #include <isc/mem.h>

 #include <dns/secalg.h>

+ISC_LANG_BEGINDECLS
+
 void
 generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	     isc_buffer_t *key_txtbuffer);
@@ -34,3 +37,5 @@ dns_secalg_t
 alg_fromtext(const char *name);
 int
 alg_bits(dns_secalg_t alg);
+
+ISC_LANG_ENDDECLS
@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return -1;
+		return (-1);
 	}
-	return fchown(fileno(fd), pw->pw_uid, -1);
+	return (fchown(fileno(fd), pw->pw_uid, -1));
 }
@@ -32,7 +32,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -41,7 +40,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -290,7 +288,7 @@ options {\n\
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -28,7 +28,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/result.h>
@@ -37,7 +36,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>

 #include <dst/dst.h>
@@ -296,7 +294,7 @@ nsupdate -k <keyfile>\n");
 		isc_mem_stats(mctx, stderr);
 	}

-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -20,5 +19,4 @@ delv_LDADD =				\
 	$(LIBISC_LIBS)			\
 	$(LIBDNS_LIBS)			\
 	$(LIBNS_LIBS)			\
-	$(LIBISCCFG_LIBS)		\
-	$(OPENSSL_LIBS)
+	$(LIBISCCFG_LIBS)
@@ -25,15 +25,11 @@
 #include <sys/types.h>
 #include <unistd.h>

-#include <openssl/opensslv.h>
-
 #include <isc/async.h>
 #include <isc/attributes.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/crypto.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -56,7 +52,6 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -91,8 +86,7 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  50
-#define MAX_TOTAL    200
+#define MAX_QUERIES  32
 #define MAX_RESTARTS 11

 /* Variables used internally by delv. */
@@ -137,7 +131,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    yaml = false, fulltrace = false;

 static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t maxtotal = MAX_TOTAL;
 static uint32_t restarts = MAX_RESTARTS;

 static bool resolve_trace = false, validator_trace = false,
@@ -222,6 +215,7 @@ usage(void) {
 		"                 +[no]crypto         (Control display of "
 		"cryptographic\n"
 		"                                      fields in records)\n"
+		"                 +[no]dlv            (Obsolete)\n"
 		"                 +[no]dnssec         (Display DNSSEC "
 		"records)\n"
 		"                 +[no]mtrace         (Trace messages "
@@ -572,7 +566,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -589,15 +583,15 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	isc_buffer_add(&b, len);
 	n = dns_fixedname_initname(fn);

-	result = dns_name_fromtext(n, &b, dns_rootname, 0);
+	result = dns_name_fromtext(n, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return result;
+		return (result);
 	}

 	*name = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -630,7 +624,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (anchor_name) {
@@ -638,11 +632,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -661,7 +655,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	if (cfg_obj_isvoid(obj)) {
 		/*
 		 * "anchortype" is not defined, this must be a static-key
-		 * configured with trust-anchors.
+		 * configured with trusted-keys.
 		 */
 		anchortype = STATIC_KEY;
 	} else {
@@ -781,7 +775,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	num_keys++;

 cleanup:
-	if (result == DST_R_UNSUPPORTEDALG) {
+	if (result == DST_R_NOCRYPTO) {
+		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
+	} else if (result == DST_R_UNSUPPORTEDALG) {
 		cfg_obj_log(key, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
@@ -793,7 +789,7 @@ cleanup:
 		result = ISC_R_FAILURE;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -815,18 +811,23 @@ load_keys(const cfg_obj_t *keys, dns_client_t *client, dns_view_t *toview) {
 	}

 cleanup:
-	return result;
+	if (result == DST_R_NOCRYPTO) {
+		result = ISC_R_SUCCESS;
+	}
+	return (result);
 }

 static isc_result_t
 setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	isc_result_t result;
 	cfg_parser_t *parser = NULL;
+	const cfg_obj_t *trusted_keys = NULL;
+	const cfg_obj_t *managed_keys = NULL;
 	const cfg_obj_t *trust_anchors = NULL;
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (trust_anchor == NULL) {
@@ -863,7 +864,16 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	}

 	INSIST(bindkeys != NULL);
+	cfg_map_get(bindkeys, "trusted-keys", &trusted_keys);
+	cfg_map_get(bindkeys, "managed-keys", &managed_keys);
 	cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+
+	if (trusted_keys != NULL) {
+		CHECK(load_keys(trusted_keys, client, toview));
+	}
+	if (managed_keys != NULL) {
+		CHECK(load_keys(managed_keys, client, toview));
+	}
 	if (trust_anchors != NULL) {
 		CHECK(load_keys(trust_anchors, client, toview));
 	}
@@ -884,7 +894,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -931,7 +941,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		result = ISC_R_SUCCESS;
@@ -967,7 +977,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1036,7 +1046,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1049,10 +1059,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1113,6 +1123,14 @@ plus_option(char *option) {
 		break;
 	case 'd':
 		switch (cmd[1]) {
+		case 'l': /* dlv */
+			FULLCHECK("dlv");
+			if (state) {
+				fprintf(stderr, "Invalid option: "
+						"+dlv is obsolete\n");
+				exit(EXIT_FAILURE);
+			}
+			break;
 		case 'n': /* dnssec */
 			FULLCHECK("dnssec");
 			showdnssec = state;
@@ -1139,46 +1157,22 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a':
-			switch (cmd[3]) {
-			case 'q': /* maxqueries */
-				FULLCHECK("maxqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxqueries, value,
-						    UINT_MAX, "maxqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxqueries");
-				}
-				if (maxqueries == 0) {
-					fatal("maxqueries must be nonzero");
-				}
-				break;
-			case 't': /* maxtotalqueries */
-				FULLCHECK("maxtotalqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxtotal, value, UINT_MAX,
-						    "maxtotalqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxtotalqueries");
-				}
-				if (maxtotal == 0) {
-					fatal("maxtotalqueries must be "
-					      "nonzero");
-				}
-				break;
-			default:
+		case 'a': /* maxqueries */
+			FULLCHECK("maxqueries");
+			if (value == NULL) {
+				goto need_value;
+			}
+			if (!state) {
 				goto invalid_option;
 			}
+			result = parse_uint(&maxqueries, value, UINT_MAX,
+					    "maxqueries");
+			if (result != ISC_R_SUCCESS) {
+				fatal("Couldn't parse maxqueries");
+			}
+			if (maxqueries == 0) {
+				fatal("maxqueries must be nonzero");
+			}
 			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
@@ -1385,8 +1379,8 @@ plus_option(char *option) {
 /*
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
-static const char *single_dash_opts = "46Fhimv";
-static const char *dash_opts = "46abcdFhimpqtvx";
+static const char *single_dash_opts = "46himv";
+static const char *dash_opts = "46abcdhimpqtvx";

 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
@@ -1429,9 +1423,6 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				use_ipv4 = false;
 			}
 			break;
-		case 'F': /* FIPS */
-			/* handled in preparse_args() */
-			break;
 		case 'h':
 			usage();
 			exit(EXIT_SUCCESS);
@@ -1451,7 +1442,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -1468,7 +1459,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1505,7 +1496,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1523,28 +1514,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1565,7 +1556,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1583,14 +1574,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*
@@ -1610,11 +1601,6 @@ preparse_args(int argc, char **argv) {
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
-			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-					fatal("setting FIPS mode failed");
-				}
-				break;
 			case 'm':
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 						    ISC_MEM_DEBUGRECORD;
@@ -1762,11 +1748,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1777,17 +1763,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return append_str(in, len, p, end);
+	return (append_str(in, len, p, end));
 }

 static isc_result_t
@@ -1806,10 +1792,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1822,17 +1808,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -1909,7 +1895,6 @@ run_resolve(void *arg) {
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
 	dns_client_setmaxrestarts(client, restarts);
-	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2070,7 +2055,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return result;
+	return (result);
 }

 static void
@@ -2114,15 +2099,9 @@ sendquery(void *arg) {
 				    &requestmgr));

 	dns_view_attach(view, &(dns_view_t *){ NULL });
-
-	uint32_t initial;
-	isc_nm_gettimeouts(netmgr, &initial, NULL, NULL, NULL);
-	const unsigned int connect_timeout = initial, timeout = initial;
-
 	CHECK(dns_request_create(requestmgr, message, NULL, &peer, NULL, NULL,
-				 DNS_REQUESTOPT_TCP, NULL, connect_timeout,
-				 timeout, 0, 0, isc_loop(), recvresponse,
-				 message, &request));
+				 DNS_REQUESTOPT_TCP, NULL, 1, 0, 0, isc_loop(),
+				 recvresponse, message, &request));
 	return;

 cleanup:
@@ -2151,7 +2130,7 @@ matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,

 	*viewp = view;
 	*viewpatchresultp = ISC_R_SUCCESS;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -2174,14 +2153,13 @@ run_server(void *arg) {
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
 				     NULL, &interfacemgr));

-	dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			"_default", &view);
+	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
+			      &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
 	dns_view_setmaxrestarts(view, restarts);
-	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2284,5 +2262,5 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ delv - DNS lookup and validation utility
 Synopsis
 ~~~~~~~~

-:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-F**] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]
+:program:`delv` [@server] [ [**-4**] | [**-6**] ] [**-a** anchor-file] [**-b** address] [**-c** class] [**-d** level] [**-i**] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-x** addr] [name] [type] [class] [queryopt...]

 :program:`delv` [**-h**]

@@ -138,10 +138,6 @@ Options
   :option:`+mtrace`, :option:`+rtrace`, and :option:`+vtrace` options below for
   additional debugging details.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   This option displays the :program:`delv` help usage output and exits.
@@ -351,12 +347,7 @@ assign values to options like the timeout interval. They have the form
 .. option:: +maxqueries

   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 50.
-
-.. option:: +maxtotalqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a client request before giving up. The default is 200.
+   a name before giving up. The default is 32.

 .. option:: +trust, +notrust

@@ -5,16 +5,13 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(OPENSSL_CFLAGS)	\
-	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBUV_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
 	$(LIBISC_LIBS)		\
 	$(LIBDNS_LIBS)		\
 	$(LIBISCCFG_LIBS)	\
-	$(OPENSSL_LIBS)		\
 	$(LIBIDN2_LIBS)

 noinst_LTLIBRARIES = libdighost.la
@@ -20,9 +20,7 @@
 #include <time.h>

 #include <isc/attributes.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -34,7 +32,6 @@
 #include <dns/byaddr.h>
 #include <dns/dns64.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -72,8 +69,6 @@ static bool short_form = false, printcmd = true, plusquest = false,
 	    pluscomm = false, ipv4only = false, ipv6only = false, digrc = true;
 static uint32_t splitwidth = 0xffffffff;

-#include <openssl/opensslv.h>
-
 /*% opcode text */
 static const char *const opcodetext[] = {
 	"QUERY",      "IQUERY",	    "STATUS",	  "RESERVED3",
@@ -94,9 +89,9 @@ rcode_totext(dns_rcode_t rcode) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
 		buf[0] = '?';
-		return buf;
+		return (buf);
 	}
-	return buf + 1;
+	return (buf + 1);
 }

 /*% print usage */
@@ -289,7 +284,6 @@ help(void) {
 	       "                                      form of answers - global "
 	       "option)\n"
 	       "                 +[no]showbadcookie  (Show BADCOOKIE message)\n"
-	       "                 +[no]showbadvers    (Show BADVERS message)\n"
 	       "                 +[no]showsearch     (Search with intermediate "
 	       "results)\n"
 	       "                 +[no]split=##       (Split hex/base64 fields "
@@ -298,8 +292,6 @@ help(void) {
 	       "statistics)\n"
 	       "                 +subnet=addr        (Set edns-client-subnet "
 	       "option)\n"
-	       "                 +[no]svcparamkeycompat (Display backward-"
-	       "compatible SvcParamKey names (keyN) for non-initial entries)\n"
 	       "                 +[no]tcflag         (Set TC flag in query "
 	       "(+[no]tcflag))\n"
 	       "                 +[no]tcp            (TCP mode (+[no]vc))\n"
@@ -481,7 +473,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		ADD_STRING(buf, " ");
 	}
@@ -499,13 +491,10 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->expandaaaa) {
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	}
-	if (query->lookup->svcparamkeycompat) {
-		styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-	}
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
-		return result;
+		return (result);
 	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
@@ -522,7 +511,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -546,14 +535,14 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 				      dns_rdatatype_aaaa, dns_rdatatype_none,
 				      NULL, &rdataset);
 	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_dns64_findprefix(rdataset, prefix, &count);
 	if (result == ISC_R_NOTFOUND) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	if (count > 10) {
 		count = 10;
@@ -561,15 +550,15 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -586,12 +575,12 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,

 	UNUSED(flags);

-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -606,7 +595,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdataset_current(rdataset, &rdata);
 				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE) {
-					return result;
+					return (result);
 				}
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
@@ -617,18 +606,20 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local" };
-	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata);
+	static unsigned char local_offsets[] = { 0, 6 };
+	static dns_name_t local = DNS_NAME_INITABSOLUTE(local_ndata,
+							local_offsets);

 	for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 	     result == ISC_R_SUCCESS;
@@ -637,10 +628,10 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local)) {
-			return true;
+			return (true);
 		}
 	}
-	return false;
+	return (false);
 }

 /*
@@ -693,9 +684,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		if (query->lookup->expandaaaa) {
 			styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 		}
-		if (query->lookup->svcparamkeycompat) {
-			styleflags |= DNS_STYLEFLAG_SVCPARAMKEYCOMPAT;
-		}
 		if (query->lookup->multiline) {
 			styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 			styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -1036,7 +1024,7 @@ repopulate_buffer:

 	dig_idnsetup(query->lookup, false);

-	return result;
+	return (result);
 }

 /*%
@@ -1205,7 +1193,7 @@ proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
 		}
 	}

-	return result;
+	return (result);
 }

 static bool
@@ -1225,7 +1213,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	/* start syntax analysis and verification */
 	if (!rule_proxy_addrs(&st)) {
 		warn("PROXY source and destination addresses cannot be parsed");
-		return false;
+		return (false);
 	}

 	/* get port numeric values */
@@ -1252,7 +1240,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY source address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
@@ -1260,26 +1248,26 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY destination address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	/* addresses should be of the same type */
 	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
 		warn("PROXY source and destination addresses must be of the "
 		     "same type");
-		return false;
+		return (false);
 	}

 	*psrc = src;
 	*pdst = dst;

-	return true;
+	return (true);
 }

 static bool
 rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->src_addr_start = st->last_addr_start;
@@ -1288,13 +1276,13 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->src_port_len = st->last_port_len;

 	if (!MATCH('-')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->dst_addr_start = st->last_addr_start;
@@ -1303,17 +1291,17 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->dst_port_len = st->last_port_len;

 	if (!MATCH('\0')) {
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_addr(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!rule_addr_char(st)) {
-		return false;
+		return (false);
 	}

 	while (rule_addr_char(st)) {
@@ -1327,18 +1315,18 @@ rule_addr(isc_proxy_addrs_parser_state_t *st) {
 		ADVANCE();

 		if (!rule_port(st)) {
-			return false;
+			return (false);
 		}
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_port(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!MATCH_DIGIT()) {
-		return false;
+		return (false);
 	}

 	ADVANCE();
@@ -1350,18 +1338,18 @@ rule_port(isc_proxy_addrs_parser_state_t *st) {
 	st->last_port_start = start;
 	st->last_port_len = GETP() - start;

-	return true;
+	return (true);
 }

 static bool
 rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
 	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

-	return true;
+	return (true);
 }

 #undef GETP
@@ -1378,20 +1366,20 @@ plus_proxy_handle_addresses(const char *value, const bool state,
 		 * We are not interested in the option value in that
 		 * case
 		 */
-		return true;
+		return (true);
 	}

 	if (value == NULL || *value == '\0') {
 		lookup->proxy_local = true;
-		return true;
+		return (true);
 	}

 	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
 				   &lookup->proxy_dst_addr))
 	{
-		return false;
+		return (false);
 	}
-	return true;
+	return (true);
 }

 static bool
@@ -1414,10 +1402,10 @@ plus_proxy_options(const char *cmd, const char *value, const bool state,
 	default:
 		goto invalid_option;
 	}
-	return true;
+	return (true);

 invalid_option:
-	return false;
+	return (false);
 }

 static bool
@@ -1512,9 +1500,9 @@ plus_tls_options(const char *cmd, const char *value, const bool state,
 		goto invalid_option;
 	}

-	return true;
+	return (true);
 invalid_option:
-	return false;
+	return (false);
 }

 /*%
@@ -1537,7 +1525,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return lookup;
+		return (lookup);
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1773,8 +1761,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 						FULLCHECK("edns");
 						if (!state) {
 							lookup->edns = -1;
-							lookup->original_edns =
-								-1;
 							break;
 						}
 						if (value == NULL) {
@@ -1791,7 +1777,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							goto exit_or_usage;
 						}
 						lookup->edns = num;
-						lookup->original_edns = num;
 						break;
 					case 'f':
 						FULLCHECK("ednsflags");
@@ -2310,18 +2295,8 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 			case 'w': /* showsearch */
 				switch (cmd[4]) {
 				case 'b':
-					switch (cmd[7]) {
-					case 'c':
-						FULLCHECK("showbadcookie");
-						lookup->showbadcookie = state;
-						break;
-					case 'v':
-						FULLCHECK("showbadvers");
-						lookup->showbadvers = state;
-						break;
-					default:
-						goto invalid_option;
-					}
+					FULLCHECK("showbadcookie");
+					lookup->showbadcookie = state;
 					break;
 				case 's':
 					FULLCHECK("showsearch");
@@ -2408,10 +2383,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 				goto exit_or_usage;
 			}
 			break;
-		case 'v': /* svcparamkeycompat */
-			FULLCHECK("svcparamkeycompat");
-			lookup->svcparamkeycompat = state;
-			break;
 		default:
 			goto invalid_option;
 		}
@@ -2590,7 +2561,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 	if (value != NULL) {
 		value[-1] = '=';
 	}
-	return lookup;
+	return (lookup);

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2602,8 +2573,8 @@ exit_or_usage:
 /*%
 * #true returned if value was used
 */
-static const char *single_dash_opts = "46dFhimnruv";
-static const char *dash_opts = "46bcdFfhikmnpqrtvyx";
+static const char *single_dash_opts = "46dhimnruv";
+static const char *dash_opts = "46bcdfhikmnpqrtvyx";
 static bool
 dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    bool *open_type_class, bool *need_clone, bool config_only, int argc,
@@ -2636,7 +2607,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv4 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case '6':
@@ -2646,7 +2617,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv6 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case 'd':
@@ -2655,14 +2626,11 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				cmd = option;
 				FULLCHECK("debug");
 				debugging = true;
-				return false;
+				return (false);
 			} else {
 				debugging = true;
 			}
 			break;
-		case 'F': /* FIPS */
-			/* FIPS is handled in preparse_args() */
-			break;
 		case 'h':
 			help();
 			exit(EXIT_SUCCESS);
@@ -2689,7 +2657,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -2733,7 +2701,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*hash = '#';
 		}
 		specified_source = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
@@ -2752,13 +2720,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid class %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'f':
 		batchname = value;
-		return value_from_next;
+		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS) {
@@ -2766,7 +2734,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		port = num;
 		port_set = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (!config_only) {
 			if (*need_clone) {
@@ -2785,7 +2753,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
@@ -2843,7 +2811,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid type %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'y':
 		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
@@ -2868,7 +2836,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr[-1] = ':';
 		}
 		ptr2[-1] = ':';
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		if (*need_clone) {
 			*lookup = clone_lookup(default_lookup, true);
@@ -2898,14 +2866,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*%
@@ -2936,11 +2904,6 @@ preparse_args(int argc, char **argv) {
 				/* For debugging early startup */
 				debugging = true;
 				break;
-			case 'F':
-				if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-					fatal("setting FIPS mode failed");
-				}
-				break;
 			case 'm':
 				memdebugging = true;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
@@ -3004,7 +2967,7 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 	{
 		debug("%s %d: %s", msg, bargc, bargv[bargc]);
 	}
-	return bargc;
+	return (bargc);
 }

 static void
@@ -3465,5 +3428,5 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-	return exitcode;
+	return (exitcode);
 }
@@ -20,7 +20,7 @@ dig - DNS lookup utility

 Synopsis
 ~~~~~~~~
-:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-F**] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]
+:program:`dig` [@server] [**-b** address] [**-c** class] [**-f** filename] [**-k** filename] [**-m**] [**-p** port#] [**-q** name] [**-t** type] [**-v**] [**-x** addr] [**-y** [hmac:]name:key] [ [**-4**] | [**-6**] ] [name] [type] [class] [queryopt...]

