Add unit test case for issue #4702

Add the found erroneous case to the unit tests.
Add a unit test case for converting \000\009
2024-04-30 17:39:39 +02:00 · 2024-04-30 17:38:26 +02:00
896 changed files with 49387 additions and 56495 deletions
@@ -1538,9 +1538,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 4cb8b13987b930952238cc88e84272b8cf911933
 # Reformat sources with up-to-date clang-format-17
 79d93600116faabd89798522817ad95a69684fff
-# Reformat sources with up-to-date clang-format-18
-b7de2c7cb959fa35099d72c3f9b13938348c74e6
-# Reformat sources with up-to-date clang-format-19
-ff69d07fed2619a9bedf5ccc18cf106b7dd49bef
-# Reformat sources with up-to-date clang-format-19
-ebb5bd9c0f079de8970b538fe48e5f5c60ea7ee9
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/dtrace.sh		-export-ignore
+/util/mksymtbl.pl		-export-ignore
@@ -1 +0,0 @@
-contrib/gitchangelog/changelog.rc.py
@@ -15,7 +15,7 @@ variables:
  TEST_PARALLEL_JOBS: 4

  CONFIGURE: ./configure
-  CLANG_VERSION: 19
+  CLANG_VERSION: 18
  CLANG: "clang-${CLANG_VERSION}"
  SCAN_BUILD: "scan-build-${CLANG_VERSION}"
  LLVM_SYMBOLIZER: "/usr/lib/llvm-${CLANG_VERSION}/bin/llvm-symbolizer"
@@ -55,8 +55,6 @@ variables:
  BIND_STRESS_TEST_OS: linux
  BIND_STRESS_TEST_ARCH: amd64

-  HYPOTHESIS_PROFILE: "ci"
-
 default:
  # Allow all running CI jobs to be automatically canceled when a new
  # version of a branch is pushed.
@@ -64,13 +62,6 @@ default:
  # See: https://docs.gitlab.com/ee/ci/pipelines/settings.html#auto-cancel-redundant-pipelines
  interruptible: true

-  # AWS can interrupt the spot instance anytime, so let's retry the job when
-  # the interruption event happens to avoid a pipeline failure.
-  retry:
-    max: 2
-    when:
-      - runner_system_failure
-
 stages:
  - autoconf
  - precheck
@@ -108,23 +99,21 @@ stages:
    - runner-manager
    - aarch64

-# Autoscaling GitLab Runner on AWS EC2 (FreeBSD)
+# Stress-testing runners

 .freebsd-stress-amd64: &freebsd_stress_amd64
  tags:
-    - bsd-stress-test
-    - aws
-    - autoscaler
-    - shell
-    - stress-test
    - amd64
+    - aws
+    - bsd-stress
+    - stress

 ### Docker Image Templates

 # Alpine Linux

-.alpine-3.20-amd64: &alpine_3_20_amd64_image
-  image: "$CI_REGISTRY_IMAGE:alpine-3.20-amd64"
+.alpine-3.19-amd64: &alpine_3_19_amd64_image
+  image: "$CI_REGISTRY_IMAGE:alpine-3.19-amd64"
  <<: *linux_amd64

 # Oracle Linux
@@ -147,6 +136,10 @@ stages:

 # Debian

+.debian-bullseye-amd64: &debian_bullseye_amd64_image
+  image: "$CI_REGISTRY_IMAGE:debian-bullseye-amd64"
+  <<: *linux_amd64
+
 .debian-bookworm-amd64: &debian_bookworm_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-bookworm-amd64"
  <<: *linux_amd64
@@ -171,16 +164,16 @@ stages:

 # Fedora

-.tsan-fedora-40-amd64: &tsan_fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:tsan-fedora-40-amd64"
+.tsan-fedora-39-amd64: &tsan_fedora_39_amd64_image
+  image: "$CI_REGISTRY_IMAGE:tsan-fedora-39-amd64"
  <<: *linux_amd64

-.fedora-40-amd64: &fedora_40_amd64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-amd64"
+.fedora-39-amd64: &fedora_39_amd64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-39-amd64"
  <<: *linux_amd64

-.fedora-40-arm64: &fedora_40_arm64_image
-  image: "$CI_REGISTRY_IMAGE:fedora-40-arm64"
+.fedora-39-arm64: &fedora_39_arm64_image
+  image: "$CI_REGISTRY_IMAGE:fedora-39-arm64"
  <<: *linux_arm64

 # Ubuntu
@@ -193,10 +186,6 @@ stages:
  image: "$CI_REGISTRY_IMAGE:ubuntu-jammy-amd64"
  <<: *linux_amd64

-.ubuntu-noble-amd64: &ubuntu_noble_amd64_image
-  image: "$CI_REGISTRY_IMAGE:ubuntu-noble-amd64"
-  <<: *linux_amd64
-
 # Base image
 # This is a meta image that is used as a base for non-specific jobs

@@ -210,11 +199,11 @@ stages:
  <<: *libvirt_amd64

 .freebsd-14-amd64: &freebsd_14_amd64_image
-  image: "freebsd-14.1-x86_64"
+  image: "freebsd-14.0-x86_64"
  <<: *libvirt_amd64

 .openbsd-amd64: &openbsd_amd64_image
-  image: "openbsd-7.5-x86_64"
+  image: "openbsd-7.4-x86_64"
  <<: *libvirt_amd64

 ### Job Templates
@@ -266,6 +255,7 @@ stages:
      --enable-developer
      --enable-option-checking=fatal
      --enable-dnstap
+      --enable-dnsrps
      --with-cmocka
      --with-libxml2
      --with-json-c
@@ -275,11 +265,11 @@ stages:

 # change directory to the workspace before including this
 .find_python: &find_python
-  - PYTHON="$(cat bin/tests/system/isctest/vars/.ac_vars/PYTHON)"
+  - PYTHON="$(source bin/tests/system/conf.sh; echo $PYTHON)"
  - test -x "$PYTHON"

 .find_pytest: &find_pytest
-  - PYTEST="$(cat bin/tests/system/isctest/vars/.ac_vars/PYTEST)"
+  - PYTEST="$(source bin/tests/system/conf.sh; echo $PYTEST)"
  - test -x "$PYTEST"

 .parse_tsan: &parse_tsan
@@ -363,7 +353,6 @@ stages:
  needs:
    - job: ci-variables
      artifacts: true
-  timeout: 2h

 .system_test_common: &system_test_common
  <<: *default_triggering_rules
@@ -516,6 +505,18 @@ misc:
      - checklibs.out
    when: on_failure

+changes:
+  <<: *precheck_job
+  except:
+    - pipelines
+  script:
+    - sh util/tabify-changes < CHANGES > CHANGES.tmp
+    - diff -urNap CHANGES CHANGES.tmp
+    - perl util/check-changes CHANGES
+    - sh util/check-line-length.sh CHANGES
+    - rm CHANGES.tmp
+  needs: []
+
 black:
  <<: *precheck_job
  needs: []
@@ -529,12 +530,6 @@ black:
    expire_in: "1 week"
    when: on_failure

-vulture:
-  <<: *precheck_job
-  needs: []
-  script:
-    - vulture --exclude "*/ans*/ans.py,conftest.py,isctest" --ignore-names "pytestmark" bin/tests/system/
-
 ci-variables:
  stage: precheck
  <<: *precheck_job
@@ -578,7 +573,7 @@ pylint:
  variables:
    PYTHONPATH: "${CI_PROJECT_DIR}/bin/tests/system"
  script:
-    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/|^contrib/)')
+    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc $(git ls-files '*.py' | grep -vE '(ans\.py|dangerfile\.py|^bin/tests/system/)')
      # Ignore Pylint wrong-import-position error in system test to enable use of pytest.importorskip
    - pylint --rcfile $CI_PROJECT_DIR/.pylintrc --disable=wrong-import-position $(git ls-files 'bin/tests/system/*.py' | grep -vE 'ans\.py')

@@ -618,6 +613,8 @@ danger:
  only:
    refs:
      - merge_requests
+    variables:
+      - $DANGER_GITLAB_API_TOKEN

 checkbashisms:
  <<: *precheck_job
@@ -653,28 +650,6 @@ tarball-create:

 # Jobs for doc builds on Debian 12 "bookworm" (amd64)

-changelog:
-  <<: *base_image
-  <<: *docs_job
-  rules:
-    - if: '$CI_MERGE_REQUEST_TITLE =~ /\s(dev|usr|pkg):/'
-  variables:
-    GIT_AUTHOR_NAME: $GITLAB_USER_NAME
-    GIT_AUTHOR_EMAIL: $GITLAB_USER_EMAIL
-    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
-    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
-  before_script:
-    - echo -e "$CI_MERGE_REQUEST_TITLE\n" > commitmsg
-    - sed -i 's/^Draft:\s*//' commitmsg
-    - echo -e "$CI_MERGE_REQUEST_DESCRIPTION" >> commitmsg
-    - git commit --allow-empty -F commitmsg
-    - ./contrib/gitchangelog/gitchangelog.py HEAD^..HEAD
-  needs:
-    - job: autoreconf
-      artifacts: true
-  artifacts:
-    untracked: true
-
 docs:
  <<: *default_triggering_rules
  <<: *base_image
@@ -717,16 +692,11 @@ cross-version-config-tests:
    - *configure
    - make -j${BUILD_PARALLEL_JOBS:-1}
    - *find_pytest
-    # The cross-version-config-tests job would fail when a system test is
-    # removed from the upcoming release. To avoid this, remove the system test
-    # also from the $BIND_BASELINE_VERSION.
-    - find bin/tests/system/ -mindepth 1 -maxdepth 1 -type d -exec sh -c 'test -e ../"$0" || rm -rfv -- "$0"' {} \;
    - cd bin/tests/system
    # Run the setup phase of all system tests in the most recently tagged BIND 9
    # release using the binaries built for the current BIND 9 version.  This
    # intends to detect obvious backward compatibility issues with the latter.
-    - >
-      echo "${CI_PROJECT_DIR}" > isctest/vars/.ac_vars/TOP_BUILDDIR
+    - sed -i -E "s|(export TOP_BUILDDIR)=.*|\1=${CI_PROJECT_DIR}|" conf.sh
    - >
      "$PYTEST" --setup-only --junit-xml="$CI_PROJECT_DIR"/junit.xml -n "${TEST_PARALLEL_JOBS:-1}"
  needs:
@@ -744,28 +714,28 @@ cross-version-config-tests:
    expire_in: "1 day"
    when: always

-# Jobs for regular GCC builds on Alpine Linux 3.20 (amd64)
+# Jobs for regular GCC builds on Alpine Linux 3.19 (amd64)

-gcc:alpine3.20:amd64:
+gcc:alpine3.19:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON}"
    EXTRA_CONFIGURE: "${WITHOUT_READLINE}"
-  <<: *alpine_3_20_amd64_image
+  <<: *alpine_3_19_amd64_image
  <<: *build_job

-system:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+system:gcc:alpine3.19:amd64:
+  <<: *alpine_3_19_amd64_image
  <<: *system_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.19:amd64
      artifacts: true

-unit:gcc:alpine3.20:amd64:
-  <<: *alpine_3_20_amd64_image
+unit:gcc:alpine3.19:amd64:
+  <<: *alpine_3_19_amd64_image
  <<: *unit_test_job
  needs:
-    - job: gcc:alpine3.20:amd64
+    - job: gcc:alpine3.19:amd64
      artifacts: true

 # Jobs for regular GCC builds on Oracle Linux 8 (amd64)
@@ -900,7 +870,6 @@ system:gcc:bookworm:amd64:
  <<: *system_test_gcov_job
  variables:
    CI_ENABLE_ALL_TESTS: 1
-    TZ: Australia/Sydney
  needs:
    - job: unit:gcc:bookworm:amd64
      artifacts: true
@@ -914,30 +883,6 @@ unit:gcc:bookworm:amd64:
    - job: gcc:bookworm:amd64
      artifacts: true

-# Jobs for RBT zone- & cache-enabled GCC builds on Debian 12 "bookworm" (amd64)
-
-gcc:bookworm:rbt:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2 --with-zonedb=rbt --with-cachedb=rbt"
-  <<: *debian_bookworm_amd64_image
-  <<: *build_job
-
-system:gcc:bookworm:rbt:amd64:
-  <<: *debian_bookworm_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: unit:gcc:bookworm:rbt:amd64
-      artifacts: true
-
-unit:gcc:bookworm:rbt:amd64:
-  <<: *debian_bookworm_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:bookworm:rbt:amd64
-      artifacts: true
-
 # Build job for cross-compiled GCC builds on 64-bit Debian 12 "bookworm"
 # (amd64) with 32-bit BIND 9.

@@ -1115,7 +1060,15 @@ gcc:tumbleweed:amd64:
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -DDEBUG"
-    EXTRA_CONFIGURE: "--with-libidn2 ${WITH_READLINE_READLINE}"
+    # NOTE: Testing DNSRPS-enabled builds currently requires an
+    # operating system with glibc 2.34+.  This requirement will go away
+    # once the DNSRPS dynamic loading code gets reworked to use libuv's
+    # dlopen() API.
+    #
+    # NOTE: This does *not* enable testing of the DNSRPS feature itself.
+    # Doing that requires a DNSRPS provider library to be present on the
+    # test host.
+    EXTRA_CONFIGURE: "--enable-dnsrps --enable-dnsrps-dl --with-libidn2 ${WITH_READLINE_READLINE}"
  <<: *tumbleweed_latest_amd64_image
  <<: *build_job

@@ -1181,31 +1134,7 @@ unit:gcc:jammy:amd64:
    - job: gcc:jammy:amd64
      artifacts: true

-# Jobs for regular GCC builds on Ubuntu 24.04 Noble Numbat (amd64)
-
-gcc:noble:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON}"
-    EXTRA_CONFIGURE: "--with-libidn2"
-  <<: *ubuntu_noble_amd64_image
-  <<: *build_job
-
-system:gcc:noble:amd64:
-  <<: *ubuntu_noble_amd64_image
-  <<: *system_test_job
-  needs:
-    - job: gcc:noble:amd64
-      artifacts: true
-
-unit:gcc:noble:amd64:
-  <<: *ubuntu_noble_amd64_image
-  <<: *unit_test_job
-  needs:
-    - job: gcc:noble:amd64
-      artifacts: true
-
-# Jobs for ASAN builds on Fedora 40 (amd64)
+# Jobs for ASAN builds on Fedora 39 (amd64)

 gcc:asan:
  variables:
@@ -1213,20 +1142,20 @@ gcc:asan:
    CFLAGS: "${CFLAGS_COMMON} -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_39_amd64_image
  <<: *build_job

 system:gcc:asan:
  variables:
    LSAN_OPTIONS: "suppressions=$CI_PROJECT_DIR/suppr-lsan.txt"
-  <<: *fedora_40_amd64_image
+  <<: *fedora_39_amd64_image
  <<: *system_test_job
  needs:
    - job: gcc:asan
      artifacts: true

 unit:gcc:asan:
-  <<: *fedora_40_amd64_image
+  <<: *fedora_39_amd64_image
  <<: *unit_test_job
  needs:
    - job: gcc:asan
@@ -1255,21 +1184,21 @@ unit:clang:asan:
    - job: clang:asan
      artifacts: true

-# Jobs for TSAN builds on Fedora 40 (amd64)
+# Jobs for TSAN builds on Fedora 39 (amd64)

 gcc:tsan:
  variables:
    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Wno-stringop-overread -ggdb -O2 -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
-  <<: *tsan_fedora_40_amd64_image
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"
+  <<: *tsan_fedora_39_amd64_image
  <<: *build_job

 system:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_39_amd64_image
  <<: *system_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1278,7 +1207,7 @@ system:gcc:tsan:
 unit:gcc:tsan:
  variables:
    TSAN_OPTIONS: "${TSAN_OPTIONS_FEDORA}"
-  <<: *tsan_fedora_40_amd64_image
+  <<: *tsan_fedora_39_amd64_image
  <<: *unit_test_tsan_job
  needs:
    - job: gcc:tsan
@@ -1289,9 +1218,9 @@ clang:tsan:
  <<: *build_job
  variables:
    CC: "${CLANG}"
-    CFLAGS: "${CFLAGS_COMMON} -ggdb -O2 -fsanitize=thread"
+    CFLAGS: "${CFLAGS_COMMON} -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
+    EXTRA_CONFIGURE: "--with-libidn2 --enable-pthread-rwlock --without-jemalloc"

 system:clang:tsan:
  variables:
@@ -1311,33 +1240,54 @@ unit:clang:tsan:
    - job: clang:tsan
      artifacts: true

-generate-tsan-stress-test-configs:
-  <<: *base_image
-  <<: *default_triggering_rules
-  stage: system
-  script:
-    - util/generate-tsan-stress-jobs.py > tsan-stress-test-configs.yml
-  artifacts:
-    paths:
-      - tsan-stress-test-configs.yml
-  needs: []
-  when: manual
+# Jobs for Debian 11 "bullseye" (amd64)

-tsan:stress:
-  <<: *default_triggering_rules
-  stage: postcheck
+clang:bullseye:amd64:
  variables:
-    PARENT_PIPELINE_ID: $CI_PIPELINE_ID
-  trigger:
-    include:
-      - artifact: tsan-stress-test-configs.yml
-        job: generate-tsan-stress-test-configs
+    CC: ${CLANG}
+    CFLAGS: "${CFLAGS_COMMON} -Wenum-conversion"
+  <<: *debian_bullseye_amd64_image
+  <<: *build_job
+
+system:clang:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *system_test_job
  needs:
-    - job: generate-tsan-stress-test-configs
+    - job: clang:bullseye:amd64
      artifacts: true
-    - job: gcc:tsan
+
+unit:clang:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: clang:bullseye:amd64
      artifacts: true
-    - job: clang:tsan
+
+gcc:bullseye:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "${CFLAGS_COMMON}"
+    # See https://gitlab.isc.org/isc-projects/bind9/-/issues/3444
+    EXTRA_CONFIGURE: "--with-libidn2 --without-jemalloc --disable-leak-detection"
+  <<: *debian_bullseye_amd64_image
+  <<: *build_job
+
+system:gcc:bullseye:amd64:
+  # Set up environment variables that allow the "keyfromlabel" system test to be run
+  variables:
+    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
+  <<: *debian_bullseye_amd64_image
+  <<: *system_test_job
+  needs:
+    - job: gcc:bullseye:amd64
+      artifacts: true
+
+unit:gcc:bullseye:amd64:
+  <<: *debian_bullseye_amd64_image
+  <<: *unit_test_job
+  needs:
+    - job: gcc:bullseye:amd64
      artifacts: true

 # Jobs for Clang builds on Debian 12 "bookworm" (amd64)
@@ -1354,6 +1304,10 @@ clang:bookworm:amd64:
  <<: *build_job

 system:clang:bookworm:amd64:
+  # Set up environment variables that allow the "keyfromlabel" system test to be run
+  variables:
+    OPENSSL_CONF: "/var/tmp/etc/openssl.cnf"
+    SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
  <<: *debian_bookworm_amd64_image
  <<: *system_test_job
  needs:
@@ -1422,7 +1376,6 @@ unit:clang:freebsd14:amd64:
  needs:
    - job: clang:freebsd14:amd64
      artifacts: true
-  retry: 1  # GL #4924

 # Jobs for Clang builds on OpenBSD (amd64)

@@ -1455,12 +1408,11 @@ release:
    - pushd "${BIND_DIRECTORY}-release"
    - mv "../${BIND_DIRECTORY}.tar.xz" .
    - tar --extract --file="${BIND_DIRECTORY}.tar.xz"
-    - mv "${BIND_DIRECTORY}"/{COPYRIGHT,LICENSE,README.md,srcid} .
+    - mv "${BIND_DIRECTORY}"/{CHANGES*,COPYRIGHT,LICENSE,README.md,srcid} .
    - rm -rf "${BIND_DIRECTORY}"
    - mv "../doc/arm/_build/html" doc/arm/
    - mv "../doc/arm/_build/epub/Bv9ARM.epub" doc/arm/
    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/notes.html"><title>Redirect</title></html>' > "RELEASE-NOTES-${BIND_DIRECTORY}.html"
-    - echo '<!DOCTYPE HTML><html lang="en"><meta http-equiv="refresh" content="0; url=doc/arm/html/changelog.html"><title>Redirect</title></html>' > "CHANGELOG-${BIND_DIRECTORY}.html"
    - popd
  needs:
    - job: tarball-create
@@ -1590,7 +1542,7 @@ respdiff:asan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=address,undefined"
    LDFLAGS: "-fsanitize=address,undefined"
-    EXTRA_CONFIGURE: "--without-jemalloc"
+    EXTRA_CONFIGURE: "--disable-dnsrps --without-jemalloc"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
  script:
    - bash respdiff.sh -s named -q "${PWD}/100k_mixed.txt" -c 3 -w "${PWD}/rspworkdir" "${CI_PROJECT_DIR}" "/usr/local/respdiff-reference-bind/sbin/named"
@@ -1603,7 +1555,7 @@ respdiff:tsan:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og -fsanitize=thread"
    LDFLAGS: "-fsanitize=thread"
-    EXTRA_CONFIGURE: "--enable-pthread-rwlock --without-jemalloc PKG_CONFIG_PATH=/opt/tsan/lib/pkgconfig"
+    EXTRA_CONFIGURE: "--disable-dnsrps --enable-pthread-rwlock --without-jemalloc"
    MAX_DISAGREEMENTS_PERCENTAGE: "0.5"
    TSAN_OPTIONS: "${TSAN_OPTIONS_DEBIAN}"
  script:
@@ -1638,7 +1590,7 @@ shotgun:tcp:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: tcp
-    SHOTGUN_TRAFFIC_MULTIPLIER: 13
+    SHOTGUN_TRAFFIC_MULTIPLIER: 6
  when: delayed
  start_in: 5 minutes

@@ -1646,16 +1598,20 @@ shotgun:dot:
  <<: *shotgun_job
  variables:
    SHOTGUN_SCENARIO: dot
-    SHOTGUN_TRAFFIC_MULTIPLIER: 6
+    SHOTGUN_TRAFFIC_MULTIPLIER: 3
  when: delayed
  start_in: 5 minutes

-.stress-test: &stress_test
+# Parallel build in the "make" step is avoided since multiple jobs can be
+# executed concurrently on the same runner. This may present problems when one
+# job runs a performance-sensitive task of replying to queries while another
+# takes all cores to build BIND.
+.stress: &stress_job
  stage: performance
  script:
    - *configure
    - *setup_interfaces
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make -k all V=1
    - make DESTDIR="${INSTALL_PATH}" install
    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
    - cd bind9-qa/stress
@@ -1663,264 +1619,140 @@ shotgun:dot:
  needs:
    - job: autoreconf
      artifacts: true
-
-.stress-test-long: &stress_test_long_job
-  <<: *stress_test
  artifacts:
    untracked: true
-    exclude:
-      - "output/ns4/*.dtq*"
-      - "output/ns4/large-delta-rpz*.local"
-      - "output/rpz_*"
    expire_in: "1 week"
    when: always
  timeout: 2h

-.stress-test-short: &stress_test_short_job
-  <<: *stress_test
-  only:
-    - merge_requests
-  artifacts:
-    untracked: true
-    exclude:
-      - "output/ns4/*.dtq*"
-      - "output/ns4/large-delta-rpz*.local"
-      - "output/rpz_*"
-    when: always
-
-stress:short:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:authoritative:fedora:39:amd64:
+  <<: *fedora_39_amd64_image
  <<: *linux_amd64
-  <<: *stress_test_short_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
-  <<: *linux_amd64
-  <<: *stress_test_short_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: recursive
-    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
-  <<: *linux_amd64
-  <<: *stress_test_short_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: rpz
-    RATE: 1500
-    RUN_TIME: 15
-
-stress:short:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
-  <<: *linux_arm64
-  <<: *stress_test_short_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: authoritative
-    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
-  <<: *linux_arm64
-  <<: *stress_test_short_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: recursive
-    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
-  <<: *linux_arm64
-  <<: *stress_test_short_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: rpz
-    RATE: 1500
-    RUN_TIME: 15
-
-stress:short:authoritative:freebsd13:amd64:
-  <<: *freebsd_stress_amd64
-  <<: *stress_test_short_job
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/local/bin/flame
-    MODE: authoritative
-    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:recursive:freebsd13:amd64:
-  <<: *freebsd_stress_amd64
-  <<: *stress_test_short_job
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/local/bin/flame
-    MODE: recursive
-    RATE: 10000
-    RUN_TIME: 15
-
-stress:short:rpz:freebsd13:amd64:
-  <<: *freebsd_stress_amd64
-  <<: *stress_test_short_job
-  variables:
-    CC: clang
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/local/bin/flame
-    MODE: rpz
-    RATE: 1500
-    RUN_TIME: 15
-
-stress:authoritative:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
-  <<: *linux_amd64
-  <<: *stress_test_long_job
-  variables:
-    CC: gcc
-    CFLAGS: "${CFLAGS_COMMON} -Og"
-    FLAME: /usr/bin/flame
-    MODE: authoritative
-    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:recursive:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:recursive:fedora:39:amd64:
+  <<: *fedora_39_amd64_image
  <<: *linux_amd64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:rpz:fedora:40:amd64:
-  <<: *fedora_40_amd64_image
+stress:rpz:fedora:39:amd64:
+  <<: *fedora_39_amd64_image
  <<: *linux_amd64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

-stress:authoritative:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:authoritative:fedora:39:arm64:
+  <<: *fedora_39_arm64_image
  <<: *linux_arm64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:recursive:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:recursive:fedora:39:arm64:
+  <<: *fedora_39_arm64_image
  <<: *linux_arm64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

-stress:rpz:fedora:40:arm64:
-  <<: *fedora_40_arm64_image
+stress:rpz:fedora:39:arm64:
+  <<: *fedora_39_arm64_image
  <<: *linux_arm64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: gcc
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /linux/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /arm64/i)

 stress:authoritative:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: authoritative
    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /authoritative/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:recursive:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: recursive
    RATE: 10000
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /recursive/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)

 stress:rpz:freebsd13:amd64:
  <<: *freebsd_stress_amd64
-  <<: *stress_test_long_job
+  <<: *stress_job
  variables:
    CC: clang
    CFLAGS: "${CFLAGS_COMMON} -Og"
    FLAME: /usr/local/bin/flame
    MODE: rpz
    RATE: 1500
-    RUN_TIME: 60
+    RUN_TIME: 1
  only:
    variables:
      - $CI_COMMIT_TAG || ($BIND_STRESS_TEST_OS =~ /freebsd/i && $BIND_STRESS_TEST_MODE =~ /rpz/i && $BIND_STRESS_TEST_ARCH =~ /amd64/i)
@@ -1994,46 +1826,23 @@ pairwise:
    variables:
      - $PAIRWISE_TESTING

