Provide debugging information for the isc_random function

Merge branch '273-add-home-arpa-to-list-of-empty-zones-rfc-8375' into 'master'
Resolve "Add "HOME.ARPA" to list of empty zones (RFC 8375)" Closes #273 See merge request isc-projects/bind9!297
2018-05-23 21:37:47 +02:00 · 2018-05-22 20:57:19 -04:00 · 2018-05-23 10:48:30 +10:00 · 2018-05-23 10:47:42 +10:00 · 2018-05-22 19:42:35 -04:00 · 2018-05-22 16:32:21 -07:00
1069 changed files with 6323 additions and 284906 deletions
@@ -21,9 +21,10 @@ ans.run
 named.run
 named.memstats
 gen.dSYM/
-.libs/
+.ccache/
 .deps/
 .dirstamp
+.libs/
 unit/atf-src/atf-c++/atf-c++.pc
 unit/atf-src/atf-c/atf-c.pc
 unit/atf-src/atf-c/defs.h
@@ -98,7 +98,7 @@ stages:
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-    - autoreconf -fi
+    - ./autogen.sh
  script:
    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr/local --with-libidn2
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
@@ -174,11 +174,31 @@ precheck:debian:sid:amd64:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

-build:debian:sid:amd64:
+build:clang:debian:sid:amd64:
+  variables:
+    CC: clang-6.0
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
  <<: *debian_sid_amd64_image
  <<: *build_job
-    
+
+build:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+build:clang:debian:sid:i386:
+  variables:
+    CC: clang-6.0
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+  <<: *debian_sid_i386_image
+  <<: *build_job
+
 build:debian:sid:i386:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_sid_i386_image
  <<: *build_job

@@ -187,7 +207,13 @@ unittest:debian:sid:amd64:
  <<: *unit_test_job
  dependencies:
    - build:debian:sid:amd64
-    
+
+unittest:clang:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:clang:debian:sid:amd64
+
 unittest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
@@ -199,7 +225,7 @@ systemtest:debian:sid:amd64:
  <<: *system_test_job
  dependencies:
    - build:debian:sid:amd64
-    
+
 systemtest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
@@ -0,0 +1,42 @@
+<!--
+If the bug you are reporting is potentially security-related - for example,
+if it involves an assertion failure or other crash in `named` that can be
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
+-->
+
+### Summary
+
+(Summarize the bug encountered concisely.)
+
+### Steps to reproduce
+
+(How one can reproduce the issue - this is very important.)
+
+### What is the current *bug* behavior?
+
+(What actually happens.)
+
+### What is the expected *correct* behavior?
+
+(What you should see instead.)
+
+### Relevant configuration files
+
+(Paste any relevant configuration files - please use code blocks (```)
+to format console output. If submitting the contents of your
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)
+
+### Relevant logs and/or screenshots
+
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)
+
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug
@@ -0,0 +1,11 @@
+### Description
+
+(Describe the problem, use cases, benefits, and/or goals.)
+
+### Request
+
+(Describe the solution you'd like to see.)
+
+### Links / references
+
+/label ~"feature request"
@@ -1,100 +1,28 @@
-	--- 9.12.2 released ---
-
-	--- 9.12.2rc2 released ---
-
-4984.	[bug]		Improve handling of very large incremental
-			zone transfers to prevent journal corruption. [GL #339]
-
-4983.	[cleanup]	Remove the deprecated flag from "answer-cookie";
-                        it will be allowed to persist into 9.13. [GL #275].
-
-4982.	[cleanup]	Return FORMERR if the question section is empty
-			and no COOKIE option is present; this restores
-			older behavior except in the newly specified
-			COOKIE case. [GL #260]
-
-4981.	[bug]		Fix race in cmsg buffer usage in socket code.
-			[GL #180]
-
-4980.	[bug]		Named-checkconf failed to detect bad in-view targets.
-			[GL #288]
-
-4979.	[bug]		Non-libcap builds were not checking whether all
-			requested capabilities are present in the permitted
-			capability set. [GL #321]
-
-4978.	[test]		Fix error handling and resolver configuration in the
-			"rpz" system test. [GL #312]
-
-4977.	[func]		When starting up, log the same details that
-			would be reported by 'named -V'. [GL #247]
-
-4976.	[bug]		Log the label with invalid prefix length correctly
-			when loading RPZ zones. [GL #254]
-
-4975.	[bug]		The server cookie computation for sha1 and sha256 did
-			not match the method described in RFC 7873. [GL #356]
-
-4974.	[bug]		Restore default rrset-order to random. [GL #336]
-
-4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
-			to be const. [GL #341]
-
-4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
-			below a DNAME as out-of-zone data. [GL #298]
-
-4969.	[cleanup]	Refactor zone logging functions. [GL #269]
-
-	--- 9.12.2rc1 released ---
-
-4968.	[bug]		If glue records are signed, attempt to validate them.
-			[GL #209]
-
-4966.	[func]		Add the ability to not return a DNS COOKIE option
-			when one is present in the request (answer-cookie no;).
-			[GL #173]
-
-4965.	[func]		Add support for marking options as deprecated.
-			[GL #322]
-
-4964.	[bug]		Reduce the probabilty of double signature when deleting
-			a DNSKEY by checking if the node is otherwise signed
-			by the algorithm of the key to be deleted. [GL #240]
-
-4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
-			if available, to configure the test interfaces on
-			linux.  [GL #302]
-
-4962.	[cleanup]	Move 'named -T' processing to its own function.
-			[GL #316]
-
-4960.	[security]	When recursion is enabled, but the "allow-recursion"
-			and "allow-query-cache" ACLs are not specified,
-			they should be limited to local networks,
-			but were inadvertently set to match the default
-			"allow-query", thus allowing remote queries.
-			(CVE-2018-5738) [GL #309]
-
-4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
-
-4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
-			[GL #286]
-
-4954.	[func]		Messages about serving of stale answers are now
-			directed to the "serve-stale" logging category.
-			Also clarified serve-stale documentation. [GL !323]
-
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
+	--- 9.13.0 released ---