 :program:`dig` [**-h**]

@@ -126,10 +126,6 @@ Options
   same way it would be presented as a query to :program:`dig` using the
   command-line interface.

-.. option:: -F
-
-   This option enables FIPS mode if supported by the cryptographic library in use.
-
 .. option:: -h

   Print a usage summary.
@@ -614,12 +610,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   BADCOOKIE rcode before retrying the request or not. The default
   is to not show the messages.

-.. option:: +showbadvers, +noshowbadvers
-
-   This option toggles whether to show the message containing the
-   BADVERS rcode before retrying the request or not. The default
-   is to not show the messages.
-
 .. option:: +showsearch, +noshowsearch

   This option performs [or does not perform] a search showing intermediate results.
@@ -648,14 +638,6 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to
   prefix-length of zero, which signals a resolver that the client's
   address information must *not* be used when resolving this query.

-.. option:: +svcparamkeycompat, +nosvcparamkeycompat
-
-   This option sets [or does not set] the backward-compatible representation of
-   the Service Parameter Keys (SvcParamKeys) for SVCB records, in which case
-   the keys, which were not defined initially in :rfc:`9460` are represented
-   in their opaque "keyN"-like format, where "N" is their numerical value. The
-   default is ``+nosvcparamkeycompat``.
-
 .. option:: +tcflag, +notcflag

   This option sets [or does not set] the TC (TrunCation) bit in the query. The default is
@@ -40,6 +40,7 @@
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
+#include <isc/lang.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -60,7 +61,6 @@
 #include <isc/xml.h>

 #include <dns/byaddr.h>
-#include <dns/ede.h>
 #include <dns/fixedname.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -234,7 +234,7 @@ count_dots(char *string) {
 		}
 		s++;
 	}
-	return i;
+	return (i);
 }

 static void
@@ -282,11 +282,11 @@ hex_dump(isc_buffer_t *b) {
 static isc_result_t
 append(const char *text, size_t len, char **p, char *end) {
 	if (*p + len > end) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -297,17 +297,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = (int)strlen(in);
 	}
-	return append(in, len, p, end);
+	return (append(in, len, p, end));
 }

 isc_result_t
@@ -326,10 +326,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -342,18 +342,18 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		/* Append .in-addr.arpa. and a terminating NUL. */
 		result = append(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -454,7 +454,7 @@ make_server(const char *servname, const char *userarg) {
 	strlcpy(srv->servername, servname, MXNAME);
 	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
-	return srv;
+	return (srv);
 }

 /*%
@@ -605,7 +605,6 @@ make_empty_lookup(void) {
 		.idnout = idnout,
 		.udpsize = -1,
 		.edns = -1,
-		.original_edns = -1,
 		.recurse = true,
 		.retries = tries,
 		.comments = true,
@@ -631,7 +630,7 @@ make_empty_lookup(void) {
 	debug("make_empty_lookup() = %p->references = %" PRIuFAST32, looknew,
 	      isc_refcount_current(&looknew->references));

-	return looknew;
+	return (looknew);
 }

 #define EDNSOPT_OPTIONS 100U
@@ -739,7 +738,6 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	}

 	looknew->showbadcookie = lookold->showbadcookie;
-	looknew->showbadvers = lookold->showbadvers;
 	looknew->sendcookie = lookold->sendcookie;
 	looknew->seenbadcookie = lookold->seenbadcookie;
 	looknew->badcookie = lookold->badcookie;
@@ -760,13 +758,11 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {
 	looknew->nocrypto = lookold->nocrypto;
 	looknew->ttlunits = lookold->ttlunits;
 	looknew->expandaaaa = lookold->expandaaaa;
-	looknew->svcparamkeycompat = lookold->svcparamkeycompat;
 	looknew->qr = lookold->qr;
 	looknew->idnin = lookold->idnin;
 	looknew->idnout = lookold->idnout;
 	looknew->udpsize = lookold->udpsize;
 	looknew->edns = lookold->edns;
-	looknew->original_edns = lookold->original_edns;
 	looknew->recurse = lookold->recurse;
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
@@ -825,7 +821,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {

 	looknew->magic = DIG_LOOKUP_MAGIC;

-	return looknew;
+	return (looknew);
 }

 /*%
@@ -855,20 +851,20 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 	ISC_LIST_PREPEND(lookup_list, looknew, link);
 	debug("after insertion, init -> %p, new = %p, new -> %p", lookold,
 	      looknew, looknew->link.next);
-	return looknew;
+	return (looknew);
 }

 void
 setup_text_key(void) {
 	isc_result_t result;
-	dns_fixedname_t fkey;
-	dns_name_t *keyname = dns_fixedname_initname(&fkey);
+	dns_name_t keyname;
 	isc_buffer_t secretbuf;
 	unsigned int secretsize;
 	unsigned char *secretstore;

 	debug("setup_text_key()");
 	isc_buffer_allocate(mctx, &namebuf, MXNAME);
+	dns_name_init(&keyname, NULL);
 	isc_buffer_putstr(namebuf, keynametext);
 	secretsize = (unsigned int)strlen(keysecret) * 3 / 4;
 	secretstore = isc_mem_allocate(mctx, secretsize);
@@ -885,12 +881,12 @@ setup_text_key(void) {
 		goto failure;
 	}

-	result = dns_name_fromtext(keyname, namebuf, dns_rootname, 0);
+	result = dns_name_fromtext(&keyname, namebuf, dns_rootname, 0, namebuf);
 	if (result != ISC_R_SUCCESS) {
 		goto failure;
 	}

-	result = dns_tsigkey_create(keyname, hmac_alg, secretstore,
+	result = dns_tsigkey_create(&keyname, hmac_alg, secretstore,
 				    (int)secretsize, mctx, &tsigkey);
 failure:
 	if (result != ISC_R_SUCCESS) {
@@ -901,6 +897,7 @@ failure:
 	}

 	isc_mem_free(mctx, secretstore);
+	dns_name_invalidate(&keyname);
 	isc_buffer_free(&namebuf);
 }

@@ -915,20 +912,20 @@ parse_uint_helper(uint32_t *uip, const char *value, uint32_t max,
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 10);
+	return (parse_uint_helper(uip, value, max, desc, 10));
 }

 isc_result_t
 parse_xint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 0);
+	return (parse_uint_helper(uip, value, max, desc, 0));
 }

 static uint32_t
@@ -941,7 +938,7 @@ parse_bits(char *arg, const char *desc, uint32_t max) {
 		fatal("couldn't parse digest bits");
 	}
 	tmp = (tmp + 7) & ~0x7U;
-	return tmp;
+	return (tmp);
 }

 isc_result_t
@@ -1019,7 +1016,7 @@ done:
 	sa->length = prefix_length;
 	*sap = sa;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*
@@ -1095,7 +1092,7 @@ read_confkey(void) {
 	isc_result_t result;

 	if (!isc_file_exists(keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

 	result = cfg_parser_create(mctx, &pctx);
@@ -1136,7 +1133,7 @@ cleanup:
 		cfg_parser_destroy(&pctx);
 	}

-	return result;
+	return (result);
 }

 void
@@ -1206,7 +1203,7 @@ make_searchlist_entry(char *domain) {
 	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME - 1] = 0;
 	ISC_LINK_INIT(search, link);
-	return search;
+	return (search);
 }

 static void
@@ -1546,13 +1543,13 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
-				return false;
+				return (false);
 			}
 		}
 		q = ISC_LIST_NEXT(q, link);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -1862,7 +1859,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			result = dns_message_findtype(name, dns_rdatatype_soa,
 						      0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
-				return 0;
+				return (0);
 			}
 		}
 		rdataset = NULL;
@@ -1941,7 +1938,6 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				}
 				domain = dns_fixedname_name(&lookup->fdomain);
 				dns_name_copy(name, domain);
-				lookup->edns = lookup->original_edns;
 			}
 			debug("adding server %s", namestr);
 			num = getaddresses(lookup, namestr, &lresult);
@@ -1966,7 +1962,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	if (lookup == NULL && section == DNS_SECTION_ANSWER &&
 	    (query->lookup->trace || query->lookup->ns_search_only))
 	{
-		return followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
+		return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
 	}

 	/*
@@ -1998,7 +1994,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				    link);
 	}

-	return numLookups;
+	return (numLookups);
 }

 /*%
@@ -2025,7 +2021,7 @@ next_origin(dig_lookup_t *oldlookup) {
 		 * We're not using a search list, so don't even think
 		 * about finding the next entry.
 		 */
-		return false;
+		return (false);
 	}

 	/*
@@ -2037,14 +2033,14 @@ next_origin(dig_lookup_t *oldlookup) {
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 	{
-		return false;
+		return (false);
 	}

 	if (oldlookup->origin == NULL && !oldlookup->need_search) {
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		return false;
+		return (false);
 	}
 	if (oldlookup->origin == NULL && oldlookup->need_search) {
 		newlookup = requeue_lookup(oldlookup, true);
@@ -2053,13 +2049,13 @@ next_origin(dig_lookup_t *oldlookup) {
 	} else {
 		search = ISC_LIST_NEXT(oldlookup->origin, link);
 		if (search == NULL && oldlookup->done_as_is) {
-			return false;
+			return (false);
 		}
 		newlookup = requeue_lookup(oldlookup, true);
 		newlookup->origin = search;
 	}
 	cancel_lookup(oldlookup);
-	return true;
+	return (true);
 }

 /*%
@@ -2085,8 +2081,8 @@ insert_soa(dig_lookup_t *lookup) {
 	soa.common.rdclass = lookup->rdclass;
 	soa.common.rdtype = dns_rdatatype_soa;

-	dns_name_init(&soa.origin);
-	dns_name_init(&soa.contact);
+	dns_name_init(&soa.origin, NULL);
+	dns_name_init(&soa.contact, NULL);

 	dns_name_clone(dns_rootname, &soa.origin);
 	dns_name_clone(dns_rootname, &soa.contact);
@@ -2162,7 +2158,7 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	ISC_LINK_INIT(query, link);

 	query->magic = DIG_QUERY_MAGIC;
-	return query;
+	return (query);
 }

 /*%
@@ -2209,6 +2205,11 @@ setup_lookup(dig_lookup_t *lookup) {
 	}
 	dns_message_gettempname(lookup->sendmsg, &lookup->name);