-.post_merge_template: &post_merge
+backports:
  <<: *base_image
  stage: postmerge
-  needs: []
-  # post-merge processes should run even if another MR was merged while the job was running (or queued)
-  interruptible: false
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
  variables:
    # automated commits will inherit identification from the user who pressed Merge button
    GIT_COMMITTER_NAME: $GITLAB_USER_NAME
    GIT_COMMITTER_EMAIL: $GITLAB_USER_EMAIL
    # avoid leftover branches from previous jobs
    GIT_STRATEGY: clone
-    # assumed max depth of a MR for backport or a rebased force-push
-    GIT_DEPTH: 1000
-  before_script:
-    # force-pushes should not trigger process automation (happens only in -sub branches)
-    - >
-      echo "previous branch tip: $CI_COMMIT_BEFORE_SHA"
-    - set +o pipefail; git log --format='%H' | grep --silent "$CI_COMMIT_BEFORE_SHA" && PREVIOUS_TIP_REACHABLE=1
-    - test "$PREVIOUS_TIP_REACHABLE" != "1" && echo "force-push detected, stop" && exit 1
-    # non-fast-forward merges are disabled so we have to have merge commit on top
-    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
-    - >
-      : stop if this is not a merge request
-    - test "$MERGE_REQUEST_ID" -ge 0
-    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
-
-backports:
-  <<: *post_merge
-  rules:
-    # -sub branches are handled manually
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+    # assumed max depth of a MR for backport
+    GIT_DEPTH: 200
  script:
    # CI job token is not sufficient for push operations
-    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin
+    - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BACKPORT_GITLAB_API_TOKEN/" | xargs git remote set-url --push origin
+    # force-pushing is disabled so we have to have merge request on top
+    - MERGE_REQUEST_ID="$(git log -1 --format='%b' | sed --silent -e 's/^See merge request [^!]\+!//p')"
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
    - bind9-qa/releng/backport_mr.py $CI_PROJECT_ID "$MERGE_REQUEST_ID"
-
-merged-metadata:
-  <<: *post_merge
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
-  script:
-    - bind9-qa/releng/after_merge.py "$CI_PROJECT_ID" "$MERGE_REQUEST_ID"
@@ -12,14 +12,12 @@ confidential!
 | Deputy Incident Manager: | @user                                |
 | Public Disclosure Date:  | YYYY-MM-DD                           |
 | CVSS Score:              | [0.0][cvss_score]                    |
-| CWE:                     | [CWE-NNN][cwe_category]
 | Security Advisory:       | isc-private/printing-press!NNN       |
 | Mattermost Channel:      | [CVE-YYYY-NNNN][mattermost_url]      |
 | Support Ticket:          | [URL]                                |
 | Release Checklist:       | #NNNN                                |

 [cvss_score]: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:X/AC:X/PR:X/UI:X/S:X/C:X/I:X/A:X&version=3.1
-[cwe_category]: https://cwe.mitre.org/data/definitions/NNN.html
 [mattermost_url]:

 :bulb: **Click [here][checklist_explanations] (internal resource) for general information about the security incident handling process.**
@@ -32,12 +30,12 @@ confidential!
  - [ ] [:link:][step_respond]           **(IM)** Respond to the bug reporter
  - [ ] [:link:][step_public_mrs]        **(SwEng)** Ensure there are no public merge requests which inadvertently disclose the issue
  - [ ] [:link:][step_assign_cve_id]     **(IM)** Assign a CVE identifier
-  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier, the CVSS score, and CWE category
+  - [ ] [:link:][step_note_cve_info]     **(SwEng)** Update this issue with the assigned CVE identifier and the CVSS score
  - [ ] [:link:][step_versions_affected] **(SwEng)** Determine the range of product versions affected (including the Subscription Edition)
  - [ ] [:link:][step_workarounds]       **(SwEng)** Determine whether workarounds for the problem exist
  - [ ] [:link:][step_coordinate]        **(SwEng)** If necessary, coordinate with other parties
-  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text
-  - [ ] [:link:][step_earliest_send]     **(Support)** Update "earliest" notification ticket in support portal Earliest queue which will notify earliest customers
+  - [ ] [:link:][step_earliest_prepare]  **(Support)** Prepare "earliest" notification text and hand it off to Marketing
+  - [ ] [:link:][step_earliest_send]     **(Marketing)** Update "earliest" notification document in SF portal and send bulk email to earliest customers
  - [ ] [:link:][step_advisory_mr]       **(Support)** Create a merge request for the Security Advisory and include all readily available information in it
  - [ ] [:link:][step_reproducer_mr]     **(SwEng)** Prepare a private merge request containing a system test reproducing the problem
  - [ ] [:link:][step_notify_support]    **(SwEng)** Notify Support when a reproducer is ready
@@ -48,19 +46,18 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)

 ### At T-5

-  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in the support portal with download links to the new versions
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 5 Day queue in RT with the text of the advisory (earliest, and T-5)
+  - [ ] [:link:][step_asn_documents]     **(Marketing)** Update the text on the T-5 (from the Printing Press project) and "earliest" ASN documents in the SF portal
+  - [ ] [:link:][step_asn_links]         **(Marketing)** (BIND 9 only) Update the BIND -S information document in SF with download links to the new versions
+  - [ ] [:link:][step_asn_send]          **(Marketing)** Bulk email eligible customers to check the SF portal
  - [ ] [:link:][step_preannouncement]   **(Marketing)** (BIND 9 only) Send a pre-announcement email to the *bind-announce* mailing list to alert users that the upcoming release will include security fixes

-### At T-3
-  - [ ] [:link:][step_asn_send]          **(Support)** Notify eligible customers by adding a ticket to the 3 Day queue in RT with the text of the advisory (T-3)
-
 ### At T-1

  - [ ] [:link:][step_packager_emails]   **(First IM)** Send notifications to OS packagers
@@ -75,8 +72,8 @@ confidential!
  - [ ] [:link:][step_mitre]             **(First IM)** Advise MITRE about the disclosed CVEs
  - [ ] [:link:][step_merge_advisory]    **(First IM)** Merge the Security Advisory merge request
  - [ ] [:link:][step_embargo_end]       **(IM)** Inform original reporter (if external) that the security disclosure process is complete
-  - [ ] [:link:][step_asn_clear]         **(Support)** Update the tickets in the ASN queues in RT that the embargo is lifted
-  - [ ] [:link:][step_customers]         **(Marketing)** Open a ticket in the <software name> Announce queue that the release is published
+  - [ ] [:link:][step_asn_clear]         **(Marketing)** Update the SF portal to clear the ASN
+  - [ ] [:link:][step_customers]         **(Marketing)** Email ASN recipients that the embargo is lifted

 ### After Public Disclosure

@@ -86,7 +83,7 @@ confidential!
 [step_respond]:           https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#respond-to-the-bug-reporter
 [step_public_mrs]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#ensure-there-are-no-public-merge-requests-which-inadvertently-disclose-the-issue
 [step_assign_cve_id]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#assign-a-cve-identifier
-[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-the-cvss-score-and-the-cwe-category
+[step_note_cve_info]:     https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#update-this-issue-with-the-assigned-cve-identifier-and-the-cvss-score
 [step_versions_affected]: https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-the-range-of-product-versions-affected-including-the-subscription-edition
 [step_workarounds]:       https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#determine-whether-workarounds-for-the-problem-exist
 [step_coordinate]:        https://gitlab.isc.org/isc-private/isc-wiki/-/wikis/Security-Incident-Handling-Checklist-Explanations#if-necessary-coordinate-with-other-parties
@@ -1,27 +0,0 @@
-Alan Clegg <aclegg@isc.org>
-Alessio Podda <alessio@isc.org>
-Aram Sargsyan <aram@isc.org>
-Artem Boldariev <artem@isc.org> <artem@boldariev.com>
-Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
-Curtis Blackburn <ckb@isc.org> <ckb@isc.org>
-Diego Fronza <diego@isc.org>
-Evan Hunt <each@isc.org> Evan Hunt <fanf@isc.org>
-Håvard Eidnes <he@uninett.no>
-Jeremy C. Reed <jreed@isc.org> <jreed@docs.lab.isc.org>
-Jeremy C. Reed <jreed@isc.org> <jreed@ISC.org>
-Joey Salazar <joey@isc.org>
-John H. DuBois III <johnd>
-Mark Andrews <marka@isc.org>
-Mark Andrews <marka@isc.org> <marka@daemon.lab.isc.org>
-Mark Andrews <marka@isc.org> <marka@newdocs.lab.isc.org>
-Matthijs Mekking <matthijs@isc.org> <github@pletterpet.nl>
-Nicki Křížek <nicki@isc.org> <tkrizek@isc.org>
-Ondřej Surý <ondrej@isc.org>
-Ondřej Surý <ondrej@isc.org> <ondrej@openbsd-6-9.home.sury.org>
-Ondřej Surý <ondrej@isc.org> <ondrej@sury.org>
-Petr Menšík <pemensik@redhat.com>
-Petr Menšík <pemensik@redhat.com> <pmensik@redhat.com>
-Robert Edmonds <edmonds>
-Tatuya JINMEI 神明達哉 <jinmei@isc.org>
-Witold Kręcicki <wpk@isc.org>
-Witold Kręcicki <wpk@isc.org> <wpk@culm.net>
@@ -1,28 +1,10 @@
-[IMPORTS]
-
-deprecated-modules=
-    dns.resolver,
-
-[MESSAGES CONTROL]
-
+[MASTER]
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
    C0115, # missing-class-docstring
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
-    C0301, # line-too-long, handled better by black
-    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    R0901, # too-many-ancestors
-    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
-    R0904, # too-many-public-methods
-    R0911, # too-many-return-statements
-    R0912, # too-many-branches
-    R0913, # too-many-arguments
-    R0914, # too-many-locals
-    R0915, # too-many-statements
-    R0916, # too-many-boolean-expressions
-    R0917, # too-many-positional-arguments
@@ -6,9 +6,6 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
-  jobs:
-    pre_build:
-      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -16,3 +13,8 @@ sphinx:

 # Build all formats
 formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
@@ -24,8 +24,8 @@ Files: **/*.after*
       **/testdata/*
       .github/*
       .gitlab/*
-       .mailmap
       AUTHORS
+       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -38,31 +38,15 @@ Files: **/*.after*
       bin/tests/system/doth/CA/index.txt
       bin/tests/system/doth/CA/index.txt.attr
       bin/tests/system/doth/CA/serial
-       bin/tests/system/formerr/badnsec3owner
-       bin/tests/system/formerr/badrecordname
-       bin/tests/system/formerr/dupans
-       bin/tests/system/formerr/dupquestion
-       bin/tests/system/formerr/keyclass
-       bin/tests/system/formerr/malformeddeltype
-       bin/tests/system/formerr/malformedrrsig
+       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/formerr/nametoolong
       bin/tests/system/formerr/noquestions
-       bin/tests/system/formerr/optwrongname
-       bin/tests/system/formerr/qtypeasanswer
-       bin/tests/system/formerr/questionclass
-       bin/tests/system/formerr/shortquestion
-       bin/tests/system/formerr/shortrecord
-       bin/tests/system/formerr/tsignotlast
-       bin/tests/system/formerr/tsigwrongclass
-       bin/tests/system/formerr/twoquestionnames
-       bin/tests/system/formerr/twoquestiontypes
-       bin/tests/system/formerr/wrongclass
+       bin/tests/system/formerr/twoquestions
       bin/tests/system/forward/CA/CA.cfg
       bin/tests/system/forward/CA/README
       bin/tests/system/forward/CA/index.txt
       bin/tests/system/forward/CA/index.txt.attr
       bin/tests/system/forward/CA/serial
-       bin/tests/system/isctest/vars/.ac_vars/*
       bin/tests/system/journal/ns1/managed-keys.bind.in
       bin/tests/system/journal/ns1/managed-keys.bind.jnl.in
       bin/tests/system/journal/ns2/managed-keys.bind.in
@@ -73,12 +57,6 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/notify/CA/CA.cfg
-       bin/tests/system/notify/CA/README
-       bin/tests/system/notify/CA/index.txt
-       bin/tests/system/notify/CA/index.txt.attr
-       bin/tests/system/notify/CA/serial
-       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
       bin/tests/system/nsupdate/CA/index.txt
@@ -195,8 +173,6 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
-       contrib/gitchangelog/changelog.rc.py
-       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -21,6 +21,7 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
+	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -26,3 +26,4 @@ Some of these settings are:
 | `-DISC_MEM_TRACKLINES=0`     | Don't track memory allocations by file and line number; this improves performance but makes debugging more difficult                   |
 | `-DNAMED_RUN_PID_DIR=0`      | Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`                                           |
 | `-DNS_CLIENT_DROPPORT=0`     | Disable dropping queries from particular well-known ports                                                                              |
+| `-DOPENSSL_API_COMPAT=10100` | Build using the deprecated OpenSSL APIs so that the `engine` API is available when building with OpenSSL 3.0.0 for PKCS#11 support     |
@@ -20,6 +20,7 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
+1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -48,7 +49,8 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the [changelog](doc/arm/changelog.rst).
+the file [CHANGES](CHANGES). See [below](#changes) for details on the
+CHANGES file format.

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -161,9 +163,38 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

+### <a name="changes"/> Change log
+
+A detailed list of all changes that have been made throughout the
+development of BIND 9 is included in the file CHANGES, with the most recent
+changes listed first. Change notes include tags indicating the category of
+the change that was made; these categories are:
+
+|Category	|Description	        			|
+|--------------	|-----------------------------------------------|
+| [func] | New feature |
+| [bug] | General bug fix |
+| [security] | Fix for a significant security flaw |
+| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
+| [port] | Portability enhancement |
+| [maint] | Updates to built-in data such as root server addresses and keys |
+| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
+| [performance] | Other changes to improve server performance |
+| [protocol] | Updates to the DNS protocol such as new RR types |
+| [test] | Changes to the automatic tests, not affecting server functionality |
+| [cleanup] | Minor corrections and refactoring |
+| [doc] | Documentation |
+| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
+| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+
+In general, [func] and [experimental] tags only appear in new-feature
+releases (i.e., those with version numbers ending in zero). Some new
+functionality may be backported to older releases on a case-by-case basis.
+All other change types may be applied to all currently supported releases.
+
 #### Bug report identifiers

-Most notes in the ARM Changelog appendix include a reference to a bug report or
+Most notes in the CHANGES file include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -33,6 +33,7 @@
 #include <dns/db.h>
 #include <dns/dbiterator.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
 #include <dns/rdataclass.h>
@@ -42,6 +43,10 @@
 #include <dns/types.h>
 #include <dns/zone.h>

+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include "check-tool.h"

 #ifndef CHECK_SIBLING
@@ -92,6 +97,13 @@ dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS | DNS_ZONEOPT_CHECKMX |
 			     DNS_ZONEOPT_CHECKSVCB | DNS_ZONEOPT_CHECKWILDCARD |
 			     DNS_ZONEOPT_WARNMXCNAME | DNS_ZONEOPT_WARNSRVCNAME;

+/*
+ * This needs to match the list in bin/named/log.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
 static isc_symtab_t *symtab = NULL;
 static isc_mem_t *sym_mctx;

@@ -537,13 +549,30 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 }

 isc_result_t
-setup_logging(FILE *errout) {
-	isc_logconfig_t *logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout), 0,
-		ISC_LOGCATEGORY_DEFAULT, ISC_LOGMODULE_DEFAULT);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;

+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_registercategories(log, categories);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
+	cfg_log_init(log);
+	ns_log_init(log);
+
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination, 0);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
 	return (ISC_R_SUCCESS);
 }

@@ -29,7 +29,7 @@
 ISC_LANG_BEGINDECLS

 isc_result_t
-setup_logging(FILE *errout);
+setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp);

 isc_result_t
 load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
@@ -30,6 +30,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/rootns.h>
@@ -43,6 +44,8 @@

 static const char *program = "named-checkconf";

+isc_log_t *logc = NULL;
+
 #define CHECK(r)                             \
 	do {                                 \
 		result = (r);                \
@@ -51,7 +54,7 @@ static const char *program = "named-checkconf";
 	} while (0)

 /*% usage */
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -80,7 +83,7 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	directory = cfg_obj_asstring(obj);
 	result = isc_dir_chdir(directory);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(obj, ISC_LOG_ERROR,
+		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
 		return (result);
@@ -590,11 +593,11 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
 	bool nodeprecate = false;
-	bool allconfigs = false;
 	unsigned int flags = 0;
 	unsigned int checkflags = BIND_CHECK_PLUGINS | BIND_CHECK_ALGORITHMS;

@@ -603,7 +606,7 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "acdhijlm:nt:pvxz"
+#define CMDLINE_FLAGS "acdhijlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -657,10 +660,6 @@ main(int argc, char **argv) {
 		case 'm':
 			break;

-		case 'n':
-			allconfigs = true;
-			break;
-
 		case 't':
 			result = isc_dir_chroot(isc_commandline_argument);
 			if (result != ISC_R_SUCCESS) {
@@ -727,20 +726,20 @@ main(int argc, char **argv) {
 		conffile = NAMED_CONFFILE;
 	}

-	CHECK(setup_logging(stdout));
+	CHECK(setup_logging(mctx, stdout, &logc));

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(dst_lib_init(mctx, NULL));
+	cleanup_dst = true;
+
+	CHECK(cfg_parser_create(mctx, logc, &parser));

 	if (nodeprecate) {
 		cfg_parser_setflags(parser, CFG_PCTX_NODEPRECATED, true);
 	}
-	if (allconfigs) {
-		cfg_parser_setflags(parser, CFG_PCTX_ALLCONFIGS, true);
-	}
 	cfg_parser_setcallback(parser, directory_callback, NULL);

 	CHECK(cfg_parse_file(parser, conffile, &cfg_type_namedconf, &config));
-	CHECK(isccfg_check_namedconf(config, checkflags, mctx));
+	CHECK(isccfg_check_namedconf(config, checkflags, logc, mctx));
 	if (load_zones || list_zones) {
 		CHECK(load_zones_fromconfig(config, mctx, list_zones));
 	}
@@ -758,6 +757,14 @@ cleanup:
 		cfg_parser_destroy(&parser);
 	}

+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
+
+	if (logc != NULL) {
+		isc_log_destroy(&logc);
+	}
+
 	if (mctx != NULL) {
 		isc_mem_destroy(&mctx);
 	}
@@ -21,7 +21,7 @@ named-checkconf - named configuration file syntax checking tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkconf` [**-achjlnvz**] [**-p** [**-x** ]] [**-t** directory] {filename}
+:program:`named-checkconf` [**-achjlvz**] [**-p** [**-x** ]] [**-t** directory] {filename}

 Description
 ~~~~~~~~~~~
@@ -71,10 +71,6 @@ Options

   This option ignores warnings on deprecated options.

-.. option:: -n
-
-   Do not error on options that are disabled in this build.
-
 .. option:: -p

   This option prints out the :iscman:`named.conf` and included files in canonical form if
@@ -31,6 +31,7 @@

 #include <dns/db.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
@@ -61,7 +62,7 @@ static enum { progmode_check, progmode_compile } progmode;
 		}                                                             \
 	} while (0)

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -94,6 +95,7 @@ main(int argc, char **argv) {
 	int c;
 	char *origin = NULL;
 	const char *filename = NULL;
+	isc_log_t *lctx = NULL;
 	isc_result_t result;
 	char classname_in[] = "IN";
 	char *classname = classname_in;
@@ -159,7 +161,7 @@ main(int argc, char **argv) {

 	while ((c = isc_commandline_parse(argc, argv,
 					  "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:C:"
-					  "DF:M:R:S:T:W:")) != EOF)
+					  "DF:M:S:T:W:")) != EOF)
 	{
 		switch (c) {
 		case 'c':
@@ -323,18 +325,6 @@ main(int argc, char **argv) {
 			}
 			break;

-		case 'R':
-			if (ARGCMP("fail")) {
-				zone_options |= DNS_ZONEOPT_LOGREPORTS;
-			} else if (ARGCMP("ignore")) {
-				zone_options &= ~DNS_ZONEOPT_LOGREPORTS;
-			} else {
-				fprintf(stderr, "invalid argument to -R: %s\n",
-					isc_commandline_argument);
-				exit(EXIT_FAILURE);
-			}
-			break;
-
 		case 's':
 			if (ARGCMP("full")) {
 				outputstyle = &dns_master_style_full;
@@ -535,7 +525,8 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);
 	if (!quiet) {
-		RUNTIME_CHECK(setup_logging(errout) == ISC_R_SUCCESS);
+		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx) ==
+			      ISC_R_SUCCESS);
 	}

 	origin = argv[isc_commandline_index++];
@@ -575,6 +566,9 @@ main(int argc, char **argv) {
 		fprintf(errout, "OK\n");
 	}
 	destroy();
+	if (lctx != NULL) {
+		isc_log_destroy(&lctx);
+	}
 	isc_mem_destroy(&mctx);

 	return ((result == ISC_R_SUCCESS) ? 0 : 1);
@@ -23,7 +23,7 @@ named-checkzone - zone file validation tool
 Synopsis
 ~~~~~~~~

-:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}
+:program:`named-checkzone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-o** filename] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -166,12 +166,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn`` (the default), and ``ignore``.

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -23,7 +23,7 @@ named-compilezone - zone file converting tool
 Synopsis
 ~~~~~~~~

-:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-R** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}
+:program:`named-compilezone` [**-d**] [**-h**] [**-j**] [**-q**] [**-v**] [**-c** class] [**-C** mode] [**-f** format] [**-F** format] [**-J** filename] [**-i** mode] [**-k** mode] [**-m** mode] [**-M** mode] [**-n** mode] [**-l** ttl] [**-L** serial] [**-r** mode] [**-s** style] [**-S** mode] [**-t** directory] [**-T** mode] [**-w** directory] [**-D**] [**-W** mode] {**-o** filename} {zonename} {filename}

 Description
 ~~~~~~~~~~~
@@ -175,12 +175,6 @@ Options
   semantically equal in plain DNS. Possible modes are ``fail``,
   ``warn``, and ``ignore`` (the default).

-.. option:: -R mode
-
-   This option checks whether a TXT wildcard record exists that
-   matches the name format for RFC 9567 error-reporting queries: ``*._er``.
-   Possible modes are ``fail`` and ``ignore`` (the default).
-
 .. option:: -s style

   This option specifies the style of the dumped zone file. Possible styles are
@@ -120,6 +120,8 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 		fatal("unsupported algorithm %d\n", alg);
 	}

+	DO("initialize dst library", dst_lib_init(mctx, NULL));
+
 	DO("generate key",
 	   dst_key_generate(dns_rootname, alg, keysize, 0, 0, DNS_KEYPROTO_ANY,
 			    dns_rdataclass_in, NULL, mctx, &key, NULL));
@@ -130,12 +132,14 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,

 	isc_buffer_usedregion(&key_rawbuffer, &key_rawregion);

-	DO("base64 encode secret",
+	DO("bsse64 encode secret",
 	   isc_base64_totext(&key_rawregion, -1, "", key_txtbuffer));

 	if (key != NULL) {
 		dst_key_free(&key);
 	}
+
+	dst_lib_destroy();
 }

 /*%
@@ -60,7 +60,7 @@ bool verbose = false;

 const char *keyfile, *keydef;

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -53,7 +53,7 @@ const char *progname;
 static enum { progmode_keygen, progmode_confgen } progmode;
 bool verbose = false; /* needed by util.c but not used here */

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -52,6 +52,7 @@
 #include <dns/fixedname.h>
 #include <dns/keytable.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -69,6 +70,7 @@

 #include <dst/dst.h>

+#include <isccfg/log.h>
 #include <isccfg/namedconf.h>

 #include <ns/client.h>
@@ -86,12 +88,10 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  32
-#define MAX_RESTARTS 11
-
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
+static isc_log_t *lctx = NULL;
 static dns_view_t *view = NULL;
 static ns_server_t *sctx = NULL;
 static ns_interface_t *ifp = NULL;
@@ -130,9 +130,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

-static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t restarts = MAX_RESTARTS;
-
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -253,7 +250,7 @@ usage(void) {
 	exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -284,6 +281,12 @@ warn(const char *format, ...) {
 	fprintf(stderr, "\n");
 }

+static isc_logcategory_t categories[] = { { "delv", 0 }, { NULL, 0 } };
+#define LOGCATEGORY_DEFAULT (&categories[0])
+#define LOGMODULE_DEFAULT   (&modules[0])
+
+static isc_logmodule_t modules[] = { { "delv", 0 }, { NULL, 0 } };
+
 static void
 delv_log(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

@@ -292,15 +295,15 @@ delv_log(int level, const char *fmt, ...) {
 	va_list ap;
 	char msgbuf[2048];

-	if (!isc_log_wouldlog(level)) {
+	if (!isc_log_wouldlog(lctx, level)) {
 		return;
 	}

 	va_start(ap, fmt);

 	vsnprintf(msgbuf, sizeof(msgbuf), fmt, ap);
-	isc_log_write(DELV_LOGCATEGORY_DEFAULT, DELV_LOGMODULE_DEFAULT, level,
-		      "%s", msgbuf);
+	isc_log_write(lctx, LOGCATEGORY_DEFAULT, LOGMODULE_DEFAULT, level, "%s",
+		      msgbuf);
 	va_end(ap);
 }

@@ -308,45 +311,76 @@ static int loglevel = 0;

 static void
 setup_logging(FILE *errout) {
+	isc_result_t result;
+	isc_logdestination_t destination;
+	isc_logconfig_t *logconfig = NULL;
 	int packetlevel = 10;

-	isc_log_setdebuglevel(loglevel);
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_registercategories(lctx, categories);
+	isc_log_registermodules(lctx, modules);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+	cfg_log_init(lctx);

-	isc_logconfig_t *logconfig = isc_logconfig_get();
+	destination.file.stream = errout;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_DYNAMIC, &destination,
+			      ISC_LOG_PRINTPREFIX);

+	isc_log_setdebuglevel(lctx, loglevel);
 	isc_log_settag(logconfig, ";; ");

-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC,
-		ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_FILE(errout),
-		ISC_LOG_PRINTPREFIX, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	result = isc_log_usechannel(logconfig, "stderr",
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Couldn't attach to log channel 'stderr'");
+	}

 	if (resolve_trace && loglevel < 1) {
-		isc_log_createandusechannel(
-			logconfig, "resolver", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(1), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_RESOLVER,
-			DNS_LOGMODULE_RESOLVER);
+		isc_log_createchannel(logconfig, "resolver", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(1), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "resolver",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_RESOLVER);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'resolver'");
+		}
 	}

 	if (validator_trace && loglevel < 3) {
-		isc_log_createandusechannel(
-			logconfig, "validator", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(3), ISC_LOGDESTINATION_FILE(errout),
-			ISC_LOG_PRINTPREFIX, DNS_LOGCATEGORY_DNSSEC,
-			DNS_LOGMODULE_VALIDATOR);
+		isc_log_createchannel(logconfig, "validator",
+				      ISC_LOG_TOFILEDESC, ISC_LOG_DEBUG(3),
+				      &destination, ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "validator",
+					    DNS_LOGCATEGORY_DNSSEC,
+					    DNS_LOGMODULE_VALIDATOR);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'validator'");
+		}
 	}

 	if (send_trace) {
 		packetlevel = 11;
 	}
 	if ((message_trace || send_trace) && loglevel < packetlevel) {
-		isc_log_createandusechannel(
-			logconfig, "messages", ISC_LOG_TOFILEDESC,
-			ISC_LOG_DEBUG(packetlevel),
-			ISC_LOGDESTINATION_FILE(errout), ISC_LOG_PRINTPREFIX,
-			DNS_LOGCATEGORY_RESOLVER, DNS_LOGMODULE_PACKETS);
+		isc_log_createchannel(logconfig, "messages", ISC_LOG_TOFILEDESC,
+				      ISC_LOG_DEBUG(packetlevel), &destination,
+				      ISC_LOG_PRINTPREFIX);
+
+		result = isc_log_usechannel(logconfig, "messages",
+					    DNS_LOGCATEGORY_RESOLVER,
+					    DNS_LOGMODULE_PACKETS);
+		if (result != ISC_R_SUCCESS) {
+			fatal("Couldn't attach to log channel 'messagse'");
+		}
 	}
 }