 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]

-4949.	[bug]		lib/isc/print.c failed to handle floating point
-			output correctly. [GL #261]
+4949.	[placeholder]
+
+4948.	[bug]		When request-nsid is turned on, EDNS NSID options
+			should be logged at level info. Since change 3741
+			they have been logged at debug(3) by mistake.
+			[GL !290]
+
+4947.	[func]		Replace all random functions with isc_random(),
+			isc_random_buf() and isc_random_uniform() API.
+			[GL #221]

 4946.	[bug]		Additional glue was not being returned by resolver
 			for unsigned zones since change 4596. [GL #209]

+4945.	[func]		BIND can no longer be built without DNSSEC support.
+			A cryptography provder (i.e., OpenSSL or a hardware
+			service module with PKCS#11 support) must be
+			available. [GL #244]
+
 4944.	[cleanup]	Silence cppcheck portability warnings in
 			lib/isc/tests/buffer_test.c. [GL #239]

@@ -103,8 +31,25 @@
 			hash table size to 512 entries for 'named -m record'
 			restoring the previous memory footprint. [GL #248]

+4942.	[cleanup]	Consolidate multiple instances of splitting of
+			batchline in dig into a single function. [GL #196]
+
+4941.	[cleanup]	Silence clang static analyzer warnings. [GL #196]
+
+4940.	[cleanup]	Extract the loop in dns__zone_updatesigs() into
+			separate functions to improve code readability.
+			[GL #135]
+
 4939.	[test]		Add basic unit tests for update_sigs(). [GL #135]

+4938.	[placeholder]
+
+4937.	[func]		Remove support for OpenSSL < 1.0.0 [GL #191]
+
+4936.	[func]		Always use OpenSSL or PKCS#11 random data providers,
+			and remove the --{enable,disable}-crypto-rand configure
+			options. [GL #165]
+
 4935.	[func]		Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0
 			call were added). [GL #191]

@@ -123,12 +68,37 @@
 			logged even when an error occurred while updating
 			signatures. [GL #159]

+4931.	[func]		Removed the "rbtdb64" database implementation.
+			[GL #217]
+
 4930.	[bug]		Remove a bogus check in nslookup command line
 			argument processing. [GL #206]

+4929.	[func]		Add the ability to set RA and TC in queries made by
+			dig (+[no]raflag, +[no]tcflag). [GL #213]
+
+4928.	[func]		The "dnskey-sig-validity" option allows
+			"sig-validity-interval" to be overriden for signatures
+			covering DNSKEY RRsets. [GL #145]
+
+4927.	[placeholder]
+
 4926.	[func]		Add root key sentinel support.  To disable, add
 			'root-key-sentinel no;' to named.conf. [GL #37]

+4925.	[func]		Several configuration options that define intervals
+			can now take TTL value suffixes (for example, 2h or 1d)
+			in addition to integer parameters. These include
+			max-cache-ttl, max-ncache-ttl, max-policy-ttl,
+			fstrm-set-reopen-interval, interface-interval, and
+			min-update-interval. [GL #203]
+
+4924.	[cleanup]	Clean up the isc_string_* namespace and leave
+			only strlcpy and strlcat. [GL #178]
+
+4923.	[cleanup]	Refactor socket and socket event options into
+			enum types. [GL !135]
+
 4922.	[bug]		dnstap: Log the destination address of client
 			packets rather than the interface address.
 			[GL #197]
@@ -138,8 +108,20 @@
 			refactoring dns_fixedname_*() macros were turned into
 			functions. [GL #183]

+4920.	[cleanup]	Clean up libdns removing most of the backwards
+			compatibility wrappers.
+
+4919.	[cleanup]	Clean up the isc_hash_* namespace and leave only
+			the FNV-1a hash implementation. [GL #178]
+
 4918.	[bug]		Fix double free after keygen error in dnssec-keygen
 			when OpenSSL >= 1.1.0 is used and RSA_generate_key_ex
+			fails. [GL #109]
+
+4917.	[func]		Support 64 RPZ policy zones by default. [GL #123]
+
+4916.	[func]		Remove IDNA2003 support and the bundled idnkit-1.0
+			library.

 4915.	[func]		Implement IDNA2008 support in dig by adding support
 			for libidn2.  New dig option +idnin has been added,
@@ -174,10 +156,15 @@
 4907.	[test]		Improved the reliability of the 'notify' system
 			test. [GL #59]

+4906.	[func]		Replace getquad() with inet_pton(), completing
+			change #4900. [GL #56]
+
 4905.	[bug]		irs_resconf_load() ignored resolv.conf syntax errors
 			when "domain" or "search" options were present in that
 			file. [GL #110]

+4904.	[bug]		Temporarily revert change #4859. [GL #124]
+
 4903.	[bug]		"check-mx fail;" did not prevent MX records containing
 			IP addresses from being added to a zone by a dynamic
 			update. [GL #112]
@@ -185,11 +172,21 @@
 4902.	[test]		Improved the reliability of the 'ixfr' system
 			test. [GL #66]

+4901.	[func]		"dig +nssearch" now lists the name servers
+			for a domain that time out, as well as the servers
+			that respond. [GL #64]
+
+4900.	[func]		Remove all uses of inet_aton().  As a result of this
+			change, IPv4 addresses are now only accepted in
+			dotted-quad format. [GL #13]
+
 4899.	[test]		Convert most of the remaining system tests to be able
 			to run in parallel, continuing the work from change
 			#4895. To take advantage of this, use "make -jN check",
 			where N is the number of processors to use. [GL #91]

+4898.	[func]		Remove libseccomp based system-call filtering. [GL #93]
+
 4897.	[test]		Update to rpz system test so that it doesn't recurse.
 			[GL #68]