+	isc_buffer_init(&lookup->namebuf, lookup->name_space,
+			sizeof(lookup->name_space));
+	isc_buffer_init(&lookup->onamebuf, lookup->oname_space,
+			sizeof(lookup->oname_space));
+
 	/*
 	 * We cannot convert `textname' and `origin' separately.
 	 * `textname' doesn't contain TLD, but local mapping needs
@@ -2256,7 +2257,8 @@ setup_lookup(dig_lookup_t *lookup) {
 		len = (unsigned int)strlen(origin);
 		isc_buffer_init(&b, origin, len);
 		isc_buffer_add(&b, len);
-		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(lookup->oname, &b, dns_rootname, 0,
+					   &lookup->onamebuf);
 		if (result != ISC_R_SUCCESS) {
 			dns_message_puttempname(lookup->sendmsg, &lookup->name);
 			dns_message_puttempname(lookup->sendmsg,
@@ -2274,12 +2276,12 @@ setup_lookup(dig_lookup_t *lookup) {
 			len = (unsigned int)strlen(textname);
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
-			result = dns_name_fromtext(name, &b, NULL, 0);
+			result = dns_name_fromtext(name, &b, NULL, 0, NULL);
 			if (result == ISC_R_SUCCESS) {
 				if (!dns_name_isabsolute(name)) {
 					result = dns_name_concatenate(
 						name, lookup->oname,
-						lookup->name);
+						lookup->name, &lookup->namebuf);
 				} else {
 					dns_name_copy(name, lookup->name);
 				}
@@ -2290,7 +2292,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
 				if (result == DNS_R_NAMETOOLONG) {
-					return false;
+					return (false);
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
@@ -2307,7 +2309,8 @@ setup_lookup(dig_lookup_t *lookup) {
 			isc_buffer_init(&b, textname, len);
 			isc_buffer_add(&b, len);
 			result = dns_name_fromtext(lookup->name, &b,
-						   dns_rootname, 0);
+						   dns_rootname, 0,
+						   &lookup->namebuf);
 			if (result != ISC_R_SUCCESS) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->name);
@@ -2316,7 +2319,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
 				clear_current_lookup();
-				return false;
+				return (false);
 #else  /* if TARGET_OS_IPHONE */
 				cleanup_openssl_refs();
 				digexit();
@@ -2460,8 +2463,7 @@ setup_lookup(dig_lookup_t *lookup) {
 			lookup->udpsize = DEFAULT_EDNS_BUFSIZE;
 		}
 		if (lookup->edns < 0) {
-			lookup->original_edns = lookup->edns =
-				DEFAULT_EDNS_VERSION;
+			lookup->edns = DEFAULT_EDNS_VERSION;
 		}

 		if (lookup->nsid) {
@@ -2650,7 +2652,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	return true;
+	return (true);
 }

 /*%
@@ -2777,12 +2779,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }

-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2801,7 +2797,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,

 	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
 	{
-		return NULL;
+		return (NULL);
 	}

 	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
@@ -2829,7 +2825,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -2877,7 +2876,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 			INSIST(*psess_cache == NULL);
 			*psess_cache = sess_cache;
 		}
-		return ctx;
+		return (ctx);
 	}

 	if (psess_cache != NULL) {
@@ -2886,7 +2885,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 	}

 	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
-	return found_ctx;
+	return (found_ctx);
 failure:
 	if (ctx != NULL) {
 		isc_tlsctx_free(&ctx);
@@ -2901,7 +2900,7 @@ failure:
 	if (store != NULL && store != found_store) {
 		isc_tls_cert_store_free(&store);
 	}
-	return NULL;
+	return (NULL);
 }

 static void
@@ -3043,8 +3042,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3064,15 +3062,14 @@ start_tcp(dig_query_t *query) {

 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}

 	return;
@@ -3357,12 +3354,12 @@ try_next_server(dig_lookup_t *lookup) {

 	current_query = lookup->current_query;
 	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
-		return false;
+		return (false);
 	}

 	next_query = ISC_LIST_NEXT(current_query, link);
 	if (next_query == NULL) {
-		return false;
+		return (false);
 	}

 	debug("trying next server...");
@@ -3373,7 +3370,7 @@ try_next_server(dig_lookup_t *lookup) {
 		start_udp(next_query);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -3712,7 +3709,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result != ISC_R_SUCCESS) {
 		puts("; Transfer failed.");
-		return true;
+		return (true);
 	}
 	do {
 		dns_name_t *name;
@@ -3738,7 +3735,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
-					return true;
+					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
 				    (rdata.type != dns_rdatatype_soa))
@@ -3818,10 +3815,10 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
-	return false;
+	return (false);
 doexit:
 	dighost_received(len, peer, query);
-	return true;
+	return (true);
 }

 static void
@@ -3915,7 +3912,7 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {

 static int
 ednsvers(dns_rdataset_t *opt) {
-	return (opt->ttl >> 16) & 0xff;
+	return ((opt->ttl >> 16) & 0xff);
 }

 /*%
@@ -4129,7 +4126,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if (!query->first_soa_rcvd || query->warn_id) {
+				if ((!query->first_soa_rcvd || query->warn_id))
+				{
 					dighost_warning("%s: ID mismatch: "
 							"expected ID %u, got "
 							"%u",
@@ -4305,11 +4303,6 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 	if (msg->rcode == dns_rcode_badvers && msg->opt != NULL &&
 	    (newedns = ednsvers(msg->opt)) < l->edns && l->ednsneg)
 	{
-		if (l->showbadvers) {
-			dighost_printmessage(query, &b, msg, true);
-			dighost_received(isc_buffer_usedlength(&b), &peer,
-					 query);
-		}
 		/*
 		 * Add minimum EDNS version required checks here if needed.
 		 */
@@ -4590,12 +4583,12 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	INSIST(count == 1);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 int
@@ -4617,7 +4610,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 			fatal("couldn't get address for '%s': %s", host,
 			      isc_result_totext(result));
 		}
-		return 0;
+		return (0);
 	}

 	for (i = 0; i < count; i++) {
@@ -4627,7 +4620,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 	}

-	return count;
+	return (count);
 }

 /*%
@@ -4800,7 +4793,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -4808,14 +4801,14 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

 	idn2_free(dst);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -4881,8 +4874,8 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup) {
 	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
-		return true;
+		return (true);
 	}

-	return false;
+	return (false);
 }
@@ -21,6 +21,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/loop.h>
 #include <isc/magic.h>
@@ -84,6 +85,8 @@
 * in a tight loop of constant lookups.  It's value is arbitrary.
 */

+ISC_LANG_BEGINDECLS
+
 typedef struct dig_lookup dig_lookup_t;
 typedef struct dig_query dig_query_t;
 typedef struct dig_server dig_server_t;
@@ -104,8 +107,9 @@ struct dig_lookup {
 	isc_refcount_t references;
 	bool aaonly, adflag, badcookie, besteffort, cdflag, cleared, comments,
 		dns64prefix, dnssec, doing_xfr, done_as_is, ednsneg, expandaaaa,
-		svcparamkeycompat, expire, fuzzing, header_only,
-		identify, /*%< Append an "on server <foo>" message */
+		expire, fuzzing, header_only, identify, /*%< Append an "on
+							   server <foo>" message
+							 */
 		identify_previous_line, /*% Prepend a "Nameserver <foo>:"
 					   message, with newline and tab */
 		idnin, idnout, ignore, multiline, need_search, new_search,
@@ -117,9 +121,9 @@ struct dig_lookup {
 		section_answer, section_authority, section_question,
 		seenbadcookie, sendcookie, servfail_stops,
 		setqid, /*% use a speciied query ID */
-		showbadcookie, showbadvers, stats, tcflag, tcp_keepalive,
-		tcp_mode, tcp_mode_set, tls_mode, /*% connect using TLS */
-		trace,				  /*% dig +trace */
+		showbadcookie, stats, tcflag, tcp_keepalive, tcp_mode,
+		tcp_mode_set, tls_mode, /*% connect using TLS */
+		trace,			/*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
 		ttlunits, use_usec, waiting_connect, zflag;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
@@ -131,6 +135,8 @@ struct dig_lookup {
 	bool rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
+	isc_buffer_t namebuf;
+	isc_buffer_t onamebuf;
 	isc_buffer_t renderbuf;
 	char *sendspace;
 	dns_name_t *name;
@@ -148,7 +154,6 @@ struct dig_lookup {
 	int nsfound;
 	int16_t udpsize;
 	int16_t edns;
-	int16_t original_edns;
 	int16_t padding;
 	uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
@@ -461,3 +466,5 @@ dig_shutdown(void);

 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup);
+
+ISC_LANG_ENDDECLS
@@ -21,7 +21,6 @@

 #include <isc/attributes.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/string.h>
@@ -29,7 +28,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -82,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -99,7 +96,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 ISC_NORETURN static void
@@ -221,13 +218,13 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		printf(";; %s SECTION:\n", section_name);
 	}

-	dns_name_init(&empty_name);
+	dns_name_init(&empty_name, NULL);

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -246,7 +243,8 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			       (list_type == dns_rdatatype_any ||
 				rdataset->type == list_type)) ||
 			      (list_addresses &&
-			       (dns_rdatatype_isaddr(rdataset->type) ||
+			       (rdataset->type == dns_rdatatype_a ||
+				rdataset->type == dns_rdatatype_aaaa ||
 				rdataset->type == dns_rdatatype_ns ||
 				rdataset->type == dns_rdatatype_ptr))))
 			{
@@ -264,7 +262,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return result;
+					return (result);
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -319,11 +317,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -343,12 +341,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -425,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -459,16 +457,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}

 	if (!short_form) {
@@ -529,7 +517,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -539,7 +527,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

@@ -550,7 +538,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -560,7 +548,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -568,7 +556,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!short_form) {
@@ -586,7 +574,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return result;
+	return (result);
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -929,5 +917,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (seen_error == 0) ? 0 : 1;
+	return ((seen_error == 0) ? 0 : 1);
 }
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -20,7 +20,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
+#include <isc/condition.h>
 #include <isc/loop.h>
 #include <isc/netaddr.h>
 #include <isc/parseint.h>
@@ -30,7 +30,6 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
-#include <dns/lib.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -129,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 static void
@@ -211,9 +210,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -257,10 +256,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -295,9 +294,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -339,10 +338,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -425,7 +424,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -479,7 +478,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -538,10 +537,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -555,10 +554,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -976,5 +975,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return query_error | print_error;
+	return (query_error | print_error);
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return NULL;
+		return (NULL);
 	}
-	return buf;
-}
+	return (buf);
+};

 #define add_history(line)

@@ -41,14 +41,6 @@ dnssec_keygen_LDADD =		\
 	$(LDADD)		\
 	$(OPENSSL_LIBS)

-dnssec_ksr_CPPFLAGS=		\
-	$(AM_CPPFLAGS)		\
-	$(OPENSSL_CFLAGS)
-
-dnssec_ksr_LDADD =		\
-	$(LDADD)		\
-	$(OPENSSL_LIBS)
-
 dnssec_signzone_CPPFLAGS =	\
 	$(AM_CPPFLAGS)		\
 	$(OPENSSL_CFLAGS)
@@ -29,7 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -45,7 +44,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -178,7 +176,7 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize name %s", setname);
 	}
@@ -395,7 +393,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return buf;
+	return (buf);
 }

 static void
@@ -505,14 +503,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return true;
+			return (true);
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return false;
+			return (false);
 		}
 	}

@@ -521,7 +519,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return false;
+	return (false);
 }

 /*
@@ -575,7 +573,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return keytable;
+	return (keytable);
 }

 static void
@@ -681,7 +679,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return algo;
+	return (algo);
 }

 /*
@@ -698,7 +696,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return ok;
+	return (ok);
 }

 /*
@@ -740,7 +738,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return all_ok;
+	return (all_ok);
 }

 /*
@@ -761,10 +759,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return ISC_R_IGNORE;
+		return (ISC_R_IGNORE);
 	}

-	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
+	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
 }

 static isc_result_t
@@ -777,7 +775,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -785,7 +783,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -816,14 +814,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return result;
+			return (result);
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -868,8 +866,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return dns_rdata_compare((const dns_rdata_t *)rdata1,
-				 (const dns_rdata_t *)rdata2);
+	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
+				  (const dns_rdata_t *)rdata2));
 }

 /*
@@ -950,7 +948,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return match;
+	return (match);
 }

 static void
@@ -1075,7 +1073,7 @@ cleanup(void) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
 		}
-		isc_mem_detach(&mctx);
+		isc_mem_destroy(&mctx);
 	}
 }

@@ -1341,5 +1339,5 @@ cleanup:
 	print_mem_stats = true;
 	cleanup();

-	return 0;
+	return (0);
 }
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -35,7 +34,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -67,8 +65,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -140,7 +138,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +153,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return ISC_R_NOSPACE;
+			return (ISC_R_NOSPACE);
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -164,18 +162,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return loadset(filename, rdataset);
+	return (loadset(filename, rdataset));
 }

 static void
@@ -383,7 +381,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define OPTIONS "12Aa:Cc:d:Ff:K:sT:v:whV"
+#define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:whV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
@@ -419,6 +417,9 @@ main(int argc, char **argv) {
 		case 'f':
 			filename = isc_commandline_argument;
 			break;
+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
 		case 's':
 			usekeyset = true;
 			break;
@@ -543,13 +544,13 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -20,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -33,7 +32,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -69,8 +67,8 @@ initname(char *setname) {

 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
-	result = dns_name_fromtext(name, &buf, dns_rootname, 0);
-	return result;
+	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
+	return (result);
 }

 static void
@@ -143,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static void
@@ -456,13 +454,13 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -21,7 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -32,7 +31,6 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -367,7 +365,7 @@ main(int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -746,11 +744,11 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, label);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -38,8 +38,7 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
-#include <isc/lib.h>
+#include <isc/fips.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
@@ -51,13 +50,17 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
+
 #include "dnssectool.h"

 const char *program = "dnssec-keygen";
@@ -146,7 +149,7 @@ usage(void) {
 	fprintf(stderr, "    -l <file>: configuration file with dnssec-policy "
 			"statement\n");
 	fprintf(stderr, "    -a <algorithm>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1 | NSEC3RSASHA1 |\n");
 	}
 	fprintf(stderr, "        RSASHA256 | RSASHA512 |\n");
@@ -154,7 +157,7 @@ usage(void) {
 	fprintf(stderr, "        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
-	if (!isc_crypto_fips_mode()) {
+	if (!isc_fips_mode()) {
 		fprintf(stderr, "        RSASHA1:\t[%d..%d]\n", min_rsa,
 			MAX_RSA);
 		fprintf(stderr, "        NSEC3RSASHA1:\t[%d..%d]\n", min_rsa,
@@ -187,7 +190,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record\n");
+	fprintf(stderr, "       usage | trace | record | size | mctx\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -272,7 +275,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		isc_buffer_init(&buf, argv[isc_commandline_index],
 				strlen(argv[isc_commandline_index]));
 		isc_buffer_add(&buf, strlen(argv[isc_commandline_index]));
-		ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+		ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 		if (ret != ISC_R_SUCCESS) {
 			fatal("invalid key name %s: %s",
 			      argv[isc_commandline_index],
@@ -283,7 +286,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			fatal("unsupported algorithm: %s", algstr);
 		}

-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify only in FIPS mode */
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
@@ -336,7 +339,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 			switch (ctx->alg) {
 			case DST_ALG_RSASHA1:
 			case DST_ALG_NSEC3RSASHA1:
-				if (isc_crypto_fips_mode()) {
+				if (isc_fips_mode()) {
 					fatal("key size not specified (-b "
 					      "option)");
 				}
@@ -496,7 +499,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	switch (ctx->alg) {
 	case DNS_KEYALG_RSASHA1:
 	case DNS_KEYALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			fatal("SHA1 based keys not supported in FIPS mode");
 		}
 		FALLTHROUGH;
@@ -842,6 +845,10 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	unsigned char c;
 	int ch;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	keygen_ctx_t ctx = {
 		.options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC,
@@ -1100,9 +1107,7 @@ main(int argc, char **argv) {
 			ctx.prepub = strtottl(isc_commandline_argument);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -1129,11 +1134,32 @@ main(int argc, char **argv) {
 		ctx.quiet = true;
 	}

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/*
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

@@ -1280,11 +1306,19 @@ main(int argc, char **argv) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
 	if (freeit != NULL) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -18,9 +18,8 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
+#include <isc/fips.h>
 #include <isc/lex.h>
-#include <isc/lib.h>
 #include <isc/mem.h>