@@ -776,14 +810,14 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {

 cleanup:
 	if (result == DST_R_NOCRYPTO) {
-		cfg_obj_log(key, ISC_LOG_ERROR, "no crypto support");
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR, "no crypto support");
 	} else if (result == DST_R_UNSUPPORTEDALG) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, lctx, ISC_LOG_WARNING,
 			    "skipping trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_SUCCESS;
 	} else if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_ERROR,
+		cfg_obj_log(key, lctx, ISC_LOG_ERROR,
 			    "failed to add trusted key '%s': %s", keynamestr,
 			    isc_result_totext(result));
 		result = ISC_R_FAILURE;
@@ -838,7 +872,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		CHECK(convert_name(&afn, &anchor_name, trust_anchor));
 	}

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, dns_lctx, &parser));

 	if (anchorfile != NULL) {
 		if (access(anchorfile, R_OK) != 0) {
@@ -1157,23 +1191,6 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a': /* maxqueries */
-			FULLCHECK("maxqueries");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&maxqueries, value, UINT_MAX,
-					    "maxqueries");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse maxqueries");
-			}
-			if (maxqueries == 0) {
-				fatal("maxqueries must be nonzero");
-			}
-			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1226,22 +1243,6 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'e': /* restarts */
-			FULLCHECK("restarts");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&restarts, value, 255, "restarts");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse restarts");
-			}
-			if (restarts == 0) {
-				fatal("restarts must be between 1..255");
-			}
-			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1369,7 +1370,10 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-	need_value:
+		/*
+		 * We can also add a "need_value:" case here if we ever
+		 * add a plus-option that requires a specified value
+		 */
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1894,7 +1898,6 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
-	dns_client_setmaxrestarts(client, restarts);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2114,22 +2117,15 @@ cleanup:

 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
-	  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-	  isc_result_t *sigresultp, isc_result_t *viewpatchresultp,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
 	  dns_view_t **viewp) {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(lsctx);
-	UNUSED(loop);
-	UNUSED(cb);
-	UNUSED(cbarg);
 	UNUSED(sigresultp);

 	*viewp = view;
-	*viewpatchresultp = ISC_R_SUCCESS;
 	return (ISC_R_SUCCESS);
 }

@@ -2151,15 +2147,14 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, &interfacemgr));
+				     NULL, false, &interfacemgr));

 	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
 			      &view));
-	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
+	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
-	dns_view_setmaxrestarts(view, restarts);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2173,7 +2168,6 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
-	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2219,6 +2213,11 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);
 	loop = isc_loop_main(loopmgr);

+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("dst_lib_init failed: %d", result);
+	}
+
 	parse_args(argc, argv);

 	CHECK(setup_style());
@@ -2260,6 +2259,9 @@ cleanup:
 		dns_master_styledestroy(&style, mctx);
 	}

+	isc_log_destroy(&lctx);
+	dst_lib_destroy();
+
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 	return (0);
@@ -337,18 +337,6 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

-.. option:: +restarts
-
-   When name server mode (``delv +ns``) is in use, this option sets the
-   maximum number of CNAME queries to follow before terminating resolution.
-   This prevents ``delv`` from hanging in the event of a CNAME loop.
-   The default is 11.
-
-.. option:: +maxqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 32.
-
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -111,7 +111,7 @@ usage(void) {
 	fprintf(stderr, "Press <Help> for complete list of options\n");
 }
 #else  /* if TARGET_OS_IPHONE */
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -748,7 +748,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		char *hash;
 		int pf;

-		printf("- type: MESSAGE\n");
+		printf("-\n");
+		printf("  type: MESSAGE\n");
 		printf("  message:\n");

 		if (isquery) {
@@ -1500,9 +1501,9 @@ plus_tls_options(const char *cmd, const char *value, const bool state,
 		goto invalid_option;
 	}

-	return (true);
+	return true;
 invalid_option:
-	return (false);
+	return false;
 }

 /*%
@@ -1824,12 +1825,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "",
+						extra = strtok_r(NULL, "\0",
 								 &last);
 						save_opt(lookup, code, extra);
-						if (extra != NULL) {
-							extra[-1] = ':';
-						}
 						break;
 					default:
 						goto invalid_option;
@@ -2558,9 +2556,6 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	if (value != NULL) {
-		value[-1] = '=';
-	}
 	return (lookup);

 #if !TARGET_OS_IPHONE
@@ -2820,8 +2815,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
-								   * NULL */
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
+								    * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2832,10 +2827,6 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		if (ptr3 != NULL) {
-			ptr[-1] = ':';
-		}
-		ptr2[-1] = ':';
 		return (value_from_next);
 	case 'x':
 		if (*need_clone) {
@@ -3315,7 +3306,8 @@ dig_error(const char *format, ...) {
 	va_list args;

 	if (yaml) {
-		printf("- type: DIG_ERROR\n");
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");

 		/*
 		 * Print an indent before a literal block quote.
@@ -3332,7 +3324,10 @@ dig_error(const char *format, ...) {
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
-	printf("\n"); /* We get the error without a newline */
+
+	if (!yaml) {
+		printf("\n");
+	}
 }

 static void
@@ -36,7 +36,6 @@
 #endif /* HAVE_LIBIDN2 */

 #include <isc/base64.h>
-#include <isc/crypto.h>
 #include <isc/file.h>
 #include <isc/getaddresses.h>
 #include <isc/hex.h>
@@ -62,6 +61,7 @@

 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/name.h>
 #include <dns/opcode.h>
@@ -93,12 +93,14 @@ static bool cancel_now = false;

 bool check_ra = false, have_ipv4 = false, have_ipv6 = false,
     specified_source = false, free_now = false, usesearch = false,
-     showsearch = false, keep_open = false, verbose = false, yaml = false;
+     showsearch = false, is_dst_up = false, keep_open = false, verbose = false,
+     yaml = false;
 in_port_t port = 53;
 bool port_set = false;
 unsigned int timeout = 0;
 unsigned int extrabytes;
 isc_mem_t *mctx = NULL;
+isc_log_t *lctx = NULL;
 isc_nm_t *netmgr = NULL;
 isc_loopmgr_t *loopmgr = NULL;
 isc_loop_t *mainloop = NULL;
@@ -1095,7 +1097,7 @@ read_confkey(void) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	result = cfg_parser_create(mctx, &pctx);
+	result = cfg_parser_create(mctx, NULL, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -1360,15 +1362,22 @@ setup_libs(void) {

 	isc_managers_create(&mctx, 1, &loopmgr, &netmgr);

-	logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
-				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
-				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
-	isc_log_setdebuglevel(0);
+	isc_log_create(mctx, &lctx, &logconfig);
+	isc_log_setcontext(lctx);
+	dns_log_init(lctx);
+	dns_log_setcontext(lctx);
+
+	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
+	check_result(result, "isc_log_usechannel");
+
+	isc_log_setdebuglevel(lctx, 0);

 	isc_mem_setname(mctx, "dig");
 	mainloop = isc_loop_main(loopmgr);
+
+	result = dst_lib_init(mctx, NULL);
+	check_result(result, "dst_lib_init");
+	is_dst_up = true;
 }

 typedef struct dig_ednsoptname {
@@ -1377,27 +1386,24 @@ typedef struct dig_ednsoptname {
 } dig_ednsoptname_t;

 dig_ednsoptname_t optnames[] = {
-	{ 1, "LLQ" },		  /* draft-sekar-dns-llq */
-	{ 2, "UL" },		  /* draft-ietf-dnssd-update-lease */
-	{ 3, "NSID" },		  /* RFC 5001 */
-	{ 5, "DAU" },		  /* RFC 6975 */
-	{ 6, "DHU" },		  /* RFC 6975 */
-	{ 7, "N3U" },		  /* RFC 6975 */
-	{ 8, "ECS" },		  /* RFC 7871 */
-	{ 9, "EXPIRE" },	  /* RFC 7314 */
-	{ 10, "COOKIE" },	  /* RFC 7873 */
-	{ 11, "KEEPALIVE" },	  /* RFC 7828 */
-	{ 12, "PADDING" },	  /* RFC 7830 */
-	{ 12, "PAD" },		  /* shorthand */
-	{ 13, "CHAIN" },	  /* RFC 7901 */
-	{ 14, "KEY-TAG" },	  /* RFC 8145 */
-	{ 15, "EDE" },		  /* ietf-dnsop-extended-error-16 */
-	{ 16, "CLIENT-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 17, "SERVER-TAG" },	  /* draft-bellis-dnsop-edns-tags */
-	{ 18, "REPORT-CHANNEL" }, /* RFC 9567 */
-	{ 18, "RC" },		  /* shorthand */
-	{ 19, "ZONEVERSION" },	  /* RFC 9660 */
-	{ 26946, "DEVICEID" },	  /* Brian Hartvigsen */
+	{ 1, "LLQ" },	       /* draft-sekar-dns-llq */
+	{ 2, "UL" },	       /* draft-ietf-dnssd-update-lease */
+	{ 3, "NSID" },	       /* RFC 5001 */
+	{ 5, "DAU" },	       /* RFC 6975 */
+	{ 6, "DHU" },	       /* RFC 6975 */
+	{ 7, "N3U" },	       /* RFC 6975 */
+	{ 8, "ECS" },	       /* RFC 7871 */
+	{ 9, "EXPIRE" },       /* RFC 7314 */
+	{ 10, "COOKIE" },      /* RFC 7873 */
+	{ 11, "KEEPALIVE" },   /* RFC 7828 */
+	{ 12, "PADDING" },     /* RFC 7830 */
+	{ 12, "PAD" },	       /* shorthand */
+	{ 13, "CHAIN" },       /* RFC 7901 */
+	{ 14, "KEY-TAG" },     /* RFC 8145 */
+	{ 15, "EDE" },	       /* ietf-dnsop-extended-error-16 */
+	{ 16, "CLIENT-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 17, "SERVER-TAG" },  /* draft-bellis-dnsop-edns-tags */
+	{ 26946, "DEVICEID" }, /* Brian Hartvigsen */
 };

 #define N_EDNS_OPTNAMES (sizeof(optnames) / sizeof(optnames[0]))
@@ -3225,7 +3231,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3282,10 +3288,6 @@ start_udp(dig_query_t *query) {
 		return;
 	}

-	if (!port_set) {
-		port = 53;
-	}
-
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -3421,10 +3423,10 @@ force_next(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));

-		dighost_error("no response from %s", buf);
+		dighost_error("no response from %s\n", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("no servers could be reached");
+		dighost_error("no servers could be reached\n");
 	}

 	if (exitcode < 9) {
@@ -3648,7 +3650,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -4101,7 +4103,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			 * and cancel the lookup.
 			 */
 			printf("%s", l->cmdline);
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");

 			if (exitcode < 9) {
 				exitcode = 9;
@@ -4235,15 +4237,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
-		if (l->doing_xfr) {
-			if (query->msg_count == 0) {
-				dighost_warning("missing question section");
-			}
-		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
-			dighost_warning("missing question section");
-		}
-	} else {
+	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -4720,6 +4714,12 @@ cleanup_openssl_refs(void) {
 		debug("freeing SIG(0) key %p", sig0key);
 		dst_key_free(&sig0key);
 	}
+
+	if (is_dst_up) {
+		debug("destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
 }

 /*%
@@ -4750,6 +4750,9 @@ destroy_libs(void) {
 		isc_buffer_free(&namebuf);
 	}

+	debug("Removing log context");
+	isc_log_destroy(&lctx);
+
 	debug("Destroy memory");
 	if (memdebugging != 0) {
 		isc_mem_stats(mctx, stderr);
@@ -4758,7 +4761,7 @@ destroy_libs(void) {
 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -293,13 +293,13 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
 get_reverse(char *reverse, size_t len, char *value, bool strict);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
 warn(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 digexit(void);

 void
@@ -99,7 +99,7 @@ rcode_totext(dns_rcode_t rcode) {
 	return (totext.deconsttext);
 }

-ISC_NORETURN static void
+noreturn static void
 show_usage(void);

 static void
@@ -183,7 +183,6 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
-		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -189,7 +189,6 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
-		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -836,7 +835,7 @@ fgets_next_command(void *arg) {
 	cmdline = fgets(cmdlinebuf, COMMSIZE, stdin);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -29,7 +29,6 @@
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/serial.h>
@@ -44,6 +43,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -63,6 +63,7 @@ const char *program = "dnssec-cds";
 /*
 * Infrastructure
 */
+static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;

 /*
@@ -143,6 +144,7 @@ static dns_dbnode_t *parent_node = NULL;
 static dns_db_t *update_db = NULL;
 static dns_dbnode_t *update_node = NULL;
 static dns_dbversion_t *update_version = NULL;
+static bool cleanup_dst = false;
 static bool print_mem_stats = false;

 static void
@@ -1027,7 +1029,7 @@ nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -1069,6 +1071,12 @@ cleanup(void) {
 		free_keytable(&new_key_tbl);
 	}
 	free_all_sets();
+	if (lctx != NULL) {
+		cleanup_logging(&lctx);
+	}
+	if (cleanup_dst) {
+		dst_lib_destroy();
+	}
 	if (mctx != NULL) {
 		if (print_mem_stats && verbose > 10) {
 			isc_mem_stats(mctx, stdout);
@@ -1082,6 +1090,7 @@ main(int argc, char *argv[]) {
 	const char *child_path = NULL;
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
+	isc_result_t result;
 	bool prefer_cdnskey = false;
 	bool nsupdate = false;
 	uint32_t ttl = 0;
@@ -1169,7 +1178,14 @@ main(int argc, char *argv[]) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);
+
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+	cleanup_dst = true;

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -22,7 +22,6 @@
 #include <isc/commandline.h>
 #include <isc/dir.h>
 #include <isc/hash.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -34,6 +33,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -324,7 +324,7 @@ emits(bool showall, bool cds, dns_rdata_t *rdata) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -368,6 +368,7 @@ main(int argc, char **argv) {
 	bool usekeyset = false;
 	bool showall = false;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;

@@ -488,7 +489,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -541,6 +548,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -20,7 +20,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/hash.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -32,6 +31,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/name.h>
 #include <dns/rdata.h>
@@ -262,7 +262,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 	dst_key_free(&key);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -299,6 +299,7 @@ main(int argc, char **argv) {
 	char *endp;
 	int ch;
 	isc_result_t result;
+	isc_log_t *log = NULL;
 	dns_rdataset_t rdataset;
 	dns_rdata_t rdata;
 	isc_stdtime_t now = isc_stdtime_now();
@@ -407,7 +408,13 @@ main(int argc, char **argv) {
 		fatal("extraneous arguments");
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, NULL);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	dns_rdataset_init(&rdataset);

@@ -451,6 +458,8 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset)) {
 		dns_rdataset_disassociate(&rdataset);
 	}
+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,6 @@
 #include <isc/attributes.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -31,6 +30,7 @@
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>
@@ -43,9 +43,7 @@

 const char *program = "dnssec-keyfromlabel";

-static uint16_t tag_min = 0, tag_max = 0xffff;
-
-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -65,12 +63,13 @@ usage(void) {
 			"        ED25519 | ED448\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f keyflag: KSK | REVOKE\n");
 	fprintf(stderr, "    -K directory: directory in which to place "
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -113,6 +112,7 @@ main(int argc, char **argv) {
 	const char *directory = NULL;
 	const char *predecessor = NULL;
 	dst_key_t *prevkey = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	char *endp;
 	dst_key_t *key = NULL;
@@ -128,6 +128,7 @@ main(int argc, char **argv) {
 	isc_textregion_t r;
 	char filename[255];
 	isc_buffer_t buf;
+	isc_log_t *log = NULL;
 	dns_rdataclass_t rdclass;
 	int options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char *label = NULL;
@@ -159,7 +160,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -175,7 +176,7 @@ main(int argc, char **argv) {
 			classname = isc_commandline_argument;
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -206,20 +207,6 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
-		case 'M': {
-			unsigned long ul;
-			tag_min = ul = strtoul(isc_commandline_argument, &endp,
-					       10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -348,7 +335,12 @@ main(int argc, char **argv) {
 		}
 	}

-	setup_logging();
+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
+	setup_logging(mctx, &log);

 	if (predecessor == NULL) {
 		if (label == NULL) {
@@ -603,8 +595,8 @@ main(int argc, char **argv) {
 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	/* associate the key */
-	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, label,
-				NULL, mctx, &key);
+	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass, engine,
+				label, NULL, mctx, &key);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -694,8 +686,7 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
-	{
+	if (key_collision(key, name, directory, mctx, &exact)) {
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -740,6 +731,8 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -63,12 +63,22 @@ Options
   versions, then the NSEC3 version is used; for example,
   ``dnssec-keygen -3a RSASHA1`` specifies the NSEC3RSASHA1 algorithm.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -l label

   This option specifies the label for a key pair in the crypto hardware.

   When BIND 9 is built with OpenSSL-based PKCS#11 support, the label is
-   an arbitrary string that identifies a particular key.
+   an arbitrary string that identifies a particular key. It may be
+   preceded by an optional OpenSSL engine name, followed by a colon, as
+   in ``pkcs11:keylabel``.

 .. option:: -n nametype

@@ -123,18 +133,6 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of key tag values
-   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
-   key or the key tag of the revoked version of the new key is
-   outside this range, the new key will be rejected.  This is
-   designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid
-   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
-   default allows all key tag values to be accepted.
-
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -39,7 +39,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/fips.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/result.h>
@@ -50,13 +49,14 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/rdataclass.h>
 #include <dns/secalg.h>

 #include <dst/dst.h>

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -72,7 +72,9 @@ const char *program = "dnssec-keygen";
 static int min_rsa = 1024;
 static int min_dh = 128;

-ISC_NORETURN static void
+isc_log_t *lctx = NULL;
+
+noreturn static void
 usage(void);

 static void
@@ -89,8 +91,6 @@ struct keygen_ctx {
 	char *type;
 	int protocol;
 	int size;
-	uint16_t tag_min;
-	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
@@ -176,10 +176,11 @@ usage(void) {
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE)\n");
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
+	fprintf(stderr, "    -E <engine>:\n");
+	fprintf(stderr, "        name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -252,6 +253,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 	char filename[255];
 	char algstr[DNS_SECALG_FORMATSIZE];
 	uint16_t flags = 0;
+	int param = 0;
 	bool null_key = false;
 	bool conflict = false;
 	bool show_progress = false;
@@ -612,12 +614,12 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 				ctx->keystore, name, ctx->policy, ctx->rdclass,
 				mctx, ctx->alg, ctx->size, flags, &key);
 		} else if (!ctx->quiet && show_progress) {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       &progress);
 		} else {
-			ret = dst_key_generate(name, ctx->alg, ctx->size, 0,
+			ret = dst_key_generate(name, ctx->alg, ctx->size, param,
 					       flags, ctx->protocol,
 					       ctx->rdclass, NULL, mctx, &key,
 					       NULL);
@@ -756,9 +758,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
-				  ctx->tag_max, NULL))
-		{
+		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -843,10 +843,11 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t ret;
 	isc_textregion_t r;
+	const char *engine = NULL;
 	unsigned char c;
 	int ch;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -867,8 +868,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                          \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                        \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -921,7 +922,7 @@ main(int argc, char **argv) {
 			}
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -957,21 +958,6 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
-		case 'M': {
-			unsigned long ul;
-			ctx.tag_min = ul = strtoul(isc_commandline_argument,
-						   &endp, 10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff ||
-			    ctx.tag_max <= ctx.tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'm':
 			break;
 		case 'p':
@@ -1135,7 +1121,7 @@ main(int argc, char **argv) {
 	}

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -1155,15 +1141,20 @@ main(int argc, char **argv) {
 		}
 	}

+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
 	/*
-	 * The DST subsystem will set FIPS mode if requested at build time.
-	 * The minimum sizes are both raised to 2048.
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);

 	ctx.rdclass = strtoclass(classname);

@@ -1235,8 +1226,6 @@ main(int argc, char **argv) {
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
-			ctx.tag_min = 0;
-			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1245,7 +1234,7 @@ main(int argc, char **argv) {
 			dns_kasp_t *kasp = NULL;
 			dns_kasp_key_t *kaspkey = NULL;

-			RUNTIME_CHECK(cfg_parser_create(mctx, &parser) ==
+			RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) ==
 				      ISC_R_SUCCESS);
 			if (cfg_parse_file(parser, ctx.configfile,
 					   &cfg_type_namedconf,
@@ -1256,8 +1245,8 @@ main(int argc, char **argv) {
 				      ctx.policy, ctx.configfile);
 			}

-			kasp_from_conf(config, mctx, ctx.policy, ctx.directory,
-				       &kasp);
+			kasp_from_conf(config, mctx, lctx, ctx.policy,
+				       ctx.directory, engine, &kasp);
 			if (kasp == NULL) {
 				fatal("failed to load dnssec-policy '%s'",
 				      ctx.policy);
@@ -1285,8 +1274,6 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
-				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
-				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
 				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
 				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
 				{
@@ -1303,12 +1290,14 @@ main(int argc, char **argv) {
 		keygen(&ctx, mctx, argc, argv);
 	}

+	cleanup_logging(&lctx);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_destroy(&mctx);

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -94,6 +94,14 @@ Options
   and 4096 bits. This option is ignored for algorithms ECDSAP256SHA256,
   ECDSAP384SHA384, ED25519, and ED448.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f flag

   This option sets the specified flag in the flag field of the KEY/DNSKEY record.
@@ -150,19 +158,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of acceptable key tag values that ``dnssec-keygen``
-   will produce. If the key tag of the new key or the key tag of
-   the revoked version of the new key is outside this range,
-   the new key will be rejected and another new key will be generated.
-   This is designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid values
-   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
-   key tag values to be produced.  This option is ignored when ``-k policy``
-   is specified.
-
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -25,7 +25,6 @@
 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -40,7 +39,9 @@ const char *program = "dnssec-ksr";
 /*
 * Infrastructure
 */
+static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
+const char *engine = NULL;
 /*
 * The domain we are working on
 */
@@ -62,19 +63,16 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
-	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
-	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
-	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -89,6 +87,7 @@ static int min_dh = 128;
 #define KSR_LINESIZE   1500 /* should be long enough for any DNSKEY record */
 #define DATETIME_INDEX 25

+#define TTL_MAX INT32_MAX
 #define MAXWIRE (64 * 1024)

 #define STR(t) ((t).value.as_textregion.base)
@@ -124,6 +123,7 @@ usage(int ret) {
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "\n");
 	fprintf(stderr, "Options:\n");
+	fprintf(stderr, "    -E <engine>: name of an OpenSSL engine to use\n");
 	fprintf(stderr, "    -e <date/offset>: end date\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -f: KSR file to sign\n");
@@ -143,15 +143,6 @@ usage(int ret) {
 	exit(ret);
 }

-static isc_stdtime_t
-between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
-	isc_stdtime_t r = end;
-	if (t > 0 && t > start && t < end) {
-		r = t;
-	}
-	return (r);
-}
-
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -176,14 +167,15 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *config = NULL;

-	RUNTIME_CHECK(cfg_parser_create(mctx, &parser) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(cfg_parser_create(mctx, lctx, &parser) == ISC_R_SUCCESS);
 	if (cfg_parse_file(parser, ksr->configfile, &cfg_type_namedconf,
 			   &config) != ISC_R_SUCCESS)
 	{
 		fatal("unable to load dnssec-policy '%s' from '%s'",
 		      ksr->policy, ksr->configfile);
 	}
-	kasp_from_conf(config, mctx, ksr->policy, ksr->keydir, kasp);
+	kasp_from_conf(config, mctx, lctx, ksr->policy, ksr->keydir, engine,
+		       kasp);
 	if (*kasp == NULL) {
 		fatal("failed to load dnssec-policy '%s'", ksr->policy);
 	}
@@ -195,14 +187,10 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keyalgtag_cmp(const void *k1, const void *k2) {
+keytag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
-		return (-1);
-	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
-		return (1);
-	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
 		return (-1);
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
 		return (1);
@@ -237,7 +225,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -252,7 +240,6 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
-	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -260,7 +247,6 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
-	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -328,9 +314,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
-	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
-	   isc_stdtime_t active, isc_stdtime_t *expiration) {
+create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
+	   isc_stdtime_t inception, isc_stdtime_t active,
+	   isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -342,15 +328,9 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
-	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

-	/* ZSK or KSK? */
-	if (ksr->ksk) {
-		flags |= DNS_KEYFLAG_KSK;
-	}
-
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -441,18 +421,18 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				flags, &key);
+				DNS_KEYOWNER_ZONE, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, &progress);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, NULL);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -461,10 +441,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 		}

 		/* Do not overwrite an existing key. */
-		if (key_collision(key, name, ksr->keydir, mctx,
-				  dns_kasp_key_tagmin(kaspkey),
-				  dns_kasp_key_tagmax(kaspkey), NULL))
-		{
+		if (key_collision(key, name, ksr->keydir, mctx, NULL)) {
 			conflict = true;
 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
@@ -489,28 +466,15 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
-	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_KSK, false);
+	dst_key_setbool(key, DST_BOOL_ZSK, true);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
-	if (ksr->ksk) {
-		dns_keymgr_settime_syncpublish(key, kasp,
-					       (inception == ksr->start));
-	}
-
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove;
-
-		if (ksr->ksk) {
-			remove = ksr->ttlds + ksr->parentpropagation +
-				 ksr->retiresafety;
-			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
-		} else {
-			remove = ksr->ttlsig + ksr->propagation +
-				 ksr->retiresafety + ksr->signdelay;
-		}
+		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
+				       ksr->retiresafety + ksr->signdelay;
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -559,7 +523,10 @@ print_rdata(dns_rdataset_t *rrset) {
 static isc_stdtime_t
 print_dnskeys(dns_kasp_key_t *kaspkey, dns_ttl_t ttl, dns_dnsseckeylist_t *keys,
 	      isc_stdtime_t inception, isc_stdtime_t next_inception) {
+	bool ksk = dns_kasp_key_ksk(kaspkey);
+	bool zsk = dns_kasp_key_zsk(kaspkey);
 	char algstr[DNS_SECALG_FORMATSIZE];
+	char rolestr[4];
 	char timestr[26]; /* Minimal buf as per ctime_r() spec. */
 	dns_rdatalist_t *rdatalist = NULL;
 	dns_rdataset_t rdataset = DNS_RDATASET_INIT;
@@ -569,6 +536,13 @@ print_dnskeys(dns_kasp_key_t *kaspkey, dns_ttl_t ttl, dns_dnsseckeylist_t *keys,
 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));
 	dns_secalg_format(dns_kasp_key_algorithm(kaspkey), algstr,
 			  sizeof(algstr));
+	if (ksk && zsk) {
+		snprintf(rolestr, sizeof(rolestr), "csk");
+	} else if (ksk) {
+		snprintf(rolestr, sizeof(rolestr), "ksk");
+	} else {
+		snprintf(rolestr, sizeof(rolestr), "zsk");
+	}

 	/* Fetch matching key pair. */
 	rdatalist = isc_mem_get(mctx, sizeof(*rdatalist));
@@ -624,8 +598,8 @@ print_dnskeys(dns_kasp_key_t *kaspkey, dns_ttl_t ttl, dns_dnsseckeylist_t *keys,
 	}
 	/* Error if no key pair found. */
 	if (ISC_LIST_EMPTY(rdatalist->rdata)) {
-		fatal("no %s/%s zsk key pair found for bundle %s", namestr,
-		      algstr, timestr);
+		fatal("no %s/%s %s key pair found for bundle %s", namestr,
+		      algstr, rolestr, timestr);
 	}

