WIP use user+net namespace

WIP namespaces.py
2024-06-24 16:31:21 +02:00 · 2024-06-24 16:30:09 +02:00
1412 changed files with 62371 additions and 70681 deletions
@@ -79,5 +79,3 @@ PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
 ForEachMacros: [ 'cds_lfs_for_each', 'cds_lfs_for_each_safe', 'cds_list_for_each_entry_safe', 'ISC_LIST_FOREACH', 'ISC_LIST_FOREACH_SAFE', 'ISC_LIST_FOREACH_REV', 'ISC_LIST_FOREACH_REV_SAFE' ]
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -78,5 +78,3 @@ PenaltyBreakString: 80
 PenaltyExcessCharacter: 100
 Standard: Cpp11
 ContinuationIndentWidth: 8
-RemoveParentheses: ReturnStatement
-RemoveSemicolon: true
@@ -1540,11 +1540,3 @@ ffbe6b95371c99b7fb05e6de17a8d6b7bf4f629f
 79d93600116faabd89798522817ad95a69684fff
 # Reformat sources with up-to-date clang-format-18
 b7de2c7cb959fa35099d72c3f9b13938348c74e6
-# Reformat sources with up-to-date clang-format-19
-0aeefb974197ccf05c3f25c20506b4e8b97ded5d
-# Reformat sources with up-to-date clang-format-19
-f2fa1b7d63100564dc55463a05bdeed893f83d86
-# Remove redundant semicolons after the closing braces of functions
-c22176c0f9a71217be9bfab00573f8f0265499af
-# Remove redundant parentheses from the return statement
-58a15d38c2c321fac75abef389a48ff82deaccf0
@@ -10,4 +10,4 @@
 /util/**			 export-ignore
 /util/bindkeys.pl		-export-ignore
 /util/check-make-install.in	-export-ignore
-/util/dtrace.sh		-export-ignore
+/util/mksymtbl.pl		-export-ignore
@@ -1 +0,0 @@
-contrib/gitchangelog/changelog.rc.py
@@ -96,7 +96,6 @@ doc/man/pkcs11-tokens.8in
 /GPATH
 /GRTAGS
 /GTAGS
-TAGS
 # Emacs specific files
 \.dir-locals-2.el
 /emacs.desktop
@@ -46,6 +46,7 @@ confidential!
  - [ ] [:link:][step_backports]         **(SwEng)** Prepare backports of the merge request addressing the problem for all affected (and still maintained) branches of a given product
  - [ ] [:link:][step_finish_advisory]   **(Support)** Finish preparing the Security Advisory
  - [ ] [:link:][step_meta_issue]        **(QA)** Create (or update) the private issue containing links to fixes & reproducers for all CVEs fixed in a given release cycle
+  - [ ] [:link:][step_changes]           **(QA)** (BIND 9 only) Reserve a block of `CHANGES` placeholders once the complete set of vulnerabilities fixed in a given release cycle is determined
  - [ ] [:link:][step_merge_fixes]       **(QA)** Merge the CVE fixes in CVE identifier order
  - [ ] [:link:][step_patches]           **(QA)** Prepare a standalone patch for the last stable release of each affected (and still maintained) product branch
  - [ ] [:link:][step_asn_releases]      **(QA)** Prepare ASN releases (as outlined in the Release Checklist)
@@ -1,5 +1,4 @@
 Alan Clegg <aclegg@isc.org>
-Alessio Podda <alessio@isc.org>
 Aram Sargsyan <aram@isc.org>
 Artem Boldariev <artem@isc.org> <artem@boldariev.com>
 Curtis Blackburn <ckb@isc.org> <ckb@freebsd11.local>
@@ -1,10 +1,4 @@
-[IMPORTS]
-
-deprecated-modules=
-    dns.resolver,
-
-[MESSAGES CONTROL]
-
+[MASTER]
 disable=
    C0103, # invalid-name
    C0114, # missing-module-docstring
@@ -12,17 +6,6 @@ disable=
    C0116, # missing-function-docstring
    C0209, # consider-using-f-string
    C0301, # line-too-long, handled better by black
-    C0302, # too-many-lines
    C0415, # import-outside-toplevel
    R0801, # duplicate-code
-    R0901, # too-many-ancestors
-    R0902, # too-many-instance-attributes
    R0903, # too-few-public-methods
-    R0904, # too-many-public-methods
-    R0911, # too-many-return-statements
-    R0912, # too-many-branches
-    R0913, # too-many-arguments
-    R0914, # too-many-locals
-    R0915, # too-many-statements
-    R0916, # too-many-boolean-expressions
-    R0917, # too-many-positional-arguments
@@ -6,9 +6,6 @@ build:
  os: ubuntu-22.04
  tools:
    python: "3.11"
-  jobs:
-    pre_build:
-      - python -m pip install -r https://gitlab.isc.org/isc-projects/bind9/-/raw/main/doc/arm/requirements.txt

 # Build documentation in doc/arm/ with Sphinx
 sphinx:
@@ -16,3 +13,8 @@ sphinx:

 # Build all formats
 formats: all
+
+# Explicitly set the version of Python and its requirements
+python:
+   install:
+   - requirements: doc/arm/requirements.txt
@@ -26,6 +26,7 @@ Files: **/*.after*
       .gitlab/*
       .mailmap
       AUTHORS
+       CHANGES
       COPYRIGHT
       Makefile
       Makefile.*
@@ -73,11 +74,6 @@ Files: **/*.after*
       bin/tests/system/masterfile/knowngood.include
       bin/tests/system/masterfile/knowngood.ttl1
       bin/tests/system/masterfile/knowngood.ttl2
-       bin/tests/system/notify/CA/CA.cfg
-       bin/tests/system/notify/CA/README
-       bin/tests/system/notify/CA/index.txt
-       bin/tests/system/notify/CA/index.txt.attr
-       bin/tests/system/notify/CA/serial
       bin/tests/system/notify/ns4/named.port.in
       bin/tests/system/nsupdate/CA/CA.cfg
       bin/tests/system/nsupdate/CA/README
@@ -123,6 +119,7 @@ Files: **/*.after*
       doc/arm/*.dia
       doc/arm/*.png
       doc/arm/isc-logo.pdf
+       doc/arm/requirements.txt
       doc/man/*.1in
       doc/man/*.5in
       doc/man/*.8in
@@ -194,8 +191,6 @@ Files: **/.clang-format
       .readthedocs.yaml
       .tsan-suppress
       .uncrustify.cfg
-       contrib/gitchangelog/changelog.rc.py
-       contrib/gitchangelog/relnotes.rc.py
       doc/misc/*.zoneopt
       doc/misc/options
       doc/misc/rndc.grammar
@@ -11,7 +11,7 @@ See the COPYRIGHT file distributed with this work for additional
 information regarding copyright ownership.
 -->
 ## BIND 9 Source Access and Contributor Guidelines
-*Nov 26, 2024*
+*May 28, 2020*

 ### Contents

@@ -72,13 +72,13 @@ To clone the repository, use:
 >       $ git clone https://gitlab.isc.org/isc-projects/bind9.git

 Release branch names are of the form `bind-9.X`, where X represents the second
-number in the BIND 9 version number.  So, to check out the BIND 9.20
+number in the BIND 9 version number.  So, to check out the BIND 9.18
 branch, use:

->       $ git checkout bind-9.20
+>       $ git checkout bind-9.18

 Whenever a branch is ready for publication, a tag is placed of the
-form `v9.X.Y`.  The 9.20.0 release, for instance, is tagged as `v9.20.0`.
+form `v9.X.Y`.  The 9.18.0 release, for instance, is tagged as `v9.18.0`.

 The branch in which the next major release is being developed is called
 `main`.
@@ -121,9 +121,8 @@ patch will be applied.
 #### <a name="bind"></a>BIND code

 Patches for BIND may be submitted directly via merge requests in
-[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source repository for
-BIND. Please contact ISC and provide your GitLab username in order to be allowed
-to fork the project and submit merge requests.
+[ISC's GitLab](https://gitlab.isc.org/isc-projects/bind9/) source
+repository for BIND.

 Patches can also be submitted as diffs against a specific version of
 BIND -- preferably the current top of the `main` branch.  Diffs may
@@ -145,8 +144,8 @@ we're busy with other work, it may take us a long time to get to it.
 To ensure your patch is acted on as promptly as possible, please:

 * Try to adhere to the [BIND 9 coding style](doc/dev/style.md).
-* Run unit and system tests to ensure your change hasn't caused any
-  functional regressions (these can be checked in the CI pipeline).
+* Run `make check` to ensure your change hasn't caused any
+  functional regressions.
 * Document your work, both in the patch itself and in the
  accompanying email.
 * In patches that make non-trivial functional changes, include system
@@ -157,12 +156,12 @@ To ensure your patch is acted on as promptly as possible, please:
 ##### Changes to `configure`

 If you need to make changes to `configure`, you should not edit it
-directly; instead, edit `configure.ac`, then run `autoconf`.  Similarly,
-instead of editing `config.h.in` directly, edit `configure.ac` and run
+directly; instead, edit `configure.in`, then run `autoconf`.  Similarly,
+instead of editing `config.h.in` directly, edit `configure.in` and run
 `autoheader`.

 When submitting a patch as a diff, it's fine to omit the `configure`
-diffs to save space.  Just send the `configure.ac` diffs and we'll
+diffs to save space.  Just send the `configure.in` diffs and we'll
 generate the new `configure` during the review process.

 ##### Documentation
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -21,6 +21,7 @@ EXTRA_DIST =			\
 	util/bindkeys.pl	\
 	util/dtrace.sh		\
 	contrib			\
+	CHANGES			\
 	COPYRIGHT		\
 	LICENSE			\
 	*.md
@@ -1 +1 @@
-doc/arm/changelog.rst
+CHANGES
@@ -20,6 +20,7 @@ information regarding copyright ownership.
 1. [Building BIND](#build)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
+1. [Change log](#changes)
 1. [Acknowledgments](#ack)

 ### <a name="intro"/> Introduction
@@ -48,7 +49,8 @@ ongoing maintenance and improvement. BIND is open source software
 licensed under the terms of the Mozilla Public License, version 2.0.

 For a detailed list of changes made throughout the history of BIND 9, see
-the [changelog](doc/arm/changelog.rst).
+the file [CHANGES](CHANGES). See [below](#changes) for details on the
+CHANGES file format.

 For up-to-date versions and release notes, see
 [https://www.isc.org/download/](https://www.isc.org/download/).
@@ -161,9 +163,38 @@ can be found in the ISC Knowledgebase at
 Additional information on various subjects can be found in other
 `README` files throughout the source tree.

+### <a name="changes"/> Change log
+
+A detailed list of all changes that have been made throughout the
+development of BIND 9 is included in the file CHANGES, with the most recent
+changes listed first. Change notes include tags indicating the category of
+the change that was made; these categories are:
+
+|Category	|Description	        			|
+|--------------	|-----------------------------------------------|
+| [func] | New feature |
+| [bug] | General bug fix |
+| [security] | Fix for a significant security flaw |
+| [experimental] | Used for new features when the syntax or other aspects of the design are still in flux and may change |
+| [port] | Portability enhancement |
+| [maint] | Updates to built-in data such as root server addresses and keys |
+| [tuning] | Changes to built-in configuration defaults and constants to improve performance |
+| [performance] | Other changes to improve server performance |
+| [protocol] | Updates to the DNS protocol such as new RR types |
+| [test] | Changes to the automatic tests, not affecting server functionality |
+| [cleanup] | Minor corrections and refactoring |
+| [doc] | Documentation |
+| [contrib] | Changes to the contributed tools and libraries in the 'contrib' subdirectory |
+| [placeholder] | Used in the main development branch to reserve change numbers for use in other branches, e.g., when fixing a bug that only exists in older releases |
+
+In general, [func] and [experimental] tags only appear in new-feature
+releases (i.e., those with version numbers ending in zero). Some new
+functionality may be backported to older releases on a case-by-case basis.
+All other change types may be applied to all currently supported releases.
+
 #### Bug report identifiers

-Most notes in the ARM Changelog appendix include a reference to a bug report or
+Most notes in the CHANGES file include a reference to a bug report or
 issue number. Prior to 2018, these were usually of the form `[RT #NNN]`
 and referred to entries in the "bind9-bugs" RT database, which was not open
 to the public. More recent entries use the form `[GL #NNN]` or, less often,
@@ -146,14 +146,14 @@ logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL) {
-		return false;
+		return (false);
 	}

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static bool
@@ -177,7 +177,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 		aaaa->type == dns_rdatatype_aaaa);

 	if (a == NULL || aaaa == NULL) {
-		return answer;
+		return (answer);
 	}

 	memset(&hints, 0, sizeof(hints));
@@ -234,7 +234,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -243,7 +243,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}

 	/*
@@ -371,7 +371,7 @@ checkmissing:
 		}
 	}
 	freeaddrinfo(ai);
-	return answer;
+	return (answer);
 }

 static bool
@@ -434,7 +434,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return answer;
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -448,7 +448,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -457,7 +457,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

@@ -521,7 +521,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			}
 		}
 		freeaddrinfo(ai);
-		return answer;
+		return (answer);

 	case EAI_NONAME:
 #if defined(EAI_NODATA) && (EAI_NODATA != EAI_NONAME)
@@ -535,7 +535,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return true;
+		return (true);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -544,7 +544,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return true;
+		return (true);
 	}
 }

@@ -573,7 +573,7 @@ setup_logging(isc_mem_t *mctx, FILE *errout, isc_log_t **logp) {
 		      ISC_R_SUCCESS);

 	*logp = log;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% load the zone */
@@ -648,7 +648,7 @@ cleanup:
 	if (zone != NULL) {
 		dns_zone_detach(&zone);
 	}
-	return result;
+	return (result);
 }

 /*% dump the zone */
@@ -679,7 +679,7 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 				"could not open output "
 				"file \"%s\" for writing\n",
 				filename);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 	}

@@ -689,5 +689,5 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		(void)isc_stdio_close(output);
 	}

-	return result;
+	return (result);
 }
@@ -86,10 +86,10 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 		cfg_obj_log(obj, logc, ISC_LOG_ERROR,
 			    "change directory to '%s' failed: %s\n", directory,
 			    isc_result_totext(result));
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
@@ -97,10 +97,10 @@ get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return true;
+			return (true);
 		}
 	}
 }
@@ -116,7 +116,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL) {
-			return false;
+			return (false);
 		}
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
@@ -125,7 +125,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		}
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return true;
+			return (true);
 		}
 		for (element = cfg_list_first(checknames); element != NULL;
 		     element = cfg_list_next(element))
@@ -139,7 +139,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return true;
+			return (true);
 		}
 	}
 }
@@ -152,23 +152,23 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 	isc_textregion_t r;

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	r.base = UNCONST(zclass);
 	r.length = strlen(zclass);
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_rootns_create(mctx, rdclass, zfile, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_db_detach(&db);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*% configure the zone */
@@ -224,18 +224,18 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
 	}
 	if (inviewobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "type", &typeobj);
 	if (typeobj == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (list) {
 		const char *ztype = cfg_obj_asstring(typeobj);
 		printf("%s %s %s %s\n", zname, zclass, view, ztype);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -245,12 +245,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "dlz", &dlzobj);
 	if (dlzobj != NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	cfg_map_get(zoptions, "file", &fileobj);
@@ -264,12 +264,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * master and redirect
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
-		return configure_hint(zfile, zclass, mctx);
+		return (configure_hint(zfile, zclass, mctx));
 	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
 		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -282,12 +282,12 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		}

 		if (primariesobj != NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}

 	if (zfile == NULL) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	obj = NULL;
@@ -465,7 +465,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		fprintf(stderr, "%s/%s/%s: %s\n", view, zname, zclass,
 			isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 /*% configure a view */
@@ -500,7 +500,7 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 			result = tresult;
 		}
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -510,11 +510,11 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
-	return dns_rdataclass_fromtext(classp, &r);
+	return (dns_rdataclass_fromtext(classp, &r));
 }

 /*% load zones from the configuration */
@@ -572,7 +572,7 @@ load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
 	}

 cleanup:
-	return result;
+	return (result);
 }

 static void
@@ -593,7 +593,7 @@ main(int argc, char **argv) {
 	const char *conffile = NULL;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
-	bool cleanup_dst = false;
+	bool cleanup_dst = true;
 	bool load_zones = false;
 	bool list_zones = false;
 	bool print = false;
@@ -769,5 +769,5 @@ cleanup:
 		isc_mem_destroy(&mctx);
 	}

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -571,5 +571,5 @@ main(int argc, char **argv) {
 	}
 	isc_mem_destroy(&mctx);

-	return (result == ISC_R_SUCCESS) ? 0 : 1;
+	return ((result == ISC_R_SUCCESS) ? 0 : 1);
 }
@@ -44,24 +44,24 @@ alg_fromtext(const char *name) {
 	}

 	if (strcasecmp(p, "md5") == 0) {
-		return DST_ALG_HMACMD5;
+		return (DST_ALG_HMACMD5);
 	}
 	if (strcasecmp(p, "sha1") == 0) {
-		return DST_ALG_HMACSHA1;
+		return (DST_ALG_HMACSHA1);
 	}
 	if (strcasecmp(p, "sha224") == 0) {
-		return DST_ALG_HMACSHA224;
+		return (DST_ALG_HMACSHA224);
 	}
 	if (strcasecmp(p, "sha256") == 0) {
-		return DST_ALG_HMACSHA256;
+		return (DST_ALG_HMACSHA256);
 	}
 	if (strcasecmp(p, "sha384") == 0) {
-		return DST_ALG_HMACSHA384;
+		return (DST_ALG_HMACSHA384);
 	}
 	if (strcasecmp(p, "sha512") == 0) {
-		return DST_ALG_HMACSHA512;
+		return (DST_ALG_HMACSHA512);
 	}
-	return DST_ALG_UNKNOWN;
+	return (DST_ALG_UNKNOWN);
 }

 /*%
@@ -71,19 +71,19 @@ int
 alg_bits(dns_secalg_t alg) {
 	switch (alg) {
 	case DST_ALG_HMACMD5:
-		return 128;
+		return (128);
 	case DST_ALG_HMACSHA1:
-		return 160;
+		return (160);
 	case DST_ALG_HMACSHA224:
-		return 224;
+		return (224);
 	case DST_ALG_HMACSHA256:
-		return 256;
+		return (256);
 	case DST_ALG_HMACSHA384:
-		return 384;
+		return (384);
 	case DST_ALG_HMACSHA512:
-		return 512;
+		return (512);
 	default:
-		return 0;
+		return (0);
 	}
 }

@@ -30,7 +30,7 @@ set_user(FILE *fd, const char *user) {
 	pw = getpwnam(user);
 	if (pw == NULL) {
 		errno = EINVAL;
-		return -1;
+		return (-1);
 	}
-	return fchown(fileno(fd), pw->pw_uid, -1);
+	return (fchown(fileno(fd), pw->pw_uid, -1));
 }
@@ -290,5 +290,5 @@ options {\n\

 	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -296,5 +296,5 @@ nsupdate -k <keyfile>\n");

 	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=				\
 	$(LIBISC_CFLAGS)		\
 	$(LIBDNS_CFLAGS)		\
 	$(LIBNS_CFLAGS)			\
-	$(LIBISCCFG_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBISCCFG_CFLAGS)

 AM_CPPFLAGS +=				\
 	-DSYSCONFDIR=\"${sysconfdir}\"
@@ -88,10 +88,6 @@

 #define MAXNAME (DNS_NAME_MAXTEXT + 1)

-#define MAX_QUERIES  50
-#define MAX_TOTAL    200
-#define MAX_RESTARTS 11
-
 /* Variables used internally by delv. */
 char *progname = NULL;
 static isc_mem_t *mctx = NULL;
@@ -134,10 +130,6 @@ static bool showcomments = true, showdnssec = true, showtrust = true,
 	    multiline = false, short_form = false, print_unknown_format = false,
 	    yaml = false, fulltrace = false;

-static uint32_t maxqueries = MAX_QUERIES;
-static uint32_t maxtotal = MAX_TOTAL;
-static uint32_t restarts = MAX_RESTARTS;
-
 static bool resolve_trace = false, validator_trace = false,
 	    message_trace = false, send_trace = false;

@@ -608,7 +600,7 @@ setup_style(void) {
 						48, 80, 8, splitwidth, mctx);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -629,11 +621,11 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "failed to convert name %s: %s", text,
 			 isc_result_totext(result));
-		return result;
+		return (result);
 	}

 	*name = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -666,7 +658,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (anchor_name) {
@@ -674,11 +666,11 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client, dns_view_t *toview) {
 	}

 	if (!match_root) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	delv_log(ISC_LOG_DEBUG(3), "adding trust anchor %s", trust_anchor);
@@ -831,7 +823,7 @@ cleanup:
 		result = ISC_R_FAILURE;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -856,7 +848,7 @@ cleanup:
 	if (result == DST_R_NOCRYPTO) {
 		result = ISC_R_SUCCESS;
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -869,7 +861,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 	cfg_obj_t *bindkeys = NULL;

 	if (!root_validation) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (trust_anchor == NULL) {
@@ -936,7 +928,7 @@ cleanup:
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			 isc_result_totext(result));
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -983,7 +975,7 @@ addserver(dns_client_t *client) {
 		if (gaierror != 0) {
 			delv_log(ISC_LOG_ERROR, "getaddrinfo failed: %s",
 				 gai_strerror(gaierror));
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		result = ISC_R_SUCCESS;
@@ -1019,7 +1011,7 @@ cleanup:
 			 isc_result_totext(result));
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1088,7 +1080,7 @@ cleanup:
 	if (resconf != NULL) {
 		irs_resconf_destroy(&resconf);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -1101,10 +1093,10 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1199,47 +1191,6 @@ plus_option(char *option) {
 		break;
 	case 'm':
 		switch (cmd[1]) {
-		case 'a':
-			switch (cmd[3]) {
-			case 'q': /* maxqueries */
-				FULLCHECK("maxqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxqueries, value,
-						    UINT_MAX, "maxqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxqueries");
-				}
-				if (maxqueries == 0) {
-					fatal("maxqueries must be nonzero");
-				}
-				break;
-			case 't': /* maxtotalqueries */
-				FULLCHECK("maxtotalqueries");
-				if (value == NULL) {
-					goto need_value;
-				}
-				if (!state) {
-					goto invalid_option;
-				}
-				result = parse_uint(&maxtotal, value, UINT_MAX,
-						    "maxtotalqueries");
-				if (result != ISC_R_SUCCESS) {
-					fatal("Couldn't parse maxtotalqueries");
-				}
-				if (maxtotal == 0) {
-					fatal("maxtotalqueries must be "
-					      "nonzero");
-				}
-				break;
-			default:
-				goto invalid_option;
-			}
-			break;
 		case 't': /* mtrace */
 			FULLCHECK("mtrace");
 			message_trace = state;
@@ -1292,22 +1243,6 @@ plus_option(char *option) {
 		break;
 	case 'r':
 		switch (cmd[1]) {
-		case 'e': /* restarts */
-			FULLCHECK("restarts");
-			if (value == NULL) {
-				goto need_value;
-			}
-			if (!state) {
-				goto invalid_option;
-			}
-			result = parse_uint(&restarts, value, 255, "restarts");
-			if (result != ISC_R_SUCCESS) {
-				fatal("Couldn't parse restarts");
-			}
-			if (restarts == 0) {
-				fatal("restarts must be between 1..255");
-			}
-			break;
 		case 'o': /* root */
 			FULLCHECK("root");
 			if (state && no_sigs) {
@@ -1435,7 +1370,10 @@ plus_option(char *option) {
 		break;
 	default:
 	invalid_option:
-	need_value:
+		/*
+		 * We can also add a "need_value:" case here if we ever
+		 * add a plus-option that requires a specified value
+		 */
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
@@ -1508,7 +1446,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -1525,7 +1463,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	switch (opt) {
 	case 'a':
 		anchorfile = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 'b':
 		hash = strchr(value, '#');
 		if (hash != NULL) {
@@ -1562,7 +1500,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (hash != NULL) {
 			*hash = '#';
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if (classset) {
 			warn("extra query class");
@@ -1580,28 +1518,28 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid class");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'd':
 		result = parse_uint(&num, value, 99, "debug level");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse debug level");
 		}
 		loglevel = num;
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		port = value;
 		result = parse_uint(&destport, port, 0xffff, "port");
 		if (result != ISC_R_SUCCESS) {
 			fatal("Couldn't parse port number");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (curqname != NULL) {
 			warn("extra query name");
 			isc_mem_free(mctx, curqname);
 		}
 		curqname = isc_mem_strdup(mctx, value);
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		tr.base = value;
@@ -1622,7 +1560,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		} else {
 			warn("ignoring invalid type");
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value, false);
 		if (result == ISC_R_SUCCESS) {
@@ -1640,14 +1578,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*
@@ -1814,11 +1752,11 @@ parse_args(int argc, char **argv) {
 static isc_result_t
 append_str(const char *text, int len, char **p, char *end) {
 	if (len > end - *p) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1829,17 +1767,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = strlen(in);
 	}
-	return append_str(in, len, p, end);
+	return (append_str(in, len, p, end));
 }

 static isc_result_t
@@ -1858,10 +1796,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -1874,17 +1812,17 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append_str(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -1960,8 +1898,6 @@ run_resolve(void *arg) {
 	/* Create client */
 	CHECK(dns_client_create(mctx, loopmgr, netmgr, 0, tlsctx_client_cache,
 				&client, srcaddr4, srcaddr6));
-	dns_client_setmaxrestarts(client, restarts);
-	dns_client_setmaxqueries(client, maxtotal);

 	/* Set the nameserver */
 	if (server != NULL) {
@@ -2122,7 +2058,7 @@ accept_cb(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 	UNUSED(handle);
 	UNUSED(arg);

-	return result;
+	return (result);
 }

 static void
@@ -2181,23 +2117,16 @@ cleanup:

 static isc_result_t
 matchview(isc_netaddr_t *srcaddr, isc_netaddr_t *destaddr,
-	  dns_message_t *message, dns_aclenv_t *env, ns_server_t *lsctx,
-	  isc_loop_t *loop, isc_job_cb cb, void *cbarg,
-	  isc_result_t *sigresultp, isc_result_t *viewpatchresultp,
+	  dns_message_t *message, dns_aclenv_t *env, isc_result_t *sigresultp,
 	  dns_view_t **viewp) {
 	UNUSED(srcaddr);
 	UNUSED(destaddr);
 	UNUSED(message);
 	UNUSED(env);
-	UNUSED(lsctx);
-	UNUSED(loop);
-	UNUSED(cb);
-	UNUSED(cbarg);
 	UNUSED(sigresultp);

 	*viewp = view;
-	*viewpatchresultp = ISC_R_SUCCESS;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -2218,16 +2147,14 @@ run_server(void *arg) {
 	isc_sockaddr_any(&any);
 	CHECK(dns_dispatch_createudp(dispatchmgr, &any, &dispatch));
 	CHECK(ns_interfacemgr_create(mctx, sctx, loopmgr, netmgr, dispatchmgr,
-				     NULL, &interfacemgr));
+				     NULL, false, &interfacemgr));

-	CHECK(dns_view_create(mctx, loopmgr, dispatchmgr, dns_rdataclass_in,
-			      "_default", &view));
+	CHECK(dns_view_create(mctx, dispatchmgr, dns_rdataclass_in, "_default",
+			      &view));
 	CHECK(dns_cache_create(loopmgr, dns_rdataclass_in, "", mctx, &cache));
 	dns_view_setcache(view, cache, false);
 	dns_cache_detach(&cache);
 	dns_view_setdstport(view, destport);
-	dns_view_setmaxrestarts(view, restarts);
-	dns_view_setmaxqueries(view, maxtotal);

 	CHECK(dns_rootns_create(mctx, dns_rdataclass_in, hintfile, &roothints));
 	dns_view_sethints(view, roothints);
@@ -2241,7 +2168,6 @@ run_server(void *arg) {

 	CHECK(dns_view_createresolver(view, netmgr, 0, tlsctx_client_cache,
 				      dispatch, NULL));
-	dns_resolver_setmaxqueries(view->resolver, maxqueries);

 	isc_stats_create(mctx, &resstats, dns_resstatscounter_max);
 	dns_resolver_setstats(view->resolver, resstats);
@@ -2338,5 +2264,5 @@ cleanup:

 	isc_managers_destroy(&mctx, &loopmgr, &netmgr);

-	return 0;
+	return (0);
 }
@@ -337,23 +337,6 @@ assign values to options like the timeout interval. They have the form
   they are replaced by the string ``[omitted]`` or, in the DNSKEY case, the
   key ID is displayed as the replacement, e.g. ``[ key id = value ]``.