 #include <dns/callbacks.h>
@@ -28,7 +27,6 @@
 #include <dns/fixedname.h>
 #include <dns/keymgr.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
 #include <dns/rdataset.h>
@@ -151,7 +149,7 @@ between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
 	if (t > 0 && t > start && t < end) {
 		r = t;
 	}
-	return r;
+	return (r);
 }

 static void
@@ -201,15 +199,15 @@ keyalgtag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
 	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
-		return -1;
+		return (-1);
 	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
-		return 1;
+		return (1);
 	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
-		return -1;
+		return (-1);
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
-		return 1;
+		return (1);
 	}
-	return 0;
+	return (0);
 }

 static void
@@ -362,7 +360,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	switch (ksr->alg) {
 	case DST_ALG_RSASHA1:
 	case DST_ALG_NSEC3RSASHA1:
-		if (isc_crypto_fips_mode()) {
+		if (isc_fips_mode()) {
 			/* verify-only in FIPS mode */
 			fatal("unsupported algorithm: %s", algstr);
 		}
@@ -643,7 +641,7 @@ fail:
 		      namestr, algstr, timestr);
 	}

-	return next_bundle;
+	return (next_bundle);
 }

 static isc_stdtime_t
@@ -737,7 +735,7 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);

-	return next_bundle;
+	return (next_bundle);
 }

 /*
@@ -895,11 +893,11 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);

-	return next_bundle;
+	return (next_bundle);

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
-	return 0;
+	return (0);
 }

 static void
@@ -1008,12 +1006,12 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	dname = dns_fixedname_initname(&dfname);
 	isc_buffer_init(&b, owner, strlen(owner));
 	isc_buffer_add(&b, strlen(owner));
-	ret = dns_name_fromtext(dname, &b, dns_rootname, 0);
+	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
-		return ret;
+		return (ret);
 	}
 	if (dns_name_compare(dname, name) != 0) {
-		return DNS_R_BADOWNERNAME;
+		return (DNS_R_BADOWNERNAME);
 	}
 	isc_buffer_clear(&b);

@@ -1051,7 +1049,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {

 cleanup:
 	isc_lex_setcomments(lex, 0);
-	return ret;
+	return (ret);
 }

 static void
@@ -1348,6 +1346,10 @@ main(int argc, char *argv[]) {
 	isc_buffer_t buf;
 	int ch;
 	char *endp;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
 	ksr_ctx_t ksr = {
 		.now = isc_stdtime_now(),
 	};
@@ -1367,9 +1369,7 @@ main(int argc, char *argv[]) {
 					    ksr.now, &ksr.setend);
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;
 		case 'f':
 			ksr.file = isc_commandline_argument;
@@ -1423,18 +1423,37 @@ main(int argc, char *argv[]) {
 	 * The DST subsystem will set FIPS mode if requested at build time.
 	 * The minimum sizes are both raised to 2048.
 	 */
-	if (isc_crypto_fips_mode()) {
+	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

 	setup_logging();

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	/* zone */
 	namestr = argv[1];
 	name = dns_fixedname_initname(&fname);
 	isc_buffer_init(&buf, argv[1], strlen(argv[1]));
 	isc_buffer_add(&buf, strlen(argv[1]));
-	ret = dns_name_fromtext(name, &buf, dns_rootname, 0);
+	ret = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
 		fatal("invalid zone name %s: %s", argv[1],
 		      isc_result_totext(ret));
@@ -23,14 +23,12 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -248,7 +246,7 @@ cleanup:
 	if (dir != NULL) {
 		isc_mem_free(mctx, dir);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -25,7 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
@@ -34,7 +33,6 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
-#include <dns/lib.h>

 #include <dst/dst.h>

@@ -949,7 +947,7 @@ main(int argc, char **argv) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_free(mctx, directory);
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -42,9 +42,9 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -71,7 +71,6 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -89,6 +88,10 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif

 #include "dnssectool.h"

@@ -194,7 +197,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return result;
+	return (result);
 }

 static void
@@ -322,28 +325,28 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return key->force_sign || key->hint_sign;
+	return (key->force_sign || key->hint_sign);
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return (key->force_publish || key->hint_publish) && !key->hint_remove;
+	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return dns_name_equal(dst_key_name(key->key), gorigin) &&
-	       dst_key_iszonekey(key->key);
+	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
+		dst_key_iszonekey(key->key));
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return key->ksk;
+	return (key->ksk);
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return ignore_kskflag || !key->ksk;
+	return (ignore_kskflag || !key->ksk);
 }

 /*%
@@ -363,10 +366,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return key;
+			return (key);
 		}
 	}
-	return NULL;
+	return (NULL);
 }

 /*%
@@ -383,7 +386,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return key;
+		return (key);
 	}

 	/*
@@ -397,7 +400,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return key;
+		return (key);
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -405,7 +408,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return NULL;
+		return (NULL);
 	}

 	result = dst_key_fromfile(
@@ -416,14 +419,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}

+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return key;
+	return (key);
 }

 /*%
@@ -445,11 +449,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return true;
+		return (true);
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return false;
+		return (false);
 	default:
 		break;
 	}
@@ -457,7 +461,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return false; /* removes a warning */
+	return (false); /* removes a warning */
 }

 static bool
@@ -467,10 +471,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return true;
+		return (true);
 	} else {
 		INCSTAT(nverifyfailed);
-		return false;
+		return (false);
 	}
 }

@@ -536,7 +540,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;

 		dns_rdataset_current(&sigset, &sigrdata);
@@ -547,10 +551,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -579,21 +581,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -606,32 +602,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}

 		if (keep) {
@@ -684,10 +673,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
-		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
-			continue;
-		}
-
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -870,7 +855,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return memcmp(a, b, hash_length + 1);
+	return (memcmp(a, b, hash_length + 1));
 }

 static void
@@ -902,11 +887,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return true;
+			return (true);
 		}
 		current = next;
 	}
-	return false;
+	return (false);
 }

 static const unsigned char *
@@ -928,16 +913,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return next;
+	return (next);
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return true;
+		return (true);
 	} else {
-		return false;
+		return (false);
 	}
 }

@@ -954,7 +939,7 @@ addnowildcardhash(hashlist_t *l,

 	wild = dns_fixedname_initname(&fixed);

-	result = dns_name_concatenate(dns_wildcardname, name, wild);
+	result = dns_name_concatenate(dns_wildcardname, name, wild, NULL);
 	if (result == ISC_R_NOSPACE) {
 		return;
 	}
@@ -1046,7 +1031,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return result;
+				return (result);
 			}
 		}
 		dns_db_detach(&db);
@@ -1055,13 +1040,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&keyset);
@@ -1070,7 +1055,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1106,7 +1091,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 static bool
@@ -1115,7 +1100,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&dsset);
@@ -1125,7 +1110,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return (result == ISC_R_SUCCESS);
 }

 static bool
@@ -1135,7 +1120,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&nsset);
@@ -1148,7 +1133,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1167,7 +1152,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1385,7 +1370,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return active;
+	return (active);
 }

 /*%
@@ -1434,7 +1419,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&rdataset);
@@ -1508,7 +1493,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return result;
+	return (result);
 }

 /*%
@@ -2029,7 +2014,7 @@ addnsec3(dns_name_t *name, dns_dbnode_t *node, const unsigned char *salt,
 	dns_fixedname_init(&hashname);
 	dns_rdataset_init(&rdataset);

-	dns_name_downcase(name, name);
+	dns_name_downcase(name, name, NULL);
 	result = dns_nsec3_hashname(&hashname, hash, &hash_len, name, gorigin,
 				    dns_hash_sha1, iterations, salt, salt_len);
 	check_result(result, "addnsec3: dns_nsec3_hashname()");
@@ -2397,7 +2382,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			fatal("iterating through the database failed: %s",
 			      isc_result_totext(result));
 		}
-		dns_name_downcase(name, name);
+		dns_name_downcase(name, name, NULL);
 		hashlist_add_dns_name(hashlist, name, hashalg, iterations, salt,
 				      salt_len, false);
 		dns_db_detachnode(gdb, &node);
@@ -2407,7 +2392,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 		 * node for another <name,nextname> span so we don't add
 		 * it here.  Empty labels on nextname are within the span.
 		 */
-		dns_name_downcase(nextname, nextname);
+		dns_name_downcase(nextname, nextname, NULL);
 		dns_name_fullcompare(name, nextname, &order, &nlabels);
 		addnowildcardhash(hashlist, name, hashalg, iterations, salt,
 				  salt_len);
@@ -2574,7 +2559,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -3375,16 +3360,17 @@ main(int argc, char *argv[]) {
 	bool set_optout = false;
 	bool set_iter = false;
 	bool nonsecify = false;
+	bool set_fips_mode = false;
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif

 	atomic_init(&shuttingdown, false);
 	atomic_init(&finished, false);

-	/*
-	 * Unused letters: Bb G J l q Yy (and F is reserved).
-	 * l was previously used for DLV lookaside.
-	 */
-#define CMDLINE_FLAGS                                                        \
-	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
+	/* Unused letters: Bb G J q Yy (and F is reserved). */
+#define CMDLINE_FLAGS                                                          \
+	"3:AaCc:Dd:E:e:f:FgG:hH:i:I:j:J:K:k:L:l:m:M:n:N:o:O:PpQqRr:s:ST:tuUv:" \
 	"VX:xzZ:"

 	/*
@@ -3558,6 +3544,10 @@ main(int argc, char *argv[]) {
 			}
 			break;

+		case 'l':
+			fatal("-l option (DLV lookaside) is obsolete");
+			break;
+
 		case 'M':
 			endp = NULL;
 			set_maxttl = true;
@@ -3663,9 +3653,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
-				fatal("setting FIPS mode failed");
-			}
+			set_fips_mode = true;
 			break;

 		case '?':
@@ -3736,6 +3724,27 @@ main(int argc, char *argv[]) {

 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

+	if (set_fips_mode) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+		fips = OSSL_PROVIDER_load(NULL, "fips");
+		if (fips == NULL) {
+			ERR_clear_error();
+			fatal("Failed to load FIPS provider");
+		}
+		base = OSSL_PROVIDER_load(NULL, "base");
+		if (base == NULL) {
+			OSSL_PROVIDER_unload(fips);
+			ERR_clear_error();
+			fatal("Failed to load base provider");
+		}
+#endif
+		if (!isc_fips_mode()) {
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
+				fatal("setting FIPS mode failed");
+			}
+		}
+	}
+
 	setup_logging();

 	argc -= isc_commandline_index;
@@ -4107,6 +4116,15 @@ main(int argc, char *argv[]) {
 		isc_mem_stats(mctx, stdout);
 	}

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	if (printstats) {
@@ -4116,5 +4134,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mutex_destroy(&namelock);

-	return vresult == ISC_R_SUCCESS ? 0 : 1;
+	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -174,11 +174,6 @@ Options
   days. Therefore, if any existing RRSIG records are due to expire in
   less than 7.5 days, they are replaced.

-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are
@@ -274,7 +269,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -291,7 +286,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
@@ -44,7 +43,6 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
-#include <dns/lib.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -105,7 +103,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	isc_buffer_add(&b, len);

 	name = dns_fixedname_initname(&fname);
-	result = dns_name_fromtext(name, &b, dns_rootname, 0);
+	result = dns_name_fromtext(name, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("failed converting name '%s' to dns format: %s", origin,
 		      isc_result_totext(result));
@@ -330,7 +328,7 @@ main(int argc, char *argv[]) {
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
-	isc_mem_detach(&mctx);
+	isc_mem_destroy(&mctx);

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -173,16 +173,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return offset * (365 * 24 * 3600);
+		return (offset * (365 * 24 * 3600));
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return offset * (30 * 24 * 3600);
+			return (offset * (30 * 24 * 3600));
 		case 'I':
 		case 'i':
-			return offset * 60;
+			return (offset * 60);
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -194,29 +194,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return offset * (7 * 24 * 3600);
+		return (offset * (7 * 24 * 3600));
 	case 'D':
 	case 'd':
-		return offset * (24 * 3600);
+		return (offset * (24 * 3600));
 	case 'H':
 	case 'h':
-		return offset * 3600;
+		return (offset * 3600);
 	case 'S':
 	case 's':
 	case '\0':
-		return offset;
+		return (offset);
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return 0; /* silence compiler warning */
+	return (0); /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return (strcasecmp(str, "none") == 0) ||
-	       (strcasecmp(str, "never") == 0) ||
-	       (strcasecmp(str, "unset") == 0);
+	return ((strcasecmp(str, "none") == 0) ||
+		(strcasecmp(str, "never") == 0) ||
+		(strcasecmp(str, "unset") == 0));
 }

 dns_ttl_t
@@ -226,7 +226,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return (dns_ttl_t)0;
+		return ((dns_ttl_t)0);
 	}

 	ttl = strtol(str, &endp, 0);
@@ -234,19 +234,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return ttl;
+	return (ttl);
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return DST_KEY_STATE_NA;
+		return (DST_KEY_STATE_NA);
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return (dst_key_state_t)i;
+			return ((dst_key_state_t)i);
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -263,13 +263,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	/*
@@ -318,7 +318,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return (isc_stdtime_t)base;
+		return ((isc_stdtime_t)base);
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -331,7 +331,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return (isc_stdtime_t)val;
+	return ((isc_stdtime_t)val);
 }

 dns_rdataclass_t
@@ -341,7 +341,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return dns_rdataclass_in;
+		return (dns_rdataclass_in);
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -349,7 +349,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return rdclass;
+	return (rdclass);
 }

 unsigned int
@@ -364,14 +364,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return alg;
+	return (alg);
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return a - b;
+	return (a - b);
 }

 void
@@ -403,7 +403,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -460,7 +460,9 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
@@ -470,14 +472,14 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		if (id < min || id > max) {
 			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
 				min, max);
-			return true;
+			return (true);
 		}
 		if (rid < min || rid > max) {
 			fprintf(stderr,
 				"Revoked Key ID %d (for tag %d) outside of "
 				"[%u..%u]\n",
 				rid, id, min, max);
-			return true;
+			return (true);
 		}
 	}

@@ -485,7 +487,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return false;
+		return (false);
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -529,7 +531,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return conflict;
+	return (conflict);
 }

 bool
@@ -544,9 +546,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 void
@@ -931,7 +931,6 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -960,7 +959,6 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return DNS_R_BADTTL;
+		return (DNS_R_BADTTL);
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return result;
+	return (result);
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
-	return putrr(node, "SOA", DEFAULT_TTL, str);
+	return (putrr(node, "SOA", DEFAULT_TTL, str));
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
+	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return j + 14;
+	return (j + 14);
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				sizeof(ipv4only));
+		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				 sizeof(ipv4only)));
 	}

-	return putrdata(node, dns_rdatatype_cname, 600, rdata,
-			(unsigned int)len);
+	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
+			 (unsigned int)len));
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
-	if (name->length == 0) {
-		return bdb->lookup(node);
+	if (name->labels == 0 && name->length == 0) {
+		return (bdb->lookup(node));
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return dns64_cname(&bdb->common.origin, name, node);
+		return (dns64_cname(&bdb->common.origin, name, node));
 	} else {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->version);
+			return (puttxt(node, named_g_server->version));
 		}
 	} else {
-		return puttxt(node, PACKAGE_VERSION);
+		return (puttxt(node, PACKAGE_VERSION));
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->hostname);
+			return (puttxt(node, named_g_server->hostname));
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	}
 }

@@ -546,16 +546,16 @@ authors_lookup(bdbnode_t *node) {
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -563,13 +563,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return puttxt(node, named_g_server->sctx->server_id);
+		return (puttxt(node, named_g_server->sctx->server_id));
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -577,7 +577,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -588,10 +588,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -600,7 +600,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return result;
+	return (result);
 }

 /*
@@ -670,10 +670,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -682,9 +682,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -787,7 +787,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -839,28 +839,28 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {
 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep != NULL && *nodep == NULL);

-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -881,32 +881,32 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,
 	isorigin = dns_name_equal(name, &bdb->common.origin);

 	labels = dns_name_countlabels(name) - dns_name_countlabels(&db->origin);
-	dns_name_init(&relname);
+	dns_name_init(&relname, NULL);
 	dns_name_getlabelsequence(name, 0, labels, &relname);
 	name = &relname;