 	/* All good, print DNSKEY RRset. */
@@ -637,20 +611,19 @@ fail:
 	freerrset(&rdataset);

 	if (ret != ISC_R_SUCCESS) {
-		fatal("failed to print %s/%s zsk key pair found for bundle %s",
-		      namestr, algstr, timestr);
+		fatal("failed to print %s/%s %s key pair found for bundle %s",
+		      namestr, algstr, rolestr, timestr);
 	}

 	return (next_bundle);
 }

-static isc_stdtime_t
+static void
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
-	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -694,25 +667,6 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

-		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
-
-		/* Determine next bundle. */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
-		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(act, inception, next_bundle);
-		next_bundle = between(inact, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
-
-		if (act > inception) {
-			continue;
-		}
-		if (inact != 0 && inception >= inact) {
-			continue;
-		}
-
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -734,30 +688,15 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
-
-	return (next_bundle);
 }

-/*
- * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
- * listed in 'keys'.
- */
-static isc_stdtime_t
-get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
-		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-		dns_rdataset_t *cdsset) {
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
-	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
+static void
+create_cds(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
+	   dns_rdataset_t *cdnskeyset, dns_rdataset_t *cdsset) {
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	isc_stdtime_t next_bundle = next_inception;
-
-	dns_rdatalist_init(dnskeylist);
-	dnskeylist->rdclass = dns_rdataclass_in;
-	dnskeylist->type = dns_rdatatype_dnskey;
-	dnskeylist->ttl = ksr->ttl;
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);

 	dns_rdatalist_init(cdnskeylist);
 	cdnskeylist->rdclass = dns_rdataclass_in;
@@ -772,80 +711,18 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
-		bool published = true;
 		isc_buffer_t buf;
-		isc_buffer_t *newbuf;
-		dns_rdata_t *rdata;
+		isc_buffer_t *newbuf = NULL;
+		dns_rdata_t *rdata = NULL;
 		isc_region_t r;
 		isc_region_t rcds;
-		isc_stdtime_t pub = 0, del = 0;
-		unsigned char kskbuf[DST_KEY_MAXSIZE];
-		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
+		unsigned char rdatabuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

-		/* KSK */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
-
-		if (pub > inception) {
-			published = false;
-		}
-		if (del != 0 && inception >= del) {
-			published = false;
-		}
-
-		if (published) {
-			newbuf = NULL;
-			rdata = isc_mem_get(mctx, sizeof(*rdata));
-			dns_rdata_init(rdata);
-
-			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-			CHECK(dst_key_todns(dk->key, &buf));
-			isc_buffer_usedregion(&buf, &r);
-			isc_buffer_allocate(mctx, &newbuf, r.length);
-			isc_buffer_putmem(newbuf, r.base, r.length);
-			isc_buffer_usedregion(newbuf, &r);
-			dns_rdata_fromregion(rdata, dns_rdataclass_in,
-					     dns_rdatatype_dnskey, &r);
-			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-			ISC_LIST_APPEND(cleanup_list, newbuf, link);
-			isc_buffer_clear(newbuf);
-		}
-
-		published = true;
-		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
-			pub = 0;
-			del = 0;
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
-					      &pub);
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
-					      &del);
-
-			next_bundle = between(pub, inception, next_bundle);
-			next_bundle = between(del, inception, next_bundle);
-
-			if (pub != 0 && pub > inception) {
-				published = false;
-			}
-			if (del != 0 && inception >= del) {
-				published = false;
-			}
-		} else {
-			published = false;
-		}
-
-		if (!published) {
-			continue;
-		}
-
-		/* CDNSKEY */
-		newbuf = NULL;
 		rdata = isc_mem_get(mctx, sizeof(*rdata));
 		dns_rdata_init(rdata);

-		isc_buffer_init(&buf, cdnskeybuf, sizeof(cdnskeybuf));
+		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
 		CHECK(dst_key_todns(dk->key, &buf));
 		isc_buffer_usedregion(&buf, &r);
 		isc_buffer_allocate(mctx, &newbuf, r.length);
@@ -859,7 +736,6 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 		ISC_LIST_APPEND(cleanup_list, newbuf, link);
 		isc_buffer_clear(newbuf);

-		/* CDS */
 		for (dns_kasp_digest_t *alg = ISC_LIST_HEAD(digests);
 		     alg != NULL; alg = ISC_LIST_NEXT(alg, link))
 		{
@@ -889,101 +765,37 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 		}
 	}
 	/* All good */
-	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-
-	return (next_bundle);
+	return;

 fail:
-	fatal("failed to create KSK/CDS/CDNSKEY");
-	return (0);
+	fatal("failed to create CDS/CDNSKEY");
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
+sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
+	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 	    dns_dnsseckeylist_t *keys) {
-	isc_stdtime_t expiration = inception + ksr->sigvalidity;
-	isc_stdtime_t next_bundle = next_inception;
-	dns_rdataset_t zsk;
-
-	dns_rdataset_init(&zsk);
-	dns_rdatalist_tordataset(zsklist, &zsk);
+	dns_rdataset_t rrset = DNS_RDATASET_INIT;
+	isc_stdtime_t expiration;

+	dns_rdataset_init(&rrset);
+	dns_rdatalist_tordataset(rdatalist, &rrset);
+	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		isc_stdtime_t next_time = next_bundle;
-
-		/* DNSKEY RRset */
-		dns_rdatalist_t *dnskeylist;
-		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
-		dns_rdatalist_init(dnskeylist);
-		dnskeylist->rdclass = dns_rdataclass_in;
-		dnskeylist->type = dns_rdatatype_dnskey;
-		dnskeylist->ttl = ksr->ttl;
-
-		dns_rdataset_t ksk, cdnskey, cds, rrset;
-		dns_rdataset_init(&ksk);
-		dns_rdataset_init(&cdnskey);
-		dns_rdataset_init(&cds);
-		dns_rdataset_init(&rrset);
-		next_time = get_keymaterial(ksr, kasp, inception, next_time,
-					    keys, &ksk, &cdnskey, &cds);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
+		sign_rrset(ksr, inception, expiration, &rrset, keys);
+		if (dns_rdataset_count(cdnskey) > 0) {
+			sign_rrset(ksr, inception, expiration, cdnskey, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&ksk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&ksk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		if (dns_rdataset_count(cds) > 0) {
+			sign_rrset(ksr, inception, expiration, cds, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&zsk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&zsk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
-		}
-
-		dns_rdatalist_tordataset(dnskeylist, &rrset);
-		next_time = sign_rrset(ksr, inception, expiration, &rrset,
-				       keys);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
-		}
-		freerrset(&ksk);
-		freerrset(&rrset);
-
-		/* CDNSKEY */
-		if (dns_rdataset_count(&cdnskey) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
-					 keys);
-		}
-		freerrset(&cdnskey);
-
-		/* CDS */
-		if (dns_rdataset_count(&cds) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cds,
-					 keys);
-		}
-		freerrset(&cds);
-
-		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
-		if (inception > next_bundle) {
-			inception = next_bundle;
-		}
 		expiration = inception + ksr->sigvalidity;
-		next_bundle = expiration;
 	}
-
-	freerrset(&zsk);
+	freerrset(&rrset);
 }

 static isc_result_t
@@ -1070,12 +882,9 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
+		if (dns_kasp_key_ksk(kk)) {
 			/* only ZSKs allowed */
 			continue;
-		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
-			/* only KSKs allowed */
-			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -1086,7 +895,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_key(ksr, kasp, kk, &keys, inception, act, &act);
+			create_zsk(ksr, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -1094,7 +903,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("no keys created for policy '%s'", ksr->policy);
+		fatal("policy '%s' has no zsks", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1147,11 +956,6 @@ request(ksr_ctx_t *ksr) {
 			 * or withdrawal of a key that is after the current
 			 * inception.
 			 */
-			if (dns_kasp_key_ksk(kk)) {
-				/* We only want ZSKs in the request. */
-				continue;
-			}
-
 			next = print_dnskeys(kk, ksr->ttl, &keys, inception,
 					     next);
 		}
@@ -1159,8 +963,8 @@ request(ksr_ctx_t *ksr) {
 	}

 	isc_stdtime_tostring(ksr->now, timestr, sizeof(timestr));
-	fprintf(stdout, ";; KeySigningRequest 1.0 generated at %s by %s\n",
-		timestr, PACKAGE_VERSION);
+	fprintf(stdout, ";; KeySigningRequest generated at %s by %s\n", timestr,
+		PACKAGE_VERSION);

 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1173,6 +977,8 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
+	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
+	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1205,6 +1011,9 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

+	/* CDS and CDNSKEY */
+	create_cds(ksr, kasp, &keys, &cdnskey, &cds);
+
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1232,30 +1041,28 @@ sign(ksr_ctx_t *ksr) {
 				      ksr->file, isc_lex_getsourceline(lex));
 			}

-			if (strcmp(STR(token), "1.0") != 0) {
+			if (strcmp(STR(token), "generated") == 0) {
+				/* Final bundle */
+				goto readline;
+			} else if (strcmp(STR(token), "1.0") != 0) {
 				fatal("bad KSR file %s(%lu): expected version",
 				      ksr->file, isc_lex_getsourceline(lex));
 			}
-
+			/* Date and time of bundle */
 			CHECK(isc_lex_gettoken(lex, opt, &token));
 			if (token.type != isc_tokentype_string) {
 				fatal("bad KSR file %s(%lu): expected datetime",
 				      ksr->file, isc_lex_getsourceline(lex));
 			}
-			if (strcmp(STR(token), "generated") == 0) {
-				/* Final bundle */
-				goto readline;
-			}

-			/* Date and time of bundle */
 			sscanf(STR(token), "%s", bundle);
 			next_inception = strtotime(bundle, ksr->now, ksr->now,
 						   NULL);

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, kasp, inception,
-					    next_inception, rdatalist, &keys);
+				sign_bundle(ksr, inception, next_inception,
+					    rdatalist, &cds, &cdnskey, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1264,8 +1071,7 @@ sign(ksr_ctx_t *ksr) {
 			dns_rdatalist_init(rdatalist);
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
-			rdatalist->ttl = ksr->ttl;
-
+			rdatalist->ttl = TTL_MAX;
 			inception = next_inception;
 			have_bundle = true;

@@ -1283,7 +1089,7 @@ sign(ksr_ctx_t *ksr) {
 			} while (token.type != isc_tokentype_eol);
 		} else {
 			/* Parse DNSKEY */
-			dns_ttl_t ttl = ksr->ttl;
+			dns_ttl_t ttl = TTL_MAX;
 			isc_buffer_t buf;
 			isc_buffer_t *newbuf = NULL;
 			dns_rdata_t *rdata = NULL;
@@ -1324,7 +1130,8 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
+		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
+			    &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1336,6 +1143,10 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
+	/* Clean up */
+	freerrset(&cds);
+	freerrset(&cdnskey);
+
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1347,7 +1158,7 @@ main(int argc, char *argv[]) {
 	int ch;
 	char *endp;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif
 	ksr_ctx_t ksr = {
@@ -1358,11 +1169,11 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'e':
 			ksr.end = strtotime(isc_commandline_argument, ksr.now,
@@ -1395,9 +1206,6 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
-		case 'o':
-			ksr.ksk = true;
-			break;
 		case 'V':
 			version(program);
 			break;
@@ -1419,18 +1227,23 @@ main(int argc, char *argv[]) {
 		fatal("must provide a command and zone name");
 	}

+	ret = dst_lib_init(mctx, engine);
+	if (ret != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s", isc_result_totext(ret));
+	}
+
 	/*
-	 * The DST subsystem will set FIPS mode if requested at build time.
-	 * The minimum sizes are both raised to 2048.
+	 * After dst_lib_init which will set FIPS mode if requested
+	 * at build time.  The minumums are both raised to 2048.
 	 */
 	if (isc_fips_mode()) {
 		min_rsa = min_dh = 2048;
 	}

-	setup_logging();
+	setup_logging(mctx, &lctx);

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			fatal("Failed to load FIPS provider");
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -40,6 +40,14 @@ server.
 Options
 ~~~~~~~

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -e date/offset

   This option sets the end date for which keys or SKRs need to be generated
@@ -51,10 +59,6 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

-.. option:: -f
-
-   This option sets the SKR file to be signed when issuing a ``sign`` command.
-
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -80,11 +84,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

-.. option:: -o
-
-   Normally when pregenerating keys, ZSKs are created. When this option is
-   set, create KSKs instead.
-
 .. option:: -V

   This option prints version information.
@@ -107,20 +106,18 @@ Commands

 .. option:: keygen

-  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
-  number of generated keys depends on the interval and the key lifetime.
+  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
+  an interval. The number of generated keys depends on the interval and the
+  ZSK lifetime.

 .. option:: request

  Create a Key Signing Request (KSR), given a DNSSEC policy and an interval.
-  This will generate a file with a number of key bundles, where each bundle
-  contains the currently published ZSKs (according to the timing metadata).

 .. option:: sign

  Sign a Key Signing Request (KSR), given a DNSSEC policy and an interval,
-  creating a Signed Key Response (SKR). This will add the corresponding DNSKEY,
-  CDS, and CDNSKEY records for the KSK that is being used for signing.
+  creating a Signed Key Response (SKR).

 Exit Status
 ~~~~~~~~~~~
@@ -131,7 +128,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate ZSKs for the zone "example.com" for the next year,
+When you need to generate keys for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -144,8 +141,7 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to
-the KSK.
+Typically you would now transfer the KSR to the system that has access to the KSK.

 Signing the KSR created above can be done with:

@@ -153,8 +149,7 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those
-in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -38,7 +38,7 @@ const char *program = "dnssec-revoke";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -46,6 +46,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
+	fprintf(stderr, "    -E engine:    specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:           force overwrite\n");
 	fprintf(stderr, "    -h:           help\n");
 	fprintf(stderr, "    -K directory: use directory for key files\n");
@@ -63,6 +64,7 @@ usage(void) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	char const *filename = NULL;
 	char *dir = NULL;
 	char newname[1024], oldname[1024];
@@ -87,7 +89,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -157,6 +159,12 @@ main(int argc, char **argv) {
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	result = dst_key_fromnamedfile(
 		filename, dir, DST_TYPE_PUBLIC | DST_TYPE_PRIVATE, mctx, &key);
 	if (result != ISC_R_SUCCESS) {
@@ -240,6 +248,7 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-revoke - set the REVOKED bit on a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-f**] [**-R**] {keyfile}
+:program:`dnssec-revoke` [**-hr**] [**-v** level] [**-V**] [**-K** directory] [**-E** engine] [**-f**] [**-R**] {keyfile}

 Description
 ~~~~~~~~~~~
@@ -53,6 +53,14 @@ Options

   This option prints version information.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option indicates a forced overwrite and causes :program:`dnssec-revoke` to write the new key pair,
@@ -25,7 +25,6 @@
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/hash.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -33,6 +32,7 @@
 #include <isc/util.h>

 #include <dns/keyvalues.h>
+#include <dns/log.h>

 #include <dst/dst.h>

@@ -42,7 +42,7 @@ const char *program = "dnssec-settime";

 static isc_mem_t *mctx = NULL;

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -51,6 +51,7 @@ usage(void) {
 	fprintf(stderr, "    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", PACKAGE_VERSION);
 	fprintf(stderr, "General options:\n");
+	fprintf(stderr, "    -E engine:          specify OpenSSL engine\n");
 	fprintf(stderr, "    -f:                 force update of old-style "
 			"keys\n");
 	fprintf(stderr, "    -K directory:       set key file location\n");
@@ -185,6 +186,7 @@ writekey(dst_key_t *key, const char *directory, bool write_state) {
 int
 main(int argc, char **argv) {
 	isc_result_t result;
+	const char *engine = NULL;
 	const char *filename = NULL;
 	char *directory = NULL;
 	char keystr[DST_KEY_FORMATSIZE];
@@ -226,6 +228,7 @@ main(int argc, char **argv) {
 	bool epoch = false;
 	bool changed = false;
 	bool write_state = false;
+	isc_log_t *log = NULL;
 	isc_stdtime_t syncadd = 0, syncdel = 0;
 	bool unsetsyncadd = false, setsyncadd = false;
 	bool unsetsyncdel = false, setsyncdel = false;
@@ -244,7 +247,7 @@ main(int argc, char **argv) {

 	isc_mem_create(&mctx);

-	setup_logging();
+	setup_logging(mctx, &log);

 	isc_commandline_errprint = false;

@@ -311,7 +314,7 @@ main(int argc, char **argv) {
 					   &setdstime);
 			break;
 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;
 		case 'f':
 			force = true;
@@ -552,6 +555,12 @@ main(int argc, char **argv) {
 		fatal("Options -g, -d, -k, -r and -z require -s to be set");
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("Could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	if (predecessor != NULL) {
 		int major, minor;

@@ -943,9 +952,11 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);
 	}
 	dst_key_free(&key);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
+	cleanup_logging(&log);
 	isc_mem_free(mctx, directory);
 	isc_mem_destroy(&mctx);

@@ -21,7 +21,7 @@ dnssec-settime: set the key timing metadata for a DNSSEC key
 Synopsis
 ~~~~~~~~

-:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]
+:program:`dnssec-settime` [**-f**] [**-K** directory] [**-L** ttl] [**-P** date/offset] [**-P** ds date/offset] [**-P** sync date/offset] [**-A** date/offset] [**-R** date/offset] [**-I** date/offset] [**-D** date/offset] [**-D** ds date/offset] [**-D** sync date/offset] [**-S** key] [**-i** interval] [**-h**] [**-V**] [**-v** level] [**-E** engine] {keyfile} [**-s**] [**-g** state] [**-d** state date/offset] [**-k** state date/offset] [**-r** state date/offset] [**-z** state date/offset]

 Description
 ~~~~~~~~~~~
@@ -97,6 +97,14 @@ Options

   This option sets the debugging level.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 Timing Options
 ~~~~~~~~~~~~~~

@@ -45,7 +45,6 @@
 #include <isc/fips.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/managers.h>
 #include <isc/md.h>
@@ -71,6 +70,7 @@
 #include <dns/fixedname.h>
 #include <dns/kasp.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -88,7 +88,7 @@
 #include <dns/zoneverify.h>

 #include <dst/dst.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -140,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
-static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
+static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
+static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock;
+static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -182,9 +182,11 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)                               \
-	if (printstats) {                              \
-		atomic_fetch_add_relaxed(&counter, 1); \
+#define INCSTAT(counter)            \
+	if (printstats) {           \
+		LOCK(&statslock);   \
+		counter++;          \
+		UNLOCK(&statslock); \
 	}

 /*%
@@ -318,8 +320,9 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	}

 	tuple = NULL;
-	dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &trdata,
-			     &tuple);
+	result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+				      &trdata, &tuple);
+	check_result(result, "dns_difftuple_create");
 	dns_diff_append(add, &tuple);
 }

@@ -631,20 +634,24 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 			if (sigset.ttl != ttl) {
 				vbprintf(2, "\tfixing ttl %s\n", sigstr);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, sigset.ttl,
-						     &sigrdata, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					sigset.ttl, &sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, ttl, &sigrdata,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name, ttl,
+					&sigrdata, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		} else {
 			tuple = NULL;
 			vbprintf(2, "\tremoving signature by %s\n", sigstr);
-			dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN, name,
-					     sigset.ttl, &sigrdata, &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_DELRESIGN, name, sigset.ttl,
+				&sigrdata, &tuple);
+			check_result(result, "dns_difftuple_create");
 			dns_diff_append(del, &tuple);
 			INCSTAT(ndropped);
 		}
@@ -1073,8 +1080,9 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 					   dsbuf, &ds);
 		check_result(result, "dns_ds_buildrdata");

-		dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name, ttl, &ds,
-				     &tuple);
+		result = dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
+					      ttl, &ds, &tuple);
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -1159,7 +1167,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 * Signs all records at a name.
 */
 static void
-signname(dns_dbnode_t *node, bool apex, dns_name_t *name) {
+signname(dns_dbnode_t *node, dns_name_t *name) {
 	isc_result_t result;
 	dns_rdataset_t rdataset;
 	dns_rdatasetiter_t *rdsiter;
@@ -1210,10 +1218,6 @@ signname(dns_dbnode_t *node, bool apex, dns_name_t *name) {
 			dns_name_format(name, namebuf, sizeof(namebuf));
 			fatal("'%s': found DS RRset without NS RRset\n",
 			      namebuf);
-		} else if (rdataset.type == dns_rdatatype_dnskey && !apex) {
-			char namebuf[DNS_NAME_FORMATSIZE];
-			dns_name_format(name, namebuf, sizeof(namebuf));
-			fatal("'%s': Non-apex DNSKEY RRset\n", namebuf);
 		}

 		signset(&del, &add, node, name, &rdataset);
@@ -1533,7 +1537,7 @@ signapex(void) {
 	check_result(result, "dns_dbiterator_seek()");
 	result = dns_dbiterator_current(gdbiter, &node, name);
 	check_dns_dbiterator_current(result);
-	signname(node, true, name);
+	signname(node, name);
 	dumpnode(name, node);
 	dns_db_detachnode(gdb, &node);
 	result = dns_dbiterator_first(gdbiter);
@@ -1662,7 +1666,7 @@ assignwork(void *arg) {

 	UNLOCK(&namelock);

-	signname(node, false, dns_fixedname_name(&fname));
+	signname(node, dns_fixedname_name(&fname));

 	/*%
 	 * Write a node to the output file, and restart the worker task.
@@ -2193,9 +2197,10 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 			{
 				vbprintf(2, "removing duplicate at %s/%s\n",
 					 namestr, typestr);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 			} else if (set_maxttl && rdataset->ttl > maxttl) {
 				vbprintf(2,
@@ -2203,14 +2208,16 @@ rrset_cleanup(dns_name_t *name, dns_rdataset_t *rdataset, dns_diff_t *add,
 					 "from %d to %d\n",
 					 namestr, typestr, rdataset->ttl,
 					 maxttl);
-				dns_difftuple_create(mctx, DNS_DIFFOP_DELRESIGN,
-						     name, rdataset->ttl,
-						     &rdata2, &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_DELRESIGN, name,
+					rdataset->ttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(del, &tuple);
 				tuple = NULL;
-				dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-						     name, maxttl, &rdata2,
-						     &tuple);
+				result = dns_difftuple_create(
+					mctx, DNS_DIFFOP_ADDRESIGN, name,
+					maxttl, &rdata2, &tuple);
+				check_result(result, "dns_difftuple_create");
 				dns_diff_append(add, &tuple);
 			}
 		}
@@ -3143,13 +3150,15 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 						   DNS_DSDIGEST_SHA256, dsbuf,
 						   &ds);
 			check_result(result, "dns_ds_buildrdata");
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN, name,
-					     0, &ds, &tuple);
+			result = dns_difftuple_create(mctx,
+						      DNS_DIFFOP_ADDRESIGN,
+						      name, 0, &ds, &tuple);
 		} else {
-			dns_difftuple_create(mctx, DNS_DIFFOP_ADDRESIGN,
-					     gorigin, zone_soa_min_ttl, &rdata,
-					     &tuple);
+			result = dns_difftuple_create(
+				mctx, DNS_DIFFOP_ADDRESIGN, gorigin,
+				zone_soa_min_ttl, &rdata, &tuple);
 		}
+		check_result(result, "dns_difftuple_create");
 		dns_diff_append(&diff, &tuple);
 	}

@@ -3199,7 +3208,7 @@ print_version(FILE *fp) {
 	fprintf(fp, "; %s version %s\n", program, PACKAGE_VERSION);
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -3261,6 +3270,8 @@ usage(void) {
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3307,24 +3318,21 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
-		atomic_load(&nsigned));
-	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
-		atomic_load(&nretained));
-	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
-		atomic_load(&ndropped));
-	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
-		atomic_load(&nverified));
-	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
-		atomic_load(&nverifyfailed));
+	fprintf(out, "Signatures generated:               %10u\n", nsigned);
+	fprintf(out, "Signatures retained:                %10u\n", nretained);
+	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
+	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
+	fprintf(out,
+		"Signatures unsuccessfully "
+		"verified: %10u\n",
+		nverifyfailed);

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
-			 time_us;
+		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -3351,6 +3359,8 @@ main(int argc, char *argv[]) {
 	isc_time_t sign_start, sign_finish;
 	dns_dnsseckey_t *key;
 	isc_result_t result, vresult;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	bool free_output = false;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3361,7 +3371,7 @@ main(int argc, char *argv[]) {
 	bool set_iter = false;
 	bool nonsecify = false;
 	bool set_fips_mode = false;
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -3458,7 +3468,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'e':
@@ -3725,7 +3735,7 @@ main(int argc, char *argv[]) {
 	isc_managers_create(&mctx, nloops, &loopmgr, &netmgr);

 	if (set_fips_mode) {
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 		fips = OSSL_PROVIDER_load(NULL, "fips");
 		if (fips == NULL) {
 			ERR_clear_error();
@@ -3745,7 +3755,13 @@ main(int argc, char *argv[]) {
 		}
 	}

-	setup_logging();
+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -4027,6 +4043,10 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}
+
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4112,11 +4132,13 @@ main(int argc, char *argv[]) {

 	dns_master_styledestroy(&dsstyle, mctx);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -4131,6 +4153,7 @@ main(int argc, char *argv[]) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -62,6 +62,15 @@ Options
   ``$INCLUDE``. This option cannot be combined with :option:`-O raw <-O>`
   or serial-number updating.

+.. option:: -E engine
+
+   This option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -F

   This options turns on FIPS (US Federal Information Processing Standards)
@@ -80,11 +89,6 @@ Options
   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
   Only works in combination with smart signing (``-S``).

-.. option:: -J filename
-
-   This option tells :program:`dnssec-signzone` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -K directory

   This option specifies the directory to search for DNSSEC keys. If not
@@ -269,7 +273,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").
+   :rfc:`4641#4.2.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -286,7 +290,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`4641#4.2.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -370,7 +374,6 @@ Options

   .. note::
      ``-3 -`` is the recommended configuration. Adding salt provides no practical benefits.
-      See :rfc:`9276`.

 .. option:: -H iterations

@@ -379,7 +382,6 @@ Options

   .. warning::
      Values greater than 0 cause interoperability issues and also increase the risk of CPU-exhausting DoS attacks.
-      See :rfc:`9276`.

 .. option:: -A

@@ -388,7 +390,6 @@ Options

   .. warning::
      Do not use this option unless all its implications are fully understood. This option is intended only for extremely large zones (comparable to ``com.``) with sparse secure delegations.
-      See :rfc:`9276`.