-.. option:: +restarts
-
-   When name server mode (``delv +ns``) is in use, this option sets the
-   maximum number of CNAME queries to follow before terminating resolution.
-   This prevents ``delv`` from hanging in the event of a CNAME loop.
-   The default is 11.
-
-.. option:: +maxqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a name before giving up. The default is 50.
-
-.. option:: +maxtotalqueries
-
-   This option specifies the maximum number of queries to send to resolve
-   a client request before giving up. The default is 200.
-
 .. option:: +trust, +notrust

   This option controls whether to display the trust level when printing a record.
@@ -5,8 +5,7 @@ AM_CPPFLAGS +=			\
 	$(LIBDNS_CFLAGS)	\
 	$(LIBISCCFG_CFLAGS)	\
 	$(LIBIDN2_CFLAGS)	\
-	$(LIBUV_CFLAGS)		\
-	$(OPENSSL_CFLAGS)
+	$(LIBUV_CFLAGS)

 LDADD +=			\
 	libdighost.la		\
@@ -89,9 +89,9 @@ rcode_totext(dns_rcode_t rcode) {
 	RUNTIME_CHECK(result == ISC_R_SUCCESS);
 	if (strspn(buf + 1, "0123456789") == strlen(buf + 1)) {
 		buf[0] = '?';
-		return buf;
+		return (buf);
 	}
-	return buf + 1;
+	return (buf + 1);
 }

 /*% print usage */
@@ -473,7 +473,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	if (query->lookup->trace || query->lookup->ns_search_only) {
 		result = dns_rdatatype_totext(rdata->type, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		ADD_STRING(buf, " ");
 	}
@@ -494,7 +494,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	result = dns_rdata_tofmttext(rdata, NULL, styleflags, 0, splitwidth,
 				     " ", buf);
 	if (result == ISC_R_NOSPACE) {
-		return result;
+		return (result);
 	}
 	check_result(result, "dns_rdata_totext");
 	if (query->lookup->identify) {
@@ -511,7 +511,7 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -535,14 +535,14 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 				      dns_rdatatype_aaaa, dns_rdatatype_none,
 				      NULL, &rdataset);
 	if (result == DNS_R_NXDOMAIN || result == DNS_R_NXRRSET) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_dns64_findprefix(rdataset, prefix, &count);
 	if (result == ISC_R_NOTFOUND) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	if (count > 10) {
 		count = 10;
@@ -550,15 +550,15 @@ dns64prefix_answer(dns_message_t *msg, isc_buffer_t *buf) {
 	for (i = 0; i < count; i++) {
 		result = isc_netaddr_totext(&prefix[i].addr, buf);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = isc_buffer_printf(buf, "/%u\n", prefix[i].prefixlen);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -578,9 +578,9 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 	dns_name_init(&empty_name, NULL);
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -595,7 +595,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 				dns_rdataset_current(rdataset, &rdata);
 				result = say_message(&rdata, query, buf);
 				if (result == ISC_R_NOSPACE) {
-					return result;
+					return (result);
 				}
 				check_result(result, "say_message");
 				loopresult = dns_rdataset_next(rdataset);
@@ -606,11 +606,11 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags, isc_buffer_t *buf,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
@@ -628,10 +628,10 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local)) {
-			return true;
+			return (true);
 		}
 	}
-	return false;
+	return (false);
 }

 /*
@@ -748,7 +748,8 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		char *hash;
 		int pf;

-		printf("- type: MESSAGE\n");
+		printf("-\n");
+		printf("  type: MESSAGE\n");
 		printf("  message:\n");

 		if (isquery) {
@@ -1024,7 +1025,7 @@ repopulate_buffer:

 	dig_idnsetup(query->lookup, false);

-	return result;
+	return (result);
 }

 /*%
@@ -1193,7 +1194,7 @@ proxy_handle_addr_string(const char *addr_start, const size_t addr_len,
 		}
 	}

-	return result;
+	return (result);
 }

 static bool
@@ -1213,7 +1214,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	/* start syntax analysis and verification */
 	if (!rule_proxy_addrs(&st)) {
 		warn("PROXY source and destination addresses cannot be parsed");
-		return false;
+		return (false);
 	}

 	/* get port numeric values */
@@ -1240,7 +1241,7 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY source address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	result = proxy_handle_addr_string(st.dst_addr_start, st.dst_addr_len,
@@ -1248,26 +1249,26 @@ parse_proxy_addresses(const char *addrs, isc_sockaddr_t *psrc,
 	if (result != ISC_R_SUCCESS) {
 		warn("Cannot get PROXY destination address: %s",
 		     isc_result_totext(result));
-		return false;
+		return (false);
 	}

 	/* addresses should be of the same type */
 	if (isc_sockaddr_pf(&src) != isc_sockaddr_pf(&dst)) {
 		warn("PROXY source and destination addresses must be of the "
 		     "same type");
-		return false;
+		return (false);
 	}

 	*psrc = src;
 	*pdst = dst;

-	return true;
+	return (true);
 }

 static bool
 rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->src_addr_start = st->last_addr_start;
@@ -1276,13 +1277,13 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->src_port_len = st->last_port_len;

 	if (!MATCH('-')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

 	if (!rule_addr(st)) {
-		return false;
+		return (false);
 	}

 	st->dst_addr_start = st->last_addr_start;
@@ -1291,17 +1292,17 @@ rule_proxy_addrs(isc_proxy_addrs_parser_state_t *st) {
 	st->dst_port_len = st->last_port_len;

 	if (!MATCH('\0')) {
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_addr(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!rule_addr_char(st)) {
-		return false;
+		return (false);
 	}

 	while (rule_addr_char(st)) {
@@ -1315,18 +1316,18 @@ rule_addr(isc_proxy_addrs_parser_state_t *st) {
 		ADVANCE();

 		if (!rule_port(st)) {
-			return false;
+			return (false);
 		}
 	}

-	return true;
+	return (true);
 }

 static bool
 rule_port(isc_proxy_addrs_parser_state_t *st) {
 	const char *start = GETP();
 	if (!MATCH_DIGIT()) {
-		return false;
+		return (false);
 	}

 	ADVANCE();
@@ -1338,18 +1339,18 @@ rule_port(isc_proxy_addrs_parser_state_t *st) {
 	st->last_port_start = start;
 	st->last_port_len = GETP() - start;

-	return true;
+	return (true);
 }

 static bool
 rule_addr_char(isc_proxy_addrs_parser_state_t *st) {
 	if (MATCH('#') || MATCH('-') || MATCH('\0')) {
-		return false;
+		return (false);
 	}

 	ADVANCE();

-	return true;
+	return (true);
 }

 #undef GETP
@@ -1366,20 +1367,20 @@ plus_proxy_handle_addresses(const char *value, const bool state,
 		 * We are not interested in the option value in that
 		 * case
 		 */
-		return true;
+		return (true);
 	}

 	if (value == NULL || *value == '\0') {
 		lookup->proxy_local = true;
-		return true;
+		return (true);
 	}

 	if (!parse_proxy_addresses(value, &lookup->proxy_src_addr,
 				   &lookup->proxy_dst_addr))
 	{
-		return false;
+		return (false);
 	}
-	return true;
+	return (true);
 }

 static bool
@@ -1402,10 +1403,10 @@ plus_proxy_options(const char *cmd, const char *value, const bool state,
 	default:
 		goto invalid_option;
 	}
-	return true;
+	return (true);

 invalid_option:
-	return false;
+	return (false);
 }

 static bool
@@ -1525,7 +1526,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,

 	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
 		printf(";; Invalid option %s\n", option);
-		return lookup;
+		return (lookup);
 	}
 	if (strncasecmp(cmd, "no", 2) == 0) {
 		cmd += 2;
@@ -1824,12 +1825,9 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "",
+						extra = strtok_r(NULL, "\0",
 								 &last);
 						save_opt(lookup, code, extra);
-						if (extra != NULL) {
-							extra[-1] = ':';
-						}
 						break;
 					default:
 						goto invalid_option;
@@ -2558,10 +2556,7 @@ plus_option(char *option, bool is_batchfile, bool *need_clone,
 		fprintf(stderr, "Invalid option: +%s\n", option);
 		usage();
 	}
-	if (value != NULL) {
-		value[-1] = '=';
-	}
-	return lookup;
+	return (lookup);

 #if !TARGET_OS_IPHONE
 exit_or_usage:
@@ -2607,7 +2602,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv4 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case '6':
@@ -2617,7 +2612,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			} else {
 				fatal("can't find IPv6 networking");
 				UNREACHABLE();
-				return false;
+				return (false);
 			}
 			break;
 		case 'd':
@@ -2626,7 +2621,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				cmd = option;
 				FULLCHECK("debug");
 				debugging = true;
-				return false;
+				return (false);
 			} else {
 				debugging = true;
 			}
@@ -2657,7 +2652,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U) {
 			option = &option[1];
 		} else {
-			return false;
+			return (false);
 		}
 	}
 	opt = option[0];
@@ -2701,7 +2696,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			*hash = '#';
 		}
 		specified_source = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
@@ -2720,13 +2715,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid class %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'f':
 		batchname = value;
-		return value_from_next;
+		return (value_from_next);
 	case 'k':
 		strlcpy(keyfile, value, sizeof(keyfile));
-		return value_from_next;
+		return (value_from_next);
 	case 'p':
 		result = parse_uint(&num, value, MAXPORT, "port number");
 		if (result != ISC_R_SUCCESS) {
@@ -2734,7 +2729,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		port = num;
 		port_set = true;
-		return value_from_next;
+		return (value_from_next);
 	case 'q':
 		if (!config_only) {
 			if (*need_clone) {
@@ -2753,7 +2748,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 't':
 		*open_type_class = false;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
@@ -2811,7 +2806,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				"invalid type %s\n",
 				value);
 		}
-		return value_from_next;
+		return (value_from_next);
 	case 'y':
 		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
@@ -2820,8 +2815,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 								    * secret */
 			usage();
 		}
-		if ((ptr3 = strtok_r(NULL, "", &last)) != NULL) { /* secret or
-								   * NULL */
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or
+								    * NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -2832,11 +2827,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
-		if (ptr3 != NULL) {
-			ptr[-1] = ':';
-		}
-		ptr2[-1] = ':';
-		return value_from_next;
+		return (value_from_next);
 	case 'x':
 		if (*need_clone) {
 			*lookup = clone_lookup(default_lookup, true);
@@ -2866,14 +2857,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(EXIT_FAILURE);
 		}
-		return value_from_next;
+		return (value_from_next);
 	invalid_option:
 	default:
 		fprintf(stderr, "Invalid option: -%s\n", option);
 		usage();
 	}
 	UNREACHABLE();
-	return false;
+	return (false);
 }

 /*%
@@ -2967,7 +2958,7 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 	{
 		debug("%s %d: %s", msg, bargc, bargv[bargc]);
 	}
-	return bargc;
+	return (bargc);
 }

 static void
@@ -3315,7 +3306,8 @@ dig_error(const char *format, ...) {
 	va_list args;

 	if (yaml) {
-		printf("- type: DIG_ERROR\n");
+		printf("-\n");
+		printf("  type: DIG_ERROR\n");

 		/*
 		 * Print an indent before a literal block quote.
@@ -3332,7 +3324,10 @@ dig_error(const char *format, ...) {
 	va_start(args, format);
 	vprintf(format, args);
 	va_end(args);
-	printf("\n"); /* We get the error without a newline */
+
+	if (!yaml) {
+		printf("\n");
+	}
 }

 static void
@@ -3428,5 +3423,5 @@ main(int argc, char **argv) {
 	dig_startup();
 	dig_shutdown();

-	return exitcode;
+	return (exitcode);
 }
@@ -60,7 +60,6 @@
 #include <isc/xml.h>

 #include <dns/byaddr.h>
-#include <dns/ede.h>
 #include <dns/fixedname.h>
 #include <dns/log.h>
 #include <dns/message.h>
@@ -237,7 +236,7 @@ count_dots(char *string) {
 		}
 		s++;
 	}
-	return i;
+	return (i);
 }

 static void
@@ -285,11 +284,11 @@ hex_dump(isc_buffer_t *b) {
 static isc_result_t
 append(const char *text, size_t len, char **p, char *end) {
 	if (*p + len > end) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	memmove(*p, text, len);
 	*p += len;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -300,17 +299,17 @@ reverse_octets(const char *in, char **p, char *end) {
 		isc_result_t result;
 		result = reverse_octets(dot + 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		result = append(".", 1, p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		len = (int)(dot - in);
 	} else {
 		len = (int)strlen(in);
 	}
-	return append(in, len, p, end);
+	return (append(in, len, p, end));
 }

 isc_result_t
@@ -329,10 +328,10 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		name = dns_fixedname_initname(&fname);
 		result = dns_byaddr_createptrname(&addr, name);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		dns_name_format(name, reverse, (unsigned int)len);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else {
 		/*
 		 * Not a valid IPv6 address.  Assume IPv4.
@@ -345,18 +344,18 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		char *p = reverse;
 		char *end = reverse + len;
 		if (strict && inet_pton(AF_INET, value, &addr.type.in) != 1) {
-			return DNS_R_BADDOTTEDQUAD;
+			return (DNS_R_BADDOTTEDQUAD);
 		}
 		result = reverse_octets(value, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		/* Append .in-addr.arpa. and a terminating NUL. */
 		result = append(".in-addr.arpa.", 15, &p, end);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -457,7 +456,7 @@ make_server(const char *servname, const char *userarg) {
 	strlcpy(srv->servername, servname, MXNAME);
 	strlcpy(srv->userarg, userarg, MXNAME);
 	ISC_LINK_INIT(srv, link);
-	return srv;
+	return (srv);
 }

 /*%
@@ -633,7 +632,7 @@ make_empty_lookup(void) {
 	debug("make_empty_lookup() = %p->references = %" PRIuFAST32, looknew,
 	      isc_refcount_current(&looknew->references));

-	return looknew;
+	return (looknew);
 }

 #define EDNSOPT_OPTIONS 100U
@@ -824,7 +823,7 @@ clone_lookup(dig_lookup_t *lookold, bool servers) {

 	looknew->magic = DIG_LOOKUP_MAGIC;

-	return looknew;
+	return (looknew);
 }

 /*%
@@ -854,7 +853,7 @@ requeue_lookup(dig_lookup_t *lookold, bool servers) {
 	ISC_LIST_PREPEND(lookup_list, looknew, link);
 	debug("after insertion, init -> %p, new = %p, new -> %p", lookold,
 	      looknew, looknew->link.next);
-	return looknew;
+	return (looknew);
 }

 void
@@ -915,20 +914,20 @@ parse_uint_helper(uint32_t *uip, const char *value, uint32_t max,
 	if (result != ISC_R_SUCCESS) {
 		printf("invalid %s '%s': %s\n", desc, value,
 		       isc_result_totext(result));
-		return result;
+		return (result);
 	}
 	*uip = n;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
 parse_uint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 10);
+	return (parse_uint_helper(uip, value, max, desc, 10));
 }

 isc_result_t
 parse_xint(uint32_t *uip, const char *value, uint32_t max, const char *desc) {
-	return parse_uint_helper(uip, value, max, desc, 0);
+	return (parse_uint_helper(uip, value, max, desc, 0));
 }

 static uint32_t
@@ -941,7 +940,7 @@ parse_bits(char *arg, const char *desc, uint32_t max) {
 		fatal("couldn't parse digest bits");
 	}
 	tmp = (tmp + 7) & ~0x7U;
-	return tmp;
+	return (tmp);
 }

 isc_result_t
@@ -1019,7 +1018,7 @@ done:
 	sa->length = prefix_length;
 	*sap = sa;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*
@@ -1095,7 +1094,7 @@ read_confkey(void) {
 	isc_result_t result;

 	if (!isc_file_exists(keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

 	result = cfg_parser_create(mctx, NULL, &pctx);
@@ -1136,7 +1135,7 @@ cleanup:
 		cfg_parser_destroy(&pctx);
 	}

-	return result;
+	return (result);
 }

 void
@@ -1206,7 +1205,7 @@ make_searchlist_entry(char *domain) {
 	strlcpy(search->origin, domain, MXNAME);
 	search->origin[MXNAME - 1] = 0;
 	ISC_LINK_INIT(search, link);
-	return search;
+	return (search);
 }

 static void
@@ -1550,13 +1549,13 @@ check_if_queries_done(dig_lookup_t *l, dig_query_t *except_q) {
 		if (!q->started || isc_refcount_current(&q->references) > 1) {
 			if (!q->canceled && q != except_q) {
 				debug("there is a pending query %p", q);
-				return false;
+				return (false);
 			}
 		}
 		q = ISC_LIST_NEXT(q, link);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -1866,7 +1865,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 			result = dns_message_findtype(name, dns_rdatatype_soa,
 						      0, &rdataset);
 			if (result == ISC_R_SUCCESS) {
-				return 0;
+				return (0);
 			}
 		}
 		rdataset = NULL;
@@ -1969,7 +1968,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 	if (lookup == NULL && section == DNS_SECTION_ANSWER &&
 	    (query->lookup->trace || query->lookup->ns_search_only))
 	{
-		return followup_lookup(msg, query, DNS_SECTION_AUTHORITY);
+		return (followup_lookup(msg, query, DNS_SECTION_AUTHORITY));
 	}

 	/*
@@ -2001,7 +2000,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section) {
 				    link);
 	}

-	return numLookups;
+	return (numLookups);
 }

 /*%
@@ -2028,7 +2027,7 @@ next_origin(dig_lookup_t *oldlookup) {
 		 * We're not using a search list, so don't even think
 		 * about finding the next entry.
 		 */
-		return false;
+		return (false);
 	}

 	/*
@@ -2040,14 +2039,14 @@ next_origin(dig_lookup_t *oldlookup) {
 	    (dns_name_isabsolute(name) ||
 	     (int)dns_name_countlabels(name) > ndots))
 	{
-		return false;
+		return (false);
 	}

 	if (oldlookup->origin == NULL && !oldlookup->need_search) {
 		/*
 		 * Then we just did rootorg; there's nothing left.
 		 */
-		return false;
+		return (false);
 	}
 	if (oldlookup->origin == NULL && oldlookup->need_search) {
 		newlookup = requeue_lookup(oldlookup, true);
@@ -2056,13 +2055,13 @@ next_origin(dig_lookup_t *oldlookup) {
 	} else {
 		search = ISC_LIST_NEXT(oldlookup->origin, link);
 		if (search == NULL && oldlookup->done_as_is) {
-			return false;
+			return (false);
 		}
 		newlookup = requeue_lookup(oldlookup, true);
 		newlookup->origin = search;
 	}
 	cancel_lookup(oldlookup);
-	return true;
+	return (true);
 }

 /*%
@@ -2165,7 +2164,7 @@ _new_query(dig_lookup_t *lookup, char *servname, char *userarg,
 	ISC_LINK_INIT(query, link);

 	query->magic = DIG_QUERY_MAGIC;
-	return query;
+	return (query);
 }

 /*%
@@ -2299,7 +2298,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				dns_message_puttempname(lookup->sendmsg,
 							&lookup->oname);
 				if (result == DNS_R_NAMETOOLONG) {
-					return false;
+					return (false);
 				}
 				fatal("'%s' is not in legal name syntax (%s)",
 				      lookup->textname,
@@ -2326,7 +2325,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				     isc_result_totext(result));
 #if TARGET_OS_IPHONE
 				clear_current_lookup();
-				return false;
+				return (false);
 #else  /* if TARGET_OS_IPHONE */
 				cleanup_openssl_refs();
 				digexit();
@@ -2659,7 +2658,7 @@ setup_lookup(dig_lookup_t *lookup) {
 		ISC_LIST_ENQUEUE(lookup->q, query, link);
 	}

-	return true;
+	return (true);
 }

 /*%
@@ -2786,12 +2785,6 @@ _cancel_lookup(dig_lookup_t *lookup, const char *file, unsigned int line) {
 	check_if_done();
 }

-static inline const char *
-get_tls_sni_hostname(dig_query_t *query) {
-	return query->lookup->tls_hostname_set ? query->lookup->tls_hostname
-					       : query->userarg;
-}
-
 static isc_tlsctx_t *
 get_create_tls_context(dig_query_t *query, const bool is_https,
 		       isc_tlsctx_client_session_cache_t **psess_cache) {
@@ -2810,7 +2803,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,

 	if (query->lookup->tls_key_file_set != query->lookup->tls_cert_file_set)
 	{
-		return NULL;
+		return (NULL);
 	}

 	isc_sockaddr_format(&query->sockaddr, tlsctxname, sizeof(tlsctxname));
@@ -2838,7 +2831,10 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 		}

 		if (store != NULL) {
-			const char *hostname = get_tls_sni_hostname(query);
+			const char *hostname =
+				query->lookup->tls_hostname_set
+					? query->lookup->tls_hostname
+					: query->userarg;
 			/*
 			 * According to RFC 8310, Subject field MUST NOT be
 			 * inspected when verifying hostname for DoT. Only
@@ -2886,7 +2882,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 			INSIST(*psess_cache == NULL);
 			*psess_cache = sess_cache;
 		}
-		return ctx;
+		return (ctx);
 	}

 	if (psess_cache != NULL) {
@@ -2895,7 +2891,7 @@ get_create_tls_context(dig_query_t *query, const bool is_https,
 	}

 	INSIST(!query->lookup->tls_ca_set || found_store != NULL);
-	return found_ctx;
+	return (found_ctx);
 failure:
 	if (ctx != NULL) {
 		isc_tlsctx_free(&ctx);
@@ -2910,7 +2906,7 @@ failure:
 	if (store != NULL && store != found_store) {
 		isc_tls_cert_store_free(&store);
 	}
-	return NULL;
+	return (NULL);
 }

 static void
@@ -3052,8 +3048,7 @@ start_tcp(dig_query_t *query) {
 		}
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, tlsctx,
-					get_tls_sni_hostname(query), sess_cache,
+					local_timeout, tlsctx, sess_cache,
 					proxy_type, ppi);
 #if HAVE_LIBNGHTTP2
 	} else if (query->lookup->https_mode) {
@@ -3073,15 +3068,14 @@ start_tcp(dig_query_t *query) {

 		isc_nm_httpconnect(netmgr, &localaddr, &query->sockaddr, uri,
 				   !query->lookup->https_get, tcp_connected,
-				   connectquery, tlsctx,
-				   get_tls_sni_hostname(query), sess_cache,
+				   connectquery, tlsctx, sess_cache,
 				   local_timeout, proxy_type, ppi);
 #endif
 	} else {
 		isc_nm_streamdnsconnect(netmgr, &localaddr, &query->sockaddr,
 					tcp_connected, connectquery,
-					local_timeout, NULL, NULL, NULL,
-					proxy_type, ppi);
+					local_timeout, NULL, NULL, proxy_type,
+					ppi);
 	}

 	return;
@@ -3237,7 +3231,7 @@ udp_ready(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_udp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3294,10 +3288,6 @@ start_udp(dig_query_t *query) {
 		return;
 	}

-	if (!port_set) {
-		port = 53;
-	}
-
 	result = get_address(query->servname, port, &query->sockaddr);
 	if (result != ISC_R_SUCCESS) {
 		/* This servname doesn't have an address. */
@@ -3366,12 +3356,12 @@ try_next_server(dig_lookup_t *lookup) {

 	current_query = lookup->current_query;
 	if (current_query == NULL || !ISC_LINK_LINKED(current_query, link)) {
-		return false;
+		return (false);
 	}

 	next_query = ISC_LIST_NEXT(current_query, link);
 	if (next_query == NULL) {
-		return false;
+		return (false);
 	}

 	debug("trying next server...");
@@ -3382,7 +3372,7 @@ try_next_server(dig_lookup_t *lookup) {
 		start_udp(next_query);
 	}

-	return true;
+	return (true);
 }

 static void
@@ -3433,10 +3423,10 @@ force_next(dig_query_t *query) {
 		isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
 		isc_netaddr_format(&netaddr, buf, sizeof(buf));

-		dighost_error("no response from %s", buf);
+		dighost_error("no response from %s\n", buf);
 	} else {
 		printf("%s", l->cmdline);
-		dighost_error("no servers could be reached");
+		dighost_error("no servers could be reached\n");
 	}

 	if (exitcode < 9) {
@@ -3660,7 +3650,7 @@ tcp_connected(isc_nmhandle_t *handle, isc_result_t eresult, void *arg) {
 			start_tcp(next);
 			check_if_done();
 		} else {
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");
 			clear_current_lookup();
 		}

@@ -3721,7 +3711,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	result = dns_message_firstname(msg, DNS_SECTION_ANSWER);
 	if (result != ISC_R_SUCCESS) {
 		puts("; Transfer failed.");
-		return true;
+		return (true);
 	}
 	do {
 		dns_name_t *name;
@@ -3747,7 +3737,7 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 				{
 					puts("; Transfer failed.  "
 					     "Didn't start with SOA answer.");
-					return true;
+					return (true);
 				}
 				if ((!query->second_rr_rcvd) &&
 				    (rdata.type != dns_rdatatype_soa))
@@ -3827,10 +3817,10 @@ check_for_more_data(dig_lookup_t *lookup, dig_query_t *query,
 	isc_nmhandle_detach(&query->readhandle);
 	launch_next_query(query);
 	query_detach(&query);
-	return false;
+	return (false);
 doexit:
 	dighost_received(len, peer, query);
-	return true;
+	return (true);
 }

 static void
@@ -3924,7 +3914,7 @@ process_opt(dig_lookup_t *l, dns_message_t *msg) {

 static int
 ednsvers(dns_rdataset_t *opt) {
-	return (opt->ttl >> 16) & 0xff;
+	return ((opt->ttl >> 16) & 0xff);
 }

 /*%
@@ -4113,7 +4103,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 			 * and cancel the lookup.
 			 */
 			printf("%s", l->cmdline);
-			dighost_error("no servers could be reached");
+			dighost_error("no servers could be reached\n");

 			if (exitcode < 9) {
 				exitcode = 9;
@@ -4138,7 +4128,8 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		if (l->tcp_mode) {
 			bool fail = true;
 			if (result == ISC_R_SUCCESS) {
-				if (!query->first_soa_rcvd || query->warn_id) {
+				if ((!query->first_soa_rcvd || query->warn_id))
+				{
 					dighost_warning("%s: ID mismatch: "
 							"expected ID %u, got "
 							"%u",
@@ -4246,15 +4237,7 @@ recv_done(isc_nmhandle_t *handle, isc_result_t eresult, isc_region_t *region,
 		goto keep_query;
 	}

-	if (msg->counts[DNS_SECTION_QUESTION] == 0) {
-		if (l->doing_xfr) {
-			if (query->msg_count == 0) {
-				dighost_warning("missing question section");
-			}
-		} else if (!l->header_only && msg->opcode == dns_opcode_query) {
-			dighost_warning("missing question section");
-		}
-	} else {
+	if (msg->counts[DNS_SECTION_QUESTION] != 0) {
 		match = true;
 		for (result = dns_message_firstname(msg, DNS_SECTION_QUESTION);
 		     result == ISC_R_SUCCESS && match;
@@ -4594,12 +4577,12 @@ get_address(char *host, in_port_t myport, isc_sockaddr_t *sockaddr) {
 	result = isc_getaddresses(host, myport, sockaddr, 1, &count);
 	isc_loopmgr_nonblocking(loopmgr);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	INSIST(count == 1);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 int
@@ -4621,7 +4604,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 			fatal("couldn't get address for '%s': %s", host,
 			      isc_result_totext(result));
 		}
-		return 0;
+		return (0);
 	}

 	for (i = 0; i < count; i++) {
@@ -4631,7 +4614,7 @@ getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp) {
 		ISC_LIST_APPEND(lookup->my_server_list, srv, link);
 	}

-	return count;
+	return (count);
 }

 /*%
@@ -4813,7 +4796,7 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	}
 	resetlocale(LC_ALL);
 	if (res != IDN2_OK) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/*
@@ -4821,14 +4804,14 @@ idn_filter(isc_buffer_t *buffer, unsigned int start) {
 	 */
 	dstlen = strlen(dst);
 	if (isc_buffer_length(buffer) < start + dstlen) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_subtract(buffer, srclen);
 	memmove(isc_buffer_used(buffer), dst, dstlen);
 	isc_buffer_add(buffer, dstlen);

 	idn2_free(dst);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -4894,8 +4877,8 @@ dig_idnsetup(dig_lookup_t *lookup, bool active) {
 bool
 dig_lookup_is_tls(const dig_lookup_t *lookup) {
 	if (lookup->tls_mode || (lookup->tls_ca_set && !lookup->https_mode)) {
-		return true;
+		return (true);
 	}

-	return false;
+	return (false);
 }
@@ -80,7 +80,6 @@ struct rtype rtypes[] = { { 1, "has address" },
 			  { 25, "has key" },
 			  { 28, "has IPv6 address" },
 			  { 29, "location" },
-			  { dns_rdatatype_https, "has HTTP service bindings" },
 			  { 0, NULL } };

 static char *
@@ -97,7 +96,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 noreturn static void
@@ -184,7 +183,6 @@ retry:
 	result = dns_rdata_totext(rdata, NULL, b);
 	if (result == ISC_R_NOSPACE) {
 		isc_buffer_free(&b);
-		INSIST(bufsize <= (UINT_MAX / 2));
 		bufsize *= 2;
 		goto retry;
 	}
@@ -223,9 +221,9 @@ printsection(dns_message_t *msg, dns_section_t sectionid,

 	result = dns_message_firstname(msg, sectionid);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	for (;;) {
@@ -263,7 +261,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 							     print_name, false,
 							     no_rdata, &target);
 				if (result != ISC_R_SUCCESS) {
-					return result;
+					return (result);
 				}
 #ifdef USEINITALWS
 				if (first) {
@@ -318,11 +316,11 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -342,12 +340,12 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	result = dns_rdataset_totext(rdataset, owner, false, false, &target);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	isc_buffer_usedregion(&target, &r);
 	printf("%.*s", (int)r.length, (char *)r.base);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -424,7 +422,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 				       : query->lookup->textname,
 			       msg->rcode, rcode_totext(msg->rcode));
 		}
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -458,16 +456,6 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
-		if (lookup != NULL) {
-			strlcpy(lookup->textname, namestr,
-				sizeof(lookup->textname));
-			lookup->rdtype = dns_rdatatype_https;
-			lookup->rdtypeset = true;
-			lookup->origin = NULL;
-			lookup->retries = tries;
-			ISC_LIST_APPEND(lookup_list, lookup, link);
-		}
 	}

 	if (!short_form) {
@@ -528,7 +516,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ANSWER])) {
@@ -538,7 +526,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
 				      !short_form, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}

@@ -549,7 +537,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!ISC_LIST_EMPTY(msg->sections[DNS_SECTION_ADDITIONAL]) &&
@@ -559,7 +547,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printsection(msg, DNS_SECTION_ADDITIONAL, "ADDITIONAL",
 				      true, query);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if ((tsig != NULL) && !short_form) {
@@ -567,7 +555,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		result = printrdata(msg, tsig, tsigname, "PSEUDOSECTION TSIG",
 				    true);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
 	if (!short_form) {
@@ -585,7 +573,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printf("%s has no %s record\n", namestr, typestr);
 	}
 	seen_error = force_error;
-	return result;
+	return (result);
 }

 static const char *optstring = "46aAc:dilnm:p:rst:vVwCDN:R:TUW:";
@@ -928,5 +916,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return (seen_error == 0) ? 0 : 1;
+	return ((seen_error == 0) ? 0 : 1);
 }
@@ -122,7 +122,7 @@ Options
   CNAME, NS, SOA, TXT, DNSKEY, AXFR, etc.