@@ -198,14 +195,6 @@
 4895.	[test]		Allow some system tests to run in parallel.
 			[RT #46602]

-	--- 9.12.1 released ---
-
-	--- 9.12.1rc2 released ---
-
-4904.	[bug]		Temporarily revert change #4859. [GL #124]
-
-	--- 9.12.1rc1 released ---
-
 4894.	[bug]		named could crash while rolling a dnstap output file.
 			[RT #46942]

@@ -215,13 +204,16 @@
 			before all zone loading actions triggered by a previous
 			"rndc reload" command were completed. [RT #47076]

+4891.	[placeholder]
+
+4890.	[func]		Remove unused ondestroy callback from libisc.
+			[isc-projects/bind9!3]
+
 4889.	[func]		Warn about the use of old root keys without the new
 			root key being present.  Warn about dlv.isc.org's
 			key being present. Warn about both managed and
 			trusted root keys being present. [RT #43670]

-	--- 9.12.1b1 released ---
-
 4888.	[test]		Initialize sockets correctly in sample-update so
 			that the nsupdate system test will run on Windows.
 			[RT #47097]
@@ -292,6 +284,9 @@
 			be passed to memmove which is undefined behavior and
 			can lead to bad optimization. [RT #46888]

+4868.	[func]		dnssec-keygen can no longer generate HMAC keys.
+			Use tsig-keygen instead. [RT #46404]
+
 4867.	[cleanup]	Normalize rndc on/off commands (validation,
 			querylog, serve-stale) so they all accept the
 			same synonyms for on/off (yes/no, true/false,
@@ -301,15 +296,33 @@
 			was not disabled) and SHA-1 hash and HMAC support.
 			[RT #46764]

+4865.	[cleanup]	Simplify handling isc_socket_sendto2() return values.
+			[RT #46986]
+
 4864.	[bug]		named acting as a slave for a catalog zone crashed if
 			the latter contained a master definition without an IP
 			address. [RT #45999]

+4863.	[bug]		Fix various other bugs reported by Valgrind's
+			memcheck tool. [RT #46978]
+
+4862.	[bug]		The rdata flags for RRSIG were not being properly set
+			when constructing a rdataslab. [RT #46978]
+
 4861.	[bug]		The isc_crc64 unit test was not endian independent.
 			[RT #46973]

 4860.	[bug]		isc_int8_t should be signed char.  [RT #46973]

+4859.	[bug]		A loop was possible when attempting to validate
+			unsigned CNAME responses from secure zones;
+			this caused a delay in returning SERVFAIL and
+			also increased the chances of encountering
+			CVE-2017-3145. [RT #46839]
+
+4858.	[security]	Addresses could be referenced after being freed
+			in resolver.c, causing an assertion failure.
+			(CVE-2017-3145) [RT #46839]

 4857.	[bug]		Maintain attach/detach semantics for event->db,
 			event->node, event->rdataset and event->sigrdataset
@@ -335,6 +348,16 @@
 4851.	[port]		Support using kyua as well as atf-run to run the unit
 			tests. [RT #46853]

+4850.	[bug]		Named failed to restart with multiple added zones in
+			lmdb database. [RT #46889]
+
+4849.	[bug]		Duplicate zones could appear in the .nzf file if
+			addzone failed. [RT #46435]
+
+4848.	[func]		Zone types "primary" and "secondary" can now be used
+			as synonyms for "master" and "slave" in named.conf.
+			[RT #46713]
+
 4847.	[bug]		dnssec-dnskey-kskonly was not being honored for
 			CDS and CDNSKEY. [RT #46755]

@@ -352,34 +375,6 @@
 4842.	[bug]		Conditionally compile opensslecdsa_link.c to avoid
 			warnings about unused function. [RT #46790]

-	--- 9.12.0 released ---
-
-	--- 9.12.0rc3 released ---
-
-4863.	[bug]		Fix various other bugs reported by Valgrind's
-			memcheck tool. [RT #46978]
-
-4862.	[bug]		The rdata flags for RRSIG were not being properly set
-			when constructing a rdataslab. [RT #46978]
-
-	--- 9.12.0rc2 released ---
-
-4859.	[bug]		A loop was possible when attempting to validate
-			unsigned CNAME responses from secure zones;
-			this caused a delay in returning SERVFAIL and
-			also increased the chances of encountering
-			CVE-2017-3145. [RT #46839]
-
-4858.	[security]	Addresses could be referenced after being freed
-			in resolver.c, causing an assertion failure.
-			(CVE-2017-3145) [RT #46839]
-
-4850.	[bug]		Named failed to restart with multiple added zones in
-			lmdb database. [RT #46889]
-
-4849.	[bug]		Duplicate zones could appear in the .nzf file if
-			addzone failed. [RT #46435]
-
 	--- 9.12.0rc1 released ---

 4841.	[bug]		Address -fsanitize=undefined warnings. [RT #46786]
@@ -22,7 +22,7 @@ MANPAGES =	isc-config.sh.1

 HTMLPAGES =	isc-config.sh.html

-MANOBJS =	README HISTORY OPTIONS ${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

@@ -19,9 +19,6 @@ Setting                   Description
                          named-checkzone
 -DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
                          rather than ${localstatedir}/run/named/
-                          Increase the maximum number of configurable
-DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
-                          highest possible setting
                          Disable the use of inline functions to implement
 -DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
                          may be useful when debugging
@@ -23,6 +23,5 @@ Some of these settings are:
 |`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
-|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
 |`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
 |`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
@@ -5,7 +5,7 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.12 features
+ 4. BIND 9.13 features
 5. Building BIND
 6. macOS
 7. Compile-time options
@@ -82,8 +82,8 @@ ISC maintains a public git repository for BIND; details can be found at
 http://www.isc.org/git/.