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return result;
+			return (result);
 		}
 	}

-	*nodep = (dns_dbnode_t *)node;
-	return ISC_R_SUCCESS;
+	*nodep = node;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -925,10 +925,10 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,

 	REQUIRE(VALID_BDB(bdb));
 	REQUIRE(nodep == NULL || *nodep == NULL);
-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == (void *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return DNS_R_NXDOMAIN;
+		return (DNS_R_NXDOMAIN);
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +954,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return DNS_R_BADDB;
+				return (DNS_R_BADDB);
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}

 		/*
@@ -1015,7 +1015,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		 * and try again.
 		 */
 		if (i < nlabels) {
-			destroynode((bdbnode_t *)node);
+			destroynode(node);
 			node = NULL;
 			continue;
 		}
@@ -1069,7 +1069,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return result;
+	return (result);
 }

 static void
@@ -1117,7 +1117,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1128,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	new_rdataset(list, db, node, rdataset);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1142,7 +1142,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	     dns_rdatasetiter_t **iteratorp DNS__DB_FLARG) {
 	bdb_rdatasetiter_t *iterator = NULL;

-	REQUIRE(version == NULL || version == (dns_dbversion_t *)&dummy);
+	REQUIRE(version == NULL || version == &dummy);

 	iterator = isc_mem_get(db->mctx, sizeof(bdb_rdatasetiter_t));
 	*iterator = (bdb_rdatasetiter_t){
@@ -1158,7 +1158,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1186,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1197,8 +1197,8 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	isc_refcount_init(&bdb->common.references, 1);
 	isc_mem_attach(mctx, &bdb->common.mctx);
-	dns_name_init(&bdb->common.origin);
-	dns_name_dup(origin, mctx, &bdb->common.origin);
+	dns_name_init(&bdb->common.origin, NULL);
+	dns_name_dupwithoffsets(origin, mctx, &bdb->common.origin);

 	INSIST(argc >= 1);
 	if (strcmp(argv[0], "authors") == 0) {
@@ -1241,7 +1241,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1253,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return result;
+	return (result);
 }

 /*
@@ -1269,17 +1269,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -111,8 +111,6 @@ options {\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
 	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -170,8 +168,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 50;\n\
-	max-query-count 200;\n\
+	max-recursion-queries 32;\n\
 	max-query-restarts 11;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
@@ -195,6 +192,7 @@ options {\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
+#	sortlist <none>\n\
 	stale-answer-client-timeout off;\n\
 	stale-answer-enable false;\n\
 	stale-answer-ttl 30; /* 30 seconds */\n\
@@ -234,7 +232,6 @@ options {\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
@@ -334,7 +331,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -358,15 +355,15 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					CFG_PCTX_NOEXPERIMENTAL,
-				conf);
+	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				 CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
+					 CFG_PCTX_NOEXPERIMENTAL,
+				 conf));
 }

 const char *
 named_config_getdefault(void) {
-	return defaultconf;
+	return (defaultconf);
 }

 isc_result_t
@@ -376,10 +373,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 isc_result_t
@@ -405,7 +402,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return ISC_R_SUCCESS;
+				return (ISC_R_SUCCESS);
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -419,13 +416,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return ISC_R_SUCCESS;
+						return (ISC_R_SUCCESS);
 					}
 				}
 			}
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 int
@@ -437,7 +434,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return i;
+	return (i);
 }

 isc_result_t
@@ -448,7 +445,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
@@ -457,7 +454,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
 			    r.base);
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -468,7 +465,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
@@ -477,7 +474,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
 			    r.base);
 	}
-	return result;
+	return (result);
 }

 dns_zonetype_t
@@ -503,12 +500,12 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return ztype;
+	return (ztype);
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -519,7 +516,7 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -528,11 +525,28 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			       name) == 0)
 		{
 			*ret = obj;
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		elt = cfg_list_next(elt);
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
+}
+
+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return (getremotesdef(cctx, list, name, ret));
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return (result);
+	}
+	return (ISC_R_NOTFOUND);
 }

 static isc_result_t
@@ -547,26 +561,26 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
-	dns_name_init(*namep);
+	dns_name_init(*namep, NULL);

 	objstr = cfg_obj_asstring(obj);
 	isc_buffer_constinit(&b, objstr, strlen(objstr));
 	isc_buffer_add(&b, strlen(objstr));
 	dns_fixedname_init(&fname);
 	result = dns_name_fromtext(dns_fixedname_name(&fname), &b, dns_rootname,
-				   0);
+				   0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return result;
+		return (result);
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -583,12 +597,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -671,6 +683,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -701,22 +715,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -819,7 +828,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (addrs != NULL) {
@@ -858,7 +867,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -883,10 +892,10 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
 		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return ISC_R_RANGE;
+		return (ISC_R_RANGE);
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 struct keyalgorithms {
@@ -930,15 +939,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		if (bits > algorithms[i].size) {
-			return ISC_R_RANGE;
+			return (ISC_R_RANGE);
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -947,5 +956,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
@@ -44,23 +44,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	*cmdp = token.value.as_textregion.base;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return strcasecmp(str, command) == 0;
+	return (strcasecmp(str, command) == 0);
 }

 /*%
@@ -86,7 +86,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -94,7 +94,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return result;
+		return (result);
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -233,8 +233,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
@@ -307,5 +305,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return result;
+	return (result);
 }
@@ -31,13 +31,13 @@
 #include <isc/result.h>
 #include <isc/stdtime.h>
 #include <isc/string.h>
-#include <isc/symtab.h>
 #include <isc/util.h>

 #include <isccc/alist.h>
 #include <isccc/cc.h>
 #include <isccc/ccmsg.h>
 #include <isccc/sexpr.h>
+#include <isccc/symtab.h>
 #include <isccc/util.h>

 #include <isccfg/check.h>
@@ -108,7 +108,7 @@ struct named_controls {
 	controllistenerlist_t listeners;
 	bool shuttingdown;
 	isc_mutex_t symtab_lock;
-	isc_symtab_t *symtab;
+	isccc_symtab_t *symtab;
 };

 static isc_result_t
@@ -246,7 +246,7 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return result == ISC_R_SUCCESS && match > 0;
+	return (result == ISC_R_SUCCESS && match > 0);
 }

 static void
@@ -489,7 +489,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 		if ((sent + CLOCKSKEW) < conn->now ||
 		    (sent - CLOCKSKEW) > conn->now)
 		{
-			result = DNS_R_CLOCKSKEW;
+			result = ISCCC_R_CLOCKSKEW;
 			goto cleanup;
 		}
 	} else {
@@ -503,7 +503,7 @@ control_recvmessage(isc_nmhandle_t *handle ISC_ATTR_UNUSED, isc_result_t result,
 	if (isccc_cc_lookupuint32(conn->ctrl, "_exp", &exp) == ISC_R_SUCCESS &&
 	    conn->now > exp)
 	{
-		result = DNS_R_EXPIRED;
+		result = ISCCC_R_EXPIRED;
 		goto cleanup;
 	}

@@ -638,7 +638,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return result;
+		return (result);
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
@@ -649,11 +649,11 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	newconnection(listener, handle);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -707,11 +707,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -736,6 +736,7 @@ controlkeylist_fromcfg(const cfg_obj_t *keylist, isc_mem_t *mctx,
 		key->secret.length = 0;
 		ISC_LINK_INIT(key, link);
 		ISC_LIST_APPEND(*keyids, key, link);
+		newstr = NULL;
 	}
 }

@@ -832,7 +833,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		      ISC_LOG_INFO, "configuring command channel from '%s'",
 		      named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

 	CHECK(cfg_parser_create(mctx, &pctx));
@@ -841,12 +842,15 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	CHECK(cfg_map_get(config, "key", &key));

 	keyid = isc_mem_get(mctx, sizeof(*keyid));
-	*keyid = (controlkey_t){
-		.algorithm = DST_ALG_UNKNOWN,
-		.link = ISC_LINK_INITIALIZER,
-	};
 	keyid->keyname = isc_mem_strdup(mctx,
 					cfg_obj_asstring(cfg_map_getname(key)));
+	keyid->secret.base = NULL;
+	keyid->secret.length = 0;
+	keyid->algorithm = DST_ALG_UNKNOWN;
+	ISC_LINK_INIT(keyid, link);
+	if (keyid->keyname == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

 	CHECK(isccfg_check_key(key));

@@ -895,7 +899,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1201,7 +1205,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				cfg_obj_log(controls, ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return ISC_R_FAILURE;
+				return (ISC_R_FAILURE);
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1329,12 +1333,13 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	isc_mem_t *mctx = server->mctx;
+	isc_result_t result;
 	named_controls_t *controls = isc_mem_get(mctx, sizeof(*controls));

 	*controls = (named_controls_t){
@@ -1345,11 +1350,16 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {

 	isc_mutex_init(&controls->symtab_lock);
 	LOCK(&controls->symtab_lock);
-	isccc_cc_createsymtab(mctx, &controls->symtab);
+	result = isccc_cc_createsymtab(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);

+	if (result != ISC_R_SUCCESS) {
+		isc_mutex_destroy(&controls->symtab_lock);
+		isc_mem_put(server->mctx, controls, sizeof(*controls));
+		return (result);
+	}
 	*ctrlsp = controls;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -1361,7 +1371,7 @@ named_controls_destroy(named_controls_t **ctrlsp) {
 	REQUIRE(ISC_LIST_EMPTY(controls->listeners));

 	LOCK(&controls->symtab_lock);
-	isc_symtab_destroy(&controls->symtab);
+	isccc_symtab_destroy(&controls->symtab);
 	UNLOCK(&controls->symtab_lock);
 	isc_mutex_destroy(&controls->symtab_lock);
 	isc_mem_put(controls->server->mctx, controls, sizeof(*controls));
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return ptr;
+	return (ptr);
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return result;
+	return (result);
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return false;
+		return (false);
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return ret;
+	return (ret);
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 /*
@@ -25,6 +25,7 @@
 #include <string.h>
 #include <unistd.h>

+#include <isc/condition.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
@@ -125,7 +126,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -159,7 +160,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 /*
@@ -373,7 +374,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			continue;
@@ -585,7 +586,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return NULL;
+	return (NULL);
 }

 /*
@@ -716,7 +717,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 #endif /* ENABLE_AFL */
@@ -43,7 +43,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 			      ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return NULL;
+		return (NULL);
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
@@ -51,7 +51,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
 			      pathbuf);
-		return mmdb;
+		return (mmdb);
 	}

 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
@@ -59,7 +59,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return NULL;
+	return (NULL);
 }
 #endif /* HAVE_GEOIP2 */

@@ -17,6 +17,7 @@

 #include <inttypes.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/clientinfo.h>
@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -43,7 +43,6 @@
 #define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_HALT	   "halt"
 #define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
 #define NAMED_COMMAND_MKEYS	   "managed-keys"
 #define NAMED_COMMAND_MODZONE	   "modzone"
 #define NAMED_COMMAND_NOTIFY	   "notify"
@@ -86,6 +86,7 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
+EXTERN bool named_g_logging	       INIT(false);
 EXTERN unsigned int named_g_debuglevel INIT(0);

 /*
@@ -97,6 +98,8 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -388,15 +388,3 @@ named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 */
 isc_result_t
 named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);
@@ -15,10 +15,13 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 			 dns_tkeyctx_t **tctxp);
@@ -34,5 +37,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *
 *	Returns:
 *\li		ISC_R_SUCCESS
- *\li		return codes from dns_name_fromtext()
+ *\li		ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -15,12 +15,15 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <dns/transport.h>

 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			    isc_mem_t *mctx, dns_transport_list_t **listp);
@@ -36,3 +39,5 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *	\li	'listp' is not NULL, and '*listp' is NULL
 *
 */
+
+ISC_LANG_ENDDECLS
@@ -15,8 +15,11 @@

 /*! \file */

+#include <isc/lang.h>
 #include <isc/types.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			     isc_mem_t *mctx, dns_tsigkeyring_t **ringp);
@@ -32,6 +35,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 *
 *	Returns:
 *	\li	ISC_R_SUCCESS
- *	\li	DNS_R_BADALG
- *	\li	return codes from dns_name_fromtext()
+ *	\li	ISC_R_NOMEMORY
 */
+
+ISC_LANG_ENDDECLS
@@ -17,11 +17,14 @@

 #include <stdbool.h>

+#include <isc/lang.h>
 #include <isc/types.h>

 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>

+ISC_LANG_BEGINDECLS
+
 isc_result_t
 named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		     const cfg_obj_t *zconfig, cfg_aclconfctx_t *ac,
@@ -73,3 +76,5 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 * \li	'rdclass' to be a valid rdataclass
 * \li	'name' to be a valid zone origin name
 */
+
+ISC_LANG_ENDDECLS
@@ -52,12 +52,14 @@ named_log_init(bool safe) {
 	named_log_setdefaultsslkeylogfile(lcfg);
 	rcu_read_unlock();

-	return ISC_R_SUCCESS;
+	named_g_logging = true;
+
+	return (ISC_R_SUCCESS);

 cleanup:
 	rcu_read_unlock();

-	return result;
+	return (result);
 }

 void
@@ -217,7 +219,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	}

 cleanup:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -226,5 +228,5 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
 				    ISC_LOGMODULE_DEFAULT);
-	return result;
+	return (result);
 }
@@ -55,11 +55,11 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (logconfig == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	destinations = cfg_tuple_get(ccat, "destinations");
@@ -76,10 +76,10 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -127,7 +127,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	type = ISC_LOG_TONULL;
@@ -308,7 +308,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -363,8 +363,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	return result;
+	return (result);
 }
@@ -30,9 +30,9 @@
 #include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
+#include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
-#include <isc/lib.h>
 #include <isc/managers.h>
 #include <isc/netmgr.h>
 #include <isc/os.h>
@@ -47,7 +47,6 @@

 #include <dns/dispatch.h>
 #include <dns/dyndb.h>
-#include <dns/lib.h>
 #include <dns/name.h>
 #include <dns/resolver.h>
 #include <dns/view.h>
@@ -90,6 +89,10 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#include <openssl/err.h>
+#include <openssl/provider.h>
+#endif
 #ifdef HAVE_LIBXML2
 #include <libxml/parser.h>
 #include <libxml/xmlversion.h>
@@ -129,7 +132,6 @@ static int maxudp = 0;
 /*
 * -T options:
 */
-static bool cookiealwaysvalid = false;
 static bool dropedns = false;
 static bool ednsformerr = false;
 static bool ednsnotimp = false;
@@ -151,13 +153,24 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+static OSSL_PROVIDER *fips = NULL, *base = NULL;
+#endif
+
 void
 named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_WARNING, format, args);
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_WARNING, format, args);
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);
 }

@@ -166,10 +179,18 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to early fatal error)");
+	if (named_g_logging) {
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to early fatal error)");
+	} else {
+		fprintf(stderr, "%s: ", program_name);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 	va_end(args);