   When no query type is specified, :program:`host` automatically selects an
-   appropriate query type. By default, it looks for A, AAAA, MX, and HTTPS
+   appropriate query type. By default, it looks for A, AAAA, and MX
   records. If the :option:`-C` option is given, queries are made for SOA
   records. If ``name`` is a dotted-decimal IPv4 address or
   colon-delimited IPv6 address, :program:`host` queries for PTR records.
@@ -128,7 +128,7 @@ rcode_totext(dns_rcode_t rcode) {
 	} else {
 		totext.consttext = rcodetext[rcode];
 	}
-	return totext.deconsttext;
+	return (totext.deconsttext);
 }

 static void
@@ -189,7 +189,6 @@ printrdata(dns_rdata_t *rdata) {
 			check_result(result, "dns_rdata_totext");
 		}
 		isc_buffer_free(&b);
-		INSIST(size <= (UINT_MAX / 2));
 		size *= 2;
 	}
 }
@@ -210,9 +209,9 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -256,10 +255,10 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -294,9 +293,9 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,

 	result = dns_message_firstname(msg, section);
 	if (result == ISC_R_NOMORE) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	} else if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	for (;;) {
 		name = NULL;
@@ -338,10 +337,10 @@ detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
 		if (result == ISC_R_NOMORE) {
 			break;
 		} else if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -424,7 +423,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,

 		/* the lookup failed */
 		print_error |= 1;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (default_lookups && query->lookup->rdtype == dns_rdatatype_a) {
@@ -478,7 +477,7 @@ printmessage(dig_query_t *query, const isc_buffer_t *msgbuf, dns_message_t *msg,
 		printsection(query, msg, headers, DNS_SECTION_AUTHORITY);
 		printsection(query, msg, headers, DNS_SECTION_ADDITIONAL);
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -537,10 +536,10 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query type: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -554,10 +553,10 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS) {
-		return true;
+		return (true);
 	} else {
 		printf("unknown query class: %s\n", typetext);
-		return false;
+		return (false);
 	}
 }

@@ -975,5 +974,5 @@ main(int argc, char **argv) {
 	cancel_all();
 	destroy_libs();

-	return query_error | print_error;
+	return (query_error | print_error);
 }
@@ -48,10 +48,10 @@ readline(const char *prompt) {
 	line = fgets(buf, RL_MAXCMD, stdin);
 	if (line == NULL) {
 		free(buf);
-		return NULL;
+		return (NULL);
 	}
-	return buf;
-}
+	return (buf);
+};

 #define add_history(line)

@@ -395,7 +395,7 @@ formatset(dns_rdataset_t *rdataset) {
 	}

 	isc_buffer_putuint8(buf, 0);
-	return buf;
+	return (buf);
 }

 static void
@@ -505,14 +505,14 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return true;
+			return (true);
 		} else if (strictness == TIGHT) {
 			vbprintf(0,
 				 "key does not match %s %d %d %d "
 				 "when it looks like it should\n",
 				 c ? "CDS" : "DS", ds.key_tag, ds.algorithm,
 				 ds.digest_type);
-			return false;
+			return (false);
 		}
 	}

@@ -521,7 +521,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness) {
 		 ki->rdata.type == dns_rdatatype_cdnskey ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return false;
+	return (false);
 }

 /*
@@ -575,7 +575,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		}
 	}

-	return keytable;
+	return (keytable);
 }

 static void
@@ -681,7 +681,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 		}
 	}

-	return algo;
+	return (algo);
 }

 /*
@@ -698,7 +698,7 @@ signed_loose(dns_secalg_t *algo) {
 		}
 	}
 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return ok;
+	return (ok);
 }

 /*
@@ -740,7 +740,7 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	}

 	isc_mem_cput(mctx, algo, nkey, sizeof(algo[0]));
-	return all_ok;
+	return (all_ok);
 }

 /*
@@ -761,10 +761,10 @@ ds_from_cds(isc_buffer_t *buf, dns_rdata_t *rds, dns_dsdigest_t dt,
 	ds.common.rdtype = dns_rdatatype_ds;

 	if (ds.digest_type != dt) {
-		return ISC_R_IGNORE;
+		return (ISC_R_IGNORE);
 	}

-	return dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf);
+	return (dns_rdata_fromstruct(rds, rdclass, dns_rdatatype_ds, &ds, buf));
 }

 static isc_result_t
@@ -777,7 +777,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,

 	isc_buffer_availableregion(buf, &r);
 	if (r.length < DNS_DS_BUFFERSIZE) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}

 	result = dns_ds_buildrdata(name, cdnskey, dt, r.base, ds);
@@ -785,7 +785,7 @@ ds_from_cdnskey(isc_buffer_t *buf, dns_rdata_t *ds, dns_dsdigest_t dt,
 		isc_buffer_add(buf, DNS_DS_BUFFERSIZE);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -816,14 +816,14 @@ append_new_ds_set(ds_maker_func_t *ds_from_rdata, isc_buffer_t *buf,
 			continue;
 		case ISC_R_NOSPACE:
 			isc_mem_put(mctx, ds, sizeof(*ds));
-			return result;
+			return (result);
 		default:
 			isc_mem_put(mctx, ds, sizeof(*ds));
 			check_result(result, "ds_from_rdata()");
 		}
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -868,8 +868,8 @@ make_new_ds_set(ds_maker_func_t *ds_from_rdata, uint32_t ttl,

 static int
 rdata_cmp(const void *rdata1, const void *rdata2) {
-	return dns_rdata_compare((const dns_rdata_t *)rdata1,
-				 (const dns_rdata_t *)rdata2);
+	return (dns_rdata_compare((const dns_rdata_t *)rdata1,
+				  (const dns_rdata_t *)rdata2));
 }

 /*
@@ -950,7 +950,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	isc_mem_cput(mctx, ds, n, sizeof(dns_rdata_ds_t));
 	isc_mem_cput(mctx, arrdata, n, sizeof(dns_rdata_t));

-	return match;
+	return (match);
 }

 static void
@@ -1355,5 +1355,5 @@ cleanup:
 	print_mem_stats = true;
 	cleanup();

-	return 0;
+	return (0);
 }
@@ -66,7 +66,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return result;
+	return (result);
 }

 static void
@@ -138,7 +138,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -153,7 +153,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	if (dirname != NULL) {
 		/* allow room for a trailing slash */
 		if (strlen(dirname) >= isc_buffer_availablelength(&buf)) {
-			return ISC_R_NOSPACE;
+			return (ISC_R_NOSPACE);
 		}
 		isc_buffer_putstr(&buf, dirname);
 		if (dirname[strlen(dirname) - 1] != '/') {
@@ -162,18 +162,18 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 	}

 	if (isc_buffer_availablelength(&buf) < 7) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putstr(&buf, "keyset-");

 	result = dns_name_tofilenametext(name, false, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
 	isc_buffer_putuint8(&buf, 0);

-	return loadset(filename, rdataset);
+	return (loadset(filename, rdataset));
 }

 static void
@@ -558,8 +558,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -68,7 +68,7 @@ initname(char *setname) {
 	isc_buffer_init(&buf, setname, strlen(setname));
 	isc_buffer_add(&buf, strlen(setname));
 	result = dns_name_fromtext(name, &buf, dns_rootname, 0, NULL);
-	return result;
+	return (result);
 }

 static void
@@ -141,7 +141,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 	if (db != NULL) {
 		dns_db_detach(&db);
 	}
-	return result;
+	return (result);
 }

 static void
@@ -468,8 +468,8 @@ main(int argc, char **argv) {
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
-		return 1;
+		return (1);
 	} else {
-		return 0;
+		return (0);
 	}
 }
@@ -43,8 +43,6 @@

 const char *program = "dnssec-keyfromlabel";

-static uint16_t tag_min = 0, tag_max = 0xffff;
-
 noreturn static void
 usage(void);

@@ -72,7 +70,6 @@ usage(void) {
 			"key files\n");
 	fprintf(stderr, "    -k: generate a TYPE=KEY key\n");
 	fprintf(stderr, "    -L ttl: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -n nametype: ZONE | HOST | ENTITY | USER | "
 			"OTHER\n");
 	fprintf(stderr, "        (DNSKEY generation defaults to ZONE\n");
@@ -163,7 +160,7 @@ main(int argc, char **argv) {

 	isc_commandline_errprint = false;

-#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:M:n:P:p:R:S:t:v:Vy"
+#define CMDLINE_FLAGS "3A:a:Cc:D:E:Ff:GhI:i:kK:L:l:n:P:p:R:S:t:v:Vy"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
 		case '3':
@@ -210,20 +207,6 @@ main(int argc, char **argv) {
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
 			break;
-		case 'M': {
-			unsigned long ul;
-			tag_min = ul = strtoul(isc_commandline_argument, &endp,
-					       10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff || tag_max <= tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'n':
 			nametype = isc_commandline_argument;
 			break;
@@ -703,8 +686,7 @@ main(int argc, char **argv) {
 	 * is a risk of ID collision due to this key or another key
 	 * being revoked.
 	 */
-	if (key_collision(key, name, directory, mctx, tag_min, tag_max, &exact))
-	{
+	if (key_collision(key, name, directory, mctx, &exact)) {
 		isc_buffer_clear(&buf);
 		ret = dst_key_buildfilename(key, 0, directory, &buf);
 		if (ret != ISC_R_SUCCESS) {
@@ -761,5 +743,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-keyfromlabel - DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-M** tag_min:tag_max] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}
+:program:`dnssec-keyfromlabel` {**-l** label} [**-3**] [**-a** algorithm] [**-A** date/offset] [**-c** class] [**-D** date/offset] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-G**] [**-I** date/offset] [**-i** interval] [**-k**] [**-K** directory] [**-L** ttl] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-R** date/offset] [**-S** key] [**-t** type] [**-v** level] [**-V**] [**-y**] {name}

 Description
 ~~~~~~~~~~~
@@ -133,18 +133,6 @@ Options
   place, in which case the existing TTL would take precedence. Setting
   the default TTL to ``0`` or ``none`` removes it.

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of key tag values
-   that ``dnssec-keyfromlabel`` will accept. If the key tag of the new
-   key or the key tag of the revoked version of the new key is
-   outside this range, the new key will be rejected.  This is
-   designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid
-   values for ``tag_min`` and ``tag_max`` are [0..65535].  The
-   default allows all key tag values to be accepted.
-
 .. option:: -p protocol

   This option sets the protocol value for the key. The protocol is a number between
@@ -91,8 +91,6 @@ struct keygen_ctx {
 	char *type;
 	int protocol;
 	int size;
-	uint16_t tag_min;
-	uint16_t tag_max;
 	int signatory;
 	dns_rdataclass_t rdclass;
 	int options;
@@ -183,7 +181,6 @@ usage(void) {
 	fprintf(stderr, "    -f <keyflag>: ZSK | KSK | REVOKE\n");
 	fprintf(stderr, "    -F: FIPS mode\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
-	fprintf(stderr, "    -M <min>:<max>: allowed Key ID range\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
@@ -194,7 +191,7 @@ usage(void) {
 			"(default: AUTHCONF)\n");
 	fprintf(stderr, "    -h: print usage and exit\n");
 	fprintf(stderr, "    -m <memory debugging mode>:\n");
-	fprintf(stderr, "       usage | trace | record\n");
+	fprintf(stderr, "       usage | trace | record | size | mctx\n");
 	fprintf(stderr, "    -v <level>: set verbosity level (0 - 10)\n");
 	fprintf(stderr, "    -V: print version information\n");
 	fprintf(stderr, "Timing options:\n");
@@ -761,9 +758,7 @@ keygen(keygen_ctx_t *ctx, isc_mem_t *mctx, int argc, char **argv) {
 		 * if there is a risk of ID collision due to this key
 		 * or another key being revoked.
 		 */
-		if (key_collision(key, name, ctx->directory, mctx, ctx->tag_min,
-				  ctx->tag_max, NULL))
-		{
+		if (key_collision(key, name, ctx->directory, mctx, NULL)) {
 			conflict = true;
 			if (null_key) {
 				dst_key_free(&key);
@@ -873,8 +868,8 @@ main(int argc, char **argv) {
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS                                          \
-	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:M:m:n:P:p:qR:r:S:s:" \
+#define CMDLINE_FLAGS                                        \
+	"3A:a:b:Cc:D:d:E:Ff:GhI:i:K:k:L:l:m:n:P:p:qR:r:S:s:" \
 	"T:t:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -963,21 +958,6 @@ main(int argc, char **argv) {
 		case 'n':
 			ctx.nametype = isc_commandline_argument;
 			break;
-		case 'M': {
-			unsigned long ul;
-			ctx.tag_min = ul = strtoul(isc_commandline_argument,
-						   &endp, 10);
-			if (*endp != ':' || ul > 0xffff) {
-				fatal("-M range invalid");
-			}
-			ctx.tag_max = ul = strtoul(endp + 1, &endp, 10);
-			if (*endp != '\0' || ul > 0xffff ||
-			    ctx.tag_max <= ctx.tag_min)
-			{
-				fatal("-M range invalid");
-			}
-			break;
-		}
 		case 'm':
 			break;
 		case 'p':
@@ -1246,8 +1226,6 @@ main(int argc, char **argv) {
 			ctx.ksk = true;
 			ctx.zsk = true;
 			ctx.lifetime = 0;
-			ctx.tag_min = 0;
-			ctx.tag_max = 0xffff;

 			keygen(&ctx, mctx, argc, argv);
 		} else {
@@ -1296,8 +1274,6 @@ main(int argc, char **argv) {
 				if (ctx.keystore != NULL) {
 					check_keystore_options(&ctx);
 				}
-				ctx.tag_min = dns_kasp_key_tagmin(kaspkey);
-				ctx.tag_max = dns_kasp_key_tagmax(kaspkey);
 				if ((ctx.ksk && !ctx.wantksk && ctx.wantzsk) ||
 				    (ctx.zsk && !ctx.wantzsk && ctx.wantksk))
 				{
@@ -1333,5 +1309,5 @@ main(int argc, char **argv) {
 		free(freeit);
 	}

-	return 0;
+	return (0);
 }
@@ -21,7 +21,7 @@ dnssec-keygen: DNSSEC key generation tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-M** tag_min:tag_max] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}
+:program:`dnssec-keygen` [**-3**] [**-A** date/offset] [**-a** algorithm] [**-b** keysize] [**-C**] [**-c** class] [**-D** date/offset] [**-d** bits] [**-D** sync date/offset] [**-E** engine] [**-f** flag] [**-F**] [**-G**] [**-h**] [**-I** date/offset] [**-i** interval] [**-K** directory] [**-k** policy] [**-L** ttl] [**-l** file] [**-n** nametype] [**-P** date/offset] [**-P** sync date/offset] [**-p** protocol] [**-q**] [**-R** date/offset] [**-S** key] [**-s** strength] [**-T** rrtype] [**-t** type] [**-V**] [**-v** level] {name}

 Description
 ~~~~~~~~~~~
@@ -158,19 +158,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy`` statement
   (matching the policy set with :option:`-k`).

-.. option:: -M tag_min:tag_max
-
-   This option sets the range of acceptable key tag values that ``dnssec-keygen``
-   will produce. If the key tag of the new key or the key tag of
-   the revoked version of the new key is outside this range,
-   the new key will be rejected and another new key will be generated.
-   This is designed to be used when generating keys in a multi-signer
-   scenario, where each operator is given a range of key tags to
-   prevent collisions among different operators.  The valid values
-   for ``tag_min`` and ``tag_max`` are [0..65535].  The default allows all
-   key tag values to be produced.  This option is ignored when ``-k policy``
-   is specified.
-
 .. option:: -n nametype

   This option specifies the owner type of the key. The value of ``nametype`` must
@@ -25,7 +25,6 @@
 #include <dns/callbacks.h>
 #include <dns/dnssec.h>
 #include <dns/fixedname.h>
-#include <dns/keymgr.h>
 #include <dns/keyvalues.h>
 #include <dns/rdataclass.h>
 #include <dns/rdatalist.h>
@@ -64,19 +63,16 @@ struct ksr_ctx {
 	bool setstart;
 	bool setend;
 	/* keygen */
-	bool ksk;
 	dns_ttl_t ttl;
 	dns_secalg_t alg;
 	int size;
 	time_t lifetime;
-	time_t parentpropagation;
 	time_t propagation;
 	time_t publishsafety;
 	time_t retiresafety;
 	time_t sigrefresh;
 	time_t sigvalidity;
 	time_t signdelay;
-	time_t ttlds;
 	time_t ttlsig;
 };
 typedef struct ksr_ctx ksr_ctx_t;
@@ -146,15 +142,6 @@ usage(int ret) {
 	exit(ret);
 }

-static isc_stdtime_t
-between(isc_stdtime_t t, isc_stdtime_t start, isc_stdtime_t end) {
-	isc_stdtime_t r = end;
-	if (t > 0 && t > start && t < end) {
-		r = t;
-	}
-	return r;
-}
-
 static void
 checkparams(ksr_ctx_t *ksr, const char *command) {
 	if (ksr->configfile == NULL) {
@@ -199,19 +186,15 @@ getkasp(ksr_ctx_t *ksr, dns_kasp_t **kasp) {
 }

 static int
-keyalgtag_cmp(const void *k1, const void *k2) {
+keytag_cmp(const void *k1, const void *k2) {
 	dns_dnsseckey_t **key1 = (dns_dnsseckey_t **)k1;
 	dns_dnsseckey_t **key2 = (dns_dnsseckey_t **)k2;
-	if (dst_key_alg((*key1)->key) < dst_key_alg((*key2)->key)) {
-		return -1;
-	} else if (dst_key_alg((*key1)->key) > dst_key_alg((*key2)->key)) {
-		return 1;
-	} else if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
-		return -1;
+	if (dst_key_id((*key1)->key) < dst_key_id((*key2)->key)) {
+		return (-1);
 	} else if (dst_key_id((*key1)->key) > dst_key_id((*key2)->key)) {
-		return 1;
+		return (1);
 	}
-	return 0;
+	return (0);
 }

 static void
@@ -241,7 +224,7 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {
 	{
 		keys_sorted[i] = dk;
 	}
-	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keyalgtag_cmp);
+	qsort(keys_sorted, n, sizeof(dns_dnsseckey_t *), keytag_cmp);
 	while (!ISC_LIST_EMPTY(keys_read)) {
 		dns_dnsseckey_t *key = ISC_LIST_HEAD(keys_read);
 		ISC_LIST_UNLINK(keys_read, key, link);
@@ -256,7 +239,6 @@ get_dnskeys(ksr_ctx_t *ksr, dns_dnsseckeylist_t *keys) {

 static void
 setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
-	ksr->parentpropagation = dns_kasp_parentpropagationdelay(kasp);
 	ksr->propagation = dns_kasp_zonepropagationdelay(kasp);
 	ksr->publishsafety = dns_kasp_publishsafety(kasp);
 	ksr->retiresafety = dns_kasp_retiresafety(kasp);
@@ -264,7 +246,6 @@ setcontext(ksr_ctx_t *ksr, dns_kasp_t *kasp) {
 	ksr->sigrefresh = dns_kasp_sigrefresh(kasp);
 	ksr->signdelay = dns_kasp_signdelay(kasp);
 	ksr->ttl = dns_kasp_dnskeyttl(kasp);
-	ksr->ttlds = dns_kasp_dsttl(kasp);
 	ksr->ttlsig = dns_kasp_zonemaxttl(kasp, true);
 }

@@ -332,9 +313,9 @@ freerrset(dns_rdataset_t *rdataset) {
 }

 static void
-create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
-	   dns_dnsseckeylist_t *keys, isc_stdtime_t inception,
-	   isc_stdtime_t active, isc_stdtime_t *expiration) {
+create_zsk(ksr_ctx_t *ksr, dns_kasp_key_t *kaspkey, dns_dnsseckeylist_t *keys,
+	   isc_stdtime_t inception, isc_stdtime_t active,
+	   isc_stdtime_t *expiration) {
 	bool conflict = false;
 	bool freekey = false;
 	bool show_progress = true;
@@ -346,15 +327,9 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	isc_buffer_t buf;
 	isc_result_t ret;
 	isc_stdtime_t prepub;
-	uint16_t flags = DNS_KEYOWNER_ZONE;

 	isc_stdtime_tostring(inception, timestr, sizeof(timestr));

-	/* ZSK or KSK? */
-	if (ksr->ksk) {
-		flags |= DNS_KEYFLAG_KSK;
-	}
-
 	/* Check algorithm and size. */
 	dns_secalg_format(ksr->alg, algstr, sizeof(algstr));
 	if (!dst_algorithm_supported(ksr->alg)) {
@@ -445,18 +420,18 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 			ret = dns_keystore_keygen(
 				ksr->keystore, name, ksr->policy,
 				dns_rdataclass_in, mctx, ksr->alg, ksr->size,
-				flags, &key);
+				DNS_KEYOWNER_ZONE, &key);
 		} else if (show_progress) {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, &progress);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, &progress);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate(name, ksr->alg, ksr->size, 0,
-					       flags, DNS_KEYPROTO_DNSSEC,
-					       dns_rdataclass_in, NULL, mctx,
-					       &key, NULL);
+			ret = dst_key_generate(
+				name, ksr->alg, ksr->size, 0, DNS_KEYOWNER_ZONE,
+				DNS_KEYPROTO_DNSSEC, dns_rdataclass_in, NULL,
+				mctx, &key, NULL);
 		}

 		if (ret != ISC_R_SUCCESS) {
@@ -465,10 +440,7 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 		}

 		/* Do not overwrite an existing key. */
-		if (key_collision(key, name, ksr->keydir, mctx,
-				  dns_kasp_key_tagmin(kaspkey),
-				  dns_kasp_key_tagmax(kaspkey), NULL))
-		{
+		if (key_collision(key, name, ksr->keydir, mctx, NULL)) {
 			conflict = true;
 			if (verbose > 0) {
 				isc_buffer_clear(&buf);
@@ -493,28 +465,15 @@ create_key(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_kasp_key_t *kaspkey,
 	prepub = ksr->ttl + ksr->publishsafety + ksr->propagation;
 	dst_key_setttl(key, ksr->ttl);
 	dst_key_setnum(key, DST_NUM_LIFETIME, ksr->lifetime);
-	dst_key_setbool(key, DST_BOOL_KSK, ksr->ksk);
-	dst_key_setbool(key, DST_BOOL_ZSK, !ksr->ksk);
+	dst_key_setbool(key, DST_BOOL_KSK, false);
+	dst_key_setbool(key, DST_BOOL_ZSK, true);
 	dst_key_settime(key, DST_TIME_CREATED, ksr->now);
 	dst_key_settime(key, DST_TIME_PUBLISH, (active - prepub));
 	dst_key_settime(key, DST_TIME_ACTIVATE, active);
-	if (ksr->ksk) {
-		dns_keymgr_settime_syncpublish(key, kasp,
-					       (inception == ksr->start));
-	}
-
 	if (ksr->lifetime > 0) {
 		isc_stdtime_t inactive = (active + ksr->lifetime);
-		isc_stdtime_t remove;
-
-		if (ksr->ksk) {
-			remove = ksr->ttlds + ksr->parentpropagation +
-				 ksr->retiresafety;
-			dst_key_settime(key, DST_TIME_SYNCDELETE, inactive);
-		} else {
-			remove = ksr->ttlsig + ksr->propagation +
-				 ksr->retiresafety + ksr->signdelay;
-		}
+		isc_stdtime_t remove = ksr->ttlsig + ksr->propagation +
+				       ksr->retiresafety + ksr->signdelay;
 		dst_key_settime(key, DST_TIME_INACTIVE, inactive);
 		dst_key_settime(key, DST_TIME_DELETE, (inactive + remove));
 		*expiration = inactive;
@@ -645,16 +604,15 @@ fail:
 		      namestr, algstr, timestr);
 	}

-	return next_bundle;
+	return (next_bundle);
 }

-static isc_stdtime_t
+static void
 sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	   dns_rdataset_t *rrset, dns_dnsseckeylist_t *keys) {
 	dns_rdatalist_t *rrsiglist = NULL;
 	dns_rdataset_t rrsigset = DNS_RDATASET_INIT;
 	isc_result_t ret;
-	isc_stdtime_t next_bundle = expiration;

 	UNUSED(ksr);

@@ -698,25 +656,6 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 		unsigned char rdatabuf[SIG_FORMATSIZE];
 		isc_stdtime_t clockskew = inception - 3600;

-		isc_stdtime_t pub = 0, act = 0, inact = 0, del = 0;
-
-		/* Determine next bundle. */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_ACTIVATE, &act);
-		(void)dst_key_gettime(dk->key, DST_TIME_INACTIVE, &inact);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(act, inception, next_bundle);
-		next_bundle = between(inact, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
-
-		if (act > inception) {
-			continue;
-		}
-		if (inact != 0 && inception >= inact) {
-			continue;
-		}
-
 		rrsig = isc_mem_get(mctx, sizeof(*rrsig));
 		dns_rdata_init(rrsig);
 		isc_buffer_init(&buf, rdatabuf, sizeof(rdatabuf));
@@ -738,25 +677,21 @@ sign_rrset(ksr_ctx_t *ksr, isc_stdtime_t inception, isc_stdtime_t expiration,
 	dns_rdatalist_tordataset(rrsiglist, &rrsigset);
 	print_rdata(&rrsigset);
 	freerrset(&rrsigset);
-
-	return next_bundle;
 }

 /*
 * Create the DNSKEY, CDS, and CDNSKEY records beloing to the KSKs
 * listed in 'keys'.
 */
-static isc_stdtime_t
-get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-		isc_stdtime_t next_inception, dns_dnsseckeylist_t *keys,
-		dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
-		dns_rdataset_t *cdsset) {
-	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);
+static void
+create_ksk(ksr_ctx_t *ksr, dns_kasp_t *kasp, dns_dnsseckeylist_t *keys,
+	   dns_rdataset_t *dnskeyset, dns_rdataset_t *cdnskeyset,
+	   dns_rdataset_t *cdsset) {
 	dns_rdatalist_t *dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
 	dns_rdatalist_t *cdnskeylist = isc_mem_get(mctx, sizeof(*cdnskeylist));
 	dns_rdatalist_t *cdslist = isc_mem_get(mctx, sizeof(*cdslist));
 	isc_result_t ret = ISC_R_SUCCESS;
-	isc_stdtime_t next_bundle = next_inception;
+	dns_kasp_digestlist_t digests = dns_kasp_digests(kasp);

 	dns_rdatalist_init(dnskeylist);
 	dnskeylist->rdclass = dns_rdataclass_in;
@@ -776,73 +711,31 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	for (dns_dnsseckey_t *dk = ISC_LIST_HEAD(*keys); dk != NULL;
 	     dk = ISC_LIST_NEXT(dk, link))
 	{
-		bool published = true;
 		isc_buffer_t buf;
 		isc_buffer_t *newbuf;
 		dns_rdata_t *rdata;
 		isc_region_t r;
 		isc_region_t rcds;
-		isc_stdtime_t pub = 0, del = 0;
 		unsigned char kskbuf[DST_KEY_MAXSIZE];
 		unsigned char cdnskeybuf[DST_KEY_MAXSIZE];
 		unsigned char cdsbuf[DNS_DS_BUFFERSIZE];

 		/* KSK */
-		(void)dst_key_gettime(dk->key, DST_TIME_PUBLISH, &pub);
-		(void)dst_key_gettime(dk->key, DST_TIME_DELETE, &del);
-		next_bundle = between(pub, inception, next_bundle);
-		next_bundle = between(del, inception, next_bundle);
+		newbuf = NULL;
+		rdata = isc_mem_get(mctx, sizeof(*rdata));
+		dns_rdata_init(rdata);

-		if (pub > inception) {
-			published = false;
-		}
-		if (del != 0 && inception >= del) {
-			published = false;
-		}
-
-		if (published) {
-			newbuf = NULL;
-			rdata = isc_mem_get(mctx, sizeof(*rdata));
-			dns_rdata_init(rdata);
-
-			isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
-			CHECK(dst_key_todns(dk->key, &buf));
-			isc_buffer_usedregion(&buf, &r);
-			isc_buffer_allocate(mctx, &newbuf, r.length);
-			isc_buffer_putmem(newbuf, r.base, r.length);
-			isc_buffer_usedregion(newbuf, &r);
-			dns_rdata_fromregion(rdata, dns_rdataclass_in,
-					     dns_rdatatype_dnskey, &r);
-			ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
-			ISC_LIST_APPEND(cleanup_list, newbuf, link);
-			isc_buffer_clear(newbuf);
-		}
-
-		published = true;
-		if (dns_kasp_cdnskey(kasp) || !ISC_LIST_EMPTY(digests)) {
-			pub = 0;
-			del = 0;
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCPUBLISH,
-					      &pub);
-			(void)dst_key_gettime(dk->key, DST_TIME_SYNCDELETE,
-					      &del);
-
-			next_bundle = between(pub, inception, next_bundle);
-			next_bundle = between(del, inception, next_bundle);
-
-			if (pub != 0 && pub > inception) {
-				published = false;
-			}
-			if (del != 0 && inception >= del) {
-				published = false;
-			}
-		} else {
-			published = false;
-		}
-
-		if (!published) {
-			continue;
-		}
+		isc_buffer_init(&buf, kskbuf, sizeof(kskbuf));
+		CHECK(dst_key_todns(dk->key, &buf));
+		isc_buffer_usedregion(&buf, &r);
+		isc_buffer_allocate(mctx, &newbuf, r.length);
+		isc_buffer_putmem(newbuf, r.base, r.length);
+		isc_buffer_usedregion(newbuf, &r);
+		dns_rdata_fromregion(rdata, dns_rdataclass_in,
+				     dns_rdatatype_dnskey, &r);
+		ISC_LIST_APPEND(dnskeylist->rdata, rdata, link);
+		ISC_LIST_APPEND(cleanup_list, newbuf, link);
+		isc_buffer_clear(newbuf);

 		/* CDNSKEY */
 		newbuf = NULL;
@@ -896,98 +789,35 @@ get_keymaterial(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
 	dns_rdatalist_tordataset(dnskeylist, dnskeyset);
 	dns_rdatalist_tordataset(cdnskeylist, cdnskeyset);
 	dns_rdatalist_tordataset(cdslist, cdsset);
-
-	return next_bundle;
+	return;

 fail:
 	fatal("failed to create KSK/CDS/CDNSKEY");
-	return 0;
 }

 static void
-sign_bundle(ksr_ctx_t *ksr, dns_kasp_t *kasp, isc_stdtime_t inception,
-	    isc_stdtime_t next_inception, dns_rdatalist_t *zsklist,
+sign_bundle(ksr_ctx_t *ksr, isc_stdtime_t inception,
+	    isc_stdtime_t next_inception, dns_rdatalist_t *rdatalist,
+	    dns_rdataset_t *cds, dns_rdataset_t *cdnskey,
 	    dns_dnsseckeylist_t *keys) {
-	isc_stdtime_t expiration = inception + ksr->sigvalidity;
-	isc_stdtime_t next_bundle = next_inception;
-	dns_rdataset_t zsk;
-
-	dns_rdataset_init(&zsk);
-	dns_rdatalist_tordataset(zsklist, &zsk);
+	dns_rdataset_t rrset = DNS_RDATASET_INIT;
+	isc_stdtime_t expiration;