 Information for BIND contributors can be found in the following files: -
-General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
-style.md - BIND architecture and developer guide: doc/dev/dev.md
+General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
+- BIND architecture and developer guide: doc/dev/dev.md

 Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
@@ -97,49 +97,13 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.12 features
+BIND 9.13 features

-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases. New features
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases. New features
 include:

-  * named and related libraries have been substantially refactored for
-    improved query performance -- particularly on delegation heavy zones
-    -- and for improved readability, maintainability, and testability.
-  * Code implementing the name server query processing logic has been
-    moved into a new libns library, for easier testing and use in tools
-    other than named.
-  * Cached, validated NSEC and other records can now be used to synthesize
-    NXDOMAIN responses.
-  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting 'max-journal-size default' now limits the size of journal
-    files to twice the size of the zone.
-  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
-    message.
-  * dnstap output files can now be configured to roll automatically when
-    reaching a given size.
-  * Log file timestamps can now also be formatted in ISO 8601 (local) or
-    ISO 8601 (UTC) formats.
-  * Logging channels and dnstap output files can now be configured to use
-    a timestamp as the suffix when rolling to a new file.
-  * 'named-checkconf -l' lists zones found in named.conf.
-  * Added support for the EDNS Padding and Keepalive options.
-  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored.
-  * The default key algorithm in rndc-confgen is now hmac-sha256.
-  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
-    default without a configure option.
-  * The obsolete isc-hmac-fixup command has been removed.
-
-BIND 9.12.1
-
-BIND 9.12.1 is a maintenance release.
-
-BIND 9.12.2
-
-BIND 9.12.2 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
-CVE-2018-5738.
+  * TBD

 Building BIND

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.12 features](#features)
+1. [BIND 9.13 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Compile-time options](#opts)
@@ -95,7 +95,7 @@ ISC maintains a public git repository for BIND; details can be found
 at [http://www.isc.org/git/](http://www.isc.org/git/).

 Information for BIND contributors can be found in the following files:
- General information: [doc/dev/contrib.md](doc/dev/contrib.md)
+- General information: [CONTRIBUTING.md](CONTRIBUTING)
 - BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)

@@ -114,49 +114,13 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.12 features
+### <a name="features"/> BIND 9.13 features

-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases.  New features
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases.  New features
 include:

-* `named` and related libraries have been substantially refactored for
-  improved query performance -- particularly on delegation heavy zones -- 
-  and for improved readability, maintainability, and testability.
-* Code implementing the name server query processing logic has been moved
-  into a new `libns` library, for easier testing and use in tools other
-  than `named`.
-* Cached, validated NSEC and other records can now be used to synthesize
-  NXDOMAIN responses.
-* The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `'max-journal-size default'` now limits the size of journal files
-  to twice the size of the zone.
-* `dnstap-read -x` prints a hex dump of the wire format of each logged
-  DNS message.
-* `dnstap` output files can now be configured to roll automatically when
-  reaching a given size.
-* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
-  8601 (UTC) formats.
-* Logging channels and `dnstap` output files can now be configured to use a
-  timestamp as the suffix when rolling to a new file.
-* `'named-checkconf -l'` lists zones found in `named.conf`.
-* Added support for the EDNS Padding and Keepalive options.
-* 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
-
-#### BIND 9.12.1
-
-BIND 9.12.1 is a maintenance release.
-
-#### BIND 9.12.2
-
-BIND 9.12.2 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
-CVE-2018-5738.
+* TBD

 ### <a name="build"/> Building BIND

@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 		${ISC_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -98,18 +98,17 @@ isc_boolean_t docheckmx = ISC_FALSE;
 isc_boolean_t dochecksrv = ISC_FALSE;
 isc_boolean_t docheckns = ISC_FALSE;
 #endif
-unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
-			    DNS_ZONEOPT_CHECKMX |
-			    DNS_ZONEOPT_MANYERRORS |
-			    DNS_ZONEOPT_CHECKNAMES |
-			    DNS_ZONEOPT_CHECKINTEGRITY |
+dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS |
+			     DNS_ZONEOPT_CHECKMX |
+			     DNS_ZONEOPT_MANYERRORS |
+			     DNS_ZONEOPT_CHECKNAMES |
+			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
-			    DNS_ZONEOPT_CHECKSIBLING |
+			     DNS_ZONEOPT_CHECKSIBLING |
 #endif
-			    DNS_ZONEOPT_CHECKWILDCARD |
-			    DNS_ZONEOPT_WARNMXCNAME |
-			    DNS_ZONEOPT_WARNSRVCNAME;
-unsigned int zone_options2 = 0;
+			     DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_WARNMXCNAME |
+			     DNS_ZONEOPT_WARNSRVCNAME;

 /*
 * This needs to match the list in bin/named/log.c.
@@ -688,7 +687,8 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
 	CHECK(dns_zone_setorigin(zone, origin));
 	CHECK(dns_zone_setdbtype(zone, 1, (const char * const *) dbtype));
-	CHECK(dns_zone_setfile2(zone, filename, fileformat));
+	CHECK(dns_zone_setfile(zone, filename, fileformat,
+			       &dns_master_style_default));
 	if (journal != NULL)
 		CHECK(dns_zone_setjournal(zone, journal));

@@ -698,7 +698,6 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,

 	dns_zone_setclass(zone, rdclass);
 	dns_zone_setoption(zone, zone_options, ISC_TRUE);
-	dns_zone_setoption2(zone, zone_options2, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);

 	dns_zone_setmaxttl(zone, maxttl);
@@ -761,8 +760,8 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		}
 	}

-	result = dns_zone_dumptostream3(zone, output, fileformat, style,
-					rawversion);
+	result = dns_zone_dumptostream(zone, output, fileformat, style,
+				       rawversion);
 	if (output != stdout)
 		(void)isc_stdio_close(output);