 .. option:: -AA

@@ -442,4 +443,4 @@ See Also
 ~~~~~~~~

 :iscman:`dnssec-keygen(8) <dnssec-keygen>`, BIND 9 Administrator Reference Manual, :rfc:`4033`,
-:rfc:`6781`.
+:rfc:`4641`.
@@ -23,7 +23,6 @@
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/mutex.h>
 #include <isc/os.h>
@@ -43,6 +42,7 @@
 #include <dns/ds.h>
 #include <dns/fixedname.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/master.h>
 #include <dns/masterdump.h>
 #include <dns/nsec.h>
@@ -136,7 +136,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 	}
 }

-ISC_NORETURN static void
+noreturn static void
 usage(void);

 static void
@@ -157,6 +157,8 @@ usage(void) {
 	fprintf(stderr, "\t-I format:\n");
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
+	fprintf(stderr, "\t-E engine:\n");
+	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 	fprintf(stderr, "\t-x:\tDNSKEY record signed with KSKs only, "
 			"not ZSKs\n");
 	fprintf(stderr, "\t-z:\tAll records signed with KSKs\n");
@@ -168,6 +170,8 @@ main(int argc, char *argv[]) {
 	char *origin = NULL, *file = NULL;
 	char *inputformatstr = NULL;
 	isc_result_t result;
+	isc_log_t *log = NULL;
+	const char *engine = NULL;
 	char *classname = NULL;
 	dns_rdataclass_t rdclass;
 	char *endp;
@@ -211,7 +215,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'E':
-			fatal("%s", isc_result_totext(DST_R_NOENGINE));
+			engine = isc_commandline_argument;
 			break;

 		case 'I':
@@ -271,11 +275,17 @@ main(int argc, char *argv[]) {
 		}
 	}

+	result = dst_lib_init(mctx, engine);
+	if (result != ISC_R_SUCCESS) {
+		fatal("could not initialize dst: %s",
+		      isc_result_totext(result));
+	}
+
 	now = isc_stdtime_now();

 	rdclass = strtoclass(classname);

-	setup_logging();
+	setup_logging(mctx, &log);

 	argc -= isc_commandline_index;
 	argv += isc_commandline_index;
@@ -325,6 +335,8 @@ main(int argc, char *argv[]) {
 	dns_db_closeversion(gdb, &gversion, false);
 	dns_db_detach(&gdb);

+	cleanup_logging(&log);
+	dst_lib_destroy();
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -37,6 +37,14 @@ Options

   This option specifies the DNS class of the zone.

+.. option:: -E engine
+
+   This option specifies the cryptographic hardware to use, when applicable.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are ``text``
@@ -45,11 +53,6 @@ Options
   format containing updates can be verified independently.
   This option is not useful for non-dynamic zones.

-.. option:: -J filename
-
-   This option tells :program:`dnssec-verify` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -o origin

   This option indicates the zone origin. If not specified, the name of the zone file is
@@ -29,7 +29,6 @@
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -44,6 +43,7 @@
 #include <dns/fixedname.h>
 #include <dns/journal.h>
 #include <dns/keyvalues.h>
+#include <dns/log.h>
 #include <dns/name.h>
 #include <dns/nsec.h>
 #include <dns/nsec3.h>
@@ -128,8 +128,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size) {
 }

 void
-setup_logging(void) {
+setup_logging(isc_mem_t *mctx, isc_log_t **logp) {
+	isc_logdestination_t destination;
 	isc_logconfig_t *logconfig = NULL;
+	isc_log_t *log = NULL;
 	int level;

 	if (verbose < 0) {
@@ -151,8 +153,10 @@ setup_logging(void) {
 		break;
 	}

-	logconfig = isc_logconfig_get();
-
+	isc_log_create(mctx, &log, &logconfig);
+	isc_log_setcontext(log);
+	dns_log_init(log);
+	dns_log_setcontext(log);
 	isc_log_settag(logconfig, program);

 	/*
@@ -161,11 +165,36 @@ setup_logging(void) {
 	 *  - the program name and logging level are printed
 	 *  - no time stamp is printed
 	 */
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, level,
-		ISC_LOGDESTINATION_STDERR,
-		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	destination.file.stream = stderr;
+	destination.file.name = NULL;
+	destination.file.versions = ISC_LOG_ROLLNEVER;
+	destination.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC, level,
+			      &destination,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+
+	RUNTIME_CHECK(isc_log_usechannel(logconfig, "stderr", NULL, NULL) ==
+		      ISC_R_SUCCESS);
+
+	*logp = log;
+}
+
+void
+cleanup_logging(isc_log_t **logp) {
+	isc_log_t *log;
+
+	REQUIRE(logp != NULL);
+
+	log = *logp;
+	*logp = NULL;
+
+	if (log == NULL) {
+		return;
+	}
+
+	isc_log_destroy(&log);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
 }

 static isc_stdtime_t
@@ -450,7 +479,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+	      isc_mem_t *mctx, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -468,21 +497,6 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

-	if (min != max) {
-		if (id < min || id > max) {
-			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
-				min, max);
-			return (true);
-		}
-		if (rid < min || rid > max) {
-			fprintf(stderr,
-				"Revoked Key ID %d (for tag %d) outside of "
-				"[%u..%u]\n",
-				rid, id, min, max);
-			return (true);
-		}
-	}
-
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
@@ -590,8 +604,9 @@ cleanup:
 }

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp) {
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp) {
 	isc_result_t result = ISC_R_NOTFOUND;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *kasps = NULL;
@@ -610,7 +625,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	{
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		ks = NULL;
-		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
+		result = cfg_keystore_fromconfig(kconfig, mctx, lctx, engine,
+						 &kslist, NULL);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure key-store '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -619,7 +635,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	}
 	/* Default key-directory key store. */
 	ks = NULL;
-	(void)cfg_keystore_fromconfig(NULL, mctx, &kslist, &ks);
+	(void)cfg_keystore_fromconfig(NULL, mctx, lctx, engine, &kslist, &ks);
 	INSIST(ks != NULL);
 	if (keydir != NULL) {
 		/* '-K keydir' takes priority */
@@ -639,8 +655,8 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 			continue;
 		}

-		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, &kslist,
-					     &kasplist, &kasp);
+		result = cfg_kasp_fromconfig(kconfig, NULL, true, mctx, lctx,
+					     &kslist, &kasplist, &kasp);
 		if (result != ISC_R_SUCCESS) {
 			fatal("failed to configure dnssec-policy '%s': %s",
 			      cfg_obj_asstring(cfg_tuple_get(kconfig, "name")),
@@ -54,7 +54,7 @@ extern uint8_t dtype[8];

 typedef void(fatalcallback_t)(void);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -66,7 +66,7 @@ check_result(isc_result_t result, const char *message);
 void
 vbprintf(int level, const char *fmt, ...) ISC_FORMAT_PRINTF(2, 3);

-ISC_NORETURN void
+noreturn void
 version(const char *program);

 void
@@ -75,7 +75,10 @@ sig_format(dns_rdata_rrsig_t *sig, char *cp, unsigned int size);
 	(DNS_NAME_FORMATSIZE + DNS_SECALG_FORMATSIZE + sizeof("65535"))

 void
-setup_logging(void);
+setup_logging(isc_mem_t *mctx, isc_log_t **logp);
+
+void
+cleanup_logging(isc_log_t **logp);

 dns_ttl_t
 strtottl(const char *str);
@@ -106,7 +109,7 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);
+	      isc_mem_t *mctx, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
@@ -115,5 +118,6 @@ void
 loadjournal(isc_mem_t *mctx, dns_db_t *db, const char *journal);

 void
-kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
-	       const char *keydir, dns_kasp_t **kaspp);
+kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, isc_log_t *lctx,
+	       const char *name, const char *keydir, const char *engine,
+	       dns_kasp_t **kaspp);
@@ -529,17 +529,13 @@ authors_lookup(bdbnode_t *node) {
 	isc_result_t result;
 	const char **p = NULL;
 	static const char *authors[] = {
-		"Mark Andrews",	      "Curtis Blackburn",
-		"James Brister",      "Ben Cottrell",
-		"John H. DuBois III", "Francis Dupont",
-		"Michael Graff",      "Andreas Gustafsson",
-		"Bob Halley",	      "Evan Hunt",
-		"JINMEI Tatuya",      "Witold Krecicki",
-		"David Lawrence",     "Scott Mann",
-		"Danny Mayer",	      "Aydin Mercan",
-		"Damien Neil",	      "Matt Nelson",
-		"Jeremy C. Reed",     "Michael Sawyer",
-		"Brian Wellington",   NULL
+		"Mark Andrews",	  "Curtis Blackburn",	"James Brister",
+		"Ben Cottrell",	  "John H. DuBois III", "Francis Dupont",
+		"Michael Graff",  "Andreas Gustafsson", "Bob Halley",
+		"Evan Hunt",	  "JINMEI Tatuya",	"Witold Krecicki",
+		"David Lawrence", "Scott Mann",		"Danny Mayer",
+		"Damien Neil",	  "Matt Nelson",	"Jeremy C. Reed",
+		"Michael Sawyer", "Brian Wellington",	NULL
 	};

 	/*
@@ -63,6 +63,7 @@ options {\n\
 	geoip-directory \".\";\n"
 #endif /* if defined(HAVE_GEOIP2) */
 			    "\
+	heartbeat-interval 60;\n\
 	interface-interval 60;\n\
 	listen-on {any;};\n\
 	listen-on-v6 {any;};\n\
@@ -95,12 +96,10 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
-#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	resolver-query-timeout 10;\n\
-#	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -110,7 +109,6 @@ options {\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
-	sig0checks-quota 1;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -152,6 +150,9 @@ options {\n\
 	clients-per-query 10;\n\
 	dnssec-accept-expired no;\n\
 	dnssec-validation " VALIDATION_DEFAULT "; \n"
+#ifdef USE_DNSRPS
+			    "	dnsrps-library \"" DNSRPS_LIBRPZ_PATH "\";\n"
+#endif /* ifdef USE_DNSRPS */
 #ifdef HAVE_DNSTAP
 			    "	dnstap-identity hostname;\n"
 #endif /* ifdef HAVE_DNSTAP */
@@ -168,8 +169,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 32;\n\
-	max-query-restarts 11;\n\
+	max-recursion-queries 100;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -188,7 +188,6 @@ options {\n\
 	recursion true;\n\
 	request-expire true;\n\
 	request-ixfr true;\n\
-	request-ixfr-max-diffs 0;\n\
 	require-server-cookie no;\n\
 	root-key-sentinel yes;\n\
 	servfail-ttl 1;\n\
@@ -208,13 +207,14 @@ options {\n\
 	/* zone */\n\
 	allow-query {any;};\n\
 	allow-query-on {any;};\n\
-	allow-transfer {none;};\n\
+	allow-transfer {any;};\n\
 #	also-notify <none>\n\
 	check-integrity yes;\n\
 	check-mx-cname warn;\n\
 	check-sibling yes;\n\
 	check-srv-cname warn;\n\
 	check-wildcard yes;\n\
+	dialup no;\n\
 	dnssec-loadkeys-interval 60;\n\
 #	forward <none>\n\
 #	forwarders <none>\n\
@@ -222,10 +222,8 @@ options {\n\
 	ixfr-from-differences false;\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
-	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
-	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
@@ -236,7 +234,6 @@ options {\n\
 	notify yes;\n\
 	notify-delay 5;\n\
 	notify-to-soa no;\n\
-	send-report-channel .;\n\
 	serial-update-method increment;\n\
 	sig-signing-nodes 100;\n\
 	sig-signing-signatures 10;\n\
@@ -298,7 +295,6 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
-	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -356,9 +352,7 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {
 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
 	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				 CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					 CFG_PCTX_NOEXPERIMENTAL,
-				 conf));
+				 CFG_PCTX_NODEPRECATED, conf));
 }

 const char *
@@ -451,8 +445,8 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 	r.length = strlen(r.base);
 	result = dns_rdataclass_fromtext(classp, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(classobj, ISC_LOG_ERROR, "unknown class '%s'",
-			    r.base);
+		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown class '%s'", r.base);
 	}
 	return (result);
 }
@@ -471,8 +465,8 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 	r.length = strlen(r.base);
 	result = dns_rdatatype_fromtext(typep, &r);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(typeobj, ISC_LOG_ERROR, "unknown type '%s'",
-			    r.base);
+		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
+			    "unknown type '%s'", r.base);
 	}
 	return (result);
 }
@@ -663,7 +657,7 @@ newlist:
 	if (cfg_obj_isuint32(portobj)) {
 		uint32_t val = cfg_obj_asuint32(portobj);
 		if (val > UINT16_MAX) {
-			cfg_obj_log(portobj, ISC_LOG_ERROR,
+			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
 			goto cleanup;
@@ -718,7 +712,7 @@ resume:
 			tresult = named_config_getremotesdef(config, listtype,
 							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
-				cfg_obj_log(addr, ISC_LOG_ERROR,
+				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
 					    "%s \"%s\" not found", listtype,
 					    listname);

@@ -890,7 +884,8 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	result = named_config_get(maps, type, &portobj);
 	INSIST(result == ISC_R_SUCCESS);
 	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
-		cfg_obj_log(portobj, ISC_LOG_ERROR, "port '%u' out of range",
+		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
+			    "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
 		return (ISC_R_RANGE);
 	}
@@ -16,7 +16,6 @@
 #include <stdbool.h>

 #include <isc/lex.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/string.h>
@@ -135,7 +134,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	    !command_compare(command, NAMED_COMMAND_TESTGEN) &&
 	    !command_compare(command, NAMED_COMMAND_ZONESTATUS))
 	{
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, log_level,
 			      "rejecting restricted control channel "
 			      "command '%s'",
@@ -144,9 +143,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		goto cleanup;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      log_level, "received control channel command '%s'",
-		      cmdline);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, log_level,
+		      "received control channel command '%s'", cmdline);

 	/*
 	 * After the lengthy "halt" and "stop", the commands are
@@ -202,9 +201,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		   command_compare(command, NAMED_COMMAND_MODZONE))
 	{
 		result = named_server_changezone(named_g_server, cmdline, text);
-	} else if (command_compare(command, NAMED_COMMAND_CLOSELOGS)) {
-		isc_log_closefilelogs();
-		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DELZONE)) {
 		result = named_server_delzone(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DNSSEC)) {
@@ -214,7 +210,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		result = named_server_dumpdb(named_g_server, lex, text);
+		named_server_dumpdb(named_g_server, lex, text);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -227,8 +224,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
-		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
@@ -239,16 +234,14 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_notifycommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTRACE)) {
 		named_g_debuglevel = 0;
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_NTA)) {
 		result = named_server_nta(named_g_server, lex, readonly, text);
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "query logging",
-						  NS_SERVER_LOGQUERIES, lex);
+		result = named_server_togglequerylog(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -257,10 +250,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "response logging",
-						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -294,7 +283,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_ZONESTATUS)) {
 		result = named_server_zonestatus(named_g_server, lex, text);
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "unknown control channel command '%s'", command);
 		result = DNS_R_UNKNOWNCOMMAND;
@@ -225,9 +225,9 @@ shutdown_listener(controllistener_t *listener) {

 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "stopping command channel on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+		      "stopping command channel on %s", socktext);

 	isc_nm_stoplistening(listener->sock);
 	isc_nmsocket_close(&listener->sock);
@@ -272,7 +272,7 @@ control_senddone(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(handle);

 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "error sending command response to %s: %s",
 			      socktext, isc_result_totext(result));
@@ -291,8 +291,9 @@ log_invalid(isccc_ccmsg_t *ccmsg, isc_result_t result) {
 	isc_sockaddr_t peeraddr = isc_nmhandle_peeraddr(ccmsg->handle);

 	isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_ERROR, "invalid command from %s: %s", socktext,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_ERROR,
+		      "invalid command from %s: %s", socktext,
 		      isc_result_totext(result));
 }

@@ -587,8 +588,9 @@ conn_free(controlconnection_t *conn) {
 	}
 #endif /* ifdef ENABLE_AFL */

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "freeing control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "freeing control connection");

 	isc_mem_put(listener->mctx, conn, sizeof(*conn));

@@ -599,7 +601,7 @@ static void
 newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	/* Don't create new connection if we are shutting down */
 	if (listener->shuttingdown) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
 			      "rejected new control connection: %s",
 			      isc_result_totext(ISC_R_SHUTTINGDOWN));
@@ -607,8 +609,9 @@ newconnection(controllistener_t *listener, isc_nmhandle_t *handle) {
 	}

 	controlconnection_t *conn = isc_mem_get(listener->mctx, sizeof(*conn));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_DEBUG(3), "allocate new control connection");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_DEBUG(3),
+		      "allocate new control connection");

 	*conn = (controlconnection_t){
 		.alg = DST_ALG_UNKNOWN,
@@ -645,7 +648,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	if (!address_ok(&peeraddr, listener)) {
 		char socktext[ISC_SOCKADDR_FORMATSIZE];
 		isc_sockaddr_format(&peeraddr, socktext, sizeof(socktext));
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
@@ -757,7 +760,7 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,

 		result = cfgkeylist_find(keylist, keyid->keyname, &keydef);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't find key '%s' for use with "
 				    "command channel %s",
 				    keyid->keyname, socktext);
@@ -780,7 +783,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = named_config_getkeyalgorithm(algstr, &algtype,
 							      NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(control, ISC_LOG_WARNING,
+				cfg_obj_log(control, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "unsupported algorithm '%s' in "
 					    "key '%s' for use with command "
 					    "channel %s",
@@ -795,7 +799,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			result = isc_base64_decodestring(secretstr, &b);

 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(keydef, ISC_LOG_WARNING,
+				cfg_obj_log(keydef, named_g_lctx,
+					    ISC_LOG_WARNING,
 					    "secret for key '%s' on "
 					    "command channel %s: %s",
 					    keyid->keyname, socktext,
@@ -829,14 +834,14 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	unsigned int algtype;
 	isc_buffer_t b;

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_INFO, "configuring command channel from '%s'",
-		      named_g_keyfile);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
+		      "configuring command channel from '%s'", named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	CHECK(cfg_parser_create(mctx, &pctx));
+	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
 	CHECK(cfg_parse_file(pctx, named_g_keyfile, &cfg_type_rndckey,
 			     &config));
 	CHECK(cfg_map_get(config, "key", &key));
@@ -852,7 +857,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		CHECK(ISC_R_NOMEMORY);
 	}

-	CHECK(isccfg_check_key(key));
+	CHECK(isccfg_check_key(key, named_g_lctx));

 	(void)cfg_map_get(key, "algorithm", &algobj);
 	(void)cfg_map_get(key, "secret", &secretobj);
@@ -863,7 +868,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {

 	result = named_config_getkeyalgorithm(algstr, &algtype, NULL);
 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "unsupported algorithm '%s' in "
 			    "key '%s' for use with command "
 			    "channel",
@@ -876,7 +881,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	result = isc_base64_decodestring(secretstr, &b);

 	if (result != ISC_R_SUCCESS) {
-		cfg_obj_log(key, ISC_LOG_WARNING,
+		cfg_obj_log(key, named_g_lctx, ISC_LOG_WARNING,
 			    "secret for key '%s' on command channel: %s",
 			    keyid->keyname, isc_result_totext(result));
 		goto cleanup;
@@ -1004,12 +1009,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		 * sake of avoiding this message would be too much trouble.
 		 */
 		if (control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install new keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
 		} else {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 				      "couldn't install new keys for "
 				      "command channel %s: %s",
@@ -1022,8 +1027,9 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 	 */
 	if (control != NULL && type == isc_socktype_tcp) {
 		allow = cfg_tuple_get(control, "allow");
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -1043,12 +1049,12 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 		dns_acl_detach(&new_acl);
 		/* XXXDCL say the old acl is still used? */
 	} else if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "command channel %s: %s",
 			    socktext, isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "couldn't install new acl for "
 			      "command channel %s: %s",
@@ -1095,8 +1101,8 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		const cfg_obj_t *readonly = NULL;

 		allow = cfg_tuple_get(control, "allow");
-		CHECK(cfg_acl_fromconfig(allow, config, aclconfctx, mctx, 0,
-					 &new_acl));
+		CHECK(cfg_acl_fromconfig(allow, config, named_g_lctx,
+					 aclconfctx, mctx, 0, &new_acl));

 		readonly = cfg_tuple_get(control, "read-only");
 		if (!cfg_obj_isvoid(readonly)) {
@@ -1122,7 +1128,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	} else {
 		result = get_rndckey(mctx, &listener->keys);
 		if (result != ISC_R_SUCCESS && control != NULL) {
-			cfg_obj_log(control, ISC_LOG_WARNING,
+			cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 				    "couldn't install keys for "
 				    "command channel %s: %s",
 				    socktext, isc_result_totext(result));
@@ -1140,9 +1146,9 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 			       &listener->address, control_newconn, listener, 5,
 			       NULL, &listener->sock));

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_CONTROL,
-		      ISC_LOG_NOTICE, "command channel listening on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
+		      "command channel listening on %s", socktext);
 	*listenerp = listener;
 	return;

@@ -1153,11 +1159,11 @@ cleanup:

 shuttingdown:
 	if (control != NULL) {
-		cfg_obj_log(control, ISC_LOG_WARNING,
+		cfg_obj_log(control, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't add command channel %s: %s", socktext,
 			    isc_result_totext(result));
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "couldn't add command channel %s: %s", socktext,
 			      isc_result_totext(result));
@@ -1202,7 +1208,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,

 			(void)cfg_map_get(controls, "unix", &unixcontrols);
 			if (unixcontrols != NULL) {
-				cfg_obj_log(controls, ISC_LOG_ERROR,
+				cfg_obj_log(controls, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
 				return (ISC_R_FAILURE);
@@ -1238,7 +1245,8 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_CONTROL,
 					      ISC_LOG_DEBUG(9),
 					      "processing control channel %s",
@@ -17,13 +17,13 @@
 #include <stdlib.h>
 #include <string.h>

-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/util.h>
 #include <isc/uv.h>

 #include <dns/dlz_dlopen.h>
+#include <dns/log.h>

 #include <dlz/dlz_dlopen_driver.h>
 #include <named/globals.h>
@@ -80,7 +80,7 @@ static void
 dlopen_log(int level, const char *fmt, ...) {
 	va_list ap;
 	va_start(ap, fmt);
-	isc_log_vwrite(DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
+	isc_log_vwrite(dns_lctx, DNS_LOGCATEGORY_DATABASE, DNS_LOGMODULE_DLZ,
 		       ISC_LOG_DEBUG(level), fmt, ap);
 	va_end(ap);
 }
@@ -26,12 +26,13 @@
 #include <unistd.h>

 #include <isc/condition.h>
-#include <isc/log.h>
 #include <isc/loop.h>
 #include <isc/mutex.h>
 #include <isc/thread.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
 #include <named/globals.h>
 #include <named/log.h>
 #include <named/server.h>
@@ -39,8 +39,8 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	n = snprintf(pathbuf, sizeof(pathbuf), "%s/%s", dir, dbfile);
 	if (n >= sizeof(pathbuf)) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
 		return (NULL);
@@ -48,14 +48,14 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
 	if (ret == MMDB_SUCCESS) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_INFO, "opened GeoIP2 database '%s'",
-			      pathbuf);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+			      "opened GeoIP2 database '%s'", pathbuf);
 		return (mmdb);
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_DEBUG(1),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_DEBUG(1),
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

@@ -79,9 +79,9 @@ named_geoip_load(char *dir) {
 #if defined(HAVE_GEOIP2)
 	REQUIRE(dir != NULL);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "looking for GeoIP2 databases in '%s'",
-		      dir);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
+		      "looking for GeoIP2 databases in '%s'", dir);

 	named_g_geoip->country = open_geoip2(dir, "GeoIP2-Country.mmdb",
 					     &geoip_country);
@@ -28,51 +28,48 @@

 #define NAMED_CONTROL_PORT 953

-#define NAMED_COMMAND_ADDZONE	   "addzone"
-#define NAMED_COMMAND_CLOSELOGS	   "closelogs"
-#define NAMED_COMMAND_DELZONE	   "delzone"
-#define NAMED_COMMAND_DNSSEC	   "dnssec"
-#define NAMED_COMMAND_DNSTAP	   "dnstap"
-#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
-#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_STOP	   "stop"
+#define NAMED_COMMAND_HALT	   "halt"
+#define NAMED_COMMAND_RELOAD	   "reload"
+#define NAMED_COMMAND_RECONFIG	   "reconfig"
+#define NAMED_COMMAND_REFRESH	   "refresh"
+#define NAMED_COMMAND_RETRANSFER   "retransfer"
 #define NAMED_COMMAND_DUMPSTATS	   "stats"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
+#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_SECROOTS	   "secroots"
+#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_NOTRACE	   "notrace"
 #define NAMED_COMMAND_FLUSH	   "flush"
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
-#define NAMED_COMMAND_FREEZE	   "freeze"
-#define NAMED_COMMAND_HALT	   "halt"
-#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MKEYS	   "managed-keys"
-#define NAMED_COMMAND_MODZONE	   "modzone"
-#define NAMED_COMMAND_NOTIFY	   "notify"
-#define NAMED_COMMAND_NOTRACE	   "notrace"
-#define NAMED_COMMAND_NTA	   "nta"
-#define NAMED_COMMAND_NULL	   "null"
-#define NAMED_COMMAND_QUERYLOG	   "querylog"
-#define NAMED_COMMAND_RECONFIG	   "reconfig"
-#define NAMED_COMMAND_RECURSING	   "recursing"
-#define NAMED_COMMAND_REFRESH	   "refresh"
-#define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RESPONSELOG  "responselog"
-#define NAMED_COMMAND_RETRANSFER   "retransfer"
-#define NAMED_COMMAND_SCAN	   "scan"
-#define NAMED_COMMAND_SECROOTS	   "secroots"
-#define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_SHOWZONE	   "showzone"
-#define NAMED_COMMAND_SIGN	   "sign"
-#define NAMED_COMMAND_SIGNING	   "signing"
-#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_STATUS	   "status"
-#define NAMED_COMMAND_STOP	   "stop"
-#define NAMED_COMMAND_SYNC	   "sync"
-#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
-#define NAMED_COMMAND_TESTGEN	   "testgen"
-#define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
+#define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_RECURSING	   "recursing"
+#define NAMED_COMMAND_NULL	   "null"
+#define NAMED_COMMAND_NOTIFY	   "notify"
 #define NAMED_COMMAND_VALIDATION   "validation"
+#define NAMED_COMMAND_SCAN	   "scan"
+#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
+#define NAMED_COMMAND_ADDZONE	   "addzone"
+#define NAMED_COMMAND_MODZONE	   "modzone"
+#define NAMED_COMMAND_DELZONE	   "delzone"
+#define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SYNC	   "sync"
+#define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_DNSSEC	   "dnssec"