+	dns_rdataset_init(&rrset);
+	dns_rdatalist_tordataset(rdatalist, &rrset);
+	expiration = inception + ksr->sigvalidity;
 	while (inception <= next_inception) {
-		isc_stdtime_t next_time = next_bundle;
-
-		/* DNSKEY RRset */
-		dns_rdatalist_t *dnskeylist;
-		dnskeylist = isc_mem_get(mctx, sizeof(*dnskeylist));
-		dns_rdatalist_init(dnskeylist);
-		dnskeylist->rdclass = dns_rdataclass_in;
-		dnskeylist->type = dns_rdatatype_dnskey;
-		dnskeylist->ttl = ksr->ttl;
-
-		dns_rdataset_t ksk, cdnskey, cds, rrset;
-		dns_rdataset_init(&ksk);
-		dns_rdataset_init(&cdnskey);
-		dns_rdataset_init(&cds);
-		dns_rdataset_init(&rrset);
-		next_time = get_keymaterial(ksr, kasp, inception, next_time,
-					    keys, &ksk, &cdnskey, &cds);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
+		sign_rrset(ksr, inception, expiration, &rrset, keys);
+		if (dns_rdataset_count(cdnskey) > 0) {
+			sign_rrset(ksr, inception, expiration, cdnskey, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&ksk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&ksk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
+		if (dns_rdataset_count(cds) > 0) {
+			sign_rrset(ksr, inception, expiration, cds, keys);
 		}
-
-		for (isc_result_t r = dns_rdatalist_first(&zsk);
-		     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&zsk))
-		{
-			dns_rdata_t *clone = isc_mem_get(mctx, sizeof(*clone));
-			dns_rdata_init(clone);
-			dns_rdatalist_current(&zsk, clone);
-			ISC_LIST_APPEND(dnskeylist->rdata, clone, link);
-		}
-
-		dns_rdatalist_tordataset(dnskeylist, &rrset);
-		next_time = sign_rrset(ksr, inception, expiration, &rrset,
-				       keys);
-		if (next_bundle > next_time) {
-			next_bundle = next_time;
-		}
-		freerrset(&ksk);
-		freerrset(&rrset);
-
-		/* CDNSKEY */
-		if (dns_rdataset_count(&cdnskey) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cdnskey,
-					 keys);
-		}
-		freerrset(&cdnskey);
-
-		/* CDS */
-		if (dns_rdataset_count(&cds) > 0) {
-			(void)sign_rrset(ksr, inception, expiration, &cds,
-					 keys);
-		}
-		freerrset(&cds);
-
-		/* Next response bundle. */
 		inception = expiration - ksr->sigrefresh;
-		if (inception > next_bundle) {
-			inception = next_bundle;
-		}
 		expiration = inception + ksr->sigvalidity;
-		next_bundle = expiration;
 	}
-
-	freerrset(&zsk);
+	freerrset(&rrset);
 }

 static isc_result_t
@@ -1012,10 +842,10 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {
 	isc_buffer_add(&b, strlen(owner));
 	ret = dns_name_fromtext(dname, &b, dns_rootname, 0, NULL);
 	if (ret != ISC_R_SUCCESS) {
-		return ret;
+		return (ret);
 	}
 	if (dns_name_compare(dname, name) != 0) {
-		return DNS_R_BADOWNERNAME;
+		return (DNS_R_BADOWNERNAME);
 	}
 	isc_buffer_clear(&b);

@@ -1053,7 +883,7 @@ parse_dnskey(isc_lex_t *lex, char *owner, isc_buffer_t *buf, dns_ttl_t *ttl) {

 cleanup:
 	isc_lex_setcomments(lex, 0);
-	return ret;
+	return (ret);
 }

 static void
@@ -1074,12 +904,9 @@ keygen(ksr_ctx_t *ksr) {
 	for (dns_kasp_key_t *kk = ISC_LIST_HEAD(dns_kasp_keys(kasp));
 	     kk != NULL; kk = ISC_LIST_NEXT(kk, link))
 	{
-		if (dns_kasp_key_ksk(kk) && !ksr->ksk) {
+		if (dns_kasp_key_ksk(kk)) {
 			/* only ZSKs allowed */
 			continue;
-		} else if (dns_kasp_key_zsk(kk) && ksr->ksk) {
-			/* only KSKs allowed */
-			continue;
 		}
 		ksr->alg = dns_kasp_key_algorithm(kk);
 		ksr->lifetime = dns_kasp_key_lifetime(kk);
@@ -1090,7 +917,7 @@ keygen(ksr_ctx_t *ksr) {
 		for (isc_stdtime_t inception = ksr->start, act = ksr->start;
 		     inception < ksr->end; inception += ksr->lifetime)
 		{
-			create_key(ksr, kasp, kk, &keys, inception, act, &act);
+			create_zsk(ksr, kk, &keys, inception, act, &act);
 			if (ksr->lifetime == 0) {
 				/* unlimited lifetime, but not infinite loop */
 				break;
@@ -1098,7 +925,7 @@ keygen(ksr_ctx_t *ksr) {
 		}
 	}
 	if (noop) {
-		fatal("no keys created for policy '%s'", ksr->policy);
+		fatal("policy '%s' has no zsks", ksr->policy);
 	}
 	/* Cleanup */
 	cleanup(&keys, kasp);
@@ -1177,6 +1004,9 @@ sign(ksr_ctx_t *ksr) {
 	dns_dnsseckeylist_t keys;
 	dns_kasp_t *kasp = NULL;
 	dns_rdatalist_t *rdatalist = NULL;
+	dns_rdataset_t ksk = DNS_RDATASET_INIT;
+	dns_rdataset_t cdnskey = DNS_RDATASET_INIT;
+	dns_rdataset_t cds = DNS_RDATASET_INIT;
 	isc_result_t ret;
 	isc_stdtime_t inception;
 	isc_lex_t *lex = NULL;
@@ -1209,6 +1039,9 @@ sign(ksr_ctx_t *ksr) {
 		      isc_result_totext(ret));
 	}

+	/* KSK, CDS and CDNSKEY */
+	create_ksk(ksr, kasp, &keys, &ksk, &cdnskey, &cds);
+
 	for (ret = isc_lex_gettoken(lex, opt, &token); ret == ISC_R_SUCCESS;
 	     ret = isc_lex_gettoken(lex, opt, &token))
 	{
@@ -1258,8 +1091,8 @@ sign(ksr_ctx_t *ksr) {

 			if (have_bundle) {
 				/* Sign previous bundle */
-				sign_bundle(ksr, kasp, inception,
-					    next_inception, rdatalist, &keys);
+				sign_bundle(ksr, inception, next_inception,
+					    rdatalist, &cds, &cdnskey, &keys);
 				fprintf(stdout, "\n");
 			}

@@ -1269,7 +1102,15 @@ sign(ksr_ctx_t *ksr) {
 			rdatalist->rdclass = dns_rdataclass_in;
 			rdatalist->type = dns_rdatatype_dnskey;
 			rdatalist->ttl = ksr->ttl;
-
+			for (isc_result_t r = dns_rdatalist_first(&ksk);
+			     r == ISC_R_SUCCESS; r = dns_rdatalist_next(&ksk))
+			{
+				dns_rdata_t *clone =
+					isc_mem_get(mctx, sizeof(*clone));
+				dns_rdata_init(clone);
+				dns_rdatalist_current(&ksk, clone);
+				ISC_LIST_APPEND(rdatalist->rdata, clone, link);
+			}
 			inception = next_inception;
 			have_bundle = true;

@@ -1328,7 +1169,8 @@ sign(ksr_ctx_t *ksr) {

 	/* Final bundle */
 	if (have_bundle && rdatalist != NULL) {
-		sign_bundle(ksr, kasp, inception, ksr->end, rdatalist, &keys);
+		sign_bundle(ksr, inception, ksr->end, rdatalist, &cds, &cdnskey,
+			    &keys);
 	} else {
 		fatal("bad KSR file %s(%lu): no bundles", ksr->file,
 		      isc_lex_getsourceline(lex));
@@ -1340,6 +1182,11 @@ sign(ksr_ctx_t *ksr) {
 		timestr, PACKAGE_VERSION);

 fail:
+	/* Clean up */
+	freerrset(&ksk);
+	freerrset(&cdnskey);
+	freerrset(&cds);
+
 	isc_lex_destroy(&lex);
 	cleanup(&keys, kasp);
 }
@@ -1362,7 +1209,7 @@ main(int argc, char *argv[]) {

 	isc_commandline_errprint = false;

-#define OPTIONS "E:e:Ff:hi:K:k:l:ov:V"
+#define OPTIONS "E:e:Ff:hi:K:k:l:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'E':
@@ -1399,9 +1246,6 @@ main(int argc, char *argv[]) {
 		case 'l':
 			ksr.configfile = isc_commandline_argument;
 			break;
-		case 'o':
-			ksr.ksk = true;
-			break;
 		case 'V':
 			version(program);
 			break;
@@ -21,7 +21,7 @@ dnssec-ksr - Create signed key response (SKR) files for offline KSK setups
 Synopsis
 ~~~~~~~~

-:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-f** file] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-o**] [**-V**] [**-v** level] {command} {zone}
+:program:`dnssec-ksr` [**-E** engine] [**-e** date/offset] [**-F**] [**-h**] [**-i** date/offset] [**-K** directory] [**-k** policy] [**-l** file] [**-V**] [**-v** level] {command} {zone}

 Description
 ~~~~~~~~~~~
@@ -59,10 +59,6 @@ Options
   mode if the underlying crytographic library supports running in FIPS
   mode.

-.. option:: -f
-
-   This option sets the SKR file to be signed when issuing a ``sign`` command.
-
 .. option:: -h

   This option prints a short summary of the options and arguments to
@@ -88,11 +84,6 @@ Options
   This option provides a configuration file that contains a ``dnssec-policy``
   statement (matching the policy set with :option:`-k`).

-.. option:: -o
-
-   Normally when pregenerating keys, ZSKs are created. When this option is
-   set, create KSKs instead.
-
 .. option:: -V

   This option prints version information.
@@ -115,8 +106,9 @@ Commands

 .. option:: keygen

-  Pregenerate a number of keys, given a DNSSEC policy and an interval. The
-  number of generated keys depends on the interval and the key lifetime.
+  Pregenerate a number of zone signing keys (ZSKs), given a DNSSEC policy and
+  an interval. The number of generated keys depends on the interval and the
+  ZSK lifetime.

 .. option:: request

@@ -139,7 +131,7 @@ occurred.
 Examples
 ~~~~~~~~

-When you need to generate ZSKs for the zone "example.com" for the next year,
+When you need to generate keys for the zone "example.com" for the next year,
 given a ``dnssec-policy`` named "mypolicy":

 ::
@@ -152,8 +144,7 @@ Creating a KSR for the same zone and period can be done with:

    dnssec-ksr -i now -e +1y -k mypolicy -l named.conf request example.com > ksr.txt

-Typically you would now transfer the KSR to the system that has access to
-the KSK.
+Typically you would now transfer the KSR to the system that has access to the KSK.

 Signing the KSR created above can be done with:

@@ -161,8 +152,7 @@ Signing the KSR created above can be done with:

    dnssec-ksr -i now -e +1y -k kskpolicy -l named.conf -f ksr.txt sign example.com

-Make sure that the DNSSEC parameters in ``kskpolicy`` match those
-in ``mypolicy``.
+Make sure that the DNSSEC parameters in ``kskpolicy`` match those in ``mypolicy``.

 See Also
 ~~~~~~~~
@@ -257,5 +257,5 @@ cleanup:
 	}
 	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -960,5 +960,5 @@ main(int argc, char **argv) {
 	isc_mem_free(mctx, directory);
 	isc_mem_destroy(&mctx);

-	return 0;
+	return (0);
 }
@@ -140,10 +140,10 @@ static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_masterformat_t outputformat = dns_masterformat_text;
 static uint32_t rawversion = 1, serialnum = 0;
 static bool snset = false;
-static atomic_uint_fast32_t nsigned = 0, nretained = 0, ndropped = 0;
-static atomic_uint_fast32_t nverified = 0, nverifyfailed = 0;
+static unsigned int nsigned = 0, nretained = 0, ndropped = 0;
+static unsigned int nverified = 0, nverifyfailed = 0;
 static const char *directory = NULL, *dsdir = NULL;
-static isc_mutex_t namelock;
+static isc_mutex_t namelock, statslock;
 static isc_nm_t *netmgr = NULL;
 static isc_loopmgr_t *loopmgr = NULL;
 static dns_db_t *gdb;		  /* The database */
@@ -182,9 +182,11 @@ static dns_ttl_t maxttl = 0;
 static bool no_max_check = false;
 static const char *sync_records = "cdnskey,cds:sha-256";

-#define INCSTAT(counter)                               \
-	if (printstats) {                              \
-		atomic_fetch_add_relaxed(&counter, 1); \
+#define INCSTAT(counter)            \
+	if (printstats) {           \
+		LOCK(&statslock);   \
+		counter++;          \
+		UNLOCK(&statslock); \
 	}

 /*%
@@ -197,7 +199,7 @@ savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
 	result = dns_fixedname_initname(fzonecut);
 	dns_name_copy(name, result);

-	return result;
+	return (result);
 }

 static void
@@ -326,28 +328,28 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

 static bool
 issigningkey(dns_dnsseckey_t *key) {
-	return key->force_sign || key->hint_sign;
+	return (key->force_sign || key->hint_sign);
 }

 static bool
 ispublishedkey(dns_dnsseckey_t *key) {
-	return (key->force_publish || key->hint_publish) && !key->hint_remove;
+	return ((key->force_publish || key->hint_publish) && !key->hint_remove);
 }

 static bool
 iszonekey(dns_dnsseckey_t *key) {
-	return dns_name_equal(dst_key_name(key->key), gorigin) &&
-	       dst_key_iszonekey(key->key);
+	return (dns_name_equal(dst_key_name(key->key), gorigin) &&
+		dst_key_iszonekey(key->key));
 }

 static bool
 isksk(dns_dnsseckey_t *key) {
-	return key->ksk;
+	return (key->ksk);
 }

 static bool
 iszsk(dns_dnsseckey_t *key) {
-	return ignore_kskflag || !key->ksk;
+	return (ignore_kskflag || !key->ksk);
 }

 /*%
@@ -367,10 +369,10 @@ keythatsigned_unlocked(dns_rdata_rrsig_t *rrsig) {
 		    rrsig->algorithm == dst_key_alg(key->key) &&
 		    dns_name_equal(&rrsig->signer, dst_key_name(key->key)))
 		{
-			return key;
+			return (key);
 		}
 	}
-	return NULL;
+	return (NULL);
 }

 /*%
@@ -387,7 +389,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	RWUNLOCK(&keylist_lock, isc_rwlocktype_read);
 	if (key != NULL) {
-		return key;
+		return (key);
 	}

 	/*
@@ -401,7 +403,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 	key = keythatsigned_unlocked(rrsig);
 	if (key != NULL) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return key;
+		return (key);
 	}

 	result = dst_key_fromfile(&rrsig->signer, rrsig->keyid,
@@ -409,7 +411,7 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 				  mctx, &pubkey);
 	if (result != ISC_R_SUCCESS) {
 		isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-		return NULL;
+		return (NULL);
 	}

 	result = dst_key_fromfile(
@@ -420,14 +422,15 @@ keythatsigned(dns_rdata_rrsig_t *rrsig) {
 		dns_dnsseckey_create(mctx, &privkey, &key);
 	} else {
 		dns_dnsseckey_create(mctx, &pubkey, &key);
-		key->pubkey = true;
 	}

+	key->force_publish = false;
+	key->force_sign = false;
 	key->index = keycount++;
 	ISC_LIST_APPEND(keylist, key, link);

 	isc_rwlock_unlock(&keylist_lock, isc_rwlocktype_write);
-	return key;
+	return (key);
 }

 /*%
@@ -449,11 +452,11 @@ expecttofindkey(dns_name_t *name) {
 	case ISC_R_SUCCESS:
 	case DNS_R_NXDOMAIN:
 	case DNS_R_NXRRSET:
-		return true;
+		return (true);
 	case DNS_R_DELEGATION:
 	case DNS_R_CNAME:
 	case DNS_R_DNAME:
-		return false;
+		return (false);
 	default:
 		break;
 	}
@@ -461,7 +464,7 @@ expecttofindkey(dns_name_t *name) {
 	fatal("failure looking for '%s DNSKEY' in database: %s", namestr,
 	      isc_result_totext(result));
 	UNREACHABLE();
-	return false; /* removes a warning */
+	return (false); /* removes a warning */
 }

 static bool
@@ -471,10 +474,10 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	result = dns_dnssec_verify(name, set, key, false, 0, mctx, rrsig, NULL);
 	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
-		return true;
+		return (true);
 	} else {
 		INCSTAT(nverifyfailed);
-		return false;
+		return (false);
 	}
 }

@@ -540,7 +543,7 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	}

 	while (result == ISC_R_SUCCESS) {
-		bool expired, refresh, future, offline;
+		bool expired, future;
 		bool keep = false, resign = false;

 		dns_rdataset_current(&sigset, &sigrdata);
@@ -551,10 +554,8 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		future = isc_serial_lt(now, rrsig.timesigned);

 		key = keythatsigned(&rrsig);
-		offline = (key != NULL) ? key->pubkey : false;
 		sig_format(&rrsig, sigstr, sizeof(sigstr));
-		expired = isc_serial_gt(now, rrsig.timeexpire);
-		refresh = isc_serial_gt(now + cycle, rrsig.timeexpire);
+		expired = isc_serial_gt(now + cycle, rrsig.timeexpire);

 		if (isc_serial_gt(rrsig.timesigned, rrsig.timeexpire)) {
 			/* rrsig is dropped and not replaced */
@@ -583,21 +584,15 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (issigningkey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
@@ -610,32 +605,25 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 		} else if (iszonekey(key)) {
 			wassignedby[key->index] = true;

-			if (!refresh && rrsig.originalttl == set->ttl &&
+			if (!expired && rrsig.originalttl == set->ttl &&
 			    setverifies(name, set, key->key, &sigrdata))
 			{
 				vbprintf(2, "\trrsig by %s retained\n", sigstr);
 				keep = true;
-			} else if (offline) {
-				vbprintf(2,
-					 "\trrsig by %s retained - private key "
-					 "missing\n",
-					 sigstr);
-				keep = true;
 			} else {
 				vbprintf(2, "\trrsig by %s dropped - %s\n",
 					 sigstr,
-					 refresh ? "refresh"
+					 expired ? "expired"
 					 : rrsig.originalttl != set->ttl
 						 ? "ttl change"
 						 : "failed to "
 						   "verify");
 			}
-		} else if (!refresh) {
+		} else if (!expired) {
 			vbprintf(2, "\trrsig by %s retained\n", sigstr);
 			keep = true;
 		} else {
-			vbprintf(2, "\trrsig by %s %s\n", sigstr,
-				 expired ? "expired" : "needs refresh");
+			vbprintf(2, "\trrsig by %s expired\n", sigstr);
 		}

 		if (keep) {
@@ -692,10 +680,6 @@ signset(dns_diff_t *del, dns_diff_t *add, dns_dbnode_t *node, dns_name_t *name,
 	for (key = ISC_LIST_HEAD(keylist); key != NULL;
 	     key = ISC_LIST_NEXT(key, link))
 	{
-		if (REVOKE(key->key) && set->type != dns_rdatatype_dnskey) {
-			continue;
-		}
-
 		if (nowsignedby[key->index]) {
 			continue;
 		}
@@ -878,7 +862,7 @@ hashlist_add_dns_name(hashlist_t *l,

 static int
 hashlist_comp(const void *a, const void *b) {
-	return memcmp(a, b, hash_length + 1);
+	return (memcmp(a, b, hash_length + 1));
 }

 static void
@@ -910,11 +894,11 @@ hashlist_hasdup(hashlist_t *l) {
 			continue;
 		}
 		if (isc_safe_memequal(current, next, l->length - 1)) {
-			return true;
+			return (true);
 		}
 		current = next;
 	}
-	return false;
+	return (false);
 }

 static const unsigned char *
@@ -936,16 +920,16 @@ hashlist_findnext(const hashlist_t *l,
 		}
 	} while (entries-- > 1U);
 	INSIST(entries != 0U);
-	return next;
+	return (next);
 }

 static bool
 hashlist_exists(const hashlist_t *l,
 		const unsigned char hash[NSEC3_MAX_HASH_LENGTH]) {
 	if (bsearch(hash, l->hashbuf, l->entries, l->length, hashlist_comp)) {
-		return true;
+		return (true);
 	} else {
-		return false;
+		return (false);
 	}
 }

@@ -1054,7 +1038,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 				vbprintf(2, "found DS records\n");
 				dsset->ttl = ttl;
 				dns_db_detach(&db);
-				return result;
+				return (result);
 			}
 		}
 		dns_db_detach(&db);
@@ -1063,13 +1047,13 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	/* No DS records found; try again, looking for DNSKEY records */
 	opendb("keyset-", name, gclass, &db);
 	if (db == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	result = dns_db_findnode(db, name, false, &node);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&keyset);
@@ -1078,7 +1062,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	if (result != ISC_R_SUCCESS) {
 		dns_db_detachnode(db, &node);
 		dns_db_detach(&db);
-		return result;
+		return (result);
 	}
 	vbprintf(2, "found DNSKEY records\n");

@@ -1115,7 +1099,7 @@ loadds(dns_name_t *name, uint32_t ttl, dns_rdataset_t *dsset) {
 	dns_rdataset_disassociate(&keyset);
 	dns_db_detachnode(db, &node);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 static bool
@@ -1124,7 +1108,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 	isc_result_t result;

 	if (dns_name_equal(name, gorigin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&dsset);
@@ -1134,7 +1118,7 @@ secure(dns_name_t *name, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return (result == ISC_R_SUCCESS);
 }

 static bool
@@ -1144,7 +1128,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	isc_result_t result;

 	if (dns_name_equal(name, origin)) {
-		return false;
+		return (false);
 	}

 	dns_rdataset_init(&nsset);
@@ -1157,7 +1141,7 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1176,7 +1160,7 @@ has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 		dns_rdataset_disassociate(&dnameset);
 	}

-	return result == ISC_R_SUCCESS;
+	return ((result == ISC_R_SUCCESS));
 }

 /*%
@@ -1394,7 +1378,7 @@ active_node(dns_dbnode_t *node) {
 	}
 	dns_rdatasetiter_destroy(&rdsiter);

-	return active;
+	return (active);
 }

 /*%
@@ -1443,7 +1427,7 @@ setsoaserial(uint32_t serial, dns_updatemethod_t method) {

 	result = dns_db_getoriginnode(gdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	dns_rdataset_init(&rdataset);
@@ -1517,7 +1501,7 @@ cleanup:
 	}
 	dns_rdata_reset(&rdata);

-	return result;
+	return (result);
 }

 /*%
@@ -3338,24 +3322,21 @@ print_stats(isc_time_t *timer_start, isc_time_t *timer_finish,
 	uint64_t sig_ms;  /* Signatures per millisecond */
 	FILE *out = output_stdout ? stderr : stdout;

-	fprintf(out, "Signatures generated:               %10" PRIuFAST32 "\n",
-		atomic_load(&nsigned));
-	fprintf(out, "Signatures retained:                %10" PRIuFAST32 "\n",
-		atomic_load(&nretained));
-	fprintf(out, "Signatures dropped:                 %10" PRIuFAST32 "\n",
-		atomic_load(&ndropped));
-	fprintf(out, "Signatures successfully verified:   %10" PRIuFAST32 "\n",
-		atomic_load(&nverified));
-	fprintf(out, "Signatures unsuccessfully verified: %10" PRIuFAST32 "\n",
-		atomic_load(&nverifyfailed));
+	fprintf(out, "Signatures generated:               %10u\n", nsigned);
+	fprintf(out, "Signatures retained:                %10u\n", nretained);
+	fprintf(out, "Signatures dropped:                 %10u\n", ndropped);
+	fprintf(out, "Signatures successfully verified:   %10u\n", nverified);
+	fprintf(out,
+		"Signatures unsuccessfully "
+		"verified: %10u\n",
+		nverifyfailed);

 	time_us = isc_time_microdiff(sign_finish, sign_start);
 	time_ms = time_us / 1000;
 	fprintf(out, "Signing time in seconds:           %7u.%03u\n",
 		(unsigned int)(time_ms / 1000), (unsigned int)(time_ms % 1000));
 	if (time_us > 0) {
-		sig_ms = ((uint64_t)atomic_load(&nsigned) * 1000000000) /
-			 time_us;
+		sig_ms = ((uint64_t)nsigned * 1000000000) / time_us;
 		fprintf(out, "Signatures per second:             %7u.%03u\n",
 			(unsigned int)sig_ms / 1000,
 			(unsigned int)sig_ms % 1000);
@@ -4066,6 +4047,10 @@ main(int argc, char *argv[]) {

 	isc_mutex_init(&namelock);

+	if (printstats) {
+		isc_mutex_init(&statslock);
+	}
+
 	presign();
 	sign_start = isc_time_now();
 	signapex();
@@ -4172,8 +4157,9 @@ main(int argc, char *argv[]) {
 		timer_finish = isc_time_now();
 		print_stats(&timer_start, &timer_finish, &sign_start,
 			    &sign_finish);
+		isc_mutex_destroy(&statslock);
 	}
 	isc_mutex_destroy(&namelock);

-	return vresult == ISC_R_SUCCESS ? 0 : 1;
+	return (vresult == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-signzone - DNSSEC zone signing tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-J** filename] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]
+:program:`dnssec-signzone` [**-a**] [**-c** class] [**-d** directory] [**-D**] [**-E** engine] [**-e** end-time] [**-f** output-file] [**-F**] [**-g**] [**-G sync-records**] [**-h**] [**-i** interval] [**-I** input-format] [**-j** jitter] [**-K** directory] [**-k** key] [**-L** serial] [**-M** maxttl] [**-N** soa-serial-format] [**-o** origin] [**-O** output-format] [**-P**] [**-Q**] [**-q**] [**-R**] [**-S**] [**-s** start-time] [**-T** ttl] [**-t**] [**-u**] [**-v** level] [**-V**] [**-X** extended end-time] [**-x**] [**-z**] [**-3** salt] [**-H** iterations] [**-A**] {zonefile} [key...]