@@ -21,6 +21,7 @@

 #include <dns/masterdump.h>
 #include <dns/types.h>
+#include <dns/zone.h>

 ISC_LANG_BEGINDECLS

@@ -48,8 +49,7 @@ extern isc_boolean_t nomerge;
 extern isc_boolean_t docheckmx;
 extern isc_boolean_t docheckns;
 extern isc_boolean_t dochecksrv;
-extern unsigned int zone_options;
-extern unsigned int zone_options2;
+extern dns_zoneopt_t zone_options;

 ISC_LANG_ENDDECLS

@@ -20,7 +20,6 @@

 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -128,8 +127,13 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 		     element = cfg_list_next(element)) {
 			value = cfg_listelt_value(element);
 			type = cfg_tuple_get(value, "type");
-			if (strcasecmp(cfg_obj_asstring(type), "master") != 0)
+			if ((strcasecmp(cfg_obj_asstring(type),
+					"primary") != 0) &&
+			    (strcasecmp(cfg_obj_asstring(type),
+					"master") != 0))
+			{
 				continue;
+			}
 			*obj = cfg_tuple_get(value, "mode");
 			return (ISC_TRUE);
 		}
@@ -245,11 +249,14 @@ configure_zone(const char *vclass, const char *view,
 	 * Skip loading checks for any type other than
 	 * master and redirect
 	 */
-	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0)
+	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
 		return (configure_hint(zfile, zclass, mctx));
-	else if ((strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
-		  (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
+	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
+		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
+		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
+	{
 		return (ISC_R_SUCCESS);
+	}

 	/*
 	 * Is the redirect zone configured as a slave?
@@ -399,7 +406,7 @@ configure_zone(const char *vclass, const char *view,
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
 		maxttl = cfg_obj_asuint32(obj);
-		zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+		zone_options |= DNS_ZONEOPT_CHECKTTL;
 	}

 	result = load_zone(mctx, zname, zfile, masterformat,
@@ -530,7 +537,6 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	int exit_status = 0;
-	isc_entropy_t *ectx = NULL;
 	isc_boolean_t load_zones = ISC_FALSE;
 	isc_boolean_t list_zones = ISC_FALSE;
 	isc_boolean_t print = ISC_FALSE;
@@ -646,10 +652,6 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);

-	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
-		      == ISC_R_SUCCESS);
-
 	dns_result_register();

 	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
@@ -680,9 +682,6 @@ main(int argc, char **argv) {

 	isc_log_destroy(&logc);

-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
-
 	isc_mem_destroy(&mctx);

 #ifdef _WIN32
@@ -19,7 +19,6 @@
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -46,7 +45,6 @@

 static int quiet = 0;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
@@ -259,7 +257,7 @@ main(int argc, char **argv) {
 			break;

 		case 'l':
-			zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+			zone_options |= DNS_ZONEOPT_CHECKTTL;
 			endp = NULL;
 			maxttl = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -521,9 +519,6 @@ main(int argc, char **argv) {
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
-		      == ISC_R_SUCCESS);

 	dns_result_register();

@@ -555,8 +550,6 @@ main(int argc, char **argv) {
 	destroy();
 	if (lctx != NULL)
 		isc_log_destroy(&lctx);
-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
 	isc_mem_destroy(&mctx);
 #ifdef _WIN32
 	DestroySockets();
@@ -39,7 +39,7 @@
 ddns-confgen \- ddns key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBtsig\-keygen\fR\ 'u
-\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [name]
+\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [name]
 .HP \w'\fBddns\-confgen\fR\ 'u
 \fBddns\-confgen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-q\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\-s\ \fIname\fR | \-z\ \fIzone\fR]
 .SH "DESCRIPTION"
@@ -109,17 +109,6 @@ only\&.) Quiet mode: Print only the key, with no explanatory text or usage examp
 \fBtsig\-keygen\fR\&.
 .RE
 .PP
-\-r \fIrandomfile\fR
-.RS 4
-Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-s \fIname\fR
 .RS 4
 (\fBddns\-confgen\fR
@@ -26,7 +26,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -37,7 +36,7 @@
 #include <isc/time.h>
 #include <isc/util.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -67,10 +66,9 @@ usage(int status) {
 	if (progmode == progmode_confgen) {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-k keyname] [-r randomfile] [-q] [-s name | -z zone]\n\
+ %s [-a alg] [-k keyname] [-q] [-s name | -z zone]\n\
  -a alg:        algorithm (default hmac-sha256)\n\
  -k keyname:    name of the key as it will be used in named.conf\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s name:       domain name to be updated using the created key\n\
  -z zone:       name of the zone as it will be used in named.conf\n\
  -q:            quiet mode: print the key, with no explanatory text\n",
@@ -78,9 +76,8 @@ Usage:\n\
 	} else {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-r randomfile] [keyname]\n\
-  -a alg:        algorithm (default hmac-sha256)\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n",
+ %s [-a alg] [keyname]\n\
+  -a alg:        algorithm (default hmac-sha256)\n\n",
 			 progname);
 	}

@@ -95,7 +92,6 @@ main(int argc, char **argv) {
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
-	const char *randomfile = NULL;
 	const char *keyname = NULL;
 	const char *zone = NULL;
 	const char *self_domain = NULL;
@@ -106,7 +102,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -168,7 +164,7 @@ main(int argc, char **argv) {
 				usage(1);
 			break;
 		case 'r':
-			randomfile = isc_commandline_argument;
+			fatal("The -r option has been deprecated.");
 			break;
 		case 's':
 			if (progmode == progmode_confgen)
@@ -235,7 +231,7 @@ main(int argc, char **argv) {