 	_exit(EXIT_FAILURE);
@@ -186,19 +207,26 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	/*
-	 * Reset the assertion callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_assertion_setcallback(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the assertion callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_assertion_setcallback(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file, line,
-		      isc_assertion_typetotext(type), cond);
-	isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			  ISC_LOG_CRITICAL);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "exiting (due to assertion failure)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
+			      line, isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
+				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to assertion failure)");
+	} else {
+		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
+			isc_assertion_typetotext(type), cond);
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -217,20 +245,27 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	/*
-	 * Reset the error callback in case it is the log
-	 * routines causing the assertion.
-	 */
-	isc_error_setfatal(NULL);
+	if (named_g_logging) {
+		/*
+		 * Reset the error callback in case it is the log
+		 * routines causing the assertion.
+		 */
+		isc_error_setfatal(NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL, "%s:%d:%s(): fatal error: ", file, line,
-		      func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_CRITICAL, format, args);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_CRITICAL,
-		      "exiting (due to fatal error in library)");
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "%s:%d:%s(): fatal error: ", file, line, func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_CRITICAL, format, args);
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_CRITICAL,
+			      "exiting (due to fatal error in library)");
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}

 	if (named_g_coreok) {
 		abort();
@@ -250,11 +285,19 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_ERROR, "%s:%d:%s(): unexpected error: ", file,
-		      line, func);
-	isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		       ISC_LOG_ERROR, format, args);
+	if (named_g_logging) {
+		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			      ISC_LOG_ERROR,
+			      "%s:%d:%s(): unexpected error: ", file, line,
+			      func);
+		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
+			       ISC_LOG_ERROR, format, args);
+	} else {
+		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
+		vfprintf(stderr, format, args);
+		fprintf(stderr, "\n");
+		fflush(stderr);
+	}
 }

 static void
@@ -266,7 +309,7 @@ usage(void) {
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record}]\n"
+			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -359,7 +402,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return tmp;
+	return (tmp);
 }

 static struct flag_def {
@@ -653,9 +696,7 @@ parse_T_opt(char *option) {
 	 * force the server to behave (or misbehave) in
 	 * specified ways for testing purposes.
 	 */
-	if (!strcmp(option, "cookiealwaysvalid")) {
-		cookiealwaysvalid = true;
-	} else if (!strcmp(option, "dropedns")) {
+	if (!strcmp(option, "dropedns")) {
 		dropedns = true;
 	} else if (!strcmp(option, "ednsformerr")) {
 		ednsformerr = true;
@@ -909,7 +950,25 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-			if (isc_crypto_fips_enable() != ISC_R_SUCCESS) {
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+			fips = OSSL_PROVIDER_load(NULL, "fips");
+			if (fips == NULL) {
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load FIPS provider");
+			}
+			base = OSSL_PROVIDER_load(NULL, "base");
+			if (base == NULL) {
+				OSSL_PROVIDER_unload(fips);
+				ERR_clear_error();
+				named_main_earlyfatal(
+					"Failed to load base provider");
+			}
+#endif
+			if (isc_fips_mode()) { /* Already in FIPS mode. */
+				break;
+			}
+			if (isc_fips_set_mode(1) != ISC_R_SUCCESS) {
 				named_main_earlyfatal(
 					"setting FIPS mode failed");
 			}
@@ -966,7 +1025,7 @@ create_managers(void) {

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1223,9 +1282,6 @@ setup(void) {
 	/*
 	 * Modify server context according to command line options
 	 */
-	if (cookiealwaysvalid) {
-		ns_server_setoption(sctx, NS_SERVER_COOKIEALWAYSVALID, true);
-	}
 	if (disable4) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
 	}
@@ -1337,7 +1393,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1346,7 +1402,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1355,10 +1411,17 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
+	}
+
+	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
+		UNEXPECTED_ERROR("named_smf_get_instance memory "
+				 "allocation failed: %s",
+				 isc_result_totext(ISC_R_NOMEMORY));
+		scf_handle_destroy(h);
+		return (ISC_R_FAILURE);
 	}

-	instance = isc_mem_allocate(mctx, namelen + 1);
 	if (scf_myname(h, instance, namelen + 1) == -1) {
 		if (debug) {
 			UNEXPECTED_ERROR("scf_myname() failed: %s",
@@ -1366,12 +1429,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 #endif /* HAVE_LIBSCF */

@@ -1516,9 +1579,18 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

+#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+	if (base != NULL) {
+		OSSL_PROVIDER_unload(base);
+	}
+	if (fips != NULL) {
+		OSSL_PROVIDER_unload(fips);
+	}
+#endif
+
 #ifdef HAVE_GPERFTOOLS_PROFILER
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return 0;
+	return (0);
 }
@@ -108,7 +108,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace`` and ``record``. These correspond to the
+   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -400,15 +400,15 @@ named_os_closedevnull(void) {
 static bool
 all_digits(const char *s) {
 	if (*s == '\0') {
-		return false;
+		return (false);
 	}
 	while (*s != '\0') {
 		if (!isdigit((unsigned char)(*s))) {
-			return false;
+			return (false);
 		}
 		s++;
 	}
-	return true;
+	return (true);
 }

 void
@@ -521,9 +521,9 @@ named_os_changeuser(bool permanent) {
 uid_t
 named_os_uid(void) {
 	if (runas_pw == NULL) {
-		return 0;
+		return (0);
 	}
-	return runas_pw->pw_uid;
+	return (runas_pw->pw_uid);
 }

 void
@@ -587,22 +587,22 @@ safe_open(const char *filename, mode_t mode, bool append) {

 	if (stat(filename, &sb) == -1) {
 		if (errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 	} else if ((sb.st_mode & S_IFREG) == 0) {
 		errno = EOPNOTSUPP;
-		return -1;
+		return (-1);
 	}

 	if (append) {
 		fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, mode);
 	} else {
 		if (unlink(filename) < 0 && errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 		fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
 	}
-	return fd;
+	return (fd);
 }

 static void
@@ -650,7 +650,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			    !strcmp(slash + 1, ".."))
 			{
 				*slash = '/';
-				return 0;
+				return (0);
 			}
 			mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
 			mode |= S_IRGRP | S_IXGRP;	    /* g=rx */
@@ -672,11 +672,11 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 		}
 		*slash = '/';
 	}
-	return 0;
+	return (0);

 error:
 	*slash = '/';
-	return -1;
+	return (-1);
 }

 FILE *
@@ -693,11 +693,11 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s", filename,
 					strbuf);
-		return NULL;
+		return (NULL);
 	}
 	if (mkdirpath(f, named_main_earlywarning) == -1) {
 		free(f);
-		return NULL;
+		return (NULL);
 	}
 	free(f);

@@ -737,7 +737,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
-		return NULL;
+		return (NULL);
 	}

 	fp = fdopen(fd, "w");
@@ -747,7 +747,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 					filename, strbuf);
 	}

-	return fp;
+	return (fp);
 }

 void
@@ -863,5 +863,5 @@ named_os_uname(void) {
 	if (unamep == NULL) {
 		getuname();
 	}
-	return unamep;
+	return (unamep);
 }
@@ -97,7 +97,7 @@ typedef struct stats_dumparg {
 	isc_result_t result;
 } stats_dumparg_t;

-static isc_once_t once = ISC_ONCE_INITIALIZER;
+static isc_once_t once = ISC_ONCE_INIT;

 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 #define EXTENDED_STATS
@@ -126,19 +126,19 @@ user_zonetype(dns_zone_t *zone) {
 	const struct zt *tp;

 	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	view = dns_zone_getview(zone);
 	if (view != NULL && strcmp(view->name, "_bind") == 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	ztype = dns_zone_gettype(zone);
 	for (tp = typemap; tp->string != NULL && tp->type != ztype; tp++) {
 		/* empty */
 	}
-	return tp->string;
+	return (tp->string);
 }
 #endif /* ifdef EXTENDED_STATS */

@@ -251,7 +251,7 @@ get_histo_desc(const char *prefix, int i, int inf, bool ext) {
 	}
 	INSIST(0 < len && (size_t)len < space);
 	used += len + 1;
-	return desc;
+	return (desc);
 }

 static void
@@ -339,21 +339,6 @@ init_desc(void) {
 		       "RPZRewrites");
 	SET_NSSTATDESC(udp, "UDP queries received", "QryUDP");
 	SET_NSSTATDESC(tcp, "TCP queries received", "QryTCP");
-	SET_NSSTATDESC(dot, "DoT queries received", "QryDoT");
-	SET_NSSTATDESC(doh, "DoH queries received", "QryDoH");
-	SET_NSSTATDESC(dohplain, "DoH-Plain queries received", "QryDoHPlain");
-	SET_NSSTATDESC(proxyudp, "PROXYv2 UDP queries received", "QryProxyUDP");
-	SET_NSSTATDESC(proxytcp, "PROXYv2 TCP queries received", "QryProxyTCP");
-	SET_NSSTATDESC(proxydot, "PROXYv2 DoT queries received", "QryProxyDoT");
-	SET_NSSTATDESC(proxydoh, "PROXYv2 DoH queries received", "QryProxyDoH");
-	SET_NSSTATDESC(proxydohplain, "PROXYv2/DoH-Plain queries received",
-		       "QryProxyDoHPlain");
-	SET_NSSTATDESC(encryptedproxydot,
-		       "Encrypted PROXYv2 DoT queries received",
-		       "QryEncryptedProxyDoT");
-	SET_NSSTATDESC(encryptedproxydoh,
-		       "Encrypted PROXYv2 DoH queries received",
-		       "QryEncryptedProxyDoH");
 	SET_NSSTATDESC(nsidopt, "NSID option received", "NSIDOpt");
 	SET_NSSTATDESC(expireopt, "Expire option received", "ExpireOpt");
 	SET_NSSTATDESC(keepaliveopt, "EDNS TCP keepalive option received",
@@ -831,8 +816,8 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }

 #if defined(EXTENDED_STATS)
@@ -848,8 +833,8 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	}
 	isc_histo_destroy(&hg);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }
 #endif /* defined(EXTENDED_STATS) */

@@ -878,7 +863,7 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 		if (category != NULL) {
 			cat = json_object_new_object();
 			if (cat == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(job, category, cat);
 		}
@@ -943,19 +928,19 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 #ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(cat, desc[idx], counter);
 #endif /* ifdef HAVE_JSON_C */
 			break;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "failed at dump_counters()");
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 #endif /* ifdef HAVE_LIBXML2 */
 }

@@ -1024,7 +1009,7 @@ cleanup:

 static bool
 rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr) {
-	return (DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0;
+	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
 }

 static void
@@ -1304,7 +1289,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dumparg.type = isc_statsformat_xml;
@@ -1461,11 +1446,11 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -1488,11 +1473,10 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
@@ -1504,7 +1488,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		 * (if any), but we still want to continue generating the
 		 * remaining parts of the output.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!is_running && !is_deferred && !is_presoa && !is_pending &&
@@ -1514,12 +1498,12 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_xfrin_detach(&xfr);
 		}
 		/* No ongoing/queued transfer. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (is_running && xfr == NULL) {
 		/* The transfer is finished, and it's shutting down. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
@@ -1603,7 +1587,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
@@ -1617,13 +1601,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -1706,7 +1686,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1717,9 +1697,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
-	TRY0(xmlTextWriterEndElement(writer));

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -1736,7 +1713,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		dns_xfrin_detach(&xfr);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (xfr != NULL) {
@@ -1746,7 +1723,7 @@ cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
 		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");

-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -2148,7 +2125,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
@@ -2159,7 +2136,7 @@ cleanup:
 	if (doc != NULL) {
 		xmlFreeDoc(doc);
 	}
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static void
@@ -2193,7 +2170,7 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 			      ISC_LOG_ERROR, "failed at rendering XML()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2203,8 +2180,8 @@ render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2214,8 +2191,8 @@ render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2225,8 +2202,8 @@ render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2236,8 +2213,8 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2247,8 +2224,8 @@ render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2258,8 +2235,8 @@ render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2269,8 +2246,8 @@ render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2280,8 +2257,8 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 #endif /* HAVE_LIBXML2 */
@@ -2321,7 +2298,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 	json_object *node = json_object_new_object();

 	if (node == NULL) {
-		return NULL;
+		return (NULL);
 	}

 	json_object_object_add(node, "name", json_object_new_string(name));
@@ -2335,7 +2312,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 		json_object_object_add(node, "type",
 				       json_object_new_string(ztype));
 	}
-	return node;
+	return (node);
 }

 static isc_result_t
@@ -2354,7 +2331,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2373,7 +2350,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (zoneobj == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -2541,7 +2518,7 @@ cleanup:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2567,11 +2544,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2660,7 +2636,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		dns_zone_getsourceaddr(zone, &addr);
+		addr = dns_zone_getsourceaddr(zone);
 		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
 		json_object_object_add(xfrinobj, "localaddr",
 				       json_object_new_string(addr_buf));
@@ -2675,15 +2651,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -2770,7 +2741,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2780,10 +2751,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
-	json_object_object_add(xfrinobj, "rate",
-			       json_object_new_int64(rate > INT64_MAX
-							     ? INT64_MAX
-							     : (int64_t)rate));

 	if (is_running && is_first_data_received) {
 		json_object_object_add(
@@ -2805,7 +2772,7 @@ cleanup:
 	if (xfrinobj != NULL) {
 		json_object_put(xfrinobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2843,7 +2810,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	bindstats = json_object_new_object();
 	if (bindstats == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -3376,7 +3343,7 @@ cleanup:
 		json_object_put(bindstats);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3405,7 +3372,7 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 			      ISC_LOG_ERROR, "failed at rendering JSON()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3415,8 +3382,8 @@ render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3426,8 +3393,8 @@ render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3437,8 +3404,8 @@ render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3448,8 +3415,8 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3459,8 +3426,8 @@ render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3470,8 +3437,8 @@ render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3481,8 +3448,8 @@ render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3492,8 +3459,8 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			   b, freecb, freecb_args);
+	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 #endif /* HAVE_JSON_C */
@@ -3556,7 +3523,7 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 #endif

@@ -3591,7 +3558,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	    match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return true;
+		return (true);
 	}
 	UNLOCK(&listener->lock);

@@ -3600,7 +3567,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 		      ISC_LOG_WARNING, "rejected statistics connection from %s",
 		      socktext);

-	return false;
+	return (false);
 }
 #endif

@@ -3634,7 +3601,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	UNUSED(aclconfctx);
 	UNUSED(socktext);

-	return ISC_R_NOTIMPLEMENTED;
+	return (ISC_R_NOTIMPLEMENTED);
 #else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
@@ -3737,7 +3704,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 		      ISC_LOG_NOTICE, "statistics channel listening on %s",
 		      socktext);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (listener->acl != NULL) {
@@ -3746,7 +3713,7 @@ cleanup:
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

-	return result;
+	return (result);
 #endif
 }

@@ -3939,7 +3906,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	}

 	ISC_LIST_APPENDLIST(server->statschannels, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -4177,5 +4144,5 @@ named_stats_dump(named_server_t *server, FILE *fp) {

 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

-	return ISC_R_SUCCESS; /* this function currently always succeeds */
+	return (ISC_R_SUCCESS); /* this function currently always succeeds */
 }
@@ -53,7 +53,10 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	isc_buffer_t b;
 	const cfg_obj_t *obj;

-	dns_tkeyctx_create(mctx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
+	if (result != ISC_R_SUCCESS) {
+		return (result);
+	}

 	obj = NULL;
 	result = cfg_map_get(options, "tkey-domain", &obj);
@@ -62,9 +65,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		tctx->domain = isc_mem_get(mctx, sizeof(dns_name_t));
-		dns_name_init(tctx->domain);
+		dns_name_init(tctx->domain, NULL);
 		dns_name_dup(name, mctx, tctx->domain);
 	}

@@ -76,7 +79,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_constinit(&b, s, strlen(s));
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
-		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0));
+		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
 		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
 	}

@@ -88,9 +91,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	}

 	*tctxp = tctx;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tkeyctx_destroy(&tctx);
-	return result;
+	return (result);
 }
@@ -27,16 +27,17 @@
 #include <named/log.h>
 #include <named/transportconf.h>

-#define create_name(id, name)                                     \
-	isc_buffer_t namesrc;                                     \
-	dns_fixedname_t _fn;                                      \
-	name = dns_fixedname_initname(&_fn);                      \
-	isc_buffer_constinit(&namesrc, id, strlen(id));           \
-	isc_buffer_add(&namesrc, strlen(id));                     \
-	result = (dns_name_fromtext(name, &namesrc, dns_rootname, \
-				    DNS_NAME_DOWNCASE));          \
-	if (result != ISC_R_SUCCESS) {                            \
-		goto failure;                                     \
+#define create_name(id, name)                                      \
+	isc_buffer_t namesrc, namebuf;                             \
+	char namedata[DNS_NAME_FORMATSIZE + 1];                    \
+	dns_name_init(name, NULL);                                 \
+	isc_buffer_constinit(&namesrc, id, strlen(id));            \
+	isc_buffer_add(&namesrc, strlen(id));                      \
+	isc_buffer_init(&namebuf, namedata, sizeof(namedata));     \
+	result = (dns_name_fromtext(name, &namesrc, dns_rootname,  \
+				    DNS_NAME_DOWNCASE, &namebuf)); \
+	if (result != ISC_R_SUCCESS) {                             \
+		goto failure;                                      \
 	}