 #define NAMED_COMMAND_ZONESTATUS   "zonestatus"
+#define NAMED_COMMAND_NTA	   "nta"
+#define NAMED_COMMAND_TESTGEN	   "testgen"
+#define NAMED_COMMAND_MKEYS	   "managed-keys"
+#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
+#define NAMED_COMMAND_DNSTAP	   "dnstap"
+#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_SERVESTALE   "serve-stale"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -86,8 +86,10 @@ EXTERN named_server_t *named_g_server INIT(NULL);
 /*
 * Logging.
 */
-EXTERN bool named_g_logging	       INIT(false);
-EXTERN unsigned int named_g_debuglevel INIT(0);
+EXTERN isc_log_t *named_g_lctx		     INIT(NULL);
+EXTERN isc_logcategory_t *named_g_categories INIT(NULL);
+EXTERN isc_logmodule_t *named_g_modules	     INIT(NULL);
+EXTERN unsigned int named_g_debuglevel	     INIT(0);

 /*
 * Current configuration information.
@@ -111,7 +113,6 @@ EXTERN const char *named_g_chrootdir INIT(NULL);
 EXTERN bool named_g_foreground	     INIT(false);
 EXTERN bool named_g_logstderr	     INIT(false);
 EXTERN bool named_g_nosyslog	     INIT(false);
-EXTERN unsigned int named_g_logflags INIT(0);
 EXTERN const char *named_g_logfile   INIT(NULL);

 EXTERN const char *named_g_defaultsessionkeyfile INIT(NAMED_LOCALSTATEDIR
@@ -128,6 +129,8 @@ EXTERN const char *named_g_defaultpidfile INIT(NAMED_LOCALSTATEDIR "/run/"

 EXTERN const char *named_g_username INIT(NULL);

+EXTERN const char *named_g_engine INIT(NULL);
+
 EXTERN isc_time_t		  named_g_boottime;
 EXTERN isc_time_t		  named_g_configtime;
 EXTERN bool named_g_memstatistics INIT(false);
@@ -18,8 +18,22 @@
 #include <isc/log.h>
 #include <isc/types.h>

+#include <dns/log.h>
+
 #include <named/globals.h> /* Required for named_g_(categories|modules). */

+/* Unused slot 0. */
+#define NAMED_LOGCATEGORY_UNMATCHED (&named_g_categories[1])
+
+/*
+ * Backwards compatibility.
+ */
+#define NAMED_LOGCATEGORY_GENERAL ISC_LOGCATEGORY_GENERAL
+
+#define NAMED_LOGMODULE_MAIN	(&named_g_modules[0])
+#define NAMED_LOGMODULE_SERVER	(&named_g_modules[1])
+#define NAMED_LOGMODULE_CONTROL (&named_g_modules[2])
+
 isc_result_t
 named_log_init(bool safe);
 /*%
@@ -65,3 +79,6 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg);
 /*%
 * Set up "category unmatched" to go to the right places.
 */
+
+void
+named_log_shutdown(void);
@@ -26,7 +26,7 @@
 */
 #define NAMED_MAIN_ARGS "46A:c:Cd:D:E:fFgL:M:m:n:N:p:sS:t:T:U:u:vVx:X:"

-ISC_NORETURN void
+noreturn void
 named_main_earlyfatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 void
@@ -39,13 +39,10 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(bool permanent);
-
-void
-named_os_restoreuser(void);
+named_os_changeuser(void);

 uid_t
-named_os_uid(void);
+ns_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -56,6 +56,9 @@ struct named_server {
 	char *version;	    /*%< User-specified version */
 	bool  hostname_set; /*%< User has set hostname */
 	char *hostname;	    /*%< User-specified hostname */
+#ifdef USE_DNSRPS
+	char *dnsrpslib;
+#endif /* ifdef USE_DNSRPS */

 	/* Server data structures. */
 	dns_loadmgr_t	  *loadmgr;
@@ -72,6 +75,7 @@ struct named_server {
 	isc_timer_t *tat_timer;

 	uint32_t interface_interval;
+	uint32_t heartbeat_interval;

 	atomic_int reload_status;

@@ -104,7 +108,6 @@ struct named_server {
 	isc_tlsctx_cache_t *tlsctx_client_cache;

 	isc_signal_t *sighup;
-	isc_signal_t *sigusr1;
 };

 #define NAMED_SERVER_MAGIC    ISC_MAGIC('S', 'V', 'E', 'R')
@@ -181,20 +184,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex);
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
 /*%<
- * Enable/disable, or toggle, a server option via the command channel.
- * 'option' is the option value to be changed (for example,
- * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
- * option's human-readable name for logging purposes ("query logging"
- * or "response logging").
- *
- * If an explicit argument to enable the option was provided
- * (i.e., "on", "enable", "true", or "yes") or an explicit argument
- * to disable it ("off", "disable", "false", or "no"), it will be used.
- *
- * If no argument is provided, the option's current state will be reversed.
+ * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
+ * but can also be used as a toggle for backward comptibility.)
 */

 /*%
@@ -382,9 +375,3 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Import SKR file for offline KSK signing.
- */
-isc_result_t
-named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
@@ -15,29 +15,67 @@

 #include <stdlib.h>

-#include <isc/log.h>
 #include <isc/result.h>
 #include <isc/util.h>

+#include <dns/log.h>
+
+#include <isccfg/log.h>
+
+#include <ns/log.h>
+
 #include <named/log.h>

 #ifndef ISC_FACILITY
 #define ISC_FACILITY LOG_DAEMON
 #endif /* ifndef ISC_FACILITY */

+/*%
+ * When adding a new category, be sure to add the appropriate
+ * \#define to <named/log.h> and to update the list in
+ * bin/check/check-tool.c.
+ */
+static isc_logcategory_t categories[] = { { "", 0 },
+					  { "unmatched", 0 },
+					  { NULL, 0 } };
+
+/*%
+ * When adding a new module, be sure to add the appropriate
+ * \#define to <dns/log.h>.
+ */
+static isc_logmodule_t modules[] = {
+	{ "main", 0 }, { "server", 0 }, { "control", 0 }, { NULL, 0 }
+};
+
 isc_result_t
 named_log_init(bool safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;
+	isc_mem_t *log_mctx = NULL;
+
+	named_g_categories = categories;
+	named_g_modules = modules;

 	/*
-	 * This is not technically needed, as we are calling named_log_init()
-	 * only at the start of named process.  But since the named binary is
-	 * the only place that also calls isc_logconfig_set(), this is a good
-	 * hygiene.
+	 * Setup a logging context.
 	 */
-	rcu_read_lock();
-	lcfg = isc_logconfig_get();
+	isc_mem_create(&log_mctx);
+	isc_mem_setname(log_mctx, "named_log");
+	isc_log_create(log_mctx, &named_g_lctx, &lcfg);
+	isc_mem_detach(&log_mctx);
+
+	/*
+	 * named-checktool.c:setup_logging() needs to be kept in sync.
+	 */
+	isc_log_registercategories(named_g_lctx, named_g_categories);
+	isc_log_registermodules(named_g_lctx, named_g_modules);
+	isc_log_setcontext(named_g_lctx);
+	dns_log_init(named_g_lctx);
+	dns_log_setcontext(named_g_lctx);
+	cfg_log_init(named_g_lctx);
+	ns_log_init(named_g_lctx);
+	ns_log_setcontext(named_g_lctx);
+
 	if (safe) {
 		named_log_setsafechannels(lcfg);
 	} else {
@@ -50,14 +88,13 @@ named_log_init(bool safe) {
 	}

 	named_log_setdefaultsslkeylogfile(lcfg);
-	rcu_read_unlock();
-
-	named_g_logging = true;

 	return (ISC_R_SUCCESS);

 cleanup:
-	rcu_read_unlock();
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);

 	return (result);
 }
@@ -79,16 +116,6 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILE,
 				      ISC_LOG_DYNAMIC, &destination,
 				      ISC_LOG_PRINTTIME | ISC_LOG_DEBUGONLY);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
 	}

 	if (named_g_logfile != NULL) {
@@ -112,7 +139,7 @@ named_log_setdefaultchannels(isc_logconfig_t *lcfg) {
 	/*
 	 * Set the initial debug level.
 	 */
-	isc_log_setdebuglevel(named_g_debuglevel);
+	isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 }

 void
@@ -127,19 +154,9 @@ named_log_setsafechannels(isc_logconfig_t *lcfg) {
 		 * Setting the debug level to zero should get the output
 		 * discarded a bit faster.
 		 */
-		isc_log_setdebuglevel(0);
-	} else if (named_g_logstderr && (named_g_logflags != 0)) {
-		/*
-		 * If the option -g is given, but we also requested iso
-		 * timestamps, we'll still need to override the "default_debug"
-		 * logger with a new one.
-		 */
-		isc_log_createchannel(lcfg, "default_debug", ISC_LOG_TOFILEDESC,
-				      ISC_LOG_DYNAMIC,
-				      ISC_LOGDESTINATION_STDERR,
-				      ISC_LOG_PRINTTIME | named_g_logflags);
+		isc_log_setdebuglevel(named_g_lctx, 0);
 	} else {
-		isc_log_setdebuglevel(named_g_debuglevel);
+		isc_log_setdebuglevel(named_g_lctx, named_g_debuglevel);
 	}

 	if (named_g_logfile != NULL) {
@@ -182,6 +199,7 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 			.maximum_size = 100 * 1024 * 1024,
 		},
 	};
+	isc_result_t result;

 	if (sslkeylogfile_path == NULL ||
 	    strcmp(sslkeylogfile_path, "config") == 0)
@@ -189,10 +207,11 @@ named_log_setdefaultsslkeylogfile(isc_logconfig_t *lcfg) {
 		return;
 	}

-	isc_log_createandusechannel(lcfg, "default_sslkeylogfile",
-				    ISC_LOG_TOFILE, ISC_LOG_INFO, &destination,
-				    0, ISC_LOGCATEGORY_SSLKEYLOG,
-				    ISC_LOGMODULE_DEFAULT);
+	isc_log_createchannel(lcfg, "default_sslkeylogfile", ISC_LOG_TOFILE,
+			      ISC_LOG_INFO, &destination, 0);
+	result = isc_log_usechannel(lcfg, "default_sslkeylogfile",
+				    ISC_LOGCATEGORY_SSLKEYLOG, NULL);
+	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 }

 isc_result_t
@@ -200,8 +219,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result = ISC_R_SUCCESS;

 	result = isc_log_usechannel(lcfg, "default_debug",
-				    ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
+				    ISC_LOGCATEGORY_DEFAULT, NULL);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -210,11 +228,11 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 		if (named_g_logfile != NULL) {
 			result = isc_log_usechannel(lcfg, "default_logfile",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		} else if (!named_g_nosyslog) {
 			result = isc_log_usechannel(lcfg, "default_syslog",
 						    ISC_LOGCATEGORY_DEFAULT,
-						    ISC_LOGMODULE_DEFAULT);
+						    NULL);
 		}
 	}

@@ -227,6 +245,13 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {
 	isc_result_t result;

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
-				    ISC_LOGMODULE_DEFAULT);
+				    NULL);
 	return (result);
 }
+
+void
+named_log_shutdown(void) {
+	isc_log_destroy(&named_g_lctx);
+	isc_log_setcontext(NULL);
+	dns_log_setcontext(NULL);
+}
@@ -24,6 +24,7 @@
 #include <isc/util.h>

 #include <isccfg/cfg.h>
+#include <isccfg/log.h>

 #include <named/log.h>
 #include <named/logconf.h>
@@ -43,14 +44,15 @@ static isc_result_t
 category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 	isc_result_t result;
 	const char *catname;
-	isc_logcategory_t category;
+	isc_logcategory_t *category;
+	isc_logmodule_t *module;
 	const cfg_obj_t *destinations = NULL;
 	const cfg_listelt_t *element = NULL;

 	catname = cfg_obj_asstring(cfg_tuple_get(ccat, "name"));
-	category = isc_log_categorybyname(catname);
-	if (category == ISC_LOGCATEGORY_INVALID) {
-		cfg_obj_log(ccat, ISC_LOG_ERROR,
+	category = isc_log_categorybyname(named_g_lctx, catname);
+	if (category == NULL) {
+		cfg_obj_log(ccat, named_g_lctx, ISC_LOG_ERROR,
 			    "unknown logging category '%s' ignored", catname);
 		/*
 		 * Allow further processing by returning success.
@@ -62,6 +64,8 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		return (ISC_R_SUCCESS);
 	}

+	module = NULL;
+
 	destinations = cfg_tuple_get(ccat, "destinations");
 	for (element = cfg_list_first(destinations); element != NULL;
 	     element = cfg_list_next(element))
@@ -70,9 +74,9 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		const char *channelname = cfg_obj_asstring(channel);

 		result = isc_log_usechannel(logconfig, channelname, category,
-					    ISC_LOGMODULE_DEFAULT);
+					    module);
 		if (result != ISC_R_SUCCESS) {
-			isc_log_write(CFG_LOGCATEGORY_CONFIG,
+			isc_log_write(named_g_lctx, CFG_LOGCATEGORY_CONFIG,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
@@ -123,7 +127,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 	if (i != 1) {
-		cfg_obj_log(channel, ISC_LOG_ERROR,
+		cfg_obj_log(channel, named_g_lctx, ISC_LOG_ERROR,
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
@@ -239,8 +243,6 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				flags |= ISC_LOG_ISO8601;
 			} else if (strcasecmp(s, "iso8601-utc") == 0) {
 				flags |= ISC_LOG_ISO8601 | ISC_LOG_UTC;
-			} else if (strcasecmp(s, "iso8601-tzinfo") == 0) {
-				flags |= ISC_LOG_ISO8601 | ISC_LOG_TZINFO;
 			}
 		}
 	}
@@ -27,7 +27,6 @@
 #include <isc/attributes.h>
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
-#include <isc/crypto.h>
 #include <isc/dir.h>
 #include <isc/file.h>
 #include <isc/fips.h>
@@ -89,7 +88,7 @@
 #include <openssl/crypto.h>
 #include <openssl/evp.h>
 #include <openssl/opensslv.h>
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 #include <openssl/err.h>
 #include <openssl/provider.h>
 #endif
@@ -153,7 +152,7 @@ static bool transferstuck = false;
 static bool disable6 = false;
 static bool disable4 = false;

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 static OSSL_PROVIDER *fips = NULL, *base = NULL;
 #endif

@@ -162,9 +161,10 @@ named_main_earlywarning(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_WARNING, format, args);
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING, format,
+			       args);
 	} else {
 		fprintf(stderr, "%s: ", program_name);
 		vfprintf(stderr, format, args);
@@ -179,11 +179,12 @@ named_main_earlyfatal(const char *format, ...) {
 	va_list args;

 	va_start(args, format);
-	if (named_g_logging) {
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
+	if (named_g_lctx != NULL) {
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to early fatal error)");
 	} else {
 		fprintf(stderr, "%s: ", program_name);
@@ -196,7 +197,7 @@ named_main_earlyfatal(const char *format, ...) {
 	_exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 assertion_failed(const char *file, int line, isc_assertiontype_t type,
 		 const char *cond);

@@ -207,20 +208,21 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	 * Handle assertion failures.
 	 */

-	if (named_g_logging) {
+	if (named_g_lctx != NULL) {
 		/*
 		 * Reset the assertion callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_assertion_setcallback(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL, "%s:%d: %s(%s) failed", file,
-			      line, isc_assertion_typetotext(type), cond);
-		isc_backtrace_log(NAMED_LOGCATEGORY_GENERAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
+			      "%s:%d: %s(%s) failed", file, line,
+			      isc_assertion_typetotext(type), cond);
+		isc_backtrace_log(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				  NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to assertion failure)");
 	} else {
 		fprintf(stderr, "%s:%d: %s(%s) failed\n", file, line,
@@ -234,7 +236,7 @@ assertion_failed(const char *file, int line, isc_assertiontype_t type,
 	_exit(EXIT_FAILURE);
 }

-ISC_NORETURN static void
+noreturn static void
 library_fatal_error(const char *file, int line, const char *func,
 		    const char *format, va_list args) ISC_FORMAT_PRINTF(3, 0);

@@ -245,20 +247,21 @@ library_fatal_error(const char *file, int line, const char *func,
 	 * Handle isc_error_fatal() calls from our libraries.
 	 */

-	if (named_g_logging) {
+	if (named_g_lctx != NULL) {
 		/*
 		 * Reset the error callback in case it is the log
 		 * routines causing the assertion.
 		 */
 		isc_error_setfatal(NULL);

-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "%s:%d:%s(): fatal error: ", file, line, func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_CRITICAL, format, args);
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_CRITICAL,
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL, format,
+			       args);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_CRITICAL,
 			      "exiting (due to fatal error in library)");
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
@@ -285,13 +288,14 @@ library_unexpected_error(const char *file, int line, const char *func,
 	 * Handle isc_error_unexpected() calls from our libraries.
 	 */

-	if (named_g_logging) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_ERROR,
+	if (named_g_lctx != NULL) {
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR,
 			      "%s:%d:%s(): unexpected error: ", file, line,
 			      func);
-		isc_log_vwrite(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			       ISC_LOG_ERROR, format, args);
+		isc_log_vwrite(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			       NAMED_LOGMODULE_MAIN, ISC_LOG_ERROR, format,
+			       args);
 	} else {
 		fprintf(stderr, "%s:%d:%s(): fatal error: ", file, line, func);
 		vfprintf(stderr, format, args);
@@ -303,7 +307,7 @@ library_unexpected_error(const char *file, int line, const char *func,
 static void
 usage(void) {
 	fprintf(stderr, "usage: named [-4|-6] [-c conffile] [-d debuglevel] "
-			"[-D comment]\n"
+			"[-D comment] [-E engine]\n"
 			"             [-f|-g] [-L logfile] [-n number_of_cpus] "
 			"[-p port] [-s]\n"
 			"             [-S sockets] [-t chrootdir] [-u "
@@ -506,8 +510,9 @@ list_hmac_algorithms(isc_buffer_t *b) {

 static void
 logit(isc_buffer_t *b) {
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "%.*s", (int)isc_buffer_usedlength(b),
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "%.*s",
+		      (int)isc_buffer_usedlength(b),
 		      (char *)isc_buffer_base(b));
 }

@@ -551,6 +556,8 @@ format_supported_algorithms(void (*emit)(isc_buffer_t *b)) {
 static void
 printversion(bool verbose) {
 	char rndcconf[PATH_MAX], *dot = NULL;
+	isc_mem_t *mctx = NULL;
+	isc_result_t result;
 	isc_buffer_t b;
 	char buf[512];
 #if defined(HAVE_GEOIP2)
@@ -583,8 +590,16 @@ printversion(bool verbose) {
 	printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
 	printf("compiled with OpenSSL version: %s\n", OPENSSL_VERSION_TEXT);
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
 	printf("linked to OpenSSL version: %s\n",
 	       OpenSSL_version(OPENSSL_VERSION));
+
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	printf("linked to OpenSSL version: %s\n",
+	       SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
 	printf("compiled with libuv version: %d.%d.%d\n", UV_VERSION_MAJOR,
 	       UV_VERSION_MINOR, UV_VERSION_PATCH);
 	printf("linked to libuv version: %s\n", uv_version_string());
@@ -624,9 +639,17 @@ printversion(bool verbose) {
 #endif /* if defined(HAVE_DNSTAP) */
 	printf("threads support is enabled\n");

-	isc_buffer_init(&b, buf, sizeof(buf));
-	format_supported_algorithms(printit);
-	printf("\n");
+	isc_mem_create(&mctx);
+	result = dst_lib_init(mctx, named_g_engine);
+	if (result == ISC_R_SUCCESS) {
+		isc_buffer_init(&b, buf, sizeof(buf));
+		format_supported_algorithms(printit);
+		printf("\n");
+		dst_lib_destroy();
+	} else {
+		printf("DST initialization failure: %s\n",
+		       isc_result_totext(result));
+	}

 	/*
 	 * The default rndc.conf and rndc.key paths are in the same
@@ -650,9 +673,7 @@ printversion(bool verbose) {
 	printf("  named PID file:       %s\n", named_g_defaultpidfile);
 #if defined(HAVE_GEOIP2)
 #define RTC(x) RUNTIME_CHECK((x) == ISC_R_SUCCESS)
-	isc_mem_t *mctx = NULL;
-	isc_mem_create(&mctx);
-	RTC(cfg_parser_create(mctx, &parser));
+	RTC(cfg_parser_create(mctx, named_g_lctx, &parser));
 	RTC(named_config_parsedefaults(parser, &config));
 	RTC(cfg_map_get(config, "options", &defaults));
 	RTC(cfg_map_get(defaults, "geoip-directory", &obj));
@@ -881,8 +902,7 @@ parse_command_line(int argc, char *argv[]) {
 			/* Descriptive comment for 'ps'. */
 			break;
 		case 'E':
-			named_main_earlyfatal(
-				"%s", isc_result_totext(DST_R_NOENGINE));
+			named_g_engine = isc_commandline_argument;
 			break;
 		case 'f':
 			named_g_foreground = true;
@@ -890,8 +910,6 @@ parse_command_line(int argc, char *argv[]) {
 		case 'g':
 			named_g_foreground = true;
 			named_g_logstderr = true;
-			named_g_logflags = ISC_LOG_PRINTTIME | ISC_LOG_ISO8601 |
-					   ISC_LOG_TZINFO;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -950,7 +968,7 @@ parse_command_line(int argc, char *argv[]) {
 			named_main_earlyfatal("option '-X' has been removed");
 			break;
 		case 'F':
-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 			fips = OSSL_PROVIDER_load(NULL, "fips");
 			if (fips == NULL) {
 				ERR_clear_error();
@@ -1014,11 +1032,11 @@ create_managers(void) {
 		named_g_cpus = named_g_cpus_detected;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
-		      named_g_cpus_detected,
-		      named_g_cpus_detected == 1 ? "" : "s", named_g_cpus,
-		      named_g_cpus == 1 ? "" : "s");
+	isc_log_write(
+		named_g_lctx, NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
+		ISC_LOG_INFO, "found %u CPU%s, using %u worker thread%s",
+		named_g_cpus_detected, named_g_cpus_detected == 1 ? "" : "s",
+		named_g_cpus, named_g_cpus == 1 ? "" : "s");

 	isc_managers_create(&named_g_mctx, named_g_cpus, &named_g_loopmgr,
 			    &named_g_netmgr);
@@ -1098,129 +1116,150 @@ setup(void) {
 		named_os_daemonize();
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "starting %s%s <id:%s>", PACKAGE_STRING,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "starting %s%s <id:%s>", PACKAGE_STRING,
 		      PACKAGE_DESCRIPTION, PACKAGE_SRCID);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running on %s", named_os_uname());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "running on %s",
+		      named_os_uname());

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "built with %s", PACKAGE_CONFIGARGS);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "built with %s",
+		      PACKAGE_CONFIGARGS);

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "running as: %s%s%s", program_name,
-		      saved_command_line, ellipsis);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "running as: %s%s%s", program_name, saved_command_line,
+		      ellipsis);
 #ifdef __clang__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by CLANG %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by CLANG %s", __VERSION__);
 #else /* ifdef __clang__ */
 #if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by ICC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by ICC %s", __VERSION__);
 #else /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #ifdef __GNUC__
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by GCC %s", __VERSION__);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by GCC %s", __VERSION__);
 #endif /* ifdef __GNUC__ */
 #endif /* if defined(__ICC) || defined(__INTEL_COMPILER) */
 #endif /* ifdef __clang__ */
 #ifdef __SUNPRO_C
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled by Solaris Studio %x",
-		      __SUNPRO_C);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled by Solaris Studio %x", __SUNPRO_C);
 #endif /* ifdef __SUNPRO_C */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with OpenSSL version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with OpenSSL version: %s",
 		      OPENSSL_VERSION_TEXT);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to OpenSSL version: %s",
+#if !defined(LIBRESSL_VERSION_NUMBER) && \
+	OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
 		      OpenSSL_version(OPENSSL_VERSION));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libuv version: %d.%d.%d",
-		      UV_VERSION_MAJOR, UV_VERSION_MINOR, UV_VERSION_PATCH);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libuv version: %s",
-		      uv_version_string());
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with %s version: %s",
-		      RCU_FLAVOR, RCU_VERSION);
+#else  /* if !defined(LIBRESSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= \
+	* 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to OpenSSL version: %s",
+		      SSLeay_version(SSLEAY_VERSION));
+#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libuv version: %d.%d.%d", UV_VERSION_MAJOR,
+		      UV_VERSION_MINOR, UV_VERSION_PATCH);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libuv version: %s", uv_version_string());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with %s version: %s", RCU_FLAVOR, RCU_VERSION);
 #if defined(JEMALLOC_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with jemalloc version: %u.%u.%u",
 		      JEMALLOC_VERSION_MAJOR, JEMALLOC_VERSION_MINOR,
 		      JEMALLOC_VERSION_BUGFIX);
 #elif defined(M_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "compiled with system jemalloc version: %u", M_VERSION);
 #endif
 #if HAVE_LIBNGHTTP2
 	nghttp2_info *nginfo = NULL;
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libnghttp2 version: %s",
-		      NGHTTP2_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libnghttp2 version: %s", NGHTTP2_VERSION);
 	nginfo = nghttp2_version(1);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libnghttp2 version: %s",
-		      nginfo->version_str);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libnghttp2 version: %s", nginfo->version_str);
 #endif
 #ifdef HAVE_LIBXML2
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with libxml2 version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with libxml2 version: %s",
 		      LIBXML_DOTTED_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to libxml2 version: %s",
-		      xmlParserVersion);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to libxml2 version: %s", xmlParserVersion);
 #endif /* ifdef HAVE_LIBXML2 */
 #if defined(HAVE_JSON_C)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with json-c version: %s",
-		      JSON_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to json-c version: %s",
-		      json_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with json-c version: %s", JSON_C_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to json-c version: %s", json_c_version());
 #endif /* if defined(HAVE_JSON_C) */
 #if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with zlib version: %s",
-		      ZLIB_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to zlib version: %s",
-		      zlibVersion());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with zlib version: %s", ZLIB_VERSION);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to zlib version: %s", zlibVersion());
 #endif /* if defined(HAVE_ZLIB) && defined(ZLIB_VERSION) */
 #if defined(HAVE_GEOIP2)
 	/* Unfortunately, no version define on link time */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to maxminddb version: %s",
-		      MMDB_lib_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to maxminddb version: %s", MMDB_lib_version());
 #endif /* if defined(HAVE_GEOIP2) */
 #if defined(HAVE_DNSTAP)
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "compiled with protobuf-c version: %s",
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "compiled with protobuf-c version: %s",
 		      PROTOBUF_C_VERSION);
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "linked to protobuf-c version: %s",
-		      protobuf_c_version());
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
+		      "linked to protobuf-c version: %s", protobuf_c_version());
 #endif /* if defined(HAVE_DNSTAP) */
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "BIND 9 is maintained by Internet Systems Consortium,");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "Inc. (ISC), a non-profit 501(c)(3) public-benefit ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "corporation.  Support and training for BIND 9 are ");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "available at https://www.isc.org/support");
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "----------------------------------------------------");

 	/*
@@ -1277,6 +1316,10 @@ setup(void) {
 	ENSURE(named_g_server != NULL);
 	sctx = named_g_server->sctx;

+	/*
+	 * Report supported algorithms now that dst_lib_init() has
+	 * been called via named_server_create().
+	 */
 	format_supported_algorithms(logit);

 	/*
@@ -1352,8 +1395,9 @@ cleanup(void) {
 	 */
 	dlz_dlopen_clear();

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE, "exiting");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE, "exiting");
+	named_log_shutdown();
 }

 static char *memstats = NULL;
@@ -1523,7 +1567,6 @@ main(int argc, char *argv[]) {
 	 * Start things running
 	 */
 	isc_signal_start(named_g_server->sighup);
-	isc_signal_start(named_g_server->sigusr1);

 	/*
 	 * Pause the loop manager in fatal.
@@ -1566,7 +1609,7 @@ main(int argc, char *argv[]) {
 	isc_managers_destroy(&named_g_mctx, &named_g_loopmgr, &named_g_netmgr);

 #if ENABLE_LEAK_DETECTION
-	isc__crypto_setdestroycheck(true);
+	isc__tls_setdestroycheck(true);
 	isc__uv_setdestroycheck(true);
 	isc__xml_setdestroycheck(true);
 #endif
@@ -1579,7 +1622,7 @@ main(int argc, char *argv[]) {

 	named_os_shutdown();

-#if OPENSSL_VERSION_NUMBER >= 0x30000000L
+#if OPENSSL_VERSION_NUMBER >= 0x30000000L && OPENSSL_API_LEVEL >= 30000
 	if (base != NULL) {
 		OSSL_PROVIDER_unload(base);
 	}
@@ -21,7 +21,7 @@ named - Internet domain name server
 Synopsis
 ~~~~~~~~

-:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]
+:program:`named` [ [**-4**] | [**-6**] ] [**-c** config-file] [**-C**] [**-d** debug-level] [**-D** string] [**-E** engine-name] [**-f**] [**-g**] [**-L** logfile] [**-M** option] [**-m** flag] [**-n** #cpus] [**-p** port] [**-s**] [**-t** directory] [**-u** user] [**-v**] [**-V**] ]

 Description
 ~~~~~~~~~~~
@@ -73,6 +73,15 @@ Options
   This option specifies a string that is used to identify a instance of :program:`named`
   in a process listing. The contents of ``string`` are not examined.

+.. option:: -E engine-name
+
+   When applicable, this option specifies the hardware to use for cryptographic
+   operations, such as a secure key store used for signing.
+
+   When BIND 9 is built with OpenSSL, this needs to be set to the OpenSSL
+   engine identifier that drives the cryptographic accelerator or
+   hardware service module (usually ``pkcs11``).
+
 .. option:: -f

   This option runs the server in the foreground (i.e., do not daemonize).
@@ -61,9 +61,6 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

-static uid_t saved_uid = (uid_t)-1;
-static gid_t saved_gid = (gid_t)-1;
-
 #if HAVE_LIBCAP

 static bool non_root = false;
@@ -252,6 +249,115 @@ linux_keepcaps(void) {

 #endif /* HAVE_LIBCAP */

+/*
+ * First define compatibility shims if {set,get}res{uid,gid} are not available
+ */
+
+#if !HAVE_GETRESGID
+static int
+getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
+	*rgid = -1;
+	*egid = getegid();
+	*sgid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESGID */
+
+#if !HAVE_SETRESGID
+static int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
+	REQUIRE(rgid == (gid_t)-1);
+	REQUIRE(sgid == (gid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(rgid, egid));
+#else  /* HAVE_SETREGID */
+	return (setegid(egid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESGID */
+
+#if !HAVE_GETRESUID
+static int
+getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
+	*ruid = -1;
+	*euid = geteuid();
+	*suid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESUID */
+
+#if !HAVE_SETRESUID
+static int
+setresuid(uid_t ruid, uid_t euid, uid_t suid) {
+	REQUIRE(ruid == (uid_t)-1);
+	REQUIRE(suid == (uid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(ruid, euid));
+#else  /* HAVE_SETREGID */
+	return (setegid(euid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESUID */
+
+static int
+set_effective_gid(gid_t gid) {
+	gid_t oldgid;
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid == gid) {
+		return (0);
+	}
+
+	if (setresgid(-1, gid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid != gid) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+set_effective_uid(uid_t uid) {
+	uid_t olduid;
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid == uid) {
+		return (0);
+	}
+
+	if (setresuid(-1, uid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid != uid) {
+		return (-1);
+	}
+
+	/* Success */
+	return (0);
+}
+
 static void
 setperms(uid_t uid, gid_t gid) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -260,13 +366,13 @@ setperms(uid_t uid, gid_t gid) {
 	 * Drop the gid privilege first, because in some cases the gid privilege
 	 * cannot be dropped after the uid privilege has been dropped.
 	 */
-	if (setegid(gid) == -1) {
+	if (set_effective_gid(gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective gid to %d: %s",
 					gid, strbuf);
 	}

-	if (seteuid(uid) == -1) {
+	if (set_effective_uid(uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective uid to %d: %s",
 					uid, strbuf);
@@ -464,41 +570,20 @@ named_os_inituserinfo(const char *username) {
 }

 void
-named_os_restoreuser(void) {
-	if (runas_pw == NULL || done_setuid) {
-		return;
-	}
-
-	REQUIRE(saved_uid != (uid_t)-1);
-	REQUIRE(saved_gid != (gid_t)-1);
-
-	setperms(saved_uid, saved_gid);
-}
-
-void
-named_os_changeuser(bool permanent) {
+named_os_changeuser(void) {
 	char strbuf[ISC_STRERRORSIZE];
 	if (runas_pw == NULL || done_setuid) {
 		return;
 	}

-	if (!permanent) {
-		saved_uid = getuid();
-		saved_gid = getgid();
-
-		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
-		return;
-	}
-
 	done_setuid = true;

-	if (setgid(runas_pw->pw_gid) == -1) {
+	if (setgid(runas_pw->pw_gid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

-	if (setuid(runas_pw->pw_uid) == -1) {
+	if (setuid(runas_pw->pw_uid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
@@ -519,7 +604,7 @@ named_os_changeuser(bool permanent) {
 }

 uid_t
-named_os_uid(void) {
+ns_os_uid(void) {
 	if (runas_pw == NULL) {
 		return (0);
 	}
@@ -541,8 +626,8 @@ named_os_adjustnofile(void) {
 	rlim_old = rl.rlim_cur;

 	if (rl.rlim_cur == rl.rlim_max) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-			      ISC_LOG_NOTICE,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 			      "the limit on open files is already at the "
 			      "maximum allowed value: "
 			      "%" PRIu64,
@@ -556,8 +641,8 @@ named_os_adjustnofile(void) {
 		goto fail;
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_MAIN,
-		      ISC_LOG_NOTICE,
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "adjusted limit on open files from "
 		      "%" PRIu64 " to "
 		      "%" PRIu64,
@@ -575,7 +660,7 @@ void
 named_os_minprivs(void) {
 #if HAVE_LIBCAP
 	linux_keepcaps();
-	named_os_changeuser(true);
+	named_os_changeuser();
 	linux_minprivs();
 #endif /* HAVE_LIBCAP */
 }
@@ -702,16 +787,19 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 	free(f);

 	if (switch_user && runas_pw != NULL) {
+		uid_t olduid = getuid();
+		gid_t oldgid = getgid();
+
 		/*
-		 * Temporarily set UID/GID to the one we'll be running with
+		 * Set UID/GID to the one we'll be running with
 		 * eventually.
 		 */
-		named_os_changeuser(false);
+		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

 		fd = safe_open(filename, mode, false);

 		/* Restore UID/GID to previous uid/gid */
-		named_os_restoreuser();
+		setperms(olduid, oldgid);

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -327,8 +327,6 @@ init_desc(void) {
 	SET_NSSTATDESC(updatebadprereq,
 		       "updates rejected due to prerequisite failure",
 		       "UpdateBadPrereq");
-	SET_NSSTATDESC(recurshighwater, "Recursive clients high-water",
-		       "RecursHighwater");
 	SET_NSSTATDESC(recursclients, "recursing clients", "RecursClients");
 	SET_NSSTATDESC(dns64, "queries answered by DNS64", "DNS64");
 	SET_NSSTATDESC(ratedropped, "responses dropped for rate limits",
@@ -472,8 +470,6 @@ init_desc(void) {
 			"ClientQuota");
 	SET_RESSTATDESC(nextitem, "waited for next item", "NextItem");
 	SET_RESSTATDESC(priming, "priming queries", "Priming");
-	SET_RESSTATDESC(forwardonlyfail, "all forwarders failed",
-			"ForwardOnlyFail");

 	INSIST(i == dns_resstatscounter_max);

@@ -938,8 +934,9 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at dump_counters()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at dump_counters()");
 	return (ISC_R_FAILURE);
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -1000,8 +997,9 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rdtypestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rdtypestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1088,8 +1086,9 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rdatasetstats_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rdatasetstats_dump()");
 	dumparg->result = ISC_R_FAILURE;
 #endif /* ifdef HAVE_LIBXML2 */
 }
@@ -1142,8 +1141,9 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at opcodestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at opcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1197,8 +1197,9 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {

 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at rcodestat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at rcodestat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1253,8 +1254,9 @@ dnssecsignstat_dump(uint32_t kval, uint64_t val, void *arg) {
 	return;
 #ifdef HAVE_LIBXML2
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed at dnssecsignstat_dump()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed at dnssecsignstat_dump()");
 	dumparg->result = ISC_R_FAILURE;
 	return;
 #endif /* ifdef HAVE_LIBXML2 */
@@ -1448,8 +1450,9 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	return (ISC_R_SUCCESS);
 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "Failed at zone_xmlrender()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "Failed at zone_xmlrender()");
 	return (ISC_R_FAILURE);
 }

@@ -1720,8 +1723,9 @@ cleanup:
 		dns_xfrin_detach(&xfr);
 	}

-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "Failed at xfrin_xmlrender()");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "Failed at xfrin_xmlrender()");

 	return (ISC_R_FAILURE);
 }
@@ -2128,8 +2132,9 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,
 	return (ISC_R_SUCCESS);

 cleanup:
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_ERROR, "failed generating XML response");
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+		      "failed generating XML response");
 	if (writer != NULL) {
 		xmlFreeTextWriter(writer);
 	}
@@ -2166,8 +2171,9 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_xmlfree;
 		*freecb_args = NULL;
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "failed at rendering XML()");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "failed at rendering XML()");
 	}

 	return (result);
@@ -3368,8 +3374,9 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 		*freecb = wrap_jsonfree;
 		*freecb_args = bindstats;
 	} else {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "failed at rendering JSON()");
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "failed at rendering JSON()");
 	}

 	return (result);
@@ -3465,11 +3472,6 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,

 #endif /* HAVE_JSON_C */

-#if HAVE_LIBXML2
-/*
- * This is only needed if we have libxml2 and was confusingly returned if
- * neither of libxml2 or json-c is configured.
- */
 static isc_result_t
 render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
 	   unsigned int *retcode, const char **retmsg, const char **mimetype,
@@ -3525,20 +3527,18 @@ send:
 end:
 	return (ISC_R_SUCCESS);
 }
-#endif

 static void
 shutdown_listener(named_statschannel_t *listener) {
 	char socktext[ISC_SOCKADDR_FORMATSIZE];
 	isc_sockaddr_format(&listener->address, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_NOTICE, "stopping statistics channel on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+		      "stopping statistics channel on %s", socktext);

 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static bool
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
@@ -3563,15 +3563,13 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	UNLOCK(&listener->lock);

 	isc_sockaddr_format(fromaddr, socktext, sizeof(socktext));
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_WARNING, "rejected statistics connection from %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
+		      "rejected statistics connection from %s", socktext);

 	return (false);
 }
-#endif

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static void
 destroy_listener(void *arg) {
 	named_statschannel_t *listener = (named_statschannel_t *)arg;
@@ -3585,24 +3583,12 @@ destroy_listener(void *arg) {
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
-#endif

 static isc_result_t
 add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     const cfg_obj_t *listen_params, const cfg_obj_t *config,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
-#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON_C)
-	UNUSED(server);
-	UNUSED(listenerp);
-	UNUSED(listen_params);
-	UNUSED(config);
-	UNUSED(addr);
-	UNUSED(aclconfctx);
-	UNUSED(socktext);
-
-	return (ISC_R_NOTIMPLEMENTED);
-#else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
@@ -3617,8 +3603,9 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,

 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3667,8 +3654,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
@@ -3698,11 +3683,13 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
+	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			    server);

 	*listenerp = listener;
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-		      ISC_LOG_NOTICE, "statistics channel listening on %s",
-		      socktext);
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
+		      "statistics channel listening on %s", socktext);

 	return (ISC_R_SUCCESS);

@@ -3714,7 +3701,6 @@ cleanup:
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

 	return (result);
-#endif
 }

 static void
@@ -3745,8 +3731,9 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,
 	 */
 	allow = cfg_tuple_get(listen_params, "allow");
 	if (allow != NULL && cfg_obj_islist(allow)) {
-		result = cfg_acl_fromconfig(allow, config, aclconfctx,
-					    listener->mctx, 0, &new_acl);
+		result = cfg_acl_fromconfig(allow, config, named_g_lctx,
+					    aclconfctx, listener->mctx, 0,
+					    &new_acl);
 	} else {
 		result = dns_acl_any(listener->mctx, &new_acl);
 	}
@@ -3760,7 +3747,7 @@ update_listener(named_server_t *server, named_statschannel_t **listenerp,

 		UNLOCK(&listener->lock);
 	} else {
-		cfg_obj_log(listen_params, ISC_LOG_WARNING,
+		cfg_obj_log(listen_params, named_g_lctx, ISC_LOG_WARNING,
 			    "couldn't install new acl for "
 			    "statistics channel %s: %s",
 			    socktext, isc_result_totext(result));
@@ -3797,20 +3784,20 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	 */
 	if (statschannellist != NULL) {
 #ifndef EXTENDED_STATS
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels specified but not effective "
 			      "due to missing XML and/or JSON library");
 #else /* EXTENDED_STATS */
 #ifndef HAVE_LIBXML2
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels: XML library missing, "
 			      "only JSON stats will be available");
 #endif /* !HAVE_LIBXML2 */
 #ifndef HAVE_JSON_C
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_WARNING,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 			      "statistics-channels: JSON library missing, "
 			      "only XML stats will be available");
 #endif /* !HAVE_JSON_C */
@@ -3849,7 +3836,8 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 				isc_sockaddr_format(&addr, socktext,
 						    sizeof(socktext));

-				isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+				isc_log_write(named_g_lctx,
+					      NAMED_LOGCATEGORY_GENERAL,
 					      NAMED_LOGMODULE_SERVER,
 					      ISC_LOG_DEBUG(9),
 					      "processing statistics "
@@ -3880,6 +3868,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 					if (r != ISC_R_SUCCESS) {
 						cfg_obj_log(
 							listen_params,
+							named_g_lctx,
 							ISC_LOG_WARNING,
 							"couldn't allocate "
 							"statistics channel"
@@ -38,9 +38,9 @@
 	} while (0)

 #include <named/log.h>
-#define LOG(msg)                                                         \
-	isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER, \
-		      ISC_LOG_ERROR, "%s", msg)
+#define LOG(msg)                                               \
+	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL, \
+		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR, "%s", msg)

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
@@ -133,7 +133,8 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {

 	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(doh, ISC_LOG_ERROR, "configuring DoH '%s': %s", dohid,
+	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

 	return (result);
@@ -186,7 +187,8 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {

 	return (ISC_R_SUCCESS);
 failure:
-	cfg_obj_log(tls, ISC_LOG_ERROR, "configuring tls '%s': %s", tlsid,
+	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

 	return (result);
@@ -85,7 +85,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		if (named_config_getkeyalgorithm(algstr, &alg, &bits) !=
 		    ISC_R_SUCCESS)
 		{
-			cfg_obj_log(algobj, ISC_LOG_ERROR,
+			cfg_obj_log(algobj, named_g_lctx, ISC_LOG_ERROR,
 				    "key '%s': has a "
 				    "unsupported algorithm '%s'",
 				    keyid, algstr);
@@ -129,8 +129,8 @@ failure:
 	if (secret != NULL) {
 		isc_mem_put(mctx, secret, secretalloc);
 	}
-	cfg_obj_log(key, ISC_LOG_ERROR, "configuring key '%s': %s", keyid,
-		    isc_result_totext(ret));
+	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
+		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
 	return (ret);
 }

@@ -16,7 +16,6 @@

 #include <isc/buffer.h>
 #include <isc/file.h>
-#include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/result.h>
 #include <isc/stats.h>
@@ -29,6 +28,7 @@
 #include <dns/ipkeylist.h>
 #include <dns/journal.h>
 #include <dns/kasp.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/name.h>
 #include <dns/nsec3.h>
@@ -175,8 +175,8 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	}

 parse_acl:
-	result = cfg_acl_fromconfig(aclobj, config, actx, named_g_mctx, 0,
-				    &acl);
+	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
+				    named_g_mctx, 0, &acl);
 	if (result != ISC_R_SUCCESS) {
 		return (result);
 	}
@@ -203,11 +203,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
 	bool autoddns = false;
 	isc_result_t result = ISC_R_SUCCESS;
-	char debug[1024];
-	isc_buffer_t dbuf;
-
-	isc_buffer_init(&dbuf, debug, sizeof(debug));
-	isc_buffer_setmctx(&dbuf, mctx);

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);

@@ -242,9 +237,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_t b;
 		dns_ssuruletype_t *types;
 		unsigned int i, n;
-		char namebuf[DNS_NAME_FORMATSIZE];

-		isc_buffer_clear(&dbuf);
 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
@@ -253,23 +246,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		} else {
 			UNREACHABLE();
 		}
-		isc_buffer_putstr(&dbuf, str);
-
-		dns_fixedname_init(&fident);
-		str = cfg_obj_asstring(identity);
-		isc_buffer_constinit(&b, str, strlen(str));
-		isc_buffer_add(&b, strlen(str));
-		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
-					   dns_rootname, 0, NULL);
-		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(identity, ISC_LOG_ERROR,
-				    "'%s' is not a valid name", str);
-			goto cleanup;
-		}
-		dns_name_format(dns_fixedname_name(&fident), namebuf,
-				sizeof(namebuf));
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, namebuf);

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -278,8 +254,18 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		{
 			usezone = true;
 		}
-		isc_buffer_putstr(&dbuf, " ");
-		isc_buffer_putstr(&dbuf, str);
+
+		dns_fixedname_init(&fident);
+		str = cfg_obj_asstring(identity);
+		isc_buffer_constinit(&b, str, strlen(str));
+		isc_buffer_add(&b, strlen(str));
+		result = dns_name_fromtext(dns_fixedname_name(&fident), &b,
+					   dns_rootname, 0, NULL);
+		if (result != ISC_R_SUCCESS) {
+			cfg_obj_log(identity, named_g_lctx, ISC_LOG_ERROR,
+				    "'%s' is not a valid name", str);
+			goto cleanup;
+		}

 		dns_fixedname_init(&fname);
 		if (usezone) {
@@ -292,14 +278,11 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			result = dns_name_fromtext(dns_fixedname_name(&fname),
 						   &b, dns_rootname, 0, NULL);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, ISC_LOG_ERROR,
+				cfg_obj_log(identity, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "'%s' is not a valid name", str);
 				goto cleanup;
 			}
-			dns_name_format(dns_fixedname_name(&fname), namebuf,
-					sizeof(namebuf));
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, namebuf);
 		}

 		n = named_config_listcount(typelist);
@@ -323,8 +306,6 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			typeobj = cfg_listelt_value(element2);
 			str = cfg_obj_asstring(typeobj);
 			r.base = UNCONST(str);
-			isc_buffer_putstr(&dbuf, " ");
-			isc_buffer_putstr(&dbuf, str);

 			bracket = strchr(str, '(' /*)*/);
 			if (bracket != NULL) {
@@ -334,7 +315,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				if (max > 0xffff || end[0] != /*(*/ ')' ||
 				    end[1] != 0)
 				{
-					cfg_obj_log(identity, ISC_LOG_ERROR,
+					cfg_obj_log(identity, named_g_lctx,
+						    ISC_LOG_ERROR,
 						    "'%s' is not a valid count",
 						    bracket);
 					isc_mem_cput(mctx, types, n,
@@ -348,7 +330,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 			result = dns_rdatatype_fromtext(&types[i++].type, &r);
 			if (result != ISC_R_SUCCESS) {
-				cfg_obj_log(identity, ISC_LOG_ERROR,
+				cfg_obj_log(identity, named_g_lctx,
+					    ISC_LOG_ERROR,
 					    "'%.*s' is not a valid type",
 					    (int)r.length, str);
 				isc_mem_cput(mctx, types, n, sizeof(*types));
@@ -357,10 +340,9 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		}
 		INSIST(i == n);

-		isc_buffer_putuint8(&dbuf, '\0');
 		dns_ssutable_addrule(table, grant, dns_fixedname_name(&fident),
 				     mtype, dns_fixedname_name(&fname), n,
-				     types, isc_buffer_base(&dbuf));
+				     types);
 		if (types != NULL) {
 			isc_mem_cput(mctx, types, n, sizeof(*types));
 		}
@@ -375,7 +357,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		dns_ssuruletype_t any = { dns_rdatatype_any, 0 };

 		if (named_g_server->session_keyname == NULL) {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "failed to enable auto DDNS policy "
 				      "for zone %s: session key not found",
@@ -384,16 +366,15 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		dns_ssutable_addrule(
-			table, true, named_g_server->session_keyname,
-			dns_ssumatchtype_local, dns_zone_getorigin(zone), 1,
-			&any, "local");
+		dns_ssutable_addrule(table, true,
+				     named_g_server->session_keyname,
+				     dns_ssumatchtype_local,
+				     dns_zone_getorigin(zone), 1, &any);
 	}

 	dns_zone_setssutable(zone, table);

 cleanup:
-	isc_buffer_clearmctx(&dbuf);
 	dns_ssutable_detach(&table);
 	return (result);
 }
@@ -434,14 +415,14 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		sa = cfg_obj_assockaddr(address);
 		if (isc_sockaddr_getport(sa) != 0) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
 			return (ISC_R_FAILURE);
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
@@ -527,14 +508,14 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		isc_buffer_add(&b, strlen(str));
 		result = dns_name_fromtext(nsname, &b, dns_rootname, 0, NULL);
 		if (result != ISC_R_SUCCESS) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
 			return (result);
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
-			cfg_obj_log(zconfig, ISC_LOG_ERROR,
+			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
@@ -621,8 +602,8 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	 * to trigger delegation.
 	 */
 	if (ISC_LIST_EMPTY(rdatalist_ns.rdata)) {
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR,
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "No NS record is configured for a "
 			      "static-stub zone '%s'",
 			      zname);
@@ -873,7 +854,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * hierarchy supplied in 'maps'.
 	 */
 	if (named_config_get(maps, "notify", &obj) == ISC_R_SUCCESS) {
-		cfg_obj_log(obj, ISC_LOG_INFO,
+		cfg_obj_log(obj, named_g_lctx, ISC_LOG_INFO,
 			    "'notify explicit;' will be used for mirror zone "
 			    "'%s'",
 			    zname);
@@ -908,6 +889,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	static char dlz_dbtype[] = "dlz";
 	char *cpval = default_dbtype;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
+	dns_dialuptype_t dialup = dns_dialuptype_no;
 	dns_zonetype_t ztype;
 	int i;
 	int32_t journal_size;
@@ -993,7 +975,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t len;

 		if (cpval != default_dbtype) {
-			isc_log_write(NAMED_LOGCATEGORY_GENERAL,
+			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "zone '%s': both 'database' and 'dlz' "
 				      "specified",
@@ -1036,9 +1018,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype == dns_zone_primary && cpval == default_dbtype &&
 	    filename == NULL)
 	{
-		isc_log_write(NAMED_LOGCATEGORY_GENERAL, NAMED_LOGMODULE_SERVER,
-			      ISC_LOG_ERROR, "zone '%s': 'file' not specified",
-			      zname);
+		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
+			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
+			      "zone '%s': 'file' not specified", zname);
 		CHECK(ISC_R_FAILURE);
 	}

@@ -1067,7 +1049,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		const char *masterstylestr = cfg_obj_asstring(obj);

 		if (masterformat != dns_masterformat_text) {
-			cfg_obj_log(obj, ISC_LOG_ERROR,
+			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 				    "zone '%s': 'masterfile-style' "
 				    "can only be used with "
 				    "'masterfile-format text'",
@@ -1092,22 +1074,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setmaxrecords(zone, 0);
 	}

-	obj = NULL;
-	result = named_config_get(maps, "max-records-per-type", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxrrperset(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxrrperset(zone, 0);
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-types-per-name", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxtypepername(zone, 0);
-	}
-
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
@@ -1153,6 +1119,34 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				 zone, dns_zone_setqueryonacl,
 				 dns_zone_clearqueryonacl));

+	obj = NULL;
+	result = named_config_get(maps, "dialup", &obj);
+	INSIST(result == ISC_R_SUCCESS && obj != NULL);
+	if (cfg_obj_isboolean(obj)) {
+		if (cfg_obj_asboolean(obj)) {
+			dialup = dns_dialuptype_yes;
+		} else {
+			dialup = dns_dialuptype_no;
+		}
+	} else {
+		const char *dialupstr = cfg_obj_asstring(obj);
+		if (strcasecmp(dialupstr, "notify") == 0) {
+			dialup = dns_dialuptype_notify;
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
+			dialup = dns_dialuptype_notifypassive;
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
+			dialup = dns_dialuptype_refresh;
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
+			dialup = dns_dialuptype_passive;
+		} else {
+			UNREACHABLE();
+		}
+	}
+	if (raw != NULL) {
+		dns_zone_setdialup(raw, dialup);
+	}
+	dns_zone_setdialup(zone, dialup);
+
 	obj = NULL;
 	result = named_config_get(maps, "zone-statistics", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1208,8 +1202,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (ztype != dns_zone_stub && ztype != dns_zone_staticstub &&
 	    ztype != dns_zone_redirect)
 	{
-		bool logreports = false;
-
 		/* Make a reference to the default policy. */
 		result = dns_kasplist_find(kasplist, "default", &kasp);
 		INSIST(result == ISC_R_SUCCESS && kasp != NULL);
@@ -1225,7 +1217,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 							   &kasp);
 				if (result != ISC_R_SUCCESS) {
 					cfg_obj_log(
-						obj, ISC_LOG_ERROR,
+						obj, named_g_lctx,
+						ISC_LOG_ERROR,
 						"dnssec-policy '%s' not found ",
 						kaspname);
 					CHECK(result);
@@ -1351,7 +1344,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, ISC_LOG_ERROR,
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1413,11 +1406,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS);
 		dns_zone_setrequestixfr(zone, cfg_obj_asboolean(obj));

-		obj = NULL;
-		result = named_config_get(maps, "request-ixfr-max-diffs", &obj);
-		INSIST(result == ISC_R_SUCCESS);
-		dns_zone_setrequestixfrmaxdiffs(zone, cfg_obj_asuint32(obj));
-
 		obj = NULL;
 		checknames(ztype, maps, &obj);
 		INSIST(obj != NULL);
@@ -1483,51 +1471,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		dns_zone_setoption(zone, DNS_ZONEOPT_NSEC3TESTZONE,