 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, alg, keysize, &key_txtbuffer);


 	if (!quiet)
@@ -46,7 +46,6 @@
      <command>tsig-keygen</command>
      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat">name</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
@@ -157,23 +156,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-r <replaceable class="parameter">randomfile</replaceable></term>
-	<listitem>
-	  <para>
-            Specifies a source of random data for generating the
-            authorization.  If the operating system does not provide a
-            <filename>/dev/random</filename> or equivalent device, the
-            default source of randomness is keyboard input.
-            <filename>randomdev</filename> specifies the name of a
-            character device or file containing random data to be used
-            instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard input
-            should be used.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-s <replaceable class="parameter">name</replaceable></term>
 	<listitem>
@@ -35,7 +35,6 @@
      <code class="command">tsig-keygen</code> 
       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
       [<code class="option">-h</code>]
-       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [name]
    </p></div>
    <div class="cmdsynopsis"><p>
@@ -136,20 +135,6 @@
            This is essentially identical to <span class="command"><strong>tsig-keygen</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd>
-	  <p>
-            Specifies a source of random data for generating the
-            authorization.  If the operating system does not provide a
-            <code class="filename">/dev/random</code> or equivalent device, the
-            default source of randomness is keyboard input.
-            <code class="filename">randomdev</code> specifies the name of a
-            character device or file containing random data to be used
-            instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard input
-            should be used.
-	  </p>
-	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
 <dd>
 	  <p>
@@ -19,7 +19,6 @@

 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -113,17 +112,12 @@ alg_bits(dns_secalg_t alg) {
 }

 /*%
- * Generate a key of size 'keysize' using entropy source 'randomfile',
- * and place it in 'key_txtbuffer'
+ * Generate a key of size 'keysize' and place it in 'key_txtbuffer'
 */
 void
-generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
-	     int keysize, isc_buffer_t *key_txtbuffer) {
+generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
+	     isc_buffer_t *key_txtbuffer) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_entropysource_t *entropy_source = NULL;
-	int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
-	int entropy_flags = 0;
-	isc_entropy_t *ectx = NULL;
 	isc_buffer_t key_rawbuffer;
 	isc_region_t key_rawregion;
 	char key_rawsecret[64];
@@ -150,31 +144,12 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 		fatal("unsupported algorithm %d\n", alg);
 	}

-
-	DO("create entropy context", isc_entropy_create(mctx, &ectx));
-
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(ectx, ISC_TRUE);
-	}
-#endif
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		randomfile = NULL;
-		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
-	}
-	DO("start entropy source", isc_entropy_usebestsource(ectx,
-							     &entropy_source,
-							     randomfile,
-							     open_keyboard));
-
-	entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
-
-	DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));
+	DO("initialize dst library", dst_lib_init(mctx, NULL));

 	DO("generate key", dst_key_generate(dns_rootname, alg,
-					    keysize, 0, 0,
-					    DNS_KEYPROTO_ANY,
-					    dns_rdataclass_in, mctx, &key));
+					    keysize, 0, 0, DNS_KEYPROTO_ANY,
+					    dns_rdataclass_in, mctx, &key,
+					    NULL));

 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));

@@ -185,17 +160,9 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 	DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
 						     key_txtbuffer));

-	/*
-	 * Shut down the entropy source now so the "stop typing" message
-	 * does not muck with the output.
-	 */
-	if (entropy_source != NULL)
-		isc_entropy_destroysource(&entropy_source);
-
 	if (key != NULL)
 		dst_key_free(&key);

-	isc_entropy_detach(&ectx);
 	dst_lib_destroy();
 }

@@ -19,8 +19,8 @@

 ISC_LANG_BEGINDECLS

-void generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
-		  int keysize, isc_buffer_t *key_txtbuffer);
+void generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
+		  isc_buffer_t *key_txtbuffer);

 void write_key_file(const char *keyfile, const char *user,
 		    const char *keyname, isc_buffer_t *secret,
@@ -39,7 +39,7 @@
 rndc-confgen \- rndc key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBrndc\-confgen\fR\ 'u
-\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
+\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBrndc\-confgen\fR
@@ -147,17 +147,6 @@ listens for connections from
 \fBrndc\fR\&. The default is 953\&.
 .RE
 .PP
-\-r \fIrandomfile\fR
-.RS 4
-Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-s \fIaddress\fR
 .RS 4
 Specifies the IP address where
@@ -29,7 +29,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -70,7 +69,7 @@ usage(int status) {

 	fprintf(stderr, "\
 Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
  -A alg:	 algorithm (default hmac-sha256)\n\
@@ -78,7 +77,6 @@ Usage:\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
  -p port:	 the port named will listen on and rndc will connect to\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s addr:	 the address to which rndc should connect\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
@@ -95,7 +93,6 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	const char *keyname = NULL;
-	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
 	const char *algname;
@@ -165,7 +162,7 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			break;
 		case 'r':
-			randomfile = isc_commandline_argument;
+			fatal("The -r option has been deprecated.");
 			break;
 		case 's':
 			serveraddr = isc_commandline_argument;
@@ -217,7 +214,7 @@ main(int argc, char **argv) {
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, alg, keysize, &key_txtbuffer);

 	if (keyonly) {
 		write_key_file(keyfile, chrootdir == NULL ? user : NULL,
@@ -58,7 +58,6 @@
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">keyname</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">address</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">chrootdir</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">user</replaceable></option></arg>
@@ -191,24 +190,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-r <replaceable class="parameter">randomfile</replaceable></term>
-        <listitem>
-          <para>
-            Specifies a source of random data for generating the
-            authorization.  If the operating
-            system does not provide a <filename>/dev/random</filename>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <filename>randomdev</filename>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard
-            input should be used.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-s <replaceable class="parameter">address</replaceable></term>
        <listitem>
@@ -40,7 +40,6 @@
       [<code class="option">-h</code>]
       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>address</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>]
       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
@@ -154,21 +153,6 @@
            The default is 953.
          </p>
        </dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd>
-          <p>
-            Specifies a source of random data for generating the
-            authorization.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p>
-        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>address</code></em></span></dt>
 <dd>
          <p>
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
+CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
 CWARNINGS =