 #define parse_transport_option(map, transport, name, setter)      \
@@ -99,15 +100,15 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *dohname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t dohname;
+		dns_transport_t *transport;

 		doh = cfg_listelt_value(element);
 		dohid = cfg_obj_asstring(cfg_map_getname(doh));

-		create_name(dohid, dohname);
+		create_name(dohid, &dohname);

-		transport = dns_transport_new(dohname, DNS_TRANSPORT_HTTP,
+		transport = dns_transport_new(&dohname, DNS_TRANSPORT_HTTP,
 					      list);

 		dns_transport_set_tlsname(transport, dohid);
@@ -130,12 +131,12 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -147,8 +148,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 	for (const cfg_listelt_t *element = cfg_list_first(transportlist);
 	     element != NULL; element = cfg_list_next(element))
 	{
-		dns_name_t *tlsname = NULL;
-		dns_transport_t *transport = NULL;
+		dns_name_t tlsname;
+		dns_transport_t *transport;

 		tls = cfg_listelt_value(element);
 		tlsid = cfg_obj_asstring(cfg_map_getname(tls));
@@ -158,9 +159,10 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 			goto failure;
 		}

-		create_name(tlsid, tlsname);
+		create_name(tlsid, &tlsname);

-		transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+		transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS,
+					      list);

 		dns_transport_set_tlsname(transport, tlsid);
 		parse_transport_option(tls, transport, "key-file",
@@ -182,12 +184,12 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 #define CHECK(f)                             \
@@ -214,18 +216,18 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 		obj = NULL;
 	}

-	return result;
+	return (result);
 }

 static void
 transport_list_add_ephemeral(dns_transport_list_t *list) {
 	isc_result_t result;
-	dns_name_t *tlsname = NULL;
+	dns_name_t tlsname;
 	dns_transport_t *transport;

-	create_name("ephemeral", tlsname);
+	create_name("ephemeral", &tlsname);

-	transport = dns_transport_new(tlsname, DNS_TRANSPORT_TLS, list);
+	transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, list);
 	dns_transport_set_tlsname(transport, "ephemeral");

 	return;
@@ -256,8 +258,8 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*listp = list;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	dns_transport_list_detach(&list);
-	return result;
+	return (result);
 }
@@ -46,11 +46,11 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 	{
 		const cfg_obj_t *algobj = NULL;
 		const cfg_obj_t *secretobj = NULL;
-		dns_fixedname_t fkey;
-		dns_name_t *keyname = dns_fixedname_initname(&fkey);
+		dns_name_t keyname;
 		dst_algorithm_t alg = DST_ALG_UNKNOWN;
 		const char *algstr = NULL;
-		isc_buffer_t keynamesrc;
+		char keynamedata[1024];
+		isc_buffer_t keynamesrc, keynamebuf;
 		const char *secretstr = NULL;
 		isc_buffer_t secretbuf;
 		int secretlen = 0;
@@ -68,10 +68,12 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		/*
 		 * Create the key name.
 		 */
+		dns_name_init(&keyname, NULL);
 		isc_buffer_constinit(&keynamesrc, keyid, strlen(keyid));
 		isc_buffer_add(&keynamesrc, strlen(keyid));
-		ret = dns_name_fromtext(keyname, &keynamesrc, dns_rootname,
-					DNS_NAME_DOWNCASE);
+		isc_buffer_init(&keynamebuf, keynamedata, sizeof(keynamedata));
+		ret = dns_name_fromtext(&keyname, &keynamesrc, dns_rootname,
+					DNS_NAME_DOWNCASE, &keynamebuf);
 		if (ret != ISC_R_SUCCESS) {
 			goto failure;
 		}
@@ -101,7 +103,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		}
 		secretlen = isc_buffer_usedlength(&secretbuf);

-		ret = dns_tsigkey_create(keyname, alg, secret, secretlen, mctx,
+		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen, mctx,
 					 &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
@@ -121,7 +123,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		dns_tsigkey_detach(&tsigkey);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	if (secret != NULL) {
@@ -129,7 +131,7 @@ failure:
 	}
 	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
 		    isc_result_totext(ret));
-	return ret;
+	return (ret);
 }

 isc_result_t
@@ -170,9 +172,9 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*ringp = ring;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tsigkeyring_detach(&ring);
-	return result;
+	return (result);
 }
@@ -61,6 +61,13 @@ typedef enum {
 	allow_update_forwarding
 } acl_type_t;

+#define RETERR(x)                        \
+	do {                             \
+		isc_result_t _r = (x);   \
+		if (_r != ISC_R_SUCCESS) \
+			return ((_r));   \
+	} while (0)
+
 #define CHECK(x)                             \
 	do {                                 \
 		result = (x);                \
@@ -141,7 +148,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Check for default ACLs that haven't been parsed yet */
@@ -164,14 +171,14 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	(void)named_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
 				    &acl);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	(*setzacl)(zone, acl);

@@ -181,7 +188,7 @@ parse_acl:
 	}

 	dns_acl_detach(&acl);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -206,7 +213,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 	if (updatepolicy == NULL) {
 		dns_zone_setssutable(zone, NULL);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isstring(updatepolicy) &&
@@ -253,7 +260,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0);
+					   dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(identity, ISC_LOG_ERROR,
 				    "'%s' is not a valid name", str);
@@ -283,7 +290,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			isc_buffer_constinit(&b, str, strlen(str));
 			isc_buffer_add(&b, strlen(str));
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
-						   &b, dns_rootname, 0);
+						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
@@ -388,7 +395,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 cleanup:
 	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
-	return result;
+	return (result);
 }

 /*
@@ -430,7 +437,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
@@ -438,7 +445,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		switch (na.family) {
@@ -469,7 +476,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
 	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Add to the list an apex NS with the ns name being the origin name */
@@ -483,7 +490,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			     &region);
 	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

-	return result;
+	return (result);
 }

 /*%
@@ -518,20 +525,20 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		isc_buffer_constinit(&b, str, strlen(str));
 		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(nsname, &b, dns_rootname, 0);
+		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
-			return result;
+			return (result);
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		dns_name_toregion(nsname, &sregion);
@@ -545,7 +552,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	}

-	return result;
+	return (result);
 }

 /*%
@@ -570,12 +577,9 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_region_t region;

 	/* Create the DB beforehand */
-	result = dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
-			       dns_dbtype_stub, dns_zone_getclass(zone), 0,
-			       NULL, &db);
-	if (result != ISC_R_SUCCESS) {
-		return result;
-	}
+	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
+			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
+			     &db));

 	dns_rdataset_init(&rdataset);

@@ -633,7 +637,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 */
 	CHECK(dns_db_newversion(db, &dbversion));

-	dns_name_init(&apexname);
+	dns_name_init(&apexname, NULL);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
 	CHECK(dns_db_findnode(db, &apexname, false, &apexnode));

@@ -688,7 +692,7 @@ cleanup:

 	INSIST(dbversion == NULL);

-	return result;
+	return (result);
 }

 /*%
@@ -701,7 +705,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {

 	result = cfg_map_get(map, "type", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	return named_config_getzonetype(obj);
+	return (named_config_getzonetype(obj));
 }

 /*%
@@ -732,11 +736,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,

 		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		(*argvp)[n] = s;
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -748,7 +752,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 */
 static isc_result_t
 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
-	return strtoargvsub(mctx, s, argcp, argvp, 0);
+	return (strtoargvsub(mctx, s, argcp, argvp, 0));
 }

 static const char *const primary_synonyms[] = { "primary", "master", NULL };
@@ -795,12 +799,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,

 	/* interfacemgr can be destroyed only in exclusive mode. */
 	if (named_g_server->interfacemgr == NULL) {
-		return true;
+		return (true);
 	}

 	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
 	{
-		return false;
+		return (false);
 	}

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
@@ -843,7 +847,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			break;
 		}
 	}
-	return view == myview;
+	return (view == myview);
 }

 /*%
@@ -861,7 +865,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * zone is configured with something else than "notify yes;".
 	 */
 	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return ntype;
+		return (ntype);
 	}

 	/*
@@ -875,7 +879,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 			    zname);
 	}

-	return dns_notifytype_explicit;
+	return (dns_notifytype_explicit);
 }

 isc_result_t
@@ -978,6 +982,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		cpval = isc_mem_strdup(mctx, cfg_obj_asstring(obj));
 	}
+	if (cpval == NULL) {
+		CHECK(ISC_R_NOMEMORY);
+	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "dlz", &obj);
@@ -1106,20 +1113,24 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;

-		dns_zone_setfile(raw, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(raw, filename, masterformat,
+				       masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);

 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		dns_zone_setfile(zone, signedname, dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
+		CHECK(result);
 	} else {
-		dns_zone_setfile(zone, filename, masterformat, masterstyle);
+		CHECK(dns_zone_setfile(zone, filename, masterformat,
+				       masterstyle));
 	}

 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
 	if (result == ISC_R_SUCCESS) {
-		dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj));
+		CHECK(dns_zone_setjournal(mayberaw, cfg_obj_asstring(obj)));
 	}

 	/*
@@ -1266,8 +1277,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1279,22 +1290,22 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "parental-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc4(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "parental-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setparentalsrc6(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc4(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setnotifysrc6(zone, cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "notify-to-soa", &obj);
@@ -1620,7 +1631,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "key-directory", &obj);
 		if (result == ISC_R_SUCCESS) {
 			filename = cfg_obj_asstring(obj);
-			dns_zone_setkeydirectory(zone, filename);
+			CHECK(dns_zone_setkeydirectory(zone, filename));
 		}
 		/* Also save a reference to the keystore list. */
 		dns_zone_setkeystores(zone, keystorelist);
@@ -1672,8 +1683,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1845,7 +1857,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1853,8 +1865,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
@@ -1874,33 +1886,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

-		obj = NULL;
-		result = named_config_get(maps, "min-transfer-rate-in", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		uint32_t traffic_bytes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
-		uint32_t time_minutes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
-		if (traffic_bytes == 0) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' bytes"
-				    "value can not be '0'",
-				    zname);
-			CHECK(ISC_R_FAILURE);
-		}
-		/* Max. 28 days (in minutes). */
-		const unsigned int time_minutes_max = 28 * 24 * 60;
-		if (time_minutes < 1 || time_minutes > time_minutes_max) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' minutes"
-				    "value is out of range (1..%u)",
-				    zname, time_minutes_max);
-			CHECK(ISC_R_FAILURE);
-		}
-		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
-					 transferinsecs ? time_minutes
-							: time_minutes * 60);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1938,12 +1923,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "transfer-source", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource4(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource4(mayberaw,
+					     cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		result = named_config_get(maps, "transfer-source-v6", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		dns_zone_setxfrsource6(mayberaw, cfg_obj_assockaddr(obj));
+		CHECK(dns_zone_setxfrsource6(mayberaw,
+					     cfg_obj_assockaddr(obj)));

 		obj = NULL;
 		(void)named_config_get(maps, "try-tcp-refresh", &obj);
@@ -1966,7 +1953,7 @@ cleanup:
 	if (kasp != NULL) {
 		dns_kasp_detach(&kasp);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1981,11 +1968,11 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 bool
@@ -2009,7 +1996,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return false;
+		return (false);
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -2030,17 +2017,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return false;
+		return (false);
 	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return false;
+		return (false);
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return false;
+		return (false);
 	}

 	obj = NULL;
@@ -2056,10 +2043,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 bool
@@ -2093,13 +2080,13 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	if (res != ISC_R_SUCCESS ||
 	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		return false;
+		return (false);
 	}

 	/* Lookup the policy. */
 	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
 	if (res != ISC_R_SUCCESS) {
-		return false;
+		return (false);
 	}

 	inline_signing = dns_kasp_inlinesigning(kasp);
@@ -2112,8 +2099,8 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	 */
 	res = cfg_map_get(maps[0], "inline-signing", &signing);
 	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
-		return cfg_obj_asboolean(signing);
+		return (cfg_obj_asboolean(signing));
 	}

-	return inline_signing;
+	return (inline_signing);
 }
@@ -177,7 +177,7 @@ static const char *filter_a_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -210,7 +210,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -225,7 +225,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -237,7 +237,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
@@ -265,7 +265,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -306,7 +306,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -358,7 +358,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
@@ -385,7 +385,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -415,7 +415,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -440,14 +440,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -458,9 +458,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -473,7 +473,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -569,7 +569,7 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -640,7 +640,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -658,7 +658,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
@@ -675,7 +675,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -695,7 +695,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -703,7 +703,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_a) {
@@ -776,11 +776,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -813,7 +813,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -850,7 +850,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -865,10 +865,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -177,7 +177,7 @@ static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -211,7 +211,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -226,7 +226,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -238,7 +238,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {

 	cfg_map_get(fmap, "filter-aaaa", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
@@ -266,7 +266,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -309,7 +309,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -362,7 +362,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
@@ -389,7 +389,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -419,7 +419,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -444,14 +444,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -462,9 +462,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -477,7 +477,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -573,7 +573,7 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -644,7 +644,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -662,7 +662,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
@@ -679,7 +679,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -699,7 +699,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -707,7 +707,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_aaaa) {
@@ -779,11 +779,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -816,7 +816,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -853,7 +853,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -868,10 +868,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
-#include <isc/lib.h>
 #include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
@@ -37,7 +36,6 @@
 #include <isc/thread.h>
 #include <isc/util.h>

-#include <dns/lib.h>
 #include <dns/name.h>

 #include <isccc/alist.h>
@@ -145,10 +143,6 @@ command is one of the following:\n\
 		Display RFC 5011 managed keys information\n\
  managed-keys sync [class [view]]\n\
 		Write RFC 5011 managed keys to disk\n\
-  memprof [ on | off | dump ]\n\
-		Enable / disable memory profiling or dump the profile.\n\
-		Requires named to built with jemalloc and run with the relevant\n\
-		MALLOC_CONF environment variables.\n\
  modzone zone [class [view]] { zone-options }\n\
 		Modify a zone's configuration.\n\
 		Requires allow-new-zones option.\n\
@@ -1019,8 +1013,8 @@ main(int argc, char **argv) {
 	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);

 	if (failed) {
-		return 1;
+		return (1);
 	}

-	return 0;
+	return (0);
 }
@@ -322,19 +322,6 @@ Currently supported commands are:
      keys in the event of a trust anchor rollover, or as a brute-force
      repair for key maintenance problems.

-.. option:: memprof [(on | off | dump)]
-
-   This command controls memory profiling. To have any effect, :iscman:`named` must be
-   built with jemalloc, the library have profiling support enabled and run with the
-   ``prof:true`` allocator configuration. (either via ``MALLOC_CONF`` or ``/etc/malloc.conf``)
-
-   The ``prof_active:false`` option is recommended to ensure the profiling overhead does
-   not affect :iscman:`named` when not needed.
-
-   The ``on`` and ``off`` options will start and stop the jemalloc memory profiling respectively.
-   When run with the `dump` option, :iscman:`named` will dump the profile to the working
-   directory. The name will be chosen automatically by jemalloc.
-
 .. option:: modzone zone [class [view]] configuration

   This command modifies the configuration of a zone while the server is running. This
@@ -504,8 +491,9 @@ Currently supported commands are:
 .. option:: secroots [-] [view ...]