 Description
 ~~~~~~~~~~~
@@ -89,11 +89,6 @@ Options
   where ``digest-type`` is an allowed algorithm such as SHA-256 (2), or SHA-384 (4).
   Only works in combination with smart signing (``-S``).

-.. option:: -J filename
-
-   This option tells :program:`dnssec-signzone` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -K directory

   This option specifies the directory to search for DNSSEC keys. If not
@@ -183,11 +178,6 @@ Options
   days. Therefore, if any existing RRSIG records are due to expire in
   less than 7.5 days, they are replaced.

-   Note that the calculation of cycle interval is based upon the validity
-   period of the replacement signatures that would be generated by
-   ``dnssec-signzone``, not on the valid lifetimes of the input RRSIGs being
-   considered for pre-expiry replacement.
-
 .. option:: -I input-format

   This option sets the format of the input zone file. Possible formats are
@@ -283,7 +273,7 @@ Options
   with cached copies of the old DNSKEY RRset. The :option:`-Q` option forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   active. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.1` ("Pre-Publish Zone Signing Key Rollover").
+   :rfc:`6781#4.1.1.1` ("Pre-Publish Key Rollover").

 .. option:: -q

@@ -300,7 +290,7 @@ Options
   This option is similar to :option:`-Q`, except it forces
   :program:`dnssec-signzone` to remove signatures from keys that are no longer
   published. This enables ZSK rollover using the procedure described in
-   :rfc:`6781#section-4.1.1.2` ("Double Signature Zone Signing Key
+   :rfc:`6781#4.1.1.2` ("Double Signature Zone Signing Key
   Rollover").

 .. option:: -S
@@ -342,5 +342,5 @@ main(int argc, char *argv[]) {
 	}
 	isc_mem_destroy(&mctx);

-	return result == ISC_R_SUCCESS ? 0 : 1;
+	return (result == ISC_R_SUCCESS ? 0 : 1);
 }
@@ -21,7 +21,7 @@ dnssec-verify - DNSSEC zone verification tool
 Synopsis
 ~~~~~~~~

-:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-J** filename] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}
+:program:`dnssec-verify` [**-c** class] [**-E** engine] [**-I** input-format] [**-o** origin] [**-q**] [**-v** level] [**-V**] [**-x**] [**-z**] {zonefile}