 				   cfg_obj_asboolean(obj));
-
-		obj = NULL;
-		result = cfg_map_get(zoptions, "log-report-channel", &obj);
-		if (result == ISC_R_SUCCESS) {
-			logreports = cfg_obj_asboolean(obj);
-			dns_zone_setoption(zone, DNS_ZONEOPT_LOGREPORTS,
-					   logreports);
-		}
-		obj = NULL;
-		result = named_config_get(maps, "send-report-channel", &obj);
-		if (result == ISC_R_SUCCESS && obj != NULL) {
-			dns_fixedname_t fixed;
-			dns_name_t *rad = dns_fixedname_initname(&fixed);
-			const char *adstr = cfg_obj_asstring(obj);
-			dns_name_t *zn = dns_zone_getorigin(zone);
-
-			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
-						  mctx));
-			if (logreports || dns_name_equal(rad, dns_rootname)) {
-				/* Disable RC for error-logging zones or root */
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_equal(rad, zn)) {
-				/*
-				 * It's illegal to set a matching agent
-				 * domain at the zone level, but it could
-				 * be set in options/view. If so, and the
-				 * matching zone doesn't log reports, warn.
-				 */
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel is set to "
-					    "'%s' but that zone does not have "
-					    "log-report-channel set",
-					    zname);
-				dns_zone_setrad(zone, NULL);
-			} else if (dns_name_issubdomain(rad, zn)) {
-				cfg_obj_log(obj, ISC_LOG_WARNING,
-					    "send-report-channel '%s' ignored "
-					    "for zone '%s' because it is a "
-					    "subdomain of the zone",
-					    adstr, zname);
-				dns_zone_setrad(zone, NULL);
-			} else {
-				dns_zone_setrad(zone, rad);
-			}
-		}
 	} else if (ztype == dns_zone_redirect) {
 		dns_zone_setnotifytype(zone, dns_notifytype_no);

@@ -1546,7 +1489,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		} else {
 			uint64_t value = cfg_obj_asuint64(obj);
 			if (value > DNS_JOURNAL_SIZE_MAX) {
-				cfg_obj_log(obj, ISC_LOG_ERROR,
+				cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
 					    "'max-journal-size "
 					    "%" PRId64 "' "
 					    "is too large",
@@ -1587,7 +1530,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		updateacl = dns_zone_getupdateacl(mayberaw);
 		if (updateacl != NULL && dns_acl_isinsecure(updateacl)) {
-			isc_log_write(DNS_LOGCATEGORY_SECURITY,
+			isc_log_write(named_g_lctx, DNS_LOGCATEGORY_SECURITY,
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 				      "zone '%s' allows unsigned updates "
 				      "from remote hosts, which is insecure",
@@ -52,6 +52,7 @@
 #include <dns/dispatch.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
+#include <dns/log.h>
 #include <dns/masterdump.h>
 #include <dns/message.h>
 #include <dns/name.h>
@@ -116,12 +117,14 @@ static bool debugging = false, ddebugging = false;
 static bool memdebugging = false;
 static bool have_ipv4 = false;
 static bool have_ipv6 = false;
+static bool is_dst_up = false;
 static bool use_tls = false;
 static bool usevc = false;
 static bool usegsstsig = false;
 static bool local_only = false;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
+static isc_log_t *glctx = NULL;
 static isc_mem_t *gmctx = NULL;
 static dns_dispatchmgr_t *dispatchmgr = NULL;
 static dns_requestmgr_t *requestmgr = NULL;
@@ -196,7 +199,7 @@ send_update(dns_name_t *zonename, isc_sockaddr_t *primary);
 static void
 getinput(void *arg);

-ISC_NORETURN static void
+noreturn static void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 static void
@@ -557,7 +560,7 @@ failure:
 * Get a key from a named.conf format keyfile
 */
 static isc_result_t
-read_sessionkey(isc_mem_t *mctx) {
+read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *sessionkey = NULL;
 	const cfg_obj_t *key = NULL;
@@ -573,7 +576,7 @@ read_sessionkey(isc_mem_t *mctx) {
 		return (ISC_R_FILENOTFOUND);
 	}

-	result = cfg_parser_create(mctx, &pctx);
+	result = cfg_parser_create(mctx, lctx, &pctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -620,7 +623,7 @@ cleanup:
 }

 static void
-setup_keyfile(isc_mem_t *mctx) {
+setup_keyfile(isc_mem_t *mctx, isc_log_t *lctx) {
 	dst_key_t *dstkey = NULL;
 	isc_result_t result;
 	dst_algorithm_t hmac_alg = DST_ALG_UNKNOWN;
@@ -637,7 +640,7 @@ setup_keyfile(isc_mem_t *mctx) {

 	/* If that didn't work, try reading it as a session.key keyfile */
 	if (result != ISC_R_SUCCESS) {
-		result = read_sessionkey(mctx);
+		result = read_sessionkey(mctx, lctx);
 		if (result == ISC_R_SUCCESS) {
 			return;
 		}
@@ -810,12 +813,15 @@ setup_system(void *arg ISC_ATTR_UNUSED) {

 	ddebug("setup_system()");

-	logconfig = isc_logconfig_get();
-	isc_log_createandusechannel(logconfig, "debug", ISC_LOG_TOFILEDESC,
-				    ISC_LOG_DYNAMIC, ISC_LOGDESTINATION_STDERR,
-				    ISC_LOG_PRINTTIME, ISC_LOGCATEGORY_DEFAULT,
-				    ISC_LOGMODULE_DEFAULT);
-	isc_log_setdebuglevel(logdebuglevel);
+	isc_log_create(gmctx, &glctx, &logconfig);
+	isc_log_setcontext(glctx);
+	dns_log_init(glctx);
+	dns_log_setcontext(glctx);
+
+	result = isc_log_usechannel(logconfig, "default_debug", NULL, NULL);
+	check_result(result, "isc_log_usechannel");
+
+	isc_log_setdebuglevel(glctx, logdebuglevel);

 	result = irs_resconf_load(gmctx, resolvconf, &resconf);
 	if (result != ISC_R_SUCCESS && result != ISC_R_FILENOTFOUND) {
@@ -920,6 +926,10 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	result = dns_dispatchmgr_create(gmctx, loopmgr, netmgr, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

+	result = dst_lib_init(gmctx, NULL);
+	check_result(result, "dst_lib_init");
+	is_dst_up = true;
+
 	set_source_ports(dispatchmgr);

 	if (have_ipv6) {
@@ -968,13 +978,13 @@ setup_system(void *arg ISC_ATTR_UNUSED) {
 	if (keystr != NULL) {
 		setup_keystr();
 	} else if (local_only) {
-		result = read_sessionkey(gmctx);
+		result = read_sessionkey(gmctx, glctx);
 		if (result != ISC_R_SUCCESS) {
 			fatal("can't read key from %s: %s\n", keyfile,
 			      isc_result_totext(result));
 		}
 	} else if (keyfile != NULL) {
-		setup_keyfile(gmctx);
+		setup_keyfile(gmctx, glctx);
 	}

 	isc_mutex_init(&answer_lock);
@@ -3483,6 +3493,9 @@ cleanup(void) {
 	}
 #endif /* ifdef HAVE_GSSAPI */

+	ddebug("Removing log context");
+	isc_log_destroy(&glctx);
+
 	ddebug("Destroying memory context");
 	if (memdebugging) {
 		isc_mem_stats(gmctx, stderr);
@@ -3490,6 +3503,12 @@ cleanup(void) {

 	isc_mutex_destroy(&answer_lock);

+	if (is_dst_up) {
+		ddebug("Destroy DST lib");
+		dst_lib_destroy();
+		is_dst_up = false;
+	}
+
 	ddebug("Shutting down managers");
 	isc_managers_destroy(&gmctx, &loopmgr, &netmgr);
 }
@@ -32,6 +32,7 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -43,6 +44,7 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
+#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -229,7 +231,8 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -240,20 +243,20 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v6", &f6));
 	CHECK(parse_filter_a_on(fmap, "filter-a-on-v4", &f4));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is 'none;' but "
 			    "either filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-a\" is set but "
 			    "neither filter-a-on-v6 or filter-a-on-v4 "
 			    "is enabled");
@@ -271,28 +274,28 @@ cleanup:
 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, void *actx) {
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v6", &inst->v6_a));
 	CHECK(parse_filter_a_on(param_obj, "filter-a-on-v4", &inst->v4_a));

 	result = cfg_map_get(param_obj, "filter-a", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->a_acl));
 	} else {
@@ -324,12 +327,13 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
-		ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO,
 		      "registering 'filter-a' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -340,7 +344,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, actx));
+				       cfg_line, mctx, lctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -363,20 +367,21 @@ cleanup:

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -32,6 +32,7 @@
 #include <dns/acl.h>
 #include <dns/db.h>
 #include <dns/enumtype.h>
+#include <dns/log.h>
 #include <dns/message.h>
 #include <dns/rdataset.h>
 #include <dns/types.h>
@@ -43,6 +44,7 @@

 #include <ns/client.h>
 #include <ns/hooks.h>
+#include <ns/log.h>
 #include <ns/query.h>
 #include <ns/types.h>

@@ -230,7 +232,8 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 }

 static isc_result_t
-check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
+check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	const cfg_obj_t *aclobj = NULL;
 	dns_acl_t *acl = NULL;
@@ -241,20 +244,20 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, void *actx) {
 		return (result);
 	}

-	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg,
+	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
 				 (cfg_aclconfctx_t *)actx, mctx, 0, &acl));

 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v4", &f4));
 	CHECK(parse_filter_aaaa_on(fmap, "filter-aaaa-on-v6", &f6));

 	if ((f4 != NONE || f6 != NONE) && dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is 'none;' but "
 			    "either filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
 		result = ISC_R_FAILURE;
 	} else if (f4 == NONE && f6 == NONE && !dns_acl_isnone(acl)) {
-		cfg_obj_log(aclobj, ISC_LOG_WARNING,
+		cfg_obj_log(aclobj, lctx, ISC_LOG_WARNING,
 			    "\"filter-aaaa\" is set but "
 			    "neither filter-aaaa-on-v4 or filter-aaaa-on-v6 "
 			    "is enabled");
@@ -272,21 +275,21 @@ cleanup:
 static isc_result_t
 parse_parameters(filter_instance_t *inst, const char *parameters,
 		 const void *cfg, const char *cfg_file, unsigned long cfg_line,
-		 isc_mem_t *mctx, void *actx) {
+		 isc_mem_t *mctx, isc_log_t *lctx, void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	const cfg_obj_t *obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 	CHECK(parse_filter_aaaa_on(param_obj, "filter-aaaa-on-v4",
 				   &inst->v4_aaaa));
@@ -295,7 +298,7 @@ parse_parameters(filter_instance_t *inst, const char *parameters,

 	result = cfg_map_get(param_obj, "filter-aaaa", &obj);
 	if (result == ISC_R_SUCCESS) {
-		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg,
+		CHECK(cfg_acl_fromconfig(obj, (const cfg_obj_t *)cfg, lctx,
 					 (cfg_aclconfctx_t *)actx, mctx, 0,
 					 &inst->aaaa_acl));
 	} else {
@@ -327,12 +330,13 @@ cleanup:
 */
 isc_result_t
 plugin_register(const char *parameters, const void *cfg, const char *cfg_file,
-		unsigned long cfg_line, isc_mem_t *mctx, void *actx,
-		ns_hooktable_t *hooktable, void **instp) {
+		unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+		void *actx, ns_hooktable_t *hooktable, void **instp) {
 	filter_instance_t *inst = NULL;
 	isc_result_t result = ISC_R_SUCCESS;

-	isc_log_write(NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS, ISC_LOG_INFO,
+	isc_log_write(lctx, NS_LOGCATEGORY_GENERAL, NS_LOGMODULE_HOOKS,
+		      ISC_LOG_INFO,
 		      "registering 'filter-aaaa' "
 		      "module from %s:%lu, %s parameters",
 		      cfg_file, cfg_line, parameters != NULL ? "with" : "no");
@@ -344,7 +348,7 @@ plugin_register(const char *parameters, const void *cfg, const char *cfg_file,

 	if (parameters != NULL) {
 		CHECK(parse_parameters(inst, parameters, cfg, cfg_file,
-				       cfg_line, mctx, actx));
+				       cfg_line, mctx, lctx, actx));
 	}

 	isc_ht_init(&inst->ht, mctx, 1, ISC_HT_CASE_SENSITIVE);
@@ -367,20 +371,21 @@ cleanup:

 isc_result_t
 plugin_check(const char *parameters, const void *cfg, const char *cfg_file,
-	     unsigned long cfg_line, isc_mem_t *mctx, void *actx) {
+	     unsigned long cfg_line, isc_mem_t *mctx, isc_log_t *lctx,
+	     void *actx) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_parser_t *parser = NULL;
 	cfg_obj_t *param_obj = NULL;
 	isc_buffer_t b;

-	CHECK(cfg_parser_create(mctx, &parser));
+	CHECK(cfg_parser_create(mctx, lctx, &parser));

 	isc_buffer_constinit(&b, parameters, strlen(parameters));
 	isc_buffer_add(&b, strlen(parameters));
 	CHECK(cfg_parse_buffer(parser, &b, cfg_file, cfg_line,
 			       &cfg_type_parameters, 0, &param_obj));

-	CHECK(check_syntax(param_obj, cfg, mctx, actx));
+	CHECK(check_syntax(param_obj, cfg, mctx, lctx, actx));

 cleanup:
 	if (param_obj != NULL) {
@@ -87,7 +87,7 @@ static int32_t timeout = RNDC_TIMEOUT;
 static void
 rndc_startconnect(isc_sockaddr_t *addr);

-ISC_NORETURN static void
+noreturn static void
 usage(int status);

 static void
@@ -132,9 +132,6 @@ command is one of the following:\n\
  halt		Stop the server without saving pending updates.\n\
  halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
-  skr -import file zone [class [view]]\n\
-		Import a SKR file for the specified zone, for offline KSK\n\
-		signing.\n\
  loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
  managed-keys refresh [class [view]]\n\
@@ -529,8 +526,8 @@ rndc_start(void *arg) {
 }

 static void
-parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
-	     cfg_obj_t **configp) {
+parse_config(isc_mem_t *mctx, isc_log_t *log, const char *keyname,
+	     cfg_parser_t **pctxp, cfg_obj_t **configp) {
 	isc_result_t result;
 	const char *conffile = admin_conffile;
 	const cfg_obj_t *addresses = NULL;
@@ -573,7 +570,7 @@ parse_config(isc_mem_t *mctx, const char *keyname, cfg_parser_t **pctxp,
 			admin_keyfile, admin_conffile);
 	}

-	DO("create parser", cfg_parser_create(mctx, pctxp));
+	DO("create parser", cfg_parser_create(mctx, log, pctxp));

 	/*
 	 * The parser will output its own errors, so DO() is not used.
@@ -809,7 +806,9 @@ int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	bool show_final_mem = false;
+	isc_log_t *log = NULL;
 	isc_logconfig_t *logconfig = NULL;
+	isc_logdestination_t logdest;
 	cfg_parser_t *pctx = NULL;
 	cfg_obj_t *config = NULL;
 	const char *keyname = NULL;
@@ -955,15 +954,20 @@ main(int argc, char **argv) {

 	isc_nm_settimeouts(netmgr, timeout, timeout, timeout, 0);

-	logconfig = isc_logconfig_get();
+	isc_log_create(rndc_mctx, &log, &logconfig);
+	isc_log_setcontext(log);
 	isc_log_settag(logconfig, progname);
-	isc_log_createandusechannel(
-		logconfig, "default_stderr", ISC_LOG_TOFILEDESC, ISC_LOG_INFO,
-		ISC_LOGDESTINATION_STDERR,
-		ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL, ISC_LOGCATEGORY_DEFAULT,
-		ISC_LOGMODULE_DEFAULT);
+	logdest.file.stream = stderr;
+	logdest.file.name = NULL;
+	logdest.file.versions = ISC_LOG_ROLLNEVER;
+	logdest.file.maximum_size = 0;
+	isc_log_createchannel(logconfig, "stderr", ISC_LOG_TOFILEDESC,
+			      ISC_LOG_INFO, &logdest,
+			      ISC_LOG_PRINTTAG | ISC_LOG_PRINTLEVEL);
+	DO("enabling log channel",
+	   isc_log_usechannel(logconfig, "stderr", NULL, NULL));

-	parse_config(rndc_mctx, keyname, &pctx, &config);
+	parse_config(rndc_mctx, log, keyname, &pctx, &config);

 	isc_buffer_allocate(rndc_mctx, &databuf, 2048);

@@ -999,6 +1003,9 @@ main(int argc, char **argv) {

 	isccc_ccmsg_invalidate(&rndc_ccmsg);

+	isc_log_destroy(&log);
+	isc_log_setcontext(NULL);
+
 	cfg_obj_destroy(pctx, &config);
 	cfg_parser_destroy(&pctx);

@@ -152,15 +152,6 @@ Currently supported commands are:

   See also :option:`rndc delzone` and :option:`rndc modzone`.

-.. option:: closelogs
-
-   This command closes currently open log files.  It is intended to be used
-   by external log rotation tools following this proceedure.
-
-   1) rename the log files
-   2) run ``rndc closelogs``
-   3) optionally compress the log files
-
 .. option:: delzone [-clean] zone [class [view]]

   This command deletes a zone while the server is running.
@@ -266,11 +257,6 @@ Currently supported commands are:

   See also :option:`rndc stop`.

-.. option:: skr -import file zone [class [view]]
-
-   This command allows you to import a SKR file for the specified zone, to
-   support offline KSK signing.
-
 .. option:: loadkeys [zone [class [view]]]

   This command fetches all DNSSEC keys for the given zone from the key directory. If
@@ -429,10 +415,8 @@ Currently supported commands are:

   The first list includes all unique clients that are waiting for
   recursion to complete, including the query that is awaiting a
-   response, the timestamp (seconds since the Unix epoch) of
-   when named started processing this client query, the client's
-   address, and the transport over which the the query was received
-   (UDP, TCP, TLS, or HTTP).
+   response and the timestamp (seconds since the Unix epoch) of
+   when named started processing this client query.

   The second list comprises of domains for which there are active
   (or recently active) fetches in progress.  It reports the number
@@ -460,27 +444,14 @@ Currently supported commands are:

 .. program:: rndc

-.. option:: responselog [on | off]
-
-   This command enables or disables response logging. For backward compatibility,
-   this command can also be used without an argument to toggle response logging
-   on and off.
-
-   Unlike query logging, response logging cannot be enabled by explicitly directing
-   the ``responses`` ``category`` to a ``channel`` in the ``logging`` section
-   of :iscman:`named.conf`, but it can still be enabled by specifying
-   ``responselog yes;`` in the ``options`` section of :iscman:`named.conf`.
-
-.. option:: retransfer [-force] zone [class [view]]
+.. option:: retransfer zone [class [view]]

   This command retransfers the given secondary zone from the primary server.

   If the zone is configured to use ``inline-signing``, the signed
   version of the zone is discarded; after the retransfer of the
   unsigned version is complete, the signed version is regenerated
-   with new signatures. With the optional ``-force`` argument provided
-   if there is an ongoing zone transfer it will be aborted before a new zone
-   transfer is scheduled.
+   with new signatures.

 .. option:: scan

@@ -36,7 +36,7 @@ ISC_LANG_BEGINDECLS
 void
 notify(const char *fmt, ...) ISC_FORMAT_PRINTF(1, 2);

-ISC_NORETURN void
+noreturn void
 fatal(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);

 ISC_LANG_ENDDECLS
@@ -3,6 +3,7 @@ nxtify
 sdig
 *_test
 gsstest
+conf.sh
 dlopen
 keycreate
 keydelete
@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/env python
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -9,20 +9,16 @@ named.lock
 named.pid
 named.run
 /feature-test
-/legacy.run.sh
 /makejournal
 /random.data
 /*.log
 /*.trs
 /*.xml
 /resolve
-/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
 /ifconfig.sh
-/isctest/vars/.ac_vars/*
-!/isctest/vars/.ac_vars/*.in

 # Ignore file names with underscore in their name except python or shell files.
 # This is done to ignore the temporary directories and symlinks created by the
@@ -11,6 +11,10 @@ dist-hook:

 SUBDIRS = dyndb/driver dlzexternal/driver hooks/driver

+if DNSRPS
+SUBDIRS += rpz/testlib
+endif
+
 AM_CPPFLAGS +=			\
 	$(LIBISC_CFLAGS) 	\
 	$(LIBDNS_CFLAGS)
@@ -27,7 +31,8 @@ noinst_PROGRAMS =		\
 	feature-test		\
 	makejournal		\
 	pipelined/pipequeries	\
-	rndc/gencheck
+	rndc/gencheck		\
+	rpz/dnsrps

 feature_test_CPPFLAGS =		\
 	$(AM_CPPFLAGS)		\
@@ -55,6 +60,16 @@ pipelined_pipequeries_LDADD =	\
 	$(LDADD)		\
 	$(LIBDNS_LIBS)

+rpz_dnsrps_CPPFLAGS =		\
+	$(AM_CPPFLAGS)		\
+	$(LIBDNS_CFLAGS)	\
+	-DLIBRPZ_LIB_OPEN=\"$(abs_builddir)/rpz/testlib/.libs/libdummyrpz.so\"
+
+rpz_dnsrps_LDADD =		\
+	$(LDADD)		\
+	$(LIBDNS_LIBS)		\
+	$(DLOPEN_LIBS)
+
 # Longer running tests are listed (and executed) first to take the most
 # advantage of parallel execution.
 TESTS =				\
@@ -80,8 +95,8 @@ TESTS =				\
 	checknames		\
 	checkzone		\
 	cookie			\
-	cpu			\
 	database		\
+	dialup			\
 	digdelv			\
 	dispatch		\
 	dlzexternal		\
@@ -51,7 +51,6 @@ To run system tests, make sure you have the following dependencies installed:
 - perl
 - dnspython
 - pytest-xdist (for parallel execution)
- python-jinja2 (for tests which use jinja templates)

 Individual system tests might also require additional dependencies. If those
 are missing, the affected tests will be skipped and should produce a message
@@ -155,17 +154,9 @@ system test directories may contain the following standard files:
 - `tests_*.py`: These python files are picked up by pytest as modules. If they
  contain any test functions, they're added to the test suite.

- `*.j2`: These jinja2 templates can be used for configuration files or any
-  other files which require certain variables filled in, e.g. ports from the
-  environment variables. During test setup, the pytest runner will automatically
-  fill those in and strip the filename extension .j2, e.g. `ns1/named.conf.j2`
-  becomes `ns1/named.conf`. When using advanced templating to conditionally
-  include/omit entire sections or when filling in custom variables used for the
-  test, ensure the templates always include the defaults. If you don't need the
-  file to be auto-templated during test setup, use `.j2.manual` instead and then
-  no defaults are needed.
-
- `setup.sh`: This sets up the preconditions for the tests.
+- `setup.sh`: This sets up the preconditions for the tests. Although optional,
+  virtually all tests will require such a file to set up the ports they should
+  use for the test.

 - `tests.sh`: Any shell-based tests are located within this file. Runs the
  actual tests.
@@ -19,9 +19,3 @@ key rndc_key {
 	algorithm       hmac-sha256;
 	secret          "1234abcd8765";
 };
-
-/* Regresssion test for [GL #4991] */
-server example.com {
-	key rndc-key;
-	addresses { localhost; 127.0.0.1; ::1; };
-};
@@ -25,7 +25,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
-	allow-transfer { any; };
 	allow-query { any; };
 	allow-new-zones yes;
 	recursion no;
@@ -23,7 +23,6 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-query { any; };
-	allow-transfer { any; };
 	recursion no;
 	allow-new-zones yes;
 	dnssec-validation no;
@@ -23,7 +23,6 @@ options {
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
 	allow-query { any; };
-	allow-transfer { any; };
 	recursion no;
 	allow-new-zones yes;
 	dnssec-validation no;
@@ -11,11 +11,10 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-rm -f */named.conf
 rm -f */named.memstats
 rm -f */named.run
-rm -f */named.run.prev
+rm -f */named.conf
 rm -f dig.out.test*
-rm -f ns*/managed-keys.bind* ns*/*mkeys*
 rm -f ns2/example.com.bk
 rm -f ns2/example.net.bk
+rm -f ns*/managed-keys.bind* ns*/*mkeys*
@@ -1,23 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
-*._er                   TXT     "Report received"
@@ -22,12 +22,9 @@ options {
 	recursion no;
 	notify yes;
 	dnssec-validation no;
-	send-report-channel "example.rad";
 };

 view main in {
-	allow-transfer { any; };
-
 	zone example.net {
 		type primary;
 		file "example.net.db";
@@ -36,18 +33,6 @@ view main in {
 	zone example.com {
 		type primary;
 		file "example.com.db";
-		send-report-channel "rad.example.net";
-	};
-
-	zone rad {
-		type primary;
-		file "rad.db";
-	};
-
-	zone example.rad {
-		type primary;
-		file "example.rad.db";
-		log-report-channel yes;
 	};
 };

@@ -1,24 +0,0 @@
-; Copyright (C) Internet Systems Consortium, Inc. ("ISC")
-;
-; SPDX-License-Identifier: MPL-2.0
-;
-; This Source Code Form is subject to the terms of the Mozilla Public
-; License, v. 2.0.  If a copy of the MPL was not distributed with this
-; file, you can obtain one at https://mozilla.org/MPL/2.0/.
-;
-; See the COPYRIGHT file distributed with this work for additional
-; information regarding copyright ownership.
-
-$TTL 300        ; 5 minutes
-@                       IN SOA  ns root (
-				2018010100 ; serial
-				1800       ; refresh (30 minutes)
-				1800       ; retry (30 minutes)
-				1814400    ; expire (3 weeks)
-				3600       ; minimum (1 hour)
-				)
-			NS      ns
-ns                      A       10.53.0.1
-server			A	10.53.0.100
-
-example			NS	ns
@@ -186,57 +186,5 @@ lines=$(wc -l <dig.out.test$n)
 [ $ret -eq 0 ] || echo_i "failed"
 status=$((status + ret))

-n=$((n + 1))
-echo_i "check that a Report-Channel EDNS option is added to responses ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.net >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that Report-Channel option is omitted for names in error-logging zones ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.rad >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that Report-Channel option is omitted for zones above the agent-domain ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 rad >dig.out.test$n
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that a zone-level Report-Channel EDNS option is added to responses ($n)"
-ret=0
-$DIG $DIGOPTS @10.53.0.1 example.com >dig.out.test$n
-grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that error report queries are logged and no Report-Channel option is present in the response ($n)"
-ret=0
-nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.rad TXT >dig.out.test$n
-nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.rad/IN'" >/dev/null || ret=1
-grep "; Report-Channel: \"example.rad\"" dig.out.test$n >/dev/null && ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
-n=$((n + 1))
-echo_i "check that error report queries to non-logging zones are not logged ($n)"
-ret=0
-nextpart ns1/named.run >/dev/null
-$DIG $DIGOPTS @10.53.0.1 _er.0.example.1._er.example.com TXT >dig.out.test$n
-nextpart ns1/named.run | grep "dns-reporting-agent '_er.0.example.1._er.example.com/IN'" >/dev/null && ret=1
-grep "; Report-Channel: \"rad.example.net\"" dig.out.test$n >/dev/null || ret=1
-[ $ret -eq 0 ] || echo_i "failed"
-status=$((status + ret))
-
 echo_i "exit status: $status"
 [ $status -eq 0 ] || exit 1
@@ -21,7 +21,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.1; };
 	listen-on-v6 { none; };
-	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -21,7 +21,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.2; };
 	listen-on-v6 { none; };
-	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -157,7 +157,10 @@ $DSFROMKEY $ksk.key >dsset-${zone}.
 # None of these algorithms are supported for signing in FIPS mode
 # as they are MD5 and SHA1 based.
 #
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if (
+  cd ..
+  $SHELL ../testcrypto.sh -q RSASHA1
+); then
  setup nsec-only.example
  cp $infile $zonefile
  ksk=$($KEYGEN -q -a RSASHA1 -fk $zone 2>kg.out) || dumpit kg.out
@@ -24,7 +24,6 @@ options {
 	pid-file "named.pid";
 	listen-on { 10.53.0.3; };
 	listen-on-v6 { none; };
-	allow-transfer { any; };
 	recursion no;
 	notify yes;
 	dnssec-validation yes;
@@ -892,7 +892,7 @@ checkprivate nsec3.nsec3.example 10.53.0.3 || ret=1
 checkprivate nsec3.optout.example 10.53.0.3 || ret=1
 checkprivate nsec3-to-nsec.example 10.53.0.3 2 || ret=1  # automatically removed
 checkprivate nsec3-to-nsec3.example 10.53.0.3 2 || ret=1 # automatically removed
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  checkprivate nsec-only.example 10.53.0.3 || ret=1
 fi
 checkprivate oldsigs.example 10.53.0.3 2 || ret=1 # pre-signed
@@ -1252,7 +1252,7 @@ del=$(grep "DNSKEY .* is now deleted" ns2/named.run | wc -l)
 [ "$del" -eq 0 ] || ret=1
 pub=$(grep "DNSKEY .* is now published" ns3/named.run | grep -v "CDNSKEY" | wc -l)
 act=$(grep "DNSKEY .* is now active" ns3/named.run | wc -l)
-if [ $RSASHA1_SUPPORTED = 1 ]; then
+if $SHELL ../testcrypto.sh -q RSASHA1; then
  # Include two log lines for nsec-only zone.
  [ "$pub" -eq 53 ] || ret=1
  [ "$act" -eq 53 ] || ret=1
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Matthijs Mekking	f089e25217	Add unit test case for issue #4702 Add the found erroneous case to the unit tests.	2024-04-30 17:39:39 +02:00
Matthijs Mekking	1fa199fba2	Add a unit test case for converting \000\009 Sanity checking that this domain converts to the key I am expecting. Also fix some of the other names that had trailing 0x02 bits.	2024-04-30 17:38:26 +02:00