@@ -521,17 +521,17 @@ setup_style(dns_master_style_t **stylep) {
 	}

 	if (multiline || (nottl && noclass))
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 24, 32, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 24, 32, 80, 8,
+						splitwidth, mctx);
 	else if (nottl || noclass)
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 32, 40, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 32, 40, 80, 8,
+						splitwidth, mctx);
 	else
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 32, 40, 48, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 32, 40, 48, 80, 8,
+						splitwidth, mctx);

 	if (result == ISC_R_SUCCESS)
 		*stylep = style;
@@ -943,18 +943,6 @@ cleanup:
 	return (result);
 }

-static char *
-next_token(char **stringp, const char *delim) {
-	char *res;
-
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
-}
-
 static isc_result_t
 parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc) {
@@ -974,23 +962,23 @@ parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 static void
 plus_option(char *option) {
 	isc_result_t result;
-	char option_store[256];
-	char *cmd, *value, *ptr;
+	char *cmd, *value, *last = NULL;
 	isc_boolean_t state = ISC_TRUE;

-	strlcpy(option_store, option, sizeof(option_store));
-	ptr = option_store;
-	cmd = next_token(&ptr,"=");
+	INSIST(option != NULL);
+
+	cmd = strtok_r(option, "=", &last);
 	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option_store);
+		printf(";; Invalid option %s\n", option);
 		return;
 	}
-	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}

+	value = strtok_r(NULL, "\0", &last);
+
 #define FULLCHECK(A) \
 	do { \
 		size_t _l = strlen(cmd); \
@@ -1538,7 +1526,7 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict) {
 		unsigned int options = 0;

 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname2(&addr, options, name);
+		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -1622,8 +1610,8 @@ main(int argc, char *argv[]) {

 	/* Create client */
 	clopt = DNS_CLIENTCREATEOPT_USECACHE;
-	result = dns_client_createx2(mctx, actx, taskmgr, socketmgr, timermgr,
-				     clopt, &client, srcaddr4, srcaddr6);
+	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr,
+				    clopt, &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			  isc_result_totext(result));
@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -41,10 +41,10 @@ DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCDEPLIBS} ${ISCCFGDEPLIBS}

 LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
+		${ISCLIBS} @LIBIDN2_LIBS@ @LIBS@

 NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCNOSYMLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
+		${ISCNOSYMLIBS} @LIBIDN2_LIBS@ @LIBS@

 SUBDIRS =

@@ -532,7 +532,7 @@ Include an EDNS name server ID request when sending a query\&.
 .RS 4
 When this option is set,
 \fBdig\fR
-attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&.
+attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&. Addresses of servers that that did not respond are also printed\&.
 .RE
 .PP
 \fB+[no]onesoa\fR
@@ -564,6 +564,11 @@ Print [do not print] the query as it is sent\&. By default, the query is not pri
 Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
+\fB+[no]raflag\fR
+.RS 4
+Set [do not set] the RA (Recursion Available) bit in the query\&. The default is +noraflag\&. This bit should be ignored by the server for QUERY\&.
+.RE
+.PP
 \fB+[no]rdflag\fR
 .RS 4
 A synonym for
@@ -653,6 +658,11 @@ for short, sends an EDNS CLIENT\-SUBNET option with an empty address and a sourc
 be used when resolving this query\&.
 .RE
 .PP
+\fB+[no]tcflag\fR
+.RS 4
+Set [do not set] the TC (TrunCation) bit in the query\&. The default is +notcflag\&. This bit should be ignored by the server for QUERY\&.
+.RE
+.PP
 \fB+[no]tcp\fR
 .RS 4
 Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless a type
@@ -205,6 +205,7 @@ help(void) {
 "                 +padding=###        (Set padding block size [0])\n"
 "                 +[no]qr             (Print question before sending)\n"
 "                 +[no]question       (Control display of question section)\n"
+"                 +[no]raflag         (Set RA flag in query (+[no]raflag))\n"
 "                 +[no]rdflag         (Recursive mode (+[no]recurse))\n"
 "                 +[no]recurse        (Recursive mode (+[no]rdflag))\n"
 "                 +retry=###          (Set number of UDP retries) [2]\n"
@@ -217,6 +218,7 @@ help(void) {
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
 "                 +subnet=addr        (Set edns-client-subnet option)\n"
+"                 +[no]tcflag         (Set TC flag in query (+[no]tcflag))\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
@@ -480,17 +482,17 @@ printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 24, 32, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 24, 32, 80, 8,
+						splitwidth, mctx);
 	else if (query->lookup->nottl || query->lookup->noclass)
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 32, 40, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 32, 40, 80, 8,
+						splitwidth, mctx);
 	else
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 32, 40, 48, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 32, 40, 48, 80, 8,
+						splitwidth, mctx);
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
@@ -729,28 +731,27 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 */

 static void
-plus_option(const char *option, isc_boolean_t is_batchfile,
+plus_option(char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
-	char option_store[256];
-	char *cmd, *value, *ptr, *code;
+	char *cmd, *value, *last = NULL, *code, *extra;
 	isc_uint32_t num;
 	isc_boolean_t state = ISC_TRUE;
 	size_t n;

-	strlcpy(option_store, option, sizeof(option_store));
-	ptr = option_store;
-	cmd = next_token(&ptr, "=");
-	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option_store);
+	INSIST(option != NULL);
+
+	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
+		printf(";; Invalid option %s\n", option);
 		return;
 	}
-	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
 		state = ISC_FALSE;
 	}
+	/* parse the rest of the string */
+	value = strtok_r(NULL, "", &last);