 Description
 ~~~~~~~~~~~
@@ -53,11 +53,6 @@ Options
   format containing updates can be verified independently.
   This option is not useful for non-dynamic zones.

-.. option:: -J filename
-
-   This option tells :program:`dnssec-verify` to read the journal from the given file
-   when loading the zone file.
-
 .. option:: -o origin

   This option indicates the zone origin. If not specified, the name of the zone file is
@@ -202,16 +202,16 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
 	case 'Y':
 	case 'y':
-		return offset * (365 * 24 * 3600);
+		return (offset * (365 * 24 * 3600));
 	case 'M':
 	case 'm':
 		switch (suffix[1]) {
 		case 'O':
 		case 'o':
-			return offset * (30 * 24 * 3600);
+			return (offset * (30 * 24 * 3600));
 		case 'I':
 		case 'i':
-			return offset * 60;
+			return (offset * 60);
 		case '\0':
 			fatal("'%s' ambiguous: use 'mi' for minutes "
 			      "or 'mo' for months",
@@ -223,29 +223,29 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 		break;
 	case 'W':
 	case 'w':
-		return offset * (7 * 24 * 3600);
+		return (offset * (7 * 24 * 3600));
 	case 'D':
 	case 'd':
-		return offset * (24 * 3600);
+		return (offset * (24 * 3600));
 	case 'H':
 	case 'h':
-		return offset * 3600;
+		return (offset * 3600);
 	case 'S':
 	case 's':
 	case '\0':
-		return offset;
+		return (offset);
 	default:
 		fatal("time value %s is invalid", str);
 	}
 	UNREACHABLE();
-	return 0; /* silence compiler warning */
+	return (0); /* silence compiler warning */
 }

 static bool
 isnone(const char *str) {
-	return (strcasecmp(str, "none") == 0) ||
-	       (strcasecmp(str, "never") == 0) ||
-	       (strcasecmp(str, "unset") == 0);
+	return ((strcasecmp(str, "none") == 0) ||
+		(strcasecmp(str, "never") == 0) ||
+		(strcasecmp(str, "unset") == 0));
 }

 dns_ttl_t
@@ -255,7 +255,7 @@ strtottl(const char *str) {
 	char *endp;

 	if (isnone(str)) {
-		return (dns_ttl_t)0;
+		return ((dns_ttl_t)0);
 	}

 	ttl = strtol(str, &endp, 0);
@@ -263,19 +263,19 @@ strtottl(const char *str) {
 		fatal("TTL must be numeric");
 	}
 	ttl = time_units(ttl, endp, orig);
-	return ttl;
+	return (ttl);
 }

 dst_key_state_t
 strtokeystate(const char *str) {
 	if (isnone(str)) {
-		return DST_KEY_STATE_NA;
+		return (DST_KEY_STATE_NA);
 	}

 	for (int i = 0; i < KEYSTATES_NVALUES; i++) {
 		if (keystates[i] != NULL && strcasecmp(str, keystates[i]) == 0)
 		{
-			return (dst_key_state_t)i;
+			return ((dst_key_state_t)i);
 		}
 	}
 	fatal("unknown key state %s", str);
@@ -292,13 +292,13 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {

 	if (isnone(str)) {
 		SET_IF_NOT_NULL(setp, false);
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	SET_IF_NOT_NULL(setp, true);

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0') {
-		return (isc_stdtime_t)0;
+		return ((isc_stdtime_t)0);
 	}

 	/*
@@ -347,7 +347,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 	}

 	if (str[0] == '\0') {
-		return (isc_stdtime_t)base;
+		return ((isc_stdtime_t)base);
 	} else if (str[0] == '+') {
 		offset = strtol(str + 1, &endp, 0);
 		offset = time_units((isc_stdtime_t)offset, endp, orig);
@@ -360,7 +360,7 @@ strtotime(const char *str, int64_t now, int64_t base, bool *setp) {
 		fatal("time value %s is invalid", orig);
 	}

-	return (isc_stdtime_t)val;
+	return ((isc_stdtime_t)val);
 }

 dns_rdataclass_t
@@ -370,7 +370,7 @@ strtoclass(const char *str) {
 	isc_result_t result;

 	if (str == NULL) {
-		return dns_rdataclass_in;
+		return (dns_rdataclass_in);
 	}
 	r.base = UNCONST(str);
 	r.length = strlen(str);
@@ -378,7 +378,7 @@ strtoclass(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown class %s", str);
 	}
-	return rdclass;
+	return (rdclass);
 }

 unsigned int
@@ -393,14 +393,14 @@ strtodsdigest(const char *str) {
 	if (result != ISC_R_SUCCESS) {
 		fatal("unknown DS algorithm %s", str);
 	}
-	return alg;
+	return (alg);
 }

 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const uint8_t *)ap;
 	int b = *(const uint8_t *)bp;
-	return a - b;
+	return (a - b);
 }

 void
@@ -432,7 +432,7 @@ try_dir(const char *dirname) {
 	if (result == ISC_R_SUCCESS) {
 		isc_dir_close(&d);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -479,7 +479,7 @@ set_keyversion(dst_key_t *key) {

 bool
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact) {
+	      isc_mem_t *mctx, bool *exact) {
 	isc_result_t result;
 	bool conflict = false;
 	dns_dnsseckeylist_t matchkeys;
@@ -489,32 +489,19 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	isc_stdtime_t now = isc_stdtime_now();

-	SET_IF_NOT_NULL(exact, false);
+	if (exact != NULL) {
+		*exact = false;
+	}

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

-	if (min != max) {
-		if (id < min || id > max) {
-			fprintf(stderr, "Key ID %d outside of [%u..%u]\n", id,
-				min, max);
-			return true;
-		}
-		if (rid < min || rid > max) {
-			fprintf(stderr,
-				"Revoked Key ID %d (for tag %d) outside of "
-				"[%u..%u]\n",
-				rid, id, min, max);
-			return true;
-		}
-	}
-
 	ISC_LIST_INIT(matchkeys);
 	result = dns_dnssec_findmatchingkeys(name, NULL, dir, NULL, now, mctx,
 					     &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
-		return false;
+		return (false);
 	}

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
@@ -558,7 +545,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		dns_dnsseckey_destroy(mctx, &key);
 	}

-	return conflict;
+	return (conflict);
 }

 bool
@@ -573,9 +560,9 @@ isoptarg(const char *arg, char **argv, void (*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next argument */
 		isc_commandline_index++;
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 void
@@ -109,7 +109,7 @@ set_keyversion(dst_key_t *key);

 bool
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, uint16_t min, uint16_t max, bool *exact);
+	      isc_mem_t *mctx, bool *exact);

 bool
 isoptarg(const char *arg, char **argv, void (*usage)(void));
@@ -931,7 +931,6 @@
                  <th>Messages Received</th>
                  <th>Records Received</th>
                  <th>Bytes Received</th>
-                  <th>Transfer Rate (B/s)</th>
                </tr>
              </thead>
              <tbody>
@@ -960,7 +959,6 @@
                    <td><xsl:value-of select="nmsg"/></td>
                    <td><xsl:value-of select="nrecs"/></td>
                    <td><xsl:value-of select="nbytes"/></td>
-                    <td><xsl:value-of select="rate"/></td>
                  </tr>
                </xsl:for-each>
              </tbody>
@@ -120,7 +120,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 		rdatalist->ttl = ttl;
 		ISC_LIST_APPEND(node->lists, rdatalist, link);
 	} else if (rdatalist->ttl != ttl) {
-		return DNS_R_BADTTL;
+		return (DNS_R_BADTTL);
 	}

 	rdata = isc_mem_get(mctx, sizeof(dns_rdata_t));
@@ -136,7 +136,7 @@ putrdata(bdbnode_t *node, dns_rdatatype_t typeval, dns_ttl_t ttl,
 	ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	ISC_LIST_APPEND(node->buffers, rdatabuf, link);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -159,7 +159,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {
 	isc_constregion_t r = { .base = type, .length = strlen(type) };
 	result = dns_rdatatype_fromtext(&typeval, (isc_textregion_t *)&r);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_create(mctx, 64, &lex);
@@ -170,7 +170,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	result = isc_lex_openbuffer(lex, &b);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_buffer_allocate(mctx, &rb, DNS_RDATA_MAXLENGTH);
@@ -185,7 +185,7 @@ putrr(bdbnode_t *node, const char *type, dns_ttl_t ttl, const char *data) {

 	isc_buffer_free(&rb);

-	return result;
+	return (result);
 }

 /* Reasonable default SOA values */
@@ -207,9 +207,9 @@ putsoa(bdbnode_t *node, const char *mname, const char *rname, uint32_t serial) {
 		     serial, DEFAULT_REFRESH, DEFAULT_RETRY, DEFAULT_EXPIRE,
 		     DEFAULT_MINIMUM);
 	if (n >= (int)sizeof(str) || n < 0) {
-		return ISC_R_NOSPACE;
+		return (ISC_R_NOSPACE);
 	}
-	return putrr(node, "SOA", DEFAULT_TTL, str);
+	return (putrr(node, "SOA", DEFAULT_TTL, str));
 }

 static isc_result_t
@@ -222,7 +222,7 @@ puttxt(bdbnode_t *node, const char *text) {
 	}
 	buf[0] = len;
 	memmove(&buf[1], text, len);
-	return putrdata(node, dns_rdatatype_txt, 0, buf, len + 1);
+	return (putrdata(node, dns_rdatatype_txt, 0, buf, len + 1));
 }

 /*
@@ -279,7 +279,7 @@ dns64_rdata(unsigned char *v, size_t start, unsigned char *rdata) {
 		}
 	}
 	memmove(&rdata[j], "\07in-addr\04arpa", 14);
-	return j + 14;
+	return (j + 14);
 }

 static isc_result_t
@@ -301,7 +301,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	zlen = zone->length;
 	nlen = name->length;
 	if ((zlen + nlen) > 74U || zlen < 10U || (nlen % 2) != 0U) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -320,11 +320,11 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	while (j != 0U) {
 		INSIST((i / 2) < sizeof(v));
 		if (ndata[0] != 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		n = hex16[ndata[1] & 0xff];
 		if (n == 1) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		v[i / 2] = n | (v[i / 2] >> 4);
 		j -= 2;
@@ -346,14 +346,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 16U && v[(nlen - 1) / 4 - 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 8, rdata);
 		break;
@@ -363,14 +363,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 12U && v[(nlen - 1) / 4 - 3] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 6, rdata);
 		break;
@@ -380,14 +380,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 8U && v[(nlen - 1) / 4 - 2] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 5, rdata);
 		break;
@@ -397,14 +397,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (nlen > 4U && v[(nlen - 1) / 4 - 1] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 4, rdata);
 		break;
@@ -414,14 +414,14 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * to exist in the zone.
 		 */
 		if (v[(nlen - 1) / 4] != 0) {
-			return ISC_R_NOTFOUND;
+			return (ISC_R_NOTFOUND);
 		}
 		/*
 		 * If the total length is not 74 then this is a empty node
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 3, rdata);
 		break;
@@ -431,7 +431,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * so return success.
 		 */
 		if (nlen + zlen != 74U) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		len = dns64_rdata(v, 0, rdata);
 		break;
@@ -440,7 +440,7 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 		 * This should never be reached unless someone adds a
 		 * zone declaration with this internal type to named.conf.
 		 */
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	/*
@@ -449,22 +449,22 @@ dns64_cname(const dns_name_t *zone, const dns_name_t *name, bdbnode_t *node) {
 	if ((v[0] == 170 || v[0] == 171) && v[1] == 0 && v[2] == 0 &&
 	    v[3] == 192)
 	{
-		return putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
-				sizeof(ipv4only));
+		return (putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
+				 sizeof(ipv4only)));
 	}

-	return putrdata(node, dns_rdatatype_cname, 600, rdata,
-			(unsigned int)len);
+	return (putrdata(node, dns_rdatatype_cname, 600, rdata,
+			 (unsigned int)len));
 }

 static isc_result_t
 builtin_lookup(bdb_t *bdb, const dns_name_t *name, bdbnode_t *node) {
 	if (name->labels == 0 && name->length == 0) {
-		return bdb->lookup(node);
+		return (bdb->lookup(node));
 	} else if ((node->bdb->implementation->flags & BDB_DNS64) != 0) {
-		return dns64_cname(&bdb->common.origin, name, node);
+		return (dns64_cname(&bdb->common.origin, name, node));
 	} else {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 }

@@ -483,27 +483,27 @@ builtin_authority(bdb_t *bdb, bdbnode_t *node) {

 	result = putsoa(node, server, contact, 0);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = putrr(node, "NS", 0, server);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
 version_lookup(bdbnode_t *node) {
 	if (named_g_server->version_set) {
 		if (named_g_server->version == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->version);
+			return (puttxt(node, named_g_server->version));
 		}
 	} else {
-		return puttxt(node, PACKAGE_VERSION);
+		return (puttxt(node, PACKAGE_VERSION));
 	}
 }

@@ -511,16 +511,16 @@ static isc_result_t
 hostname_lookup(bdbnode_t *node) {
 	if (named_g_server->hostname_set) {
 		if (named_g_server->hostname == NULL) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		} else {
-			return puttxt(node, named_g_server->hostname);
+			return (puttxt(node, named_g_server->hostname));
 		}
 	} else {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	}
 }

@@ -546,16 +546,16 @@ authors_lookup(bdbnode_t *node) {
 	 * If a version string is specified, disable the authors.bind zone.
 	 */
 	if (named_g_server->version_set) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	for (p = authors; *p != NULL; p++) {
 		result = puttxt(node, *p);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -563,13 +563,13 @@ id_lookup(bdbnode_t *node) {
 	if (named_g_server->sctx->usehostname) {
 		char buf[256];
 		if (gethostname(buf, sizeof(buf)) != 0) {
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
-		return puttxt(node, buf);
+		return (puttxt(node, buf));
 	} else if (named_g_server->sctx->server_id != NULL) {
-		return puttxt(node, named_g_server->sctx->server_id);
+		return (puttxt(node, named_g_server->sctx->server_id));
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -577,7 +577,7 @@ static isc_result_t
 empty_lookup(bdbnode_t *node) {
 	UNUSED(node);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -588,10 +588,10 @@ ipv4only_lookup(bdbnode_t *node) {
 	for (int i = 0; i < 2; i++) {
 		result = putrdata(node, dns_rdatatype_a, 3600, data[i], 4);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -600,7 +600,7 @@ ipv4reverse_lookup(bdbnode_t *node) {

 	result = putrdata(node, dns_rdatatype_ptr, 3600, ipv4only,
 			  sizeof(ipv4only));
-	return result;
+	return (result);
 }

 /*
@@ -670,10 +670,10 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {
 	bdbnode_t *bdbnode = (bdbnode_t *)iterator->node;

 	if (ISC_LIST_EMPTY(bdbnode->lists)) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	}
 	bdbiterator->current = ISC_LIST_HEAD(bdbnode->lists);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -682,9 +682,9 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator DNS__DB_FLARG) {

 	bdbiterator->current = ISC_LIST_NEXT(bdbiterator->current, link);
 	if (bdbiterator->current == NULL) {
-		return ISC_R_NOMORE;
+		return (ISC_R_NOMORE);
 	} else {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 }

@@ -787,7 +787,7 @@ createnode(bdb_t *bdb, bdbnode_t **nodep) {
 	node->magic = BDBNODE_MAGIC;

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -844,23 +844,23 @@ getoriginnode(dns_db_t *db, dns_dbnode_t **nodep DNS__DB_FLARG) {

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && result != ISC_R_NOTFOUND) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	result = builtin_authority(bdb, node);
 	if (result != ISC_R_SUCCESS) {
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -887,26 +887,26 @@ findnode(dns_db_t *db, const dns_name_t *name, bool create,

 	result = createnode(bdb, &node);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = builtin_lookup(bdb, name, node);
 	if (result != ISC_R_SUCCESS && (!isorigin || result != ISC_R_NOTFOUND))
 	{
 		destroynode(node);
-		return result;
+		return (result);
 	}

 	if (isorigin) {
 		result = builtin_authority(bdb, node);
 		if (result != ISC_R_SUCCESS) {
 			destroynode(node);
-			return result;
+			return (result);
 		}
 	}

 	*nodep = node;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -928,7 +928,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	REQUIRE(version == NULL || version == (void *)&dummy);

 	if (!dns_name_issubdomain(name, &db->origin)) {
-		return DNS_R_NXDOMAIN;
+		return (DNS_R_NXDOMAIN);
 	}

 	olabels = dns_name_countlabels(&db->origin);
@@ -954,13 +954,13 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			 * No data at zone apex?
 			 */
 			if (i == olabels) {
-				return DNS_R_BADDB;
+				return (DNS_R_BADDB);
 			}
 			result = DNS_R_NXDOMAIN;
 			continue;
 		}
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}

 		/*
@@ -1069,7 +1069,7 @@ find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		detachnode(db, &node DNS__DB_FLARG_PASS);
 	}

-	return result;
+	return (result);
 }

 static void
@@ -1117,7 +1117,7 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	UNUSED(sigrdataset);

 	if (type == dns_rdatatype_rrsig) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	list = ISC_LIST_HEAD(bdbnode->lists);
@@ -1128,12 +1128,12 @@ findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 		list = ISC_LIST_NEXT(list, link);
 	}
 	if (list == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}

 	new_rdataset(list, db, node, rdataset);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static isc_result_t
@@ -1158,7 +1158,7 @@ allrdatasets(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,

 	*iteratorp = (dns_rdatasetiter_t *)iterator;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static dns_dbmethods_t bdb_methods = {
@@ -1186,7 +1186,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,
 	REQUIRE(implementation != NULL);

 	if (type != dns_dbtype_zone) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	bdb = isc_mem_get(mctx, sizeof(*bdb));
@@ -1241,7 +1241,7 @@ create(isc_mem_t *mctx, const dns_name_t *origin, dns_dbtype_t type,

 	*dbp = (dns_db_t *)bdb;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	dns_name_free(&bdb->common.origin, mctx);
@@ -1253,7 +1253,7 @@ cleanup:
 	}

 	isc_mem_putanddetach(&bdb->common.mctx, bdb, sizeof(bdb_t));
-	return result;
+	return (result);
 }

 /*
@@ -1269,17 +1269,17 @@ named_builtin_init(void) {
 	result = dns_db_register("_builtin", create, &builtin, named_g_mctx,
 				 &builtin.dbimp);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	result = dns_db_register("_dns64", create, &dns64, named_g_mctx,
 				 &dns64.dbimp);
 	if (result != ISC_R_SUCCESS) {
 		dns_db_unregister(&builtin.dbimp);
-		return result;
+		return (result);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -96,12 +96,10 @@ options {\n\
 #endif
 			    "\
 	prefetch 2 9;\n\
-#	querylog <boolean>;\n\
 	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	resolver-query-timeout 10;\n\
-#	responselog <boolean>;\n\
 	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
@@ -111,9 +109,6 @@ options {\n\
 #	session-keyfile \"" NAMED_LOCALSTATEDIR "/run/named/session.key\";\n\
 	session-keyname local-ddns;\n\
 	startup-notify-rate 20;\n\
-	sig0checks-quota 1;\n\
-	sig0key-checks-limit 16;\n\
-	sig0message-checks-limit 2;\n\
 	statistics-file \"named.stats\";\n\
 	tcp-advertised-timeout 300;\n\
 	tcp-clients 150;\n\
@@ -174,9 +169,7 @@ options {\n\
 	max-clients-per-query 100;\n\
 	max-ncache-ttl 10800; /* 3 hours */\n\
 	max-recursion-depth 7;\n\
-	max-recursion-queries 50;\n\
-	max-query-count 200;\n\
-	max-query-restarts 11;\n\
+	max-recursion-queries 100;\n\
 	max-stale-ttl 86400; /* 1 day */\n\
 	message-compression yes;\n\
 	min-ncache-ttl 0; /* 0 hours */\n\
@@ -229,17 +222,14 @@ options {\n\
 	ixfr-from-differences false;\n\
 	max-journal-size default;\n\
 	max-records 0;\n\
-	max-records-per-type 100;\n\
 	max-refresh-time 2419200; /* 4 weeks */\n\
 	max-retry-time 1209600; /* 2 weeks */\n\
-	max-types-per-name 100;\n\
 	max-transfer-idle-in 60;\n\
 	max-transfer-idle-out 60;\n\
 	max-transfer-time-in 120;\n\
 	max-transfer-time-out 120;\n\
 	min-refresh-time 300;\n\
 	min-retry-time 500;\n\
-	min-transfer-rate-in 10240 5;\n\
 	multi-master no;\n\
 	notify yes;\n\
 	notify-delay 5;\n\
@@ -305,7 +295,6 @@ dnssec-policy \"default\" {\n\
 	cds-digest-types { 2; };\n\
 	dnskey-ttl " DNS_KASP_KEY_TTL ";\n\
 	inline-signing yes;\n\
-	offline-ksk no;\n\
 	publish-safety " DNS_KASP_PUBLISH_SAFETY "; \n\
 	retire-safety " DNS_KASP_RETIRE_SAFETY "; \n\
 	purge-keys " DNS_KASP_PURGE_KEYS "; \n\
@@ -338,7 +327,7 @@ dnssec-policy \"insecure\" {\n\

 			    "# END TRUST ANCHORS\n\
 \n\
-remote-servers " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
+primaries " DEFAULT_IANA_ROOT_ZONE_PRIMARIES " {\n\
 	2801:1b8:10::b;		# b.root-servers.net\n\
 	2001:500:2::c;		# c.root-servers.net\n\
 	2001:500:2f::f;		# f.root-servers.net\n\
@@ -362,15 +351,13 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
-				CFG_PCTX_NODEPRECATED | CFG_PCTX_NOOBSOLETE |
-					CFG_PCTX_NOEXPERIMENTAL,
-				conf);
+	return (cfg_parse_buffer(parser, &b, __FILE__, 0, &cfg_type_namedconf,
+				 CFG_PCTX_NODEPRECATED, conf));
 }

 const char *
 named_config_getdefault(void) {
-	return defaultconf;
+	return (defaultconf);
 }

 isc_result_t
@@ -380,10 +367,10 @@ named_config_get(cfg_obj_t const *const *maps, const char *name,

 	for (i = 0; maps[i] != NULL; i++) {
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS) {
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 isc_result_t
@@ -409,7 +396,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 			 */
 			if (checknames != NULL && !cfg_obj_islist(checknames)) {
 				*obj = checknames;
-				return ISC_R_SUCCESS;
+				return (ISC_R_SUCCESS);
 			}
 			for (element = cfg_list_first(checknames);
 			     element != NULL; element = cfg_list_next(element))
@@ -423,13 +410,13 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 					{
 						*obj = cfg_tuple_get(value,
 								     "mode");
-						return ISC_R_SUCCESS;
+						return (ISC_R_SUCCESS);
 					}
 				}
 			}
 		}
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
 }

 int
@@ -441,7 +428,7 @@ named_config_listcount(const cfg_obj_t *list) {
 		i++;
 	}

-	return i;
+	return (i);
 }

 isc_result_t
@@ -452,7 +439,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,

 	if (!cfg_obj_isstring(classobj)) {
 		*classp = defclass;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(classobj));
 	r.length = strlen(r.base);
@@ -461,7 +448,7 @@ named_config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 		cfg_obj_log(classobj, named_g_lctx, ISC_LOG_ERROR,
 			    "unknown class '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -472,7 +459,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,

 	if (!cfg_obj_isstring(typeobj)) {
 		*typep = deftype;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}
 	r.base = UNCONST(cfg_obj_asstring(typeobj));
 	r.length = strlen(r.base);
@@ -481,7 +468,7 @@ named_config_gettype(const cfg_obj_t *typeobj, dns_rdatatype_t deftype,
 		cfg_obj_log(typeobj, named_g_lctx, ISC_LOG_ERROR,
 			    "unknown type '%s'", r.base);
 	}
-	return result;
+	return (result);
 }

 dns_zonetype_t
@@ -507,12 +494,12 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	} else {
 		UNREACHABLE();
 	}
-	return ztype;
+	return (ztype);
 }

-isc_result_t
-named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
-			   const char *name, const cfg_obj_t **ret) {
+static isc_result_t
+getremotesdef(const cfg_obj_t *cctx, const char *list, const char *name,
+	      const cfg_obj_t **ret) {
 	isc_result_t result;
 	const cfg_obj_t *obj = NULL;
 	const cfg_listelt_t *elt;
@@ -523,7 +510,7 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,

 	result = cfg_map_get(cctx, list, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	elt = cfg_list_first(obj);
 	while (elt != NULL) {
@@ -532,11 +519,28 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			       name) == 0)
 		{
 			*ret = obj;
-			return ISC_R_SUCCESS;
+			return (ISC_R_SUCCESS);
 		}
 		elt = cfg_list_next(elt);
 	}
-	return ISC_R_NOTFOUND;
+	return (ISC_R_NOTFOUND);
+}
+
+isc_result_t
+named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
+			   const char *name, const cfg_obj_t **ret) {
+	isc_result_t result;
+
+	if (strcmp(list, "parental-agents") == 0) {
+		return (getremotesdef(cctx, list, name, ret));
+	} else if (strcmp(list, "primaries") == 0) {
+		result = getremotesdef(cctx, list, name, ret);
+		if (result != ISC_R_SUCCESS) {
+			result = getremotesdef(cctx, "masters", name, ret);
+		}
+		return (result);
+	}
+	return (ISC_R_NOTFOUND);
 }

 static isc_result_t
@@ -551,7 +555,7 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,

 	if (!cfg_obj_isstring(obj)) {
 		*namep = NULL;
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	*namep = isc_mem_get(mctx, sizeof(**namep));
@@ -566,11 +570,11 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 	if (result != ISC_R_SUCCESS) {
 		isc_mem_put(mctx, *namep, sizeof(**namep));
 		*namep = NULL;
-		return result;
+		return (result);
 	}
 	dns_name_dup(dns_fixedname_name(&fname), mctx, *namep);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 #define grow_array(mctx, array, newlen, oldlen)                          \
@@ -587,12 +591,10 @@ named_config_getname(isc_mem_t *mctx, const cfg_obj_t *obj,
 		oldlen = newlen;                                    \
 	}

-static const char *remotesnames[4] = { "remote-servers", "parental-agents",
-				       "primaries", "masters" };
-
 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl) {
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl) {
 	uint32_t addrcount = 0, srccount = 0;
 	uint32_t keycount = 0, tlscount = 0;
 	uint32_t listcount = 0, l = 0, i = 0;
@@ -675,6 +677,8 @@ newlist:
 		isc_sockaddr_any6(&src6);
 	}

+	result = ISC_R_NOMEMORY;
+
 	element = cfg_list_first(addrlist);
 resume:
 	for (; element != NULL; element = cfg_list_next(element)) {
@@ -705,22 +709,17 @@ resume:
 				continue;
 			}
 			list = NULL;
-			tresult = ISC_R_NOTFOUND;
-			for (size_t n = 0; n < ARRAY_SIZE(remotesnames); n++) {
-				tresult = named_config_getremotesdef(
-					config, remotesnames[n], listname,
-					&list);
-				if (tresult == ISC_R_SUCCESS) {
-					break;
-				}
-			}
+			tresult = named_config_getremotesdef(config, listtype,
+							     listname, &list);
 			if (tresult == ISC_R_NOTFOUND) {
 				cfg_obj_log(addr, named_g_lctx, ISC_LOG_ERROR,
-					    "remote-servers \"%s\" not found",
+					    "%s \"%s\" not found", listtype,
 					    listname);
+
+				result = tresult;
+				goto cleanup;
 			}
 			if (tresult != ISC_R_SUCCESS) {
-				result = tresult;
 				goto cleanup;
 			}
 			lists[l++].name = listname;
@@ -823,7 +822,7 @@ resume:
 	ipkl->count = addrcount;
 	ipkl->allocated = addrcount;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (addrs != NULL) {
@@ -862,7 +861,7 @@ cleanup:
 	if (stack != NULL) {
 		isc_mem_cput(mctx, stack, stackcount, sizeof(stack[0]));
 	}
-	return result;
+	return (result);
 }

 isc_result_t
@@ -888,10 +887,10 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 			    "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
-		return ISC_R_RANGE;
+		return (ISC_R_RANGE);
 	}
 	*portp = (in_port_t)cfg_obj_asuint32(portobj);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 struct keyalgorithms {
@@ -935,15 +934,15 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 		}
 	}
 	if (algorithms[i].str == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	if (str[len] == '-') {
 		result = isc_parse_uint16(&bits, str + len + 1, 10);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		if (bits > algorithms[i].size) {
-			return ISC_R_RANGE;
+			return (ISC_R_RANGE);
 		}
 	} else if (algorithms[i].size == 0) {
 		bits = 128;
@@ -952,5 +951,5 @@ named_config_getkeyalgorithm(const char *str, unsigned int *typep,
 	}
 	SET_IF_NOT_NULL(typep, algorithms[i].type);
 	SET_IF_NOT_NULL(digestbits, bits);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
@@ -43,23 +43,23 @@ getcommand(isc_lex_t *lex, char **cmdp) {

 	result = isc_lex_gettoken(lex, ISC_LEXOPT_EOF, &token);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	isc_lex_ungettoken(lex, &token);

 	if (token.type != isc_tokentype_string) {
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	*cmdp = token.value.as_textregion.base;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static bool
 command_compare(const char *str, const char *command) {
-	return strcasecmp(str, command) == 0;
+	return (strcasecmp(str, command) == 0);
 }

 /*%
@@ -85,7 +85,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * No data section.
 		 */
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	result = isccc_cc_lookupstring(data, "type", &cmdline);
@@ -93,7 +93,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		/*
 		 * We have no idea what this is.
 		 */
-		return result;
+		return (result);
 	}

 	isc_lex_create(named_g_mctx, strlen(cmdline), &lex);
@@ -210,7 +210,8 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	{
 		result = named_server_dnstap(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_DUMPDB)) {
-		result = named_server_dumpdb(named_g_server, lex, text);
+		named_server_dumpdb(named_g_server, lex, text);
+		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_DUMPSTATS)) {
 		result = named_server_dumpstats(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_FETCHLIMIT)) {
@@ -223,14 +224,10 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_flushnode(named_g_server, lex, true);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
 		result = named_server_freeze(named_g_server, true, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_SKR)) {
-		result = named_server_skr(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_LOADKEYS) ||
 		   command_compare(command, NAMED_COMMAND_SIGN))
 	{
 		result = named_server_rekey(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_MEMPROF)) {
-		result = named_server_togglememprof(lex);
 	} else if (command_compare(command, NAMED_COMMAND_MKEYS)) {
 		result = named_server_mkeys(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_NOTIFY)) {
@@ -244,9 +241,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_NULL)) {
 		result = ISC_R_SUCCESS;
 	} else if (command_compare(command, NAMED_COMMAND_QUERYLOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "query logging",
-						  NS_SERVER_LOGQUERIES, lex);
+		result = named_server_togglequerylog(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RECONFIG)) {
 		result = named_server_reconfigcommand(named_g_server);
 	} else if (command_compare(command, NAMED_COMMAND_RECURSING)) {
@@ -255,10 +250,6 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = named_server_refreshcommand(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_RELOAD)) {
 		result = named_server_reloadcommand(named_g_server, lex, text);
-	} else if (command_compare(command, NAMED_COMMAND_RESPONSELOG)) {
-		result = named_server_setortoggle(named_g_server,
-						  "response logging",
-						  NS_SERVER_LOGRESPONSES, lex);
 	} else if (command_compare(command, NAMED_COMMAND_RETRANSFER)) {
 		result = named_server_retransfercommand(named_g_server, lex,
 							text);
@@ -303,5 +294,5 @@ cleanup:
 		isc_lex_destroy(&lex);
 	}

-	return result;
+	return (result);
 }
@@ -246,7 +246,7 @@ address_ok(isc_sockaddr_t *sockaddr, controllistener_t *listener) {

 	result = dns_acl_match(&netaddr, NULL, listener->acl, env, &match,
 			       NULL);
-	return result == ISC_R_SUCCESS && match > 0;
+	return (result == ISC_R_SUCCESS && match > 0);
 }

 static void
@@ -641,7 +641,7 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 		if (result == ISC_R_SHUTTINGDOWN) {
 			shutdown_listener(listener);
 		}
-		return result;
+		return (result);
 	}

 	peeraddr = isc_nmhandle_peeraddr(handle);
@@ -652,11 +652,11 @@ control_newconn(isc_nmhandle_t *handle, isc_result_t result, void *arg) {
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_WARNING,
 			      "rejected command channel message from %s",
 			      socktext);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	newconnection(listener, handle);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -710,11 +710,11 @@ cfgkeylist_find(const cfg_obj_t *keylist, const char *keyname,
 		}
 	}
 	if (element == NULL) {
-		return ISC_R_NOTFOUND;
+		return (ISC_R_NOTFOUND);
 	}
 	obj = cfg_listelt_value(element);
 	*objp = obj;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -838,7 +838,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 		      NAMED_LOGMODULE_CONTROL, ISC_LOG_INFO,
 		      "configuring command channel from '%s'", named_g_keyfile);
 	if (!isc_file_exists(named_g_keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

 	CHECK(cfg_parser_create(mctx, named_g_lctx, &pctx));
@@ -904,7 +904,7 @@ cleanup:
 	if (pctx != NULL) {
 		cfg_parser_destroy(&pctx);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1212,7 +1212,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 					    ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
 					    "supported");
-				return ISC_R_FAILURE;
+				return (ISC_R_FAILURE);
 			}

 			(void)cfg_map_get(controls, "inet", &inetcontrols);
@@ -1341,7 +1341,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	 * down will be taken care of by listen_done().
 	 */
 	ISC_LIST_APPENDLIST(cp->listeners, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 isc_result_t
@@ -1364,10 +1364,10 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 	if (result != ISC_R_SUCCESS) {
 		isc_mutex_destroy(&controls->symtab_lock);
 		isc_mem_put(server->mctx, controls, sizeof(*controls));
-		return result;
+		return (result);
 	}
 	*ctrlsp = controls;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -98,13 +98,13 @@ dlopen_dlz_allnodes(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_allnodes == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allnodes(zone, cd->dbdata, allnodes);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -116,13 +116,13 @@ dlopen_dlz_allowzonexfr(void *driverarg, void *dbdata, const char *name,
 	UNUSED(driverarg);

 	if (cd->dlz_allowzonexfr == NULL) {
-		return ISC_R_NOPERM;
+		return (ISC_R_NOPERM);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_allowzonexfr(cd->dbdata, name, client);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -134,13 +134,13 @@ dlopen_dlz_authority(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_authority == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_authority(zone, cd->dbdata, lookup);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -155,7 +155,7 @@ dlopen_dlz_findzonedb(void *driverarg, void *dbdata, const char *name,
 	MAYBE_LOCK(cd);
 	result = cd->dlz_findzonedb(cd->dbdata, name, methods, clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -172,7 +172,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 	result = cd->dlz_lookup(zone, name, cd->dbdata, lookup, methods,
 				clientinfo);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -195,7 +195,7 @@ dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
 		}
 	}

-	return ptr;
+	return (ptr);
 }

 static void
@@ -219,7 +219,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 			   "dlz_dlopen driver for '%s' needs a path to "
 			   "the shared library",
 			   dlzname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	isc_mem_create(&mctx);
@@ -319,14 +319,14 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	*dbdata = cd;

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failed:
 	dlopen_log(ISC_LOG_ERROR, "dlz_dlopen of '%s' failed", dlzname);

 	dlopen_dlz_destroy(NULL, cd);

-	return result;
+	return (result);
 }

 /*
@@ -363,13 +363,13 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 	UNUSED(driverarg);

 	if (cd->dlz_newversion == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_newversion(zone, cd->dbdata, versionp);
 	MAYBE_UNLOCK(cd);
-	return result;
+	return (result);
 }

 /*
@@ -404,7 +404,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_configure == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	MAYBE_LOCK(cd);
@@ -413,7 +413,7 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb, void *driverarg,
 	cd->in_configure = false;
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -429,7 +429,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL) {
-		return false;
+		return (false);
 	}

 	MAYBE_LOCK(cd);
@@ -437,7 +437,7 @@ dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
 			       keydata, cd->dbdata);
 	MAYBE_UNLOCK(cd);

-	return ret;
+	return (ret);
 }

 /*
@@ -452,14 +452,14 @@ dlopen_dlz_addrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_addrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_addrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -474,14 +474,14 @@ dlopen_dlz_subrdataset(const char *name, const char *rdatastr, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_subrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_subrdataset(name, rdatastr, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 /*
@@ -496,14 +496,14 @@ dlopen_dlz_delrdataset(const char *name, const char *type, void *driverarg,
 	UNUSED(driverarg);

 	if (cd->dlz_delrdataset == NULL) {
-		return ISC_R_NOTIMPLEMENTED;
+		return (ISC_R_NOTIMPLEMENTED);
 	}

 	MAYBE_LOCK(cd);
 	result = cd->dlz_delrdataset(name, type, cd->dbdata, version);
 	MAYBE_UNLOCK(cd);

-	return result;
+	return (result);
 }

 static dns_sdlzmethods_t dlz_dlopen_methods = {
@@ -535,7 +535,7 @@ dlz_dlopen_init(isc_mem_t *mctx) {
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 /*
@@ -127,7 +127,7 @@ fuzz_thread_client(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			goto next;
@@ -161,7 +161,7 @@ fuzz_thread_client(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 /*
@@ -375,7 +375,7 @@ fuzz_thread_resolver(void *arg) {
 				named_server_flushonshutdown(named_g_server,
 							     false);
 				isc_loopmgr_shutdown(named_g_loopmgr);
-				return NULL;
+				return (NULL);
 			}
 			raise(SIGSTOP);
 			continue;
@@ -587,7 +587,7 @@ fuzz_thread_resolver(void *arg) {
 	__AFL_LOOP(0);
 #endif /* ifdef __AFL_LOOP */

-	return NULL;
+	return (NULL);
 }

 /*
@@ -718,7 +718,7 @@ fuzz_thread_tcp(void *arg) {
 	named_server_flushonshutdown(named_g_server, false);
 	isc_loopmgr_shutdown(named_g_loopmgr);

-	return NULL;
+	return (NULL);
 }

 #endif /* ENABLE_AFL */
@@ -43,7 +43,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 			      "GeoIP2 database '%s/%s': path too long", dir,
 			      dbfile);
-		return NULL;
+		return (NULL);
 	}

 	ret = MMDB_open(pathbuf, MMDB_MODE_MMAP, mmdb);
@@ -51,7 +51,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_SERVER, ISC_LOG_INFO,
 			      "opened GeoIP2 database '%s'", pathbuf);
-		return mmdb;
+		return (mmdb);
 	}

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -59,7 +59,7 @@ open_geoip2(const char *dir, const char *dbfile, MMDB_s *mmdb) {
 		      "unable to open GeoIP2 database '%s' (status %d)",
 		      pathbuf, ret);

-	return NULL;
+	return (NULL);
 }
 #endif /* HAVE_GEOIP2 */

@@ -57,8 +57,9 @@ named_config_getremotesdef(const cfg_obj_t *cctx, const char *list,
 			   const char *name, const cfg_obj_t **ret);

 isc_result_t
-named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
-			     isc_mem_t *mctx, dns_ipkeylist_t *ipkl);
+named_config_getipandkeylist(const cfg_obj_t *config, const char *listtype,
+			     const cfg_obj_t *list, isc_mem_t *mctx,
+			     dns_ipkeylist_t *ipkl);

 isc_result_t
 named_config_getport(const cfg_obj_t *config, const char *type,
@@ -28,51 +28,48 @@

 #define NAMED_CONTROL_PORT 953

-#define NAMED_COMMAND_ADDZONE	   "addzone"
-#define NAMED_COMMAND_DELZONE	   "delzone"
-#define NAMED_COMMAND_DNSSEC	   "dnssec"
-#define NAMED_COMMAND_DNSTAP	   "dnstap"
-#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
-#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_STOP	   "stop"
+#define NAMED_COMMAND_HALT	   "halt"
+#define NAMED_COMMAND_RELOAD	   "reload"
+#define NAMED_COMMAND_RECONFIG	   "reconfig"
+#define NAMED_COMMAND_REFRESH	   "refresh"
+#define NAMED_COMMAND_RETRANSFER   "retransfer"
 #define NAMED_COMMAND_DUMPSTATS	   "stats"
-#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"
+#define NAMED_COMMAND_QUERYLOG	   "querylog"
+#define NAMED_COMMAND_DUMPDB	   "dumpdb"
+#define NAMED_COMMAND_SECROOTS	   "secroots"
+#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_NOTRACE	   "notrace"
 #define NAMED_COMMAND_FLUSH	   "flush"
 #define NAMED_COMMAND_FLUSHNAME	   "flushname"
 #define NAMED_COMMAND_FLUSHTREE	   "flushtree"
-#define NAMED_COMMAND_FREEZE	   "freeze"
-#define NAMED_COMMAND_HALT	   "halt"
-#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
-#define NAMED_COMMAND_MEMPROF	   "memprof"
-#define NAMED_COMMAND_MKEYS	   "managed-keys"
-#define NAMED_COMMAND_MODZONE	   "modzone"