   This command dumps the security roots (i.e., trust anchors configured via
-   ``trust-anchors`` statement, or ``dnssec-validation auto``) and negative
-   trust anchors for the specified views. If no view is specified, all views are
+   ``trust-anchors``, or the ``managed-keys`` or ``trusted-keys`` statements
+   [both deprecated], or ``dnssec-validation auto``) and negative trust anchors
+   for the specified views. If no view is specified, all views are
   dumped. Security roots indicate whether they are configured as trusted
   keys, managed keys, or initializing managed keys (managed keys that have not
   yet been updated by a successful key refresh query).
@@ -17,6 +17,7 @@

 #include <isc/attributes.h>
 #include <isc/formatcheck.h>
+#include <isc/lang.h>

 #define NS_CONTROL_PORT 953

@@ -30,8 +31,12 @@
 			notify("%s", name);                               \
 	} while (0)

+ISC_LANG_BEGINDECLS
+
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_NORETURN void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
+
+ISC_LANG_ENDDECLS
@@ -71,7 +71,6 @@ TESTS =				\
 	autosign		\
 	builtin			\
 	cacheclean		\
-	camp			\
 	case			\
 	catz			\
 	cds			\
@@ -135,7 +134,6 @@ TESTS =				\
 	proxy			\
 	pipelined		\
 	qmin			\
-	query-source		\
 	reclimit		\
 	redirect		\
 	resolver		\
@@ -150,6 +148,7 @@ TESTS =				\
 	sfcache			\
 	shutdown		\
 	smartsign		\
+	sortlist		\
 	spf			\
 	staticstub		\
 	statistics		\
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after zone transfer tests.
+#
+
+rm -f dig.out.*
+rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
+rm -f */named.conf
+rm -f */named.memstats
+rm -f */named.run
+rm -f ns*/_default.nzf
+rm -f ns*/_default.nzd*
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -13,6 +13,7 @@

 . ../conf.sh

+$SHELL clean.sh
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/example.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/tsigzone.db
 copy_setports ns2/named1.conf.in ns2/named.conf
@@ -9,18 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out*",
-        "ns*/_default.nzd*",
-        "ns*/_default.nzf*",
-        "ns2/example.db",
-        "ns2/tsigzone.db",
-    ]
-)
-

 def test_acl(run_tests_sh):
    run_tests_sh()
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -9,6 +11,12 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-transfers_complete  # unused function (cipher-suites/tests_cipher_suites.py:31)
-transfers_complete  # unused variable (cipher-suites/tests_cipher_suites.py:86)
-token_init_and_cleanup  # unused function (keyfromlabel/tests_keyfromlabel.py:43)
+#
+# Clean up after tests.
+#
+
+rm -f dig.out.*
+rm -f */named.memstats
+rm -f */named.conf
+rm -f */named.run
+rm -f ns*/managed-keys.bind*
@@ -13,6 +13,7 @@

 . ../conf.sh

+$SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -9,14 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-    ]
-)
-

 def test_additional(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ./dig.out.*
+rm -f ./rndc.out*
+rm -f ./showzone.out*
+rm -f ./zonestatus.out*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./ns1/*.nzf ./ns1/*.nzf~
+rm -f ./ns1/*.nzd ./ns1/*.nzd-lock
+rm -f ./ns2/*.nzf ./ns2/*.nzf~
+rm -f ./ns2/*.nzd ./ns2/*.nzd-lock
+rm -f ./ns3/*.nzf ./ns3/*.nzf~
+rm -f ./ns3/*.nzd ./ns3/*.nzd-lock
+rm -f ./ns2/core*
+rm -f ./ns2/inline.db.jbk
+rm -f ./ns2/inline.db.signed
+rm -f ./ns2/inlinesec.bk*
+rm -rf ./ns2/new-zones
+rm -f ./ns*/named.run ./ns*/named.run.prev
+rm -f ./ns2/nzf-*
+rm -f ./ns3/named.conf
+rm -f ./ns3/*.nzf ./ns3/*.nzf~
+rm -f ./ns3/*.nzd ns3/*.nzd-lock
+rm -f ./ns3/inlinesec.db
+rm -f ./ns1/redirect.db
+rm -f ./ns2/redirect.db
+rm -f ./ns2/redirect.bk
+rm -f ./ns3/redirect.db
+rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
+rm -f ./nzd2nzf.out.*
+rm -f ./wait_for_message.*
@@ -34,6 +34,6 @@ zone "." {
 	file "redirect.db";
 };

-remote-servers "test" {
+primaries "test" {
 	10.53.0.99;
 };
@@ -12,21 +12,8 @@
 import concurrent.futures
 import time

-import pytest
-
 import isctest

-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "ns*/*.nzf*",
-        "ns*/*.nzd*",
-        "ns1/redirect.db",
-        "ns2/new-zones",
-        "ns2/redirect.db",
-        "ns3/redirect.db",
-    ]
-)
-

 def rndc_loop(test_state, domain, ns3):
    """
@@ -9,35 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-        "rndc.out*",
-        "showzone.out.*",
-        "zonestatus.out.*",
-        "ns*/*.nzd*",
-        "ns*/*.nzf*",
-        "ns1/redirect.db",
-        "nzd2nzf.out.*",
-        "ns2/*.nzf~",
-        "ns2/K*.key",
-        "ns2/K*.private",
-        "ns2/K*.state",
-        "ns2/external.nzd",
-        "ns2/extra.nzd",
-        "ns2/inline.db.jbk",
-        "ns2/inline.db.signed",
-        "ns2/inline.db.signed.jnl",
-        "ns2/inlinesec.bk.jbk",
-        "ns2/new-zones",
-        "ns2/redirect.bk",
-        "ns2/redirect.db",
-        "ns3/redirect.db",
-    ]
-)
-

 def test_addzone(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after allow query tests.
+#
+
+rm -f dig.out.*
+rm -f ns*/named.conf
+rm -f ns2/controls.conf
+rm -f */named.memstats
+rm -f ns*/named.run ns*/named.run.prev
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -9,15 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-        "ns2/controls.conf",
-    ]
-)
-

 def test_allow_query(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,21 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f */named.conf
+rm -f */named.memstats
+rm -f */named.run
+rm -f */named.run.prev
+rm -f dig.out.test*
+rm -f ns*/managed-keys.bind* ns*/*mkeys*
+rm -f ns2/example.com.bk
+rm -f ns2/example.net.bk
@@ -9,15 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.test*",
-        "ns*/example.*.bk",
-    ]
-)
-

 def test_auth(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,76 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ./dsset-*
+rm -f */K* */dsset-* */*.signed */tmp* */*.jnl */*.bk
+rm -f */core
+rm -f */example.bk
+rm -f */named.conf
+rm -f */named.memstats
+rm -f */named.run*
+rm -f */trusted.conf */private.conf
+rm -f dig.out.*
+rm -f digcomp.out.test*
+rm -f activate-now-publish-1day.key prepub.key
+rm -f active.key inact.key del.key delzsk.key unpub.key standby.key rev.key
+rm -f delayksk.key delayzsk.key autoksk.key autozsk.key
+rm -f noksk-ksk.key nozsk-ksk.key nozsk-zsk.key inaczsk-zsk.key inaczsk-ksk.key
+rm -f nopriv.key vanishing.key del1.key del2.key
+rm -rf ns*/inactive
+rm -f ns*/managed-keys.bind*
+rm -f ns1/root.db ns1/root.db.1 ns1/root.db.2 ns1/root.db.3
+rm -f ns1/signing.out
+rm -f ns2/bar.db
+rm -f ns2/child.nsec3.example.db
+rm -f ns2/child.optout.example.db
+rm -f ns2/example.db
+rm -f ns2/insecure.secure.example.db
+rm -f ns2/nsec3-with-ent.db
+rm -f ns2/private.secure.example.db
+rm -f ns2/signing.*
+rm -f ns3/*.nzd ns3/*.nzd-lock ns3/*.nzf
+rm -f ns3/*.nzf
+rm -f ns3/*.jbk
+rm -f ns3/autonsec3.example.db
+rm -f ns3/delay.example.db ns3/delay.example.1 ns3/delay.example.2
+rm -f ns3/delzsk.example.db
+rm -f ns3/dname-at-apex-nsec3.example.db
+rm -f ns3/inaczsk2.example.db
+rm -f ns3/jitter.nsec3.example.db
+rm -f ns3/kg.out ns3/s.out ns3/st.out
+rm -f ns3/kskonly.example.db
+rm -f ns3/named.ns3.prev
+rm -f ns3/noksk.example.db
+rm -f ns3/nozsk.example.db ns3/inaczsk.example.db
+rm -f ns3/nsec-only.example.db
+rm -f ns3/nsec3-to-nsec.example.db
+rm -f ns3/nsec3.example.db
+rm -f ns3/nsec3.nsec3.example.db
+rm -f ns3/nsec3.optout.example.db
+rm -f ns3/oldsigs.example.db ns3/oldsigs.example.db.bak
+rm -f ns3/optout.example.db
+rm -f ns3/optout.nsec3.example.db
+rm -f ns3/optout.optout.example.db
+rm -f ns3/prepub.example.db
+rm -f ns3/reconf.example.db
+rm -f ns3/rsasha256.example.db ns3/rsasha512.example.db
+rm -f ns3/secure.example.db
+rm -f ns3/secure.nsec3.example.db
+rm -f ns3/secure.optout.example.db
+rm -f ns3/settime.out.*
+rm -f ns3/sync.example.db
+rm -f ns3/ttl*.db
+rm -f nsupdate.out.test*
+rm -f settime.out.*
+rm -f signing.*
+rm -f sync.key
@@ -52,6 +52,10 @@ ns.secure		A	10.53.0.3
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.3

+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
 z			A	10.0.0.26

 nsec3			NS	ns.nsec3
@@ -52,6 +52,10 @@ ns.secure		A	10.53.0.3
 insecure		NS	ns.insecure
 ns.insecure		A	10.53.0.3

+; A insecure subdomain
+mustbesecure		NS	ns.mustbesecure
+ns.mustbesecure		A	10.53.0.3
+
 z			A	10.0.0.26

 nsec3			NS	ns.nsec3
@@ -23,6 +23,7 @@ options {
 	listen-on-v6 { none; };
 	recursion yes;
 	dnssec-validation yes;
+	dnssec-must-be-secure mustbesecure.example yes;
 };

 zone "." {
@@ -9,147 +9,9 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest

 import isctest.mark

-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "active.key",
-        "activate-now-publish-1day.key",
-        "autoksk.key",
-        "autozsk.key",
-        "del.key",
-        "delayksk.key",
-        "delayzsk.key",
-        "delzsk.key",
-        "dig.out.*",
-        "dsset-.",
-        "dsset-bar.",
-        "dsset-delay.example.",
-        "inact.key",
-        "inaczsk-ksk.key",
-        "inaczsk-zsk.key",
-        "noksk-ksk.key",
-        "nopriv.key",
-        "nozsk-ksk.key",
-        "nozsk-zsk.key",
-        "nsupdate.out.*",
-        "prepub.key",
-        "rev.key",
-        "settime.out.*",
-        "signing.*out*",
-        "standby.key",
-        "sync.key",
-        "unpub.key",
-        "vanishing.key",
-        "*/K*",
-        "*/dsset-*",
-        "*/*.signed",
-        "*/*.jnl",
-        "*/*.bk",
-        "ns*/_default.nzf*",
-        "ns*/_default.nzd*",
-        "ns1/root.db",
-        "ns1/root.db.1",
-        "ns1/root.db.2",
-        "ns1/root.db.3",
-        "ns1/signing.out",
-        "ns1/trusted.conf",
-        "ns2/bar.db",
-        "ns2/child.nsec3.example.db",
-        "ns2/child.optout.example.db",
-        "ns2/dsset-dname-at-apex-nsec3.example.",
-        "ns2/dsset-example.",
-        "ns2/dsset-nsec3-to-nsec.example.",
-        "ns2/dsset-nsec3.example.",
-        "ns2/dsset-oldsigs.example.",
-        "ns2/dsset-optout.example.",
-        "ns2/dsset-private.secure.example.",
-        "ns2/dsset-rsasha256.example.",
-        "ns2/dsset-rsasha512.example.",
-        "ns2/dsset-secure.example.",
-        "ns2/example.db",
-        "ns2/insecure.secure.example.db",
-        "ns2/nsec3-with-ent.db",
-        "ns2/private.conf",
-        "ns2/private.secure.example.db",
-        "ns2/signing.bar.out",
-        "ns2/signing.privsec.out",
-        "ns2/trusted.conf",
-        "ns3/autonsec3.example.db",
-        "ns3/delay.example.1",
-        "ns3/delay.example.2",
-        "ns3/delay.example.db",
-        "ns3/delzsk.example.db",
-        "ns3/dname-at-apex-nsec3.example.db",
-        "ns3/dsset-autonsec3.example.",
-        "ns3/dsset-dname-at-apex-nsec3.example.",
-        "ns3/dsset-inaczsk.example.",
-        "ns3/dsset-inaczsk2.example.",
-        "ns3/dsset-kskonly.example.",
-        "ns3/dsset-noksk.example.",
-        "ns3/dsset-nozsk.example.",
-        "ns3/dsset-nsec-only.example.",
-        "ns3/dsset-nsec3-to-nsec.example.",
-        "ns3/dsset-nsec3-to-nsec3.example.",
-        "ns3/dsset-nsec3.example.",
-        "ns3/dsset-nsec3.nsec3.example.",
-        "ns3/dsset-nsec3.optout.example.",
-        "ns3/dsset-oldsigs.example.",
-        "ns3/dsset-optout.example.",
-        "ns3/dsset-optout.nsec3.example.",
-        "ns3/dsset-optout.optout.example.",
-        "ns3/dsset-prepub.example.",
-        "ns3/dsset-rsasha256.example.",
-        "ns3/dsset-rsasha512.example.",
-        "ns3/dsset-secure.example.",
-        "ns3/dsset-secure.nsec3.example.",
-        "ns3/dsset-secure.optout.example.",
-        "ns3/dsset-sync.example.",
-        "ns3/inactive",
-        "ns3/inaczsk.example.db",
-        "ns3/inaczsk2.example.db",
-        "ns3/jitter.nsec3.example.db",
-        "ns3/kg.out",
-        "ns3/kskonly.example.db",
-        "ns3/kskonly.example.db.jbk",
-        "ns3/noksk.example.db",
-        "ns3/nozsk.example.db",
-        "ns3/nsec-only.example.db",
-        "ns3/nsec3-to-nsec.example.db",
-        "ns3/nsec3-to-nsec3.example.db",
-        "ns3/nsec3.example.db",
-        "ns3/nsec3.nsec3.example.db",
-        "ns3/nsec3.optout.example.db",
-        "ns3/oldsigs.example.db",
-        "ns3/oldsigs.example.db.bak",
-        "ns3/optout.example.db",
-        "ns3/optout.example.db.jbk",
-        "ns3/optout.nsec3.example.db",
-        "ns3/optout.optout.example.db",
-        "ns3/prepub.example.db",
-        "ns3/reconf.example.db",
-        "ns3/reconf.example.db.jbk",
-        "ns3/rsasha256.example.db",
-        "ns3/rsasha512.example.db",
-        "ns3/s.out",
-        "ns3/secure.example.db",
-        "ns3/secure.nsec3.example.db",
-        "ns3/secure.optout.example.db",
-        "ns3/st.out",
-        "ns3/sync.example.db",
-        "ns3/trusted.conf",
-        "ns3/ttl1.example.db",
-        "ns3/ttl2.example.db",
-        "ns3/ttl3.example.db",
-        "ns3/ttl4.example.db",
-        "ns4/private.conf",
-        "ns4/trusted.conf",
-        "ns5/trusted.conf",
-    ]
-)
-

@isctest.mark.flaky(max_runs=2)
 def test_autosign(run_tests_sh):
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Ondřej Surý	6014e73faa	Use 65432 for DELEG type	2024-11-02 15:48:07 +01:00
Ondřej Surý	1c99e64a74	WIP: DELEG resolver side	2024-11-02 15:48:07 +01:00
Ondřej Surý	8532716753	WIP: Add experimental authoritative DELEG support	2024-11-02 14:03:52 +01:00
Ondřej Surý	c56a6d20f1	WIP: Add preliminary support for DELEG type (abusing 66)	2024-11-02 12:01:43 +01:00