-#define NAMED_COMMAND_NOTIFY	   "notify"
-#define NAMED_COMMAND_NOTRACE	   "notrace"
-#define NAMED_COMMAND_NTA	   "nta"
-#define NAMED_COMMAND_NULL	   "null"
-#define NAMED_COMMAND_QUERYLOG	   "querylog"
-#define NAMED_COMMAND_RECONFIG	   "reconfig"
-#define NAMED_COMMAND_RECURSING	   "recursing"
-#define NAMED_COMMAND_REFRESH	   "refresh"
-#define NAMED_COMMAND_RELOAD	   "reload"
-#define NAMED_COMMAND_RESPONSELOG  "responselog"
-#define NAMED_COMMAND_RETRANSFER   "retransfer"
-#define NAMED_COMMAND_SCAN	   "scan"
-#define NAMED_COMMAND_SECROOTS	   "secroots"
-#define NAMED_COMMAND_SERVESTALE   "serve-stale"
-#define NAMED_COMMAND_SHOWZONE	   "showzone"
-#define NAMED_COMMAND_SIGN	   "sign"
-#define NAMED_COMMAND_SIGNING	   "signing"
-#define NAMED_COMMAND_SKR	   "skr"
 #define NAMED_COMMAND_STATUS	   "status"
-#define NAMED_COMMAND_STOP	   "stop"
-#define NAMED_COMMAND_SYNC	   "sync"
-#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
-#define NAMED_COMMAND_TESTGEN	   "testgen"
-#define NAMED_COMMAND_THAW	   "thaw"
-#define NAMED_COMMAND_TRACE	   "trace"
+#define NAMED_COMMAND_FREEZE	   "freeze"
 #define NAMED_COMMAND_UNFREEZE	   "unfreeze"
+#define NAMED_COMMAND_THAW	   "thaw"
+#define NAMED_COMMAND_RECURSING	   "recursing"
+#define NAMED_COMMAND_NULL	   "null"
+#define NAMED_COMMAND_NOTIFY	   "notify"
 #define NAMED_COMMAND_VALIDATION   "validation"
+#define NAMED_COMMAND_SCAN	   "scan"
+#define NAMED_COMMAND_SIGN	   "sign"
+#define NAMED_COMMAND_LOADKEYS	   "loadkeys"
+#define NAMED_COMMAND_ADDZONE	   "addzone"
+#define NAMED_COMMAND_MODZONE	   "modzone"
+#define NAMED_COMMAND_DELZONE	   "delzone"
+#define NAMED_COMMAND_SHOWZONE	   "showzone"
+#define NAMED_COMMAND_SYNC	   "sync"
+#define NAMED_COMMAND_SIGNING	   "signing"
+#define NAMED_COMMAND_DNSSEC	   "dnssec"
 #define NAMED_COMMAND_ZONESTATUS   "zonestatus"
+#define NAMED_COMMAND_NTA	   "nta"
+#define NAMED_COMMAND_TESTGEN	   "testgen"
+#define NAMED_COMMAND_MKEYS	   "managed-keys"
+#define NAMED_COMMAND_DNSTAPREOPEN "dnstap-reopen"
+#define NAMED_COMMAND_DNSTAP	   "dnstap"
+#define NAMED_COMMAND_TCPTIMEOUTS  "tcp-timeouts"
+#define NAMED_COMMAND_SERVESTALE   "serve-stale"
+#define NAMED_COMMAND_FETCHLIMIT   "fetchlimit"

 isc_result_t
 named_controls_create(named_server_t *server, named_controls_t **ctrlsp);
@@ -100,6 +100,8 @@ EXTERN const char *named_g_conffile	   INIT(NAMED_SYSCONFDIR "/named.conf");
 EXTERN const char *named_g_defaultbindkeys INIT(NULL);
 EXTERN const char *named_g_keyfile	   INIT(NAMED_SYSCONFDIR "/rndc.key");

+EXTERN dns_tsigkey_t *named_g_sessionkey    INIT(NULL);
+EXTERN dns_name_t			    named_g_sessionkeyname;
 EXTERN bool named_g_conffileset		    INIT(false);
 EXTERN cfg_aclconfctx_t *named_g_aclconfctx INIT(NULL);

@@ -39,13 +39,10 @@ void
 named_os_inituserinfo(const char *username);

 void
-named_os_changeuser(bool permanent);
-
-void
-named_os_restoreuser(void);
+named_os_changeuser(void);

 uid_t
-named_os_uid(void);
+ns_os_uid(void);

 void
 named_os_adjustnofile(void);
@@ -184,20 +184,10 @@ named_server_retransfercommand(named_server_t *server, isc_lex_t *lex,
 */

 isc_result_t
-named_server_setortoggle(named_server_t *server, const char *optname,
-			 unsigned int option, isc_lex_t *lex);
+named_server_togglequerylog(named_server_t *server, isc_lex_t *lex);
 /*%<
- * Enable/disable, or toggle, a server option via the command channel.
- * 'option' is the option value to be changed (for example,
- * NS_SERVER_LOGQUERIES or NS_SERVER_LOGRESPOSNES) and 'optname' is the
- * option's human-readable name for logging purposes ("query logging"
- * or "response logging").
- *
- * If an explicit argument to enable the option was provided
- * (i.e., "on", "enable", "true", or "yes") or an explicit argument
- * to disable it ("off", "disable", "false", or "no"), it will be used.
- *
- * If no argument is provided, the option's current state will be reversed.
+ * Enable/disable logging of queries.  (Takes "yes" or "no" argument,
+ * but can also be used as a toggle for backward comptibility.)
 */

 /*%
@@ -385,21 +375,3 @@ named_server_servestale(named_server_t *server, isc_lex_t *lex,
 isc_result_t
 named_server_fetchlimit(named_server_t *server, isc_lex_t *lex,
 			isc_buffer_t **text);
-
-/*%
- * Import SKR file for offline KSK signing.
- */
-isc_result_t
-named_server_skr(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text);
-
-/*%
- * Toggle memory profiling if supported.
- */
-isc_result_t
-named_server_togglememprof(isc_lex_t *lex);
-
-/*%
- * Get status of memory profiling.
- */
-const char *
-named_server_getmemprof(void);
@@ -89,14 +89,14 @@ named_log_init(bool safe) {

 	named_log_setdefaultsslkeylogfile(lcfg);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	isc_log_destroy(&named_g_lctx);
 	isc_log_setcontext(NULL);
 	dns_log_setcontext(NULL);

-	return result;
+	return (result);
 }

 void
@@ -237,7 +237,7 @@ named_log_setdefaultcategory(isc_logconfig_t *lcfg) {
 	}

 cleanup:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -246,7 +246,7 @@ named_log_setunmatchedcategory(isc_logconfig_t *lcfg) {

 	result = isc_log_usechannel(lcfg, "null", NAMED_LOGCATEGORY_UNMATCHED,
 				    NULL);
-	return result;
+	return (result);
 }

 void
@@ -57,11 +57,11 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 		/*
 		 * Allow further processing by returning success.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (logconfig == NULL) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	module = NULL;
@@ -80,10 +80,10 @@ category_fromconf(const cfg_obj_t *ccat, isc_logconfig_t *logconfig) {
 				      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 				      "logging channel '%s': %s", channelname,
 				      isc_result_totext(result));
-			return result;
+			return (result);
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -131,7 +131,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			    "channel '%s': exactly one of file, syslog, "
 			    "null, and stderr must be present",
 			    channelname);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	type = ISC_LOG_TONULL;
@@ -310,7 +310,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}

 done:
-	return result;
+	return (result);
 }

 isc_result_t
@@ -365,8 +365,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		CHECK(named_log_setunmatchedcategory(logconfig));
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
-	return result;
+	return (result);
 }
@@ -313,7 +313,7 @@ usage(void) {
 			"             [-S sockets] [-t chrootdir] [-u "
 			"username] [-U listeners]\n"
 			"             [-m "
-			"{usage|trace|record}]\n"
+			"{usage|trace|record|size|mctx}]\n"
 			"             [-M fill|nofill]\n"
 			"usage: named [-v|-V|-C]\n");
 }
@@ -406,7 +406,7 @@ parse_int(char *arg, const char *desc) {
 	if (tmp < 0 || tmp != ltmp) {
 		named_main_earlyfatal("%s '%s' out of range", desc, arg);
 	}
-	return tmp;
+	return (tmp);
 }

 static struct flag_def {
@@ -1043,7 +1043,7 @@ create_managers(void) {

 	isc_nm_maxudp(named_g_netmgr, maxudp);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 static void
@@ -1437,7 +1437,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 			UNEXPECTED_ERROR("scf_handle_create() failed: %s",
 					 scf_strerror(scf_error()));
 		}
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (scf_handle_bind(h) == -1) {
@@ -1446,7 +1446,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if ((namelen = scf_myname(h, NULL, 0)) == -1) {
@@ -1455,7 +1455,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 					 scf_strerror(scf_error()));
 		}
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if ((instance = isc_mem_allocate(mctx, namelen + 1)) == NULL) {
@@ -1463,7 +1463,7 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 				 "allocation failed: %s",
 				 isc_result_totext(ISC_R_NOMEMORY));
 		scf_handle_destroy(h);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	if (scf_myname(h, instance, namelen + 1) == -1) {
@@ -1473,12 +1473,12 @@ named_smf_get_instance(char **ins_name, int debug, isc_mem_t *mctx) {
 		}
 		scf_handle_destroy(h);
 		isc_mem_free(mctx, instance);
-		return ISC_R_FAILURE;
+		return (ISC_R_FAILURE);
 	}

 	scf_handle_destroy(h);
 	*ins_name = instance;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
 #endif /* HAVE_LIBSCF */

@@ -1635,5 +1635,5 @@ main(int argc, char *argv[]) {
 	ProfilerStop();
 #endif /* ifdef HAVE_GPERFTOOLS_PROFILER */

-	return 0;
+	return (0);
 }
@@ -117,7 +117,7 @@ Options
 .. option:: -m flag

   This option turns on memory usage debugging flags. Possible flags are ``usage``,
-   ``trace`` and ``record``. These correspond to the
+   ``trace``, ``record``, ``size``, and ``mctx``. These correspond to the
   ``ISC_MEM_DEBUGXXXX`` flags described in ``<isc/mem.h>``.

 .. option:: -n #cpus
@@ -61,9 +61,6 @@ static struct passwd *runas_pw = NULL;
 static bool done_setuid = false;
 static int dfd[2] = { -1, -1 };

-static uid_t saved_uid = (uid_t)-1;
-static gid_t saved_gid = (gid_t)-1;
-
 #if HAVE_LIBCAP

 static bool non_root = false;
@@ -252,6 +249,115 @@ linux_keepcaps(void) {

 #endif /* HAVE_LIBCAP */

+/*
+ * First define compatibility shims if {set,get}res{uid,gid} are not available
+ */
+
+#if !HAVE_GETRESGID
+static int
+getresgid(gid_t *rgid, gid_t *egid, gid_t *sgid) {
+	*rgid = -1;
+	*egid = getegid();
+	*sgid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESGID */
+
+#if !HAVE_SETRESGID
+static int
+setresgid(gid_t rgid, gid_t egid, gid_t sgid) {
+	REQUIRE(rgid == (gid_t)-1);
+	REQUIRE(sgid == (gid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(rgid, egid));
+#else  /* HAVE_SETREGID */
+	return (setegid(egid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESGID */
+
+#if !HAVE_GETRESUID
+static int
+getresuid(uid_t *ruid, uid_t *euid, uid_t *suid) {
+	*ruid = -1;
+	*euid = geteuid();
+	*suid = -1;
+
+	return (0);
+}
+#endif /* !HAVE_GETRESUID */
+
+#if !HAVE_SETRESUID
+static int
+setresuid(uid_t ruid, uid_t euid, uid_t suid) {
+	REQUIRE(ruid == (uid_t)-1);
+	REQUIRE(suid == (uid_t)-1);
+
+#if HAVE_SETREGID
+	return (setregid(ruid, euid));
+#else  /* HAVE_SETREGID */
+	return (setegid(euid));
+#endif /* HAVE_SETREGID */
+}
+#endif /* !HAVE_SETRESUID */
+
+static int
+set_effective_gid(gid_t gid) {
+	gid_t oldgid;
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid == gid) {
+		return (0);
+	}
+
+	if (setresgid(-1, gid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresgid(&(gid_t){ 0 }, &oldgid, &(gid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (oldgid != gid) {
+		return (-1);
+	}
+
+	return (0);
+}
+
+static int
+set_effective_uid(uid_t uid) {
+	uid_t olduid;
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid == uid) {
+		return (0);
+	}
+
+	if (setresuid(-1, uid, -1) == -1) {
+		return (-1);
+	}
+
+	if (getresuid(&(uid_t){ 0 }, &olduid, &(uid_t){ 0 }) == -1) {
+		return (-1);
+	}
+
+	if (olduid != uid) {
+		return (-1);
+	}
+
+	/* Success */
+	return (0);
+}
+
 static void
 setperms(uid_t uid, gid_t gid) {
 	char strbuf[ISC_STRERRORSIZE];
@@ -260,13 +366,13 @@ setperms(uid_t uid, gid_t gid) {
 	 * Drop the gid privilege first, because in some cases the gid privilege
 	 * cannot be dropped after the uid privilege has been dropped.
 	 */
-	if (setegid(gid) == -1) {
+	if (set_effective_gid(gid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective gid to %d: %s",
 					gid, strbuf);
 	}

-	if (seteuid(uid) == -1) {
+	if (set_effective_uid(uid) == -1) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("unable to set effective uid to %d: %s",
 					uid, strbuf);
@@ -400,15 +506,15 @@ named_os_closedevnull(void) {
 static bool
 all_digits(const char *s) {
 	if (*s == '\0') {
-		return false;
+		return (false);
 	}
 	while (*s != '\0') {
 		if (!isdigit((unsigned char)(*s))) {
-			return false;
+			return (false);
 		}
 		s++;
 	}
-	return true;
+	return (true);
 }

 void
@@ -464,41 +570,20 @@ named_os_inituserinfo(const char *username) {
 }

 void
-named_os_restoreuser(void) {
-	if (runas_pw == NULL || done_setuid) {
-		return;
-	}
-
-	REQUIRE(saved_uid != (uid_t)-1);
-	REQUIRE(saved_gid != (gid_t)-1);
-
-	setperms(saved_uid, saved_gid);
-}
-
-void
-named_os_changeuser(bool permanent) {
+named_os_changeuser(void) {
 	char strbuf[ISC_STRERRORSIZE];
 	if (runas_pw == NULL || done_setuid) {
 		return;
 	}

-	if (!permanent) {
-		saved_uid = getuid();
-		saved_gid = getgid();
-
-		setperms(runas_pw->pw_uid, runas_pw->pw_gid);
-
-		return;
-	}
-
 	done_setuid = true;

-	if (setgid(runas_pw->pw_gid) == -1) {
+	if (setgid(runas_pw->pw_gid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setgid(): %s", strbuf);
 	}

-	if (setuid(runas_pw->pw_uid) == -1) {
+	if (setuid(runas_pw->pw_uid) < 0) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlyfatal("setuid(): %s", strbuf);
 	}
@@ -519,11 +604,11 @@ named_os_changeuser(bool permanent) {
 }

 uid_t
-named_os_uid(void) {
+ns_os_uid(void) {
 	if (runas_pw == NULL) {
-		return 0;
+		return (0);
 	}
-	return runas_pw->pw_uid;
+	return (runas_pw->pw_uid);
 }

 void
@@ -575,7 +660,7 @@ void
 named_os_minprivs(void) {
 #if HAVE_LIBCAP
 	linux_keepcaps();
-	named_os_changeuser(true);
+	named_os_changeuser();
 	linux_minprivs();
 #endif /* HAVE_LIBCAP */
 }
@@ -587,22 +672,22 @@ safe_open(const char *filename, mode_t mode, bool append) {

 	if (stat(filename, &sb) == -1) {
 		if (errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 	} else if ((sb.st_mode & S_IFREG) == 0) {
 		errno = EOPNOTSUPP;
-		return -1;
+		return (-1);
 	}

 	if (append) {
 		fd = open(filename, O_WRONLY | O_CREAT | O_APPEND, mode);
 	} else {
 		if (unlink(filename) < 0 && errno != ENOENT) {
-			return -1;
+			return (-1);
 		}
 		fd = open(filename, O_WRONLY | O_CREAT | O_EXCL, mode);
 	}
-	return fd;
+	return (fd);
 }

 static void
@@ -650,7 +735,7 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 			    !strcmp(slash + 1, ".."))
 			{
 				*slash = '/';
-				return 0;
+				return (0);
 			}
 			mode = S_IRUSR | S_IWUSR | S_IXUSR; /* u=rwx */
 			mode |= S_IRGRP | S_IXGRP;	    /* g=rx */
@@ -672,11 +757,11 @@ mkdirpath(char *filename, void (*report)(const char *, ...)) {
 		}
 		*slash = '/';
 	}
-	return 0;
+	return (0);

 error:
 	*slash = '/';
-	return -1;
+	return (-1);
 }

 FILE *
@@ -693,25 +778,28 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("couldn't strdup() '%s': %s", filename,
 					strbuf);
-		return NULL;
+		return (NULL);
 	}
 	if (mkdirpath(f, named_main_earlywarning) == -1) {
 		free(f);
-		return NULL;
+		return (NULL);
 	}
 	free(f);

 	if (switch_user && runas_pw != NULL) {
+		uid_t olduid = getuid();
+		gid_t oldgid = getgid();
+
 		/*
-		 * Temporarily set UID/GID to the one we'll be running with
+		 * Set UID/GID to the one we'll be running with
 		 * eventually.
 		 */
-		named_os_changeuser(false);
+		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

 		fd = safe_open(filename, mode, false);

 		/* Restore UID/GID to previous uid/gid */
-		named_os_restoreuser();
+		setperms(olduid, oldgid);

 		if (fd == -1) {
 			fd = safe_open(filename, mode, false);
@@ -737,7 +825,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		strerror_r(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
 					filename, strbuf);
-		return NULL;
+		return (NULL);
 	}

 	fp = fdopen(fd, "w");
@@ -747,7 +835,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 					filename, strbuf);
 	}

-	return fp;
+	return (fp);
 }

 void
@@ -863,5 +951,5 @@ named_os_uname(void) {
 	if (unamep == NULL) {
 		getuname();
 	}
-	return unamep;
+	return (unamep);
 }
@@ -126,19 +126,19 @@ user_zonetype(dns_zone_t *zone) {
 	const struct zt *tp;

 	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	view = dns_zone_getview(zone);
 	if (view != NULL && strcmp(view->name, "_bind") == 0) {
-		return "builtin";
+		return ("builtin");
 	}

 	ztype = dns_zone_gettype(zone);
 	for (tp = typemap; tp->string != NULL && tp->type != ztype; tp++) {
 		/* empty */
 	}
-	return tp->string;
+	return (tp->string);
 }
 #endif /* ifdef EXTENDED_STATS */

@@ -251,7 +251,7 @@ get_histo_desc(const char *prefix, int i, int inf, bool ext) {
 	}
 	INSIST(0 < len && (size_t)len < space);
 	used += len + 1;
-	return desc;
+	return (desc);
 }

 static void
@@ -814,8 +814,8 @@ dump_stats(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	memset(values, 0, sizeof(values[0]) * ncounters);
 	isc_stats_dump(stats, generalstat_dump, &dumparg, options);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }

 #if defined(EXTENDED_STATS)
@@ -831,8 +831,8 @@ dump_histo(isc_histomulti_t *hm, isc_statsformat_t type, void *arg,
 	}
 	isc_histo_destroy(&hg);

-	return dump_counters(type, arg, category, desc, ncounters, indices,
-			     values, options);
+	return (dump_counters(type, arg, category, desc, ncounters, indices,
+			      values, options));
 }
 #endif /* defined(EXTENDED_STATS) */

@@ -861,7 +861,7 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 		if (category != NULL) {
 			cat = json_object_new_object();
 			if (cat == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(job, category, cat);
 		}
@@ -926,20 +926,20 @@ dump_counters(isc_statsformat_t type, void *arg, const char *category,
 #ifdef HAVE_JSON_C
 			counter = json_object_new_int64(value);
 			if (counter == NULL) {
-				return ISC_R_NOMEMORY;
+				return (ISC_R_NOMEMORY);
 			}
 			json_object_object_add(cat, desc[idx], counter);
 #endif /* ifdef HAVE_JSON_C */
 			break;
 		}
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 #ifdef HAVE_LIBXML2
 cleanup:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "failed at dump_counters()");
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 #endif /* ifdef HAVE_LIBXML2 */
 }

@@ -1009,7 +1009,7 @@ cleanup:

 static bool
 rdatastatstype_attr(dns_rdatastatstype_t type, unsigned int attr) {
-	return (DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0;
+	return ((DNS_RDATASTATSTYPE_ATTR(type) & attr) != 0);
 }

 static void
@@ -1293,7 +1293,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dumparg.type = isc_statsformat_xml;
@@ -1450,12 +1450,12 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {

 	TRY0(xmlTextWriterEndElement(writer)); /* zone */

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 cleanup:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "Failed at zone_xmlrender()");
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -1478,11 +1478,10 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (dns_zone_getxfr(zone, &xfr, &is_firstrefresh, &is_running,
@@ -1494,7 +1493,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		 * (if any), but we still want to continue generating the
 		 * remaining parts of the output.
 		 */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (!is_running && !is_deferred && !is_presoa && !is_pending &&
@@ -1504,12 +1503,12 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 			dns_xfrin_detach(&xfr);
 		}
 		/* No ongoing/queued transfer. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (is_running && xfr == NULL) {
 		/* The transfer is finished, and it's shutting down. */
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "xfrin"));
@@ -1607,13 +1606,9 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_sockaddr_format(addrp, addr_buf, sizeof(addr_buf));
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			TRY0(xmlTextWriterWriteString(writer,
-						      ISC_XMLCHAR addr_buf));
-		} else {
-			TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR addr_buf));
 	} else {
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
 	}
@@ -1696,7 +1691,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer));

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nmsg"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%u", nmsg));
@@ -1707,9 +1702,6 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "nbytes"));
 	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, nbytes));
 	TRY0(xmlTextWriterEndElement(writer));
-	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "rate"));
-	TRY0(xmlTextWriterWriteFormatString(writer, "%" PRIu64, rate));
-	TRY0(xmlTextWriterEndElement(writer));

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "ixfr"));
 	if (is_running && is_first_data_received) {
@@ -1726,7 +1718,7 @@ xfrin_xmlrender(dns_zone_t *zone, void *arg) {
 		dns_xfrin_detach(&xfr);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (xfr != NULL) {
@@ -1737,7 +1729,7 @@ cleanup:
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_ERROR,
 		      "Failed at xfrin_xmlrender()");

-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static isc_result_t
@@ -2139,7 +2131,7 @@ generatexml(named_server_t *server, uint32_t flags, int *buflen,

 	xmlFreeTextWriter(writer);
 	xmlFreeDoc(doc);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -2151,7 +2143,7 @@ cleanup:
 	if (doc != NULL) {
 		xmlFreeDoc(doc);
 	}
-	return ISC_R_FAILURE;
+	return (ISC_R_FAILURE);
 }

 static void
@@ -2186,7 +2178,7 @@ render_xml(uint32_t flags, void *arg, unsigned int *retcode,
 			      "failed at rendering XML()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2196,8 +2188,8 @@ render_xml_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ALL, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2207,8 +2199,8 @@ render_xml_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_STATUS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2218,8 +2210,8 @@ render_xml_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_SERVER, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2229,8 +2221,8 @@ render_xml_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		 isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_ZONES, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2240,8 +2232,8 @@ render_xml_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_XFRINS, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2251,8 +2243,8 @@ render_xml_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_NET, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2262,8 +2254,8 @@ render_xml_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 	       void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_MEM, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 static isc_result_t
@@ -2273,8 +2265,8 @@ render_xml_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
-			  freecb, freecb_args);
+	return (render_xml(STATS_XML_TRAFFIC, arg, retcode, retmsg, mimetype, b,
+			   freecb, freecb_args));
 }

 #endif /* HAVE_LIBXML2 */
@@ -2314,7 +2306,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 	json_object *node = json_object_new_object();

 	if (node == NULL) {
-		return NULL;
+		return (NULL);
 	}

 	json_object_object_add(node, "name", json_object_new_string(name));
@@ -2328,7 +2320,7 @@ addzone(char *name, char *classname, const char *ztype, uint32_t serial,
 		json_object_object_add(node, "type",
 				       json_object_new_string(ztype));
 	}
-	return node;
+	return (node);
 }

 static isc_result_t
@@ -2347,7 +2339,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2366,7 +2358,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (zoneobj == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -2534,7 +2526,7 @@ cleanup:
 	if (zoneobj != NULL) {
 		json_object_put(zoneobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2560,11 +2552,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	unsigned int nmsg = 0;
 	unsigned int nrecs = 0;
 	uint64_t nbytes = 0;
-	uint64_t rate = 0;

 	statlevel = dns_zone_getstatlevel(zone);
 	if (statlevel == dns_zonestat_none) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	dns_zone_nameonly(zone, buf, sizeof(buf));
@@ -2668,15 +2659,10 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string(addr_buf));
 	} else if (is_presoa) {
-		if (dns_zone_getprimaryaddr(zone, &addr) == ISC_R_SUCCESS) {
-			isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
-			json_object_object_add(
-				xfrinobj, "remoteaddr",
-				json_object_new_string(addr_buf));
-		} else {
-			json_object_object_add(xfrinobj, "remoteaddr",
-					       json_object_new_string("-"));
-		}
+		addr = dns_zone_getprimaryaddr(zone);
+		isc_sockaddr_format(&addr, addr_buf, sizeof(addr_buf));
+		json_object_object_add(xfrinobj, "remoteaddr",
+				       json_object_new_string(addr_buf));
 	} else {
 		json_object_object_add(xfrinobj, "remoteaddr",
 				       json_object_new_string("-"));
@@ -2763,7 +2749,7 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 	}

 	if (is_running) {
-		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes, &rate);
+		dns_xfrin_getstats(xfr, &nmsg, &nrecs, &nbytes);
 	}
 	json_object_object_add(xfrinobj, "nmsg",
 			       json_object_new_int64((int64_t)nmsg));
@@ -2773,10 +2759,6 @@ xfrin_jsonrender(dns_zone_t *zone, void *arg) {
 		xfrinobj, "nbytes",
 		json_object_new_int64(nbytes > INT64_MAX ? INT64_MAX
 							 : (int64_t)nbytes));
-	json_object_object_add(xfrinobj, "rate",
-			       json_object_new_int64(rate > INT64_MAX
-							     ? INT64_MAX
-							     : (int64_t)rate));

 	if (is_running && is_first_data_received) {
 		json_object_object_add(
@@ -2798,7 +2780,7 @@ cleanup:
 	if (xfrinobj != NULL) {
 		json_object_put(xfrinobj);
 	}
-	return result;
+	return (result);
 }

 static isc_result_t
@@ -2836,7 +2818,7 @@ generatejson(named_server_t *server, size_t *msglen, const char **msg,

 	bindstats = json_object_new_object();
 	if (bindstats == NULL) {
-		return ISC_R_NOMEMORY;
+		return (ISC_R_NOMEMORY);
 	}

 	/*
@@ -3369,7 +3351,7 @@ cleanup:
 		json_object_put(bindstats);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3399,7 +3381,7 @@ render_json(uint32_t flags, void *arg, unsigned int *retcode,
 			      "failed at rendering JSON()");
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -3409,8 +3391,8 @@ render_json_all(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ALL, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3420,8 +3402,8 @@ render_json_status(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_STATUS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3431,8 +3413,8 @@ render_json_server(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_SERVER, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3442,8 +3424,8 @@ render_json_zones(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		  isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_ZONES, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3453,8 +3435,8 @@ render_json_xfrins(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		   isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_XFRINS, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 static isc_result_t
@@ -3464,8 +3446,8 @@ render_json_mem(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_MEM, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3475,8 +3457,8 @@ render_json_net(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
-			   freecb, freecb_args);
+	return (render_json(STATS_JSON_NET, arg, retcode, retmsg, mimetype, b,
+			    freecb, freecb_args));
 }

 static isc_result_t
@@ -3486,17 +3468,12 @@ render_json_traffic(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo,
 		    isc_httpdfree_t **freecb, void **freecb_args) {
 	UNUSED(httpd);
 	UNUSED(urlinfo);
-	return render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
-			   b, freecb, freecb_args);
+	return (render_json(STATS_JSON_TRAFFIC, arg, retcode, retmsg, mimetype,
+			    b, freecb, freecb_args));
 }

 #endif /* HAVE_JSON_C */

-#if HAVE_LIBXML2
-/*
- * This is only needed if we have libxml2 and was confusingly returned if
- * neither of libxml2 or json-c is configured.
- */
 static isc_result_t
 render_xsl(const isc_httpd_t *httpd, const isc_httpdurl_t *urlinfo, void *args,
 	   unsigned int *retcode, const char **retmsg, const char **mimetype,
@@ -3550,9 +3527,8 @@ send:
 	isc_buffer_reinit(b, p, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
 end:
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }
-#endif

 static void
 shutdown_listener(named_statschannel_t *listener) {
@@ -3565,7 +3541,6 @@ shutdown_listener(named_statschannel_t *listener) {
 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static bool
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
@@ -3585,7 +3560,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	    match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return true;
+		return (true);
 	}
 	UNLOCK(&listener->lock);

@@ -3594,11 +3569,9 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 		      "rejected statistics connection from %s", socktext);

-	return false;
+	return (false);
 }
-#endif

-#if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
 static void
 destroy_listener(void *arg) {
 	named_statschannel_t *listener = (named_statschannel_t *)arg;
@@ -3612,24 +3585,12 @@ destroy_listener(void *arg) {
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));
 }
-#endif

 static isc_result_t
 add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	     const cfg_obj_t *listen_params, const cfg_obj_t *config,
 	     isc_sockaddr_t *addr, cfg_aclconfctx_t *aclconfctx,
 	     const char *socktext) {
-#if !defined(HAVE_LIBXML2) && !defined(HAVE_JSON_C)
-	UNUSED(server);
-	UNUSED(listenerp);
-	UNUSED(listen_params);
-	UNUSED(config);
-	UNUSED(addr);
-	UNUSED(aclconfctx);
-	UNUSED(socktext);
-
-	return ISC_R_NOTIMPLEMENTED;
-#else
 	isc_result_t result;
 	named_statschannel_t *listener = NULL;
 	const cfg_obj_t *allow = NULL;
@@ -3695,8 +3656,6 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr,
 			    "/xml/v" STATS_XML_VERSION_MAJOR "/traffic", false,
 			    render_xml_traffic, server);
-	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
-			    server);
 #endif /* ifdef HAVE_LIBXML2 */
 #ifdef HAVE_JSON_C
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json", false, render_json_all,
@@ -3726,13 +3685,15 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 			    "/json/v" STATS_JSON_VERSION_MAJOR "/traffic",
 			    false, render_json_traffic, server);
 #endif /* ifdef HAVE_JSON_C */
+	isc_httpdmgr_addurl(listener->httpdmgr, "/bind9.xsl", true, render_xsl,
+			    server);

 	*listenerp = listener;
 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_NOTICE,
 		      "statistics channel listening on %s", socktext);

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 cleanup:
 	if (listener->acl != NULL) {
@@ -3741,8 +3702,7 @@ cleanup:
 	isc_mutex_destroy(&listener->lock);
 	isc_mem_putanddetach(&listener->mctx, listener, sizeof(*listener));

-	return result;
-#endif
+	return (result);
 }

 static void
@@ -3937,7 +3897,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	}

 	ISC_LIST_APPENDLIST(server->statschannels, new_listeners, link);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 void
@@ -4175,5 +4135,5 @@ named_stats_dump(named_server_t *server, FILE *fp) {

 	fprintf(fp, "--- Statistics Dump --- (%lu)\n", (unsigned long)now);

-	return ISC_R_SUCCESS; /* this function currently always succeeds */
+	return (ISC_R_SUCCESS); /* this function currently always succeeds */
 }
@@ -55,7 +55,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,

 	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}

 	obj = NULL;
@@ -91,9 +91,9 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	}

 	*tctxp = tctx;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tkeyctx_destroy(&tctx);
-	return result;
+	return (result);
 }
@@ -131,13 +131,13 @@ add_doh_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	cfg_obj_log(doh, named_g_lctx, ISC_LOG_ERROR,
 		    "configuring DoH '%s': %s", dohid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -185,13 +185,13 @@ add_tls_transports(const cfg_obj_t *transportlist, dns_transport_list_t *list) {
 				       dns_transport_set_remote_hostname);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	cfg_obj_log(tls, named_g_lctx, ISC_LOG_ERROR,
 		    "configuring tls '%s': %s", tlsid,
 		    isc_result_totext(result));

-	return result;
+	return (result);
 }

 #define CHECK(f)                             \
@@ -218,7 +218,7 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 		obj = NULL;
 	}

-	return result;
+	return (result);
 }

 static void
@@ -260,8 +260,8 @@ named_transports_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*listp = list;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 failure:
 	dns_transport_list_detach(&list);
-	return result;
+	return (result);
 }
@@ -123,7 +123,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 		dns_tsigkey_detach(&tsigkey);
 	}

-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	if (secret != NULL) {
@@ -131,7 +131,7 @@ failure:
 	}
 	cfg_obj_log(key, named_g_lctx, ISC_LOG_ERROR,
 		    "configuring key '%s': %s", keyid, isc_result_totext(ret));
-	return ret;
+	return (ret);
 }

 isc_result_t
@@ -172,9 +172,9 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	*ringp = ring;
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);

 failure:
 	dns_tsigkeyring_detach(&ring);
-	return result;
+	return (result);
 }
@@ -61,6 +61,13 @@ typedef enum {
 	allow_update_forwarding
 } acl_type_t;

+#define RETERR(x)                        \
+	do {                             \
+		isc_result_t _r = (x);   \
+		if (_r != ISC_R_SUCCESS) \
+			return ((_r));   \
+	} while (0)
+
 #define CHECK(x)                             \
 	do {                                 \
 		result = (x);                \
@@ -141,7 +148,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	/* Failing that, see if there's a default ACL already in the view */
 	if (aclp != NULL && *aclp != NULL) {
 		(*setzacl)(zone, *aclp);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Check for default ACLs that haven't been parsed yet */
@@ -164,14 +171,14 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	(void)named_config_get(maps, aclname, &aclobj);
 	if (aclobj == NULL) {
 		(*clearzacl)(zone);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 parse_acl:
 	result = cfg_acl_fromconfig(aclobj, config, named_g_lctx, actx,
 				    named_g_mctx, 0, &acl);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	(*setzacl)(zone, acl);

@@ -181,7 +188,7 @@ parse_acl:
 	}

 	dns_acl_detach(&acl);
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -201,7 +208,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 	if (updatepolicy == NULL) {
 		dns_zone_setssutable(zone, NULL);
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isstring(updatepolicy) &&
@@ -369,7 +376,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 cleanup:
 	dns_ssutable_detach(&table);
-	return result;
+	return (result);
 }

 /*
@@ -411,7 +418,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "port is not configurable for "
 				    "static stub server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}
 		isc_netaddr_fromsockaddr(&na, sa);
 		if (isc_netaddr_getzone(&na) != 0) {
@@ -419,7 +426,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "scoped address is not allowed "
 				    "for static stub "
 				    "server-addresses");
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		switch (na.family) {
@@ -450,7 +457,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (ISC_LIST_EMPTY(rdatalist_a->rdata) &&
 	    ISC_LIST_EMPTY(rdatalist_aaaa->rdata))
 	{
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	/* Add to the list an apex NS with the ns name being the origin name */
@@ -464,7 +471,7 @@ configure_staticstub_serveraddrs(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			     &region);
 	ISC_LIST_APPEND(rdatalist_ns->rdata, rdata, link);

-	return result;
+	return (result);
 }

 /*%
@@ -505,14 +512,14 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 				    "server-name '%s' is not a valid "
 				    "name",
 				    str);
-			return result;
+			return (result);
 		}
 		if (dns_name_issubdomain(nsname, dns_zone_getorigin(zone))) {
 			cfg_obj_log(zconfig, named_g_lctx, ISC_LOG_ERROR,
 				    "server-name '%s' must not be a "
 				    "subdomain of zone name '%s'",
 				    str, zname);
-			return ISC_R_FAILURE;
+			return (ISC_R_FAILURE);
 		}

 		dns_name_toregion(nsname, &sregion);
@@ -526,7 +533,7 @@ configure_staticstub_servernames(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		ISC_LIST_APPEND(rdatalist->rdata, rdata, link);
 	}

-	return result;
+	return (result);
 }

 /*%
@@ -551,12 +558,9 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	isc_region_t region;

 	/* Create the DB beforehand */
-	result = dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
-			       dns_dbtype_stub, dns_zone_getclass(zone), 0,
-			       NULL, &db);
-	if (result != ISC_R_SUCCESS) {
-		return result;
-	}
+	RETERR(dns_db_create(mctx, dbtype, dns_zone_getorigin(zone),
+			     dns_dbtype_stub, dns_zone_getclass(zone), 0, NULL,
+			     &db));

 	dns_rdataset_init(&rdataset);

@@ -669,7 +673,7 @@ cleanup:

 	INSIST(dbversion == NULL);

-	return result;
+	return (result);
 }

 /*%
@@ -682,7 +686,7 @@ zonetype_fromconfig(const cfg_obj_t *map) {

 	result = cfg_map_get(map, "type", &obj);
 	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	return named_config_getzonetype(obj);
+	return (named_config_getzonetype(obj));
 }

 /*%
@@ -713,11 +717,11 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,

 		result = strtoargvsub(mctx, p, argcp, argvp, n + 1);
 		if (result != ISC_R_SUCCESS) {
-			return result;
+			return (result);
 		}
 		(*argvp)[n] = s;
 	}
-	return ISC_R_SUCCESS;
+	return (ISC_R_SUCCESS);
 }

 /*%
@@ -729,7 +733,7 @@ strtoargvsub(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp,
 */
 static isc_result_t
 strtoargv(isc_mem_t *mctx, char *s, unsigned int *argcp, char ***argvp) {
-	return strtoargvsub(mctx, s, argcp, argvp, 0);
+	return (strtoargvsub(mctx, s, argcp, argvp, 0));
 }

 static const char *const primary_synonyms[] = { "primary", "master", NULL };
@@ -776,12 +780,12 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,

 	/* interfacemgr can be destroyed only in exclusive mode. */
 	if (named_g_server->interfacemgr == NULL) {
-		return true;
+		return (true);
 	}

 	if (!ns_interfacemgr_listeningon(named_g_server->interfacemgr, dstaddr))
 	{
-		return false;
+		return (false);
 	}

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
@@ -824,7 +828,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey, const isc_sockaddr_t *srcaddr,
 			break;
 		}
 	}
-	return view == myview;
+	return (view == myview);
 }

 /*%
@@ -842,7 +846,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 	 * zone is configured with something else than "notify yes;".
 	 */
 	if (ztype != dns_zone_mirror || ntype != dns_notifytype_yes) {
-		return ntype;
+		return (ntype);
 	}

 	/*
@@ -856,7 +860,7 @@ process_notifytype(dns_notifytype_t ntype, dns_zonetype_t ztype,
 			    zname);
 	}

-	return dns_notifytype_explicit;
+	return (dns_notifytype_explicit);
 }

 isc_result_t
@@ -1070,22 +1074,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		dns_zone_setmaxrecords(zone, 0);
 	}

-	obj = NULL;
-	result = named_config_get(maps, "max-records-per-type", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxrrperset(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxrrperset(zone, 0);
-	}
-
-	obj = NULL;
-	result = named_config_get(maps, "max-types-per-name", &obj);
-	INSIST(result == ISC_R_SUCCESS && obj != NULL);
-	dns_zone_setmaxtypepername(mayberaw, cfg_obj_asuint32(obj));
-	if (zone != mayberaw) {
-		dns_zone_setmaxtypepername(zone, 0);
-	}
-
 	if (raw != NULL && filename != NULL) {
 #define SIGNED ".signed"
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
@@ -1282,8 +1270,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setalsonotify(zone, ipkl.addrs, ipkl.sources,
 					       ipkl.keys, ipkl.tlss,
 					       ipkl.count);
@@ -1638,8 +1626,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (parentals != NULL) {
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);
-			CHECK(named_config_getipandkeylist(config, parentals,
-							   mctx, &ipkl));
+			CHECK(named_config_getipandkeylist(
+				config, "parental-agents", parentals, mctx,
+				&ipkl));
 			dns_zone_setparentals(zone, ipkl.addrs, ipkl.sources,
 					      ipkl.keys, ipkl.tlss, ipkl.count);
 			dns_ipkeylist_clear(mctx, &ipkl);
@@ -1811,7 +1800,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
 		{
 			result = named_config_getremotesdef(
-				named_g_config, "remote-servers",
+				named_g_config, "primaries",
 				DEFAULT_IANA_ROOT_ZONE_PRIMARIES, &obj);
 			CHECK(result);
 		}
@@ -1819,8 +1808,8 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_ipkeylist_t ipkl;
 			dns_ipkeylist_init(&ipkl);

-			CHECK(named_config_getipandkeylist(config, obj, mctx,
-							   &ipkl));
+			CHECK(named_config_getipandkeylist(config, "primaries",
+							   obj, mctx, &ipkl));
 			dns_zone_setprimaries(mayberaw, ipkl.addrs,
 					      ipkl.sources, ipkl.keys,
 					      ipkl.tlss, ipkl.count);
@@ -1840,33 +1829,6 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_MULTIMASTER, multi);

-		obj = NULL;
-		result = named_config_get(maps, "min-transfer-rate-in", &obj);
-		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		uint32_t traffic_bytes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "traffic_bytes"));
-		uint32_t time_minutes =
-			cfg_obj_asuint32(cfg_tuple_get(obj, "time_minutes"));
-		if (traffic_bytes == 0) {
-			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' bytes"
-				    "value can not be '0'",
-				    zname);
-			CHECK(ISC_R_FAILURE);
-		}
-		/* Max. 28 days (in minutes). */
-		const unsigned int time_minutes_max = 28 * 24 * 60;
-		if (time_minutes < 1 || time_minutes > time_minutes_max) {
-			cfg_obj_log(obj, named_g_lctx, ISC_LOG_ERROR,
-				    "zone '%s': 'min-transfer-rate-in' minutes"
-				    "value is out of range (1..%u)",
-				    zname, time_minutes_max);
-			CHECK(ISC_R_FAILURE);
-		}
-		dns_zone_setminxfrratein(mayberaw, traffic_bytes,
-					 transferinsecs ? time_minutes
-							: time_minutes * 60);
-
 		obj = NULL;
 		result = named_config_get(maps, "max-transfer-time-in", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
@@ -1934,7 +1896,7 @@ cleanup:
 	if (kasp != NULL) {
 		dns_kasp_detach(&kasp);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -1949,11 +1911,11 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase, dns_zone_t *zone,
 	dns_zone_settype(zone, dns_zone_dlz);
 	result = dns_sdlz_setdb(dlzdatabase, rdclass, name, &db);
 	if (result != ISC_R_SUCCESS) {
-		return result;
+		return (result);
 	}
 	result = dns_zone_dlzpostload(zone, db);
 	dns_db_detach(&db);
-	return result;
+	return (result);
 }

 bool
@@ -1977,7 +1939,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return false;
+		return (false);
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -1998,17 +1960,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	if (!inline_signing && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return false;
+		return (false);
 	} else if (inline_signing && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return false;
+		return (false);
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return false;
+		return (false);
 	}

 	obj = NULL;
@@ -2024,10 +1986,10 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig,
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return false;
+		return (false);
 	}

-	return true;
+	return (true);
 }

 bool
@@ -2061,13 +2023,13 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	if (res != ISC_R_SUCCESS ||
 	    strcmp(cfg_obj_asstring(policy), "none") == 0)
 	{
-		return false;
+		return (false);
 	}

 	/* Lookup the policy. */
 	res = dns_kasplist_find(kasplist, cfg_obj_asstring(policy), &kasp);
 	if (res != ISC_R_SUCCESS) {
-		return false;
+		return (false);
 	}

 	inline_signing = dns_kasp_inlinesigning(kasp);
@@ -2080,8 +2042,8 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	 */
 	res = cfg_map_get(maps[0], "inline-signing", &signing);
 	if (res == ISC_R_SUCCESS && cfg_obj_isboolean(signing)) {
-		return cfg_obj_asboolean(signing);
+		return (cfg_obj_asboolean(signing));
 	}

-	return inline_signing;
+	return (inline_signing);
 }
@@ -256,7 +256,7 @@ getzoneclass(void) {
 	if (zoneclass == dns_rdataclass_none) {
 		zoneclass = defaultclass;
 	}
-	return zoneclass;
+	return (zoneclass);
 }

 static bool
@@ -266,9 +266,9 @@ setzoneclass(dns_rdataclass_t rdclass) {
 		zoneclass = rdclass;
 	}
 	if (zoneclass != rdclass) {
-		return false;
+		return (false);
 	}
-	return true;
+	return (true);
 }

 static void
@@ -332,7 +332,7 @@ nsu_strsep(char **stringp, const char *delim) {
 	char sc, dc;

 	if (string == NULL) {
-		return NULL;
+		return (NULL);
 	}

 	for (; *string != '\0'; string++) {
@@ -353,11 +353,11 @@ nsu_strsep(char **stringp, const char *delim) {
 			if (sc == dc) {
 				*s++ = '\0';
 				*stringp = s;
-				return string;
+				return (string);
 			}
 		}
 	}
-	return string;
+	return (string);
 }

 static void
@@ -393,7 +393,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,

 	if (len >= sizeof(buf)) {
 		error("unknown key type '%.*s'", (int)(len), hmacstr);
-		return false;
+		return (false);
 	}

 	/* Copy len bytes and NUL terminate. */
@@ -406,7 +406,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[9], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 128) {
 			error("digest-bits out of range [0..128]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha1") == 0) {
@@ -416,7 +416,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[10], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 160) {
 			error("digest-bits out of range [0..160]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha224") == 0) {
@@ -426,7 +426,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 224) {
 			error("digest-bits out of range [0..224]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha256") == 0) {
@@ -436,7 +436,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 256) {
 			error("digest-bits out of range [0..256]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha384") == 0) {
@@ -446,7 +446,7 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 384) {
 			error("digest-bits out of range [0..384]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else if (strcasecmp(buf, "hmac-sha512") == 0) {
@@ -456,14 +456,14 @@ parse_hmac(const char *hmacstr, size_t len, dst_algorithm_t *hmac_alg,
 		result = isc_parse_uint16(&digestbits, &buf[12], 10);
 		if (result != ISC_R_SUCCESS || digestbits > 512) {
 			error("digest-bits out of range [0..512]");
-			return false;
+			return (false);
 		}
 		*digestbitsp = (digestbits + 7) & ~0x7U;
 	} else {
 		error("unknown key type '%s'", buf);
-		return false;
+		return (false);
 	}
-	return true;
+	return (true);
 }

 static int
@@ -477,7 +477,7 @@ basenamelen(const char *file) {
 	} else if (len > 4 && strcmp(file + len - 4, ".key") == 0) {
 		len -= 4;
 	}
-	return len;
+	return (len);
 }

 static void
@@ -573,7 +573,7 @@ read_sessionkey(isc_mem_t *mctx, isc_log_t *lctx) {
 	int len;

 	if (!isc_file_exists(keyfile)) {
-		return ISC_R_FILENOTFOUND;
+		return (ISC_R_FILENOTFOUND);
 	}

 	result = cfg_parser_create(mctx, lctx, &pctx);
@@ -619,7 +619,7 @@ cleanup:
 		isc_mem_free(mctx, keystr);
 	}

-	return result;
+	return (result);
 }

 static void
@@ -797,8 +797,8 @@ create_name(const char *str, char *namedata, size_t len, dns_name_t *name) {
 	isc_buffer_add(&namesrc, strlen(str));
 	isc_buffer_init(&namebuf, namedata, len);

-	return dns_name_fromtext(name, &namesrc, dns_rootname,
-				 DNS_NAME_DOWNCASE, &namebuf);
+	return (dns_name_fromtext(name, &namesrc, dns_rootname,
+				  DNS_NAME_DOWNCASE, &namebuf));
 }

 static void
@@ -1003,7 +1003,7 @@ get_addresses(char *host, in_port_t port, isc_sockaddr_t *sockaddr,
 		error("couldn't get address for '%s': %s", host,
 		      isc_result_totext(result));
 	}
-	return count;
+	return (count);
 }

 #define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:"
@@ -1313,7 +1313,7 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 	word = nsu_strsep(cmdlinep, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read owner name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	dns_message_gettempname(msg, namep);
@@ -1324,10 +1324,10 @@ parse_name(char **cmdlinep, dns_message_t *msg, dns_name_t **namep) {
 		error("invalid owner name: %s", isc_result_totext(result));
 		isc_buffer_invalidate(&source);
 		dns_message_puttempname(msg, namep);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	isc_buffer_invalidate(&source);
-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1342,7 +1342,7 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,

 	if (cmdline == NULL) {
 		rdata->flags = DNS_RDATA_UPDATE;
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}

 	while (*cmdline != 0 && isspace((unsigned char)*cmdline)) {
@@ -1373,13 +1373,13 @@ parse_rdata(char **cmdlinep, dns_rdataclass_t rdataclass,
 			fprintf(stderr, "invalid rdata format: %s\n",
 				isc_result_totext(result));
 			isc_buffer_free(&buf);
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		}
 	} else {
 		rdata->flags = DNS_RDATA_UPDATE;
 	}
 	*cmdlinep = cmdline;
-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1402,7 +1402,7 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return retval;
+		return (retval);
 	}

 	/*
@@ -1482,13 +1482,13 @@ make_prereq(char *cmdline, bool ispositive, bool isrrset) {
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_PREREQUISITE);
-	return STATUS_MORE;
+	return (STATUS_MORE);

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
-	return STATUS_SYNTAX;
+	return (STATUS_SYNTAX);
 }

 static uint16_t
@@ -1500,7 +1500,7 @@ evaluate_prereq(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
 		ispositive = false;
@@ -1516,9 +1516,9 @@ evaluate_prereq(char *cmdline) {
 		isrrset = true;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
-	return make_prereq(cmdline, ispositive, isrrset);
+	return (make_prereq(cmdline, ispositive, isrrset));
 }

 static void
@@ -1564,7 +1564,7 @@ evaluate_lease(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	if (!strcasecmp(word, "none")) {
@@ -1573,12 +1573,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}

 	result = isc_parse_uint32(&value1, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
@@ -1588,12 +1588,12 @@ evaluate_lease(char *cmdline) {
 		keylease = 0;
 		keylease_set = false;
 		updateopt();
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}

 	result = isc_parse_uint32(&value2, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	lease = value1;
@@ -1602,7 +1602,7 @@ evaluate_lease(char *cmdline) {
 	keylease_set = true;
 	updateopt();

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1612,13 +1612,13 @@ evaluate_server(char *cmdline) {

 	if (local_only) {
 		fprintf(stderr, "cannot reset server in localhost-only mode\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	server = word;

@@ -1630,13 +1630,13 @@ evaluate_server(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		}
 	}

@@ -1654,10 +1654,10 @@ evaluate_server(char *cmdline) {
 	servers = isc_mem_cget(gmctx, ns_alloc, sizeof(isc_sockaddr_t));
 	ns_total = get_addresses(server, (in_port_t)port, servers, ns_alloc);
 	if (ns_total == 0) {
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1670,7 +1670,7 @@ evaluate_local(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read server name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	local = word;

@@ -1682,13 +1682,13 @@ evaluate_local(char *cmdline) {
 		port = strtol(word, &endp, 10);
 		if (*endp != 0) {
 			fprintf(stderr, "port '%s' is not numeric\n", word);
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		} else if (port < 1 || port > 65535) {
 			fprintf(stderr,
 				"port '%s' is out of range "
 				"(1 to 65535)\n",
 				word);
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		}
 	}

@@ -1704,10 +1704,10 @@ evaluate_local(char *cmdline) {
 		isc_sockaddr_fromin(localaddr4, &in4, (in_port_t)port);
 	} else {
 		fprintf(stderr, "invalid address %s", local);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1728,7 +1728,7 @@ evaluate_key(char *cmdline) {
 	namestr = nsu_strsep(&cmdline, " \t\r\n");
 	if (namestr == NULL || *namestr == 0) {
 		fprintf(stderr, "could not read key name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	mykeyname = dns_fixedname_initname(&fkeyname);
@@ -1736,7 +1736,7 @@ evaluate_key(char *cmdline) {
 	n = strchr(namestr, ':');
 	if (n != NULL) {
 		if (!parse_hmac(namestr, n - namestr, &hmac_alg, &digestbits)) {
-			return STATUS_SYNTAX;
+			return (STATUS_SYNTAX);
 		}
 		namestr = n + 1;
 	} else {
@@ -1748,13 +1748,13 @@ evaluate_key(char *cmdline) {
 	result = dns_name_fromtext(mykeyname, &b, dns_rootname, 0, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse key name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	secretstr = nsu_strsep(&cmdline, "\r\n");
 	if (secretstr == NULL || *secretstr == 0) {
 		fprintf(stderr, "could not read key secret\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	secretlen = strlen(secretstr) * 3 / 4;
 	secret = isc_mem_allocate(gmctx, secretlen);
@@ -1765,7 +1765,7 @@ evaluate_key(char *cmdline) {
 		fprintf(stderr, "could not create key from %s: %s\n", secretstr,
 			isc_result_totext(result));
 		isc_mem_free(gmctx, secret);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	secretlen = isc_buffer_usedlength(&secretbuf);

@@ -1778,10 +1778,10 @@ evaluate_key(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not create key from %s %s: %s\n",
 			namestr, secretstr, isc_result_totext(result));
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	dst_key_setbits(tsigkey->key, digestbits);
-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1793,7 +1793,7 @@ evaluate_zone(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read zone name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	userzone = dns_fixedname_initname(&fuserzone);
@@ -1803,10 +1803,10 @@ evaluate_zone(char *cmdline) {
 	if (result != ISC_R_SUCCESS) {
 		userzone = NULL; /* Lest it point to an invalid name */
 		fprintf(stderr, "could not parse zone name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1823,19 +1823,19 @@ evaluate_realm(char *cmdline) {

 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}

 	n = snprintf(buf, sizeof(buf), "@%s", word);
 	if (n < 0 || (size_t)n >= sizeof(buf)) {
 		error("realm is too long");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	realm = isc_mem_strdup(gmctx, buf);
-	return STATUS_MORE;
+	return (STATUS_MORE);
 #else  /* HAVE_GSSAPI */
 	UNUSED(cmdline);
-	return STATUS_SYNTAX;
+	return (STATUS_SYNTAX);
 #endif /* HAVE_GSSAPI */
 }

@@ -1848,29 +1848,29 @@ evaluate_ttl(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read ttl\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	if (!strcasecmp(word, "none")) {
 		default_ttl = 0;
 		default_ttl_set = false;
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}

 	result = isc_parse_uint32(&ttl, word, 10);
 	if (result != ISC_R_SUCCESS) {
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	if (ttl > TTL_MAX) {
 		fprintf(stderr, "ttl '%s' is out of range (0 to %u)\n", word,
 			TTL_MAX);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	default_ttl = ttl;
 	default_ttl_set = true;

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1883,7 +1883,7 @@ evaluate_class(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read class name\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}

 	r.base = word;
@@ -1891,19 +1891,19 @@ evaluate_class(char *cmdline) {
 	result = dns_rdataclass_fromtext(&rdclass, &r);
 	if (result != ISC_R_SUCCESS) {
 		fprintf(stderr, "could not parse class name: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	switch (rdclass) {
 	case dns_rdataclass_none:
 	case dns_rdataclass_any:
 	case dns_rdataclass_reserved0:
 		fprintf(stderr, "bad default class: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	default:
 		defaultclass = rdclass;
 	}

-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -1927,7 +1927,7 @@ update_addordelete(char *cmdline, bool isdelete) {
 	 */
 	retval = parse_name(&cmdline, updatemsg, &name);
 	if (retval != STATUS_MORE) {
-		return retval;
+		return (retval);
 	}

 	dns_message_gettemprdata(updatemsg, &rdata);
@@ -2113,14 +2113,14 @@ doneparsing:
 	ISC_LIST_INIT(name->list);
 	ISC_LIST_APPEND(name->list, rdataset, link);
 	dns_message_addname(updatemsg, name, DNS_SECTION_UPDATE);
-	return STATUS_MORE;
+	return (STATUS_MORE);

 failure:
 	if (name != NULL) {
 		dns_message_puttempname(updatemsg, &name);
 	}
 	dns_message_puttemprdata(updatemsg, &rdata);
-	return STATUS_SYNTAX;
+	return (STATUS_SYNTAX);
 }

 static uint16_t
@@ -2132,7 +2132,7 @@ evaluate_update(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read operation code\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	if (strcasecmp(word, "delete") == 0) {
 		isdelete = true;
@@ -2142,9 +2142,9 @@ evaluate_update(char *cmdline) {
 		isdelete = false;
 	} else {
 		fprintf(stderr, "incorrect operation code: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
-	return update_addordelete(cmdline, isdelete);
+	return (update_addordelete(cmdline, isdelete));
 }

 static uint16_t
@@ -2155,7 +2155,7 @@ evaluate_checknames(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-names directive\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2168,9 +2168,9 @@ evaluate_checknames(char *cmdline) {
 		checknames = false;
 	} else {
 		fprintf(stderr, "incorrect check-names directive: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static uint16_t
@@ -2181,7 +2181,7 @@ evaluate_checksvcb(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");
 	if (word == NULL || *word == 0) {
 		fprintf(stderr, "could not read check-svcb directive\n");
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
 	if (strcasecmp(word, "yes") == 0 || strcasecmp(word, "true") == 0 ||
 	    strcasecmp(word, "on") == 0)
@@ -2194,9 +2194,9 @@ evaluate_checksvcb(char *cmdline) {
 		checksvcb = false;
 	} else {
 		fprintf(stderr, "incorrect check-svcb directive: %s\n", word);
-		return STATUS_SYNTAX;
+		return (STATUS_SYNTAX);
 	}
-	return STATUS_MORE;
+	return (STATUS_MORE);
 }

 static void
@@ -2274,58 +2274,58 @@ do_next_command(char *cmdline) {
 	word = nsu_strsep(&cmdline, " \t\r\n");

 	if (word == NULL || *word == 0) {
-		return STATUS_SEND;
+		return (STATUS_SEND);
 	}
 	if (word[0] == ';') {
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "quit") == 0) {
-		return STATUS_QUIT;
+		return (STATUS_QUIT);
 	}
 	if (strcasecmp(word, "prereq") == 0) {
-		return evaluate_prereq(cmdline);
+		return (evaluate_prereq(cmdline));
 	}
 	if (strcasecmp(word, "nxdomain") == 0) {
-		return make_prereq(cmdline, false, false);
+		return (make_prereq(cmdline, false, false));
 	}
 	if (strcasecmp(word, "yxdomain") == 0) {
-		return make_prereq(cmdline, true, false);
+		return (make_prereq(cmdline, true, false));
 	}
 	if (strcasecmp(word, "nxrrset") == 0) {
-		return make_prereq(cmdline, false, true);
+		return (make_prereq(cmdline, false, true));
 	}
 	if (strcasecmp(word, "yxrrset") == 0) {
-		return make_prereq(cmdline, true, true);
+		return (make_prereq(cmdline, true, true));
 	}
 	if (strcasecmp(word, "update") == 0) {
-		return evaluate_update(cmdline);
+		return (evaluate_update(cmdline));
 	}
 	if (strcasecmp(word, "delete") == 0) {
-		return update_addordelete(cmdline, true);
+		return (update_addordelete(cmdline, true));
 	}
 	if (strcasecmp(word, "del") == 0) {
-		return update_addordelete(cmdline, true);
+		return (update_addordelete(cmdline, true));
 	}
 	if (strcasecmp(word, "add") == 0) {
-		return update_addordelete(cmdline, false);
+		return (update_addordelete(cmdline, false));
 	}
 	if (strcasecmp(word, "lease") == 0) {
-		return evaluate_lease(cmdline);
+		return (evaluate_lease(cmdline));
 	}
 	if (strcasecmp(word, "server") == 0) {
-		return evaluate_server(cmdline);
+		return (evaluate_server(cmdline));
 	}
 	if (strcasecmp(word, "local") == 0) {
-		return evaluate_local(cmdline);
+		return (evaluate_local(cmdline));
 	}
 	if (strcasecmp(word, "zone") == 0) {
-		return evaluate_zone(cmdline);
+		return (evaluate_zone(cmdline));
 	}
 	if (strcasecmp(word, "class") == 0) {
-		return evaluate_class(cmdline);
+		return (evaluate_class(cmdline));
 	}
 	if (strcasecmp(word, "send") == 0) {
-		return STATUS_SEND;
+		return (STATUS_SEND);
 	}
 	if (strcasecmp(word, "debug") == 0) {
 		if (debugging) {
@@ -2333,14 +2333,14 @@ do_next_command(char *cmdline) {
 		} else {
 			debugging = true;
 		}
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "ttl") == 0) {
-		return evaluate_ttl(cmdline);
+		return (evaluate_ttl(cmdline));
 	}
 	if (strcasecmp(word, "show") == 0) {
 		show_message(stdout, updatemsg, "Outgoing update query:");
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "answer") == 0) {
 		LOCK(&answer_lock);
@@ -2348,24 +2348,24 @@ do_next_command(char *cmdline) {
 			show_message(stdout, answer, "Answer:");
 		}
 		UNLOCK(&answer_lock);
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "key") == 0) {
 		usegsstsig = false;
-		return evaluate_key(cmdline);
+		return (evaluate_key(cmdline));
 	}
 	if (strcasecmp(word, "realm") == 0) {
-		return evaluate_realm(cmdline);
+		return (evaluate_realm(cmdline));
 	}
 	if (strcasecmp(word, "check-names") == 0 ||
 	    strcasecmp(word, "checknames") == 0)
 	{
-		return evaluate_checknames(cmdline);
+		return (evaluate_checknames(cmdline));
 	}
 	if (strcasecmp(word, "check-svcb") == 0 ||
 	    strcasecmp(word, "checksvcb") == 0)
 	{
-		return evaluate_checksvcb(cmdline);
+		return (evaluate_checksvcb(cmdline));
 	}
 	if (strcasecmp(word, "gsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2373,7 +2373,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "oldgsstsig") == 0) {
 #if HAVE_GSSAPI
@@ -2381,7 +2381,7 @@ do_next_command(char *cmdline) {
 #else  /* HAVE_GSSAPI */
 		fprintf(stderr, "gsstsig not supported\n");
 #endif /* HAVE_GSSAPI */
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "help") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION ":\n"
@@ -2421,14 +2421,14 @@ do_next_command(char *cmdline) {
 				"record to the zone)\n"
 				"[update] del[ete] ....    (remove the given "
 				"record(s) from the zone)\n");
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	if (strcasecmp(word, "version") == 0) {
 		fprintf(stdout, "nsupdate " PACKAGE_VERSION "\n");
-		return STATUS_MORE;
+		return (STATUS_MORE);
 	}
 	fprintf(stderr, "incorrect section name: %s\n", word);
-	return STATUS_SYNTAX;
+	return (STATUS_SYNTAX);
 }

 static uint16_t
@@ -2460,7 +2460,7 @@ get_next_command(void) {
 		free(ptr);
 	}

-	return result;
+	return (result);
 }

 static bool
@@ -2475,9 +2475,9 @@ user_interaction(void) {
 		}
 	}
 	if (result == STATUS_SEND) {
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static void
@@ -2522,10 +2522,10 @@ next_primary(const char *caller, isc_sockaddr_t *addr, isc_result_t eresult) {
 	fprintf(stderr, "; Communication with %s failed: %s\n", addrbuf,
 		isc_result_totext(eresult));
 	if (++primary_inuse >= primary_total) {
-		return false;
+		return (false);
 	}
 	ddebug("%s: trying next server", caller);
-	return true;
+	return (true);
 }

 static void
@@ -3575,8 +3575,8 @@ main(int argc, char **argv) {
 	cleanup();

 	if (seenerror) {
-		return 2;
+		return (2);
 	}

-	return 0;
+	return (0);
 }
@@ -179,7 +179,7 @@ static const char *filter_a_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_a(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -212,7 +212,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -227,7 +227,7 @@ parse_filter_a_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -240,7 +240,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,

 	cfg_map_get(fmap, "filter-a", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
@@ -268,7 +268,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -309,7 +309,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -362,7 +362,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
@@ -390,7 +390,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -420,7 +420,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -445,14 +445,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -463,9 +463,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -478,7 +478,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -574,7 +574,7 @@ process_name(query_ctx_t *qctx, filter_a_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -645,7 +645,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -663,7 +663,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_a != NONE || inst->v6_a != NONE) {
@@ -680,7 +680,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -700,7 +700,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -708,7 +708,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_a) {
@@ -781,11 +781,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -818,7 +818,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -855,7 +855,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -870,10 +870,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -179,7 +179,7 @@ static const char *filter_aaaa_enums[] = { "break-dnssec", NULL };

 static isc_result_t
 parse_filter_aaaa(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
-	return cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret);
+	return (cfg_parse_enum_or_other(pctx, type, &cfg_type_boolean, ret));
 }

 static void
@@ -213,7 +213,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,

 	result = cfg_map_get(param_obj, param_name, &obj);
 	if (result != ISC_R_SUCCESS) {
-		return ISC_R_SUCCESS;
+		return (ISC_R_SUCCESS);
 	}

 	if (cfg_obj_isboolean(obj)) {
@@ -228,7 +228,7 @@ parse_filter_aaaa_on(const cfg_obj_t *param_obj, const char *param_name,
 		result = ISC_R_UNEXPECTED;
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -241,7 +241,7 @@ check_syntax(cfg_obj_t *fmap, const void *cfg, isc_mem_t *mctx, isc_log_t *lctx,

 	cfg_map_get(fmap, "filter-aaaa", &aclobj);
 	if (aclobj == NULL) {
-		return result;
+		return (result);
 	}

 	CHECK(cfg_acl_fromconfig(aclobj, (const cfg_obj_t *)cfg, lctx,
@@ -269,7 +269,7 @@ cleanup:
 		dns_acl_detach(&acl);
 	}

-	return result;
+	return (result);
 }

 static isc_result_t
@@ -312,7 +312,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /**
@@ -366,7 +366,7 @@ cleanup:
 		plugin_destroy((void **)&inst);
 	}

-	return result;
+	return (result);
 }

 isc_result_t
@@ -394,7 +394,7 @@ cleanup:
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
-	return result;
+	return (result);
 }

 /*
@@ -424,7 +424,7 @@ plugin_destroy(void **instp) {
 */
 int
 plugin_version(void) {
-	return NS_PLUGIN_VERSION;
+	return (NS_PLUGIN_VERSION);
 }

 /**
@@ -449,14 +449,14 @@ typedef struct section_filter {
 static bool
 is_v4_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET) {
-		return true;
+		return (true);
 	}
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 /*
@@ -467,9 +467,9 @@ is_v6_client(ns_client_t *client) {
 	if (isc_sockaddr_pf(&client->peeraddr) == AF_INET6 &&
 	    !IN6_IS_ADDR_V4MAPPED(&client->peeraddr.type.sin6.sin6_addr))
 	{
-		return true;
+		return (true);
 	}
-	return false;
+	return (false);
 }

 static filter_data_t *
@@ -482,7 +482,7 @@ client_state_get(const query_ctx_t *qctx, filter_instance_t *inst) {
 			     sizeof(qctx->client), (void **)&client_state);
 	UNLOCK(&inst->hlock);

-	return result == ISC_R_SUCCESS ? client_state : NULL;
+	return (result == ISC_R_SUCCESS ? client_state : NULL);
 }

 static void
@@ -578,7 +578,7 @@ process_name(query_ctx_t *qctx, filter_aaaa_t mode, const dns_name_t *name,
 	}

 cleanup:
-	return modified;
+	return (modified);
 }

 /*%
@@ -649,7 +649,7 @@ filter_qctx_initialize(void *arg, void *cbdata, isc_result_t *resp) {
 		client_state_create(qctx, inst);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -667,7 +667,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (inst->v4_aaaa != NONE || inst->v6_aaaa != NONE) {
@@ -684,7 +684,7 @@ filter_prep_response_begin(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -704,7 +704,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (client_state == NULL) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (client_state->mode != BREAK_DNSSEC &&
@@ -712,7 +712,7 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {
 	     (WANTDNSSEC(qctx->client) && qctx->sigrdataset != NULL &&
 	      dns_rdataset_isassociated(qctx->sigrdataset))))
 	{
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	if (qctx->qtype == dns_rdatatype_aaaa) {
@@ -784,11 +784,11 @@ filter_respond_begin(void *arg, void *cbdata, isc_result_t *resp) {

 		*resp = result;

-		return NS_HOOK_RETURN;
+		return (NS_HOOK_RETURN);
 	}

 	*resp = result;
-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -821,7 +821,7 @@ filter_respond_any_found(void *arg, void *cbdata, isc_result_t *resp) {
 		process_section(&filter_answer);
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -858,7 +858,7 @@ filter_query_done_send(void *arg, void *cbdata, isc_result_t *resp) {
 		}
 	}

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }

 /*
@@ -873,10 +873,10 @@ filter_qctx_destroy(void *arg, void *cbdata, isc_result_t *resp) {
 	*resp = ISC_R_UNSET;

 	if (!qctx->detach_client) {
-		return NS_HOOK_CONTINUE;
+		return (NS_HOOK_CONTINUE);
 	}

 	client_state_destroy(qctx, inst);

-	return NS_HOOK_CONTINUE;
+	return (NS_HOOK_CONTINUE);
 }
@@ -132,9 +132,6 @@ command is one of the following:\n\
  halt		Stop the server without saving pending updates.\n\
  halt -p	Stop the server without saving pending updates reporting\n\
 		process id.\n\
-  skr -import file zone [class [view]]\n\
-		Import a SKR file for the specified zone, for offline KSK\n\
-		signing.\n\
  loadkeys zone [class [view]]\n\
 		Update keys without signing immediately.\n\
  managed-keys refresh [class [view]]\n\
@@ -143,10 +140,6 @@ command is one of the following:\n\
 		Display RFC 5011 managed keys information\n\
  managed-keys sync [class [view]]\n\
 		Write RFC 5011 managed keys to disk\n\
-  memprof [ on | off | dump ]\n\
-		Enable / disable memory profiling or dump the profile.\n\
-		Requires named to built with jemalloc and run with the relevant\n\
-		MALLOC_CONF environment variables.\n\
  modzone zone [class [view]] { zone-options }\n\
 		Modify a zone's configuration.\n\
 		Requires allow-new-zones option.\n\
@@ -1027,8 +1020,8 @@ main(int argc, char **argv) {
 	isc_managers_destroy(&rndc_mctx, &loopmgr, &netmgr);

 	if (failed) {
-		return 1;
+		return (1);
 	}

-	return 0;
+	return (0);
 }
@@ -257,11 +257,6 @@ Currently supported commands are:

   See also :option:`rndc stop`.

-.. option:: skr -import file zone [class [view]]
-
-   This command allows you to import a SKR file for the specified zone, to
-   support offline KSK signing.
-
 .. option:: loadkeys [zone [class [view]]]

   This command fetches all DNSSEC keys for the given zone from the key directory. If
@@ -313,19 +308,6 @@ Currently supported commands are:
      keys in the event of a trust anchor rollover, or as a brute-force
      repair for key maintenance problems.

-.. option:: memprof [(on | off | dump)]
-
-   This command controls memory profiling. To have any effect, :iscman:`named` must be
-   built with jemalloc, the library have profiling support enabled and run with the
-   ``prof:true`` allocator configuration. (either via ``MALLOC_CONF`` or ``/etc/malloc.conf``)
-
-   The ``prof_active:false`` option is recommended to ensure the profiling overhead does
-   not affect :iscman:`named` when not needed.
-
-   The ``on`` and ``off`` options will start and stop the jemalloc memory profiling respectively.
-   When run with the `dump` option, :iscman:`named` will dump the profile to the working
-   directory. The name will be chosen automatically by jemalloc.
-
 .. option:: modzone zone [class [view]] configuration

   This command modifies the configuration of a zone while the server is running. This
@@ -462,27 +444,14 @@ Currently supported commands are:

 .. program:: rndc

-.. option:: responselog [on | off]
-
-   This command enables or disables response logging. For backward compatibility,
-   this command can also be used without an argument to toggle response logging
-   on and off.
-
-   Unlike query logging, response logging cannot be enabled by explicitly directing
-   the ``responses`` ``category`` to a ``channel`` in the ``logging`` section
-   of :iscman:`named.conf`, but it can still be enabled by specifying
-   ``responselog yes;`` in the ``options`` section of :iscman:`named.conf`.
-
-.. option:: retransfer [-force] zone [class [view]]
+.. option:: retransfer zone [class [view]]

   This command retransfers the given secondary zone from the primary server.

   If the zone is configured to use ``inline-signing``, the signed
   version of the zone is discarded; after the retransfer of the
   unsigned version is complete, the signed version is regenerated
-   with new signatures. With the optional ``-force`` argument provided
-   if there is an ongoing zone transfer it will be aborted before a new zone
-   transfer is scheduled.
+   with new signatures.

 .. option:: scan

@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+#!/usr/bin/env python
 #
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
@@ -15,7 +15,6 @@ named.run
 /*.trs
 /*.xml
 /resolve
-/legacy.run.sh
 /run.log
 /start.sh
 /stop.sh
@@ -86,7 +86,6 @@ TESTS =				\
 	autosign		\
 	builtin			\
 	cacheclean		\
-	camp			\
 	case			\
 	catz			\
 	cds			\
@@ -96,7 +95,6 @@ TESTS =				\
 	checknames		\
 	checkzone		\
 	cookie			\
-	cpu			\
 	database		\
 	dialup			\
 	digdelv			\
@@ -151,7 +149,6 @@ TESTS =				\
 	proxy			\
 	pipelined		\
 	qmin			\
-	query-source		\
 	reclimit		\
 	redirect		\
 	resolver		\
@@ -51,7 +51,6 @@ To run system tests, make sure you have the following dependencies installed:
 - perl
 - dnspython
 - pytest-xdist (for parallel execution)
- python-jinja2 (for tests which use jinja templates)

 Individual system tests might also require additional dependencies. If those
 are missing, the affected tests will be skipped and should produce a message
@@ -155,17 +154,9 @@ system test directories may contain the following standard files:
 - `tests_*.py`: These python files are picked up by pytest as modules. If they
  contain any test functions, they're added to the test suite.

- `*.j2`: These jinja2 templates can be used for configuration files or any
-  other files which require certain variables filled in, e.g. ports from the
-  environment variables. During test setup, the pytest runner will automatically
-  fill those in and strip the filename extension .j2, e.g. `ns1/named.conf.j2`
-  becomes `ns1/named.conf`. When using advanced templating to conditionally
-  include/omit entire sections or when filling in custom variables used for the
-  test, ensure the templates always include the defaults. If you don't need the
-  file to be auto-templated during test setup, use `.j2.manual` instead and then
-  no defaults are needed.
-
- `setup.sh`: This sets up the preconditions for the tests.
+- `setup.sh`: This sets up the preconditions for the tests. Although optional,
+  virtually all tests will require such a file to set up the ports they should
+  use for the test.

 - `tests.sh`: Any shell-based tests are located within this file. Runs the
  actual tests.
@@ -19,9 +19,3 @@ key rndc_key {
 	algorithm       hmac-sha256;
 	secret          "1234abcd8765";
 };
-
-/* Regresssion test for [GL #4991] */
-server example.com {
-	key rndc-key;
-	addresses { localhost; 127.0.0.1; ::1; };
-};
@@ -0,0 +1,25 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after zone transfer tests.
+#
+
+rm -f dig.out.*
+rm -f ns2/example.db ns2/tsigzone.db ns2/example.db.jnl
+rm -f */named.conf
+rm -f */named.memstats
+rm -f */named.run
+rm -f ns*/_default.nzf
+rm -f ns*/_default.nzd*
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -13,6 +13,7 @@

 . ../conf.sh

+$SHELL clean.sh
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/example.db
 $SHELL ${TOP_SRCDIR}/bin/tests/system/genzone.sh 2 3 >ns2/tsigzone.db
 copy_setports ns2/named1.conf.in ns2/named.conf
@@ -9,18 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out*",
-        "ns*/_default.nzd*",
-        "ns*/_default.nzf*",
-        "ns2/example.db",
-        "ns2/tsigzone.db",
-    ]
-)
-

 def test_acl(run_tests_sh):
    run_tests_sh()
@@ -1,3 +1,5 @@
+#!/bin/sh
+
 # Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 #
 # SPDX-License-Identifier: MPL-2.0
@@ -9,17 +11,12 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
+#
+# Clean up after tests.
+#

-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out*",
-        "ans*/ans.run",
-        "ns*/*.jnl",
-        "ns*/*tld*.db",
-    ]
-)
-
-
-def test_camp(run_tests_sh):
-    run_tests_sh()
+rm -f dig.out.*
+rm -f */named.memstats
+rm -f */named.conf
+rm -f */named.run
+rm -f ns*/managed-keys.bind*
@@ -13,6 +13,7 @@

 . ../conf.sh

+$SHELL clean.sh
 copy_setports ns1/named1.conf.in ns1/named.conf
 copy_setports ns2/named.conf.in ns2/named.conf
 copy_setports ns3/named.conf.in ns3/named.conf
@@ -279,7 +279,7 @@ n=$((n + 1))
 echo_i "testing with 'minimal-any no;' ($n)"
 ret=0
 $DIG $DIGOPTS -t ANY www.rt.example @10.53.0.1 >dig.out.$n || ret=1
-grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 1" dig.out.$n >/dev/null || ret=1
+grep "ANSWER: 3, AUTHORITY: 2, ADDITIONAL: 2" dig.out.$n >/dev/null || ret=1
 if [ $ret -eq 1 ]; then
  echo_i "failed"
  status=$((status + 1))
@@ -9,14 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-    ]
-)
-

 def test_additional(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,43 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f ./dig.out.*
+rm -f ./rndc.out*
+rm -f ./showzone.out*
+rm -f ./zonestatus.out*
+rm -f ./*/named.conf
+rm -f ./*/named.memstats
+rm -f ./ns1/*.nzf ./ns1/*.nzf~
+rm -f ./ns1/*.nzd ./ns1/*.nzd-lock
+rm -f ./ns2/*.nzf ./ns2/*.nzf~
+rm -f ./ns2/*.nzd ./ns2/*.nzd-lock
+rm -f ./ns3/*.nzf ./ns3/*.nzf~
+rm -f ./ns3/*.nzd ./ns3/*.nzd-lock
+rm -f ./ns2/core*
+rm -f ./ns2/inline.db.jbk
+rm -f ./ns2/inline.db.signed
+rm -f ./ns2/inlinesec.bk*
+rm -rf ./ns2/new-zones
+rm -f ./ns*/named.run ./ns*/named.run.prev
+rm -f ./ns2/nzf-*
+rm -f ./ns3/named.conf
+rm -f ./ns3/*.nzf ./ns3/*.nzf~
+rm -f ./ns3/*.nzd ns3/*.nzd-lock
+rm -f ./ns3/inlinesec.db
+rm -f ./ns1/redirect.db
+rm -f ./ns2/redirect.db
+rm -f ./ns2/redirect.bk
+rm -f ./ns3/redirect.db
+rm -f ./ns*/managed-keys.bind* ns*/*.mkeys*
+rm -f ./nzd2nzf.out.*
+rm -f ./wait_for_message.*
@@ -34,6 +34,6 @@ zone "." {
 	file "redirect.db";
 };

-remote-servers "test" {
+primaries "test" {
 	10.53.0.99;
 };
@@ -12,21 +12,8 @@
 import concurrent.futures
 import time

-import pytest
-
 import isctest

-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "ns*/*.nzf*",
-        "ns*/*.nzd*",
-        "ns1/redirect.db",
-        "ns2/new-zones",
-        "ns2/redirect.db",
-        "ns3/redirect.db",
-    ]
-)
-

 def rndc_loop(test_state, domain, ns3):
    """
@@ -9,35 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-        "rndc.out*",
-        "showzone.out.*",
-        "zonestatus.out.*",
-        "ns*/*.nzd*",
-        "ns*/*.nzf*",
-        "ns1/redirect.db",
-        "nzd2nzf.out.*",
-        "ns2/*.nzf~",
-        "ns2/K*.key",
-        "ns2/K*.private",
-        "ns2/K*.state",
-        "ns2/external.nzd",
-        "ns2/extra.nzd",
-        "ns2/inline.db.jbk",
-        "ns2/inline.db.signed",
-        "ns2/inline.db.signed.jnl",
-        "ns2/inlinesec.bk.jbk",
-        "ns2/new-zones",
-        "ns2/redirect.bk",
-        "ns2/redirect.db",
-        "ns3/redirect.db",
-    ]
-)
-

 def test_addzone(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,23 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+#
+# Clean up after allow query tests.
+#
+
+rm -f dig.out.*
+rm -f ns*/named.conf
+rm -f ns2/controls.conf
+rm -f */named.memstats
+rm -f ns*/named.run ns*/named.run.prev
+rm -f ns*/managed-keys.bind* ns*/*.mkeys*
@@ -9,15 +9,6 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.

-import pytest
-
-pytestmark = pytest.mark.extra_artifacts(
-    [
-        "dig.out.*",
-        "ns2/controls.conf",
-    ]
-)
-

 def test_allow_query(run_tests_sh):
    run_tests_sh()
@@ -0,0 +1,20 @@
+#!/bin/sh
+
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+rm -f */named.memstats
+rm -f */named.run
+rm -f */named.conf
+rm -f dig.out.test*
+rm -f ns2/example.com.bk
+rm -f ns2/example.net.bk
+rm -f ns*/managed-keys.bind* ns*/*mkeys*
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Nicki Křížek	8e2e0cd2d7	WIP use user+net namespace	2024-06-24 16:31:21 +02:00
Nicki Křížek	14a3012171	WIP namespaces.py	2024-06-24 16:30:09 +02:00