 #define FULLCHECK(A) \
 	do { \
@@ -1006,8 +1007,9 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 							     "specified");
 							goto exit_or_usage;
 						}
-						code = next_token(&value, ":");
-						save_opt(lookup, code, value);
+						code = strtok_r(value, ":", &last);
+						extra = strtok_r(NULL, "\0", &last);
+						save_opt(lookup, code, extra);
 						break;
 					default:
 						goto invalid_option;
@@ -1242,6 +1244,10 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 		break;
 	case 'r':
 		switch (cmd[1]) {
+		case 'a': /* raflag */
+			FULLCHECK("raflag");
+			lookup->raflag = state;
+			break;
 		case 'd': /* rdflag */
 			FULLCHECK("rdflag");
 			lookup->recurse = state;
@@ -1385,10 +1391,20 @@ plus_option(const char *option, isc_boolean_t is_batchfile,
 	case 't':
 		switch (cmd[1]) {
 		case 'c': /* tcp */
-			FULLCHECK("tcp");
-			if (!is_batchfile) {
-				lookup->tcp_mode = state;
-				lookup->tcp_mode_set = ISC_TRUE;
+			switch (cmd[2]) {
+			case 'f':
+				FULLCHECK("tcflag");
+				lookup->tcflag = state;
+				break;
+			case 'p':
+				FULLCHECK("tcp");
+				if (!is_batchfile) {
+					lookup->tcp_mode = state;
+					lookup->tcp_mode_set = ISC_TRUE;
+				}
+				break;
+			default:
+				goto invalid_option;
 			}
 			break;
 		case 'i': /* timeout */
@@ -1524,7 +1540,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	    isc_boolean_t config_only, int argc, char **argv,
 	    isc_boolean_t *firstarg)
 {
-	char opt, *value, *ptr, *ptr2, *ptr3;
+	char opt, *value, *ptr, *ptr2, *ptr3, *last;
 	isc_result_t result;
 	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
@@ -1738,15 +1754,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		ptr = next_token(&value, ":");	/* hmac type or name */
-		if (ptr == NULL) {
+		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
 		}
-		ptr2 = next_token(&value, ":");	/* name or secret */
-		if (ptr2 == NULL)
+		if ((ptr2 = strtok_r(NULL, ":", &last)) == NULL) {	/* name or secret */
 			usage();
-		ptr3 = next_token(&value, ":"); /* secret or NULL */
-		if (ptr3 != NULL) {
+		}
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -1758,6 +1772,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 #endif
 			digestbits = 0;
 		}
+		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
 		return (value_from_next);
@@ -1841,6 +1856,22 @@ preparse_args(int argc, char **argv) {
 	}
 }

+static int
+split_batchline(char *batchline, char **bargv, int len, const char *msg) {
+	int bargc;
+	char *last = NULL;
+
+	REQUIRE(batchline != NULL);
+
+	for (bargc = 1, bargv[bargc] = strtok_r(batchline, " \t\r\n", &last);
+	     bargc < len && bargv[bargc];
+	     bargv[++bargc] = strtok_r(NULL,  " \t\r\n", &last))
+	{
+		debug("%s %d: %s", msg, bargc, bargv[bargc]);
+	}
+	return (bargc);
+}
+
 static void
 parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv)
@@ -1859,10 +1890,8 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	char **rv;
 #ifndef NOPOSIX
 	char *homedir;
-	char rcfile[256];
+	char rcfile[PATH_MAX];
 #endif
-	char *input;
-	int i;
 	isc_boolean_t need_clone = ISC_TRUE;

 	/*
@@ -1894,30 +1923,21 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
-			if (n < sizeof(rcfile))
+			if (n < sizeof(rcfile)) {
 				batchfp = fopen(rcfile, "r");
+			}
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline),
-				     batchfp) != 0) {
+				     batchfp) != 0)
+			{
 				debug("config line %s", batchline);
-				bargc = 1;
-				input = batchline;
-				bargv[bargc] = next_token(&input, " \t\r\n");
-				while ((bargc < 62) && (bargv[bargc] != NULL)) {
-					bargc++;
-					bargv[bargc] =
-						next_token(&input, " \t\r\n");
-				}
-
+				bargc = split_batchline(batchline, bargv, 62,
+						        ".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
-
-				for(i = 0; i < bargc; i++)
-					debug(".digrc argv %d: %s",
-					      i, bargv[i]);
-				parse_args(ISC_TRUE, ISC_TRUE, bargc,
-					   (char **)bargv);
+				parse_args(ISC_TRUE, ISC_TRUE,
+					   bargc, (char **)bargv);
 			}
 			fclose(batchfp);
 		}
@@ -1928,8 +1948,9 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* Processing '-f batchfile'. */
 		lookup = clone_lookup(default_lookup, ISC_TRUE);
 		need_clone = ISC_FALSE;
-	} else
+	} else {
 		lookup = default_lookup;
+	}

 	rc = argc;
 	rv = argv;
@@ -2096,23 +2117,14 @@ parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		/* XXX Remove code dup from shutdown code */
 	next_line:
 		if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
-			bargc = 1;
 			debug("batch line %s", batchline);
-			if (batchline[0] == '\r' || batchline[0] == '\n'
-			    || batchline[0] == '#' || batchline[0] == ';')
+			if (batchline[0] == '\r' || batchline[0] == '\n' ||
+			    batchline[0] == '#' || batchline[0] == ';')
 				goto next_line;
-			input = batchline;
-			bargv[bargc] = next_token(&input, " \t\r\n");
-			while ((bargc < 14) && (bargv[bargc] != NULL)) {
-				bargc++;
-				bargv[bargc] = next_token(&input, " \t\r\n");
-			}
-
+			bargc = split_batchline(batchline, bargv, 14,
+						"batch argv");
 			bargv[0] = argv[0];
 			argv0 = argv[0];
-
-			for(i = 0; i < bargc; i++)
-				debug("batch argv %d: %s", i, bargv[i]);
 			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 			return;
 		}
@@ -2151,8 +2163,6 @@ query_finished(void) {
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[16];
-	char *input;
-	int i;

 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -2170,18 +2180,8 @@ query_finished(void) {

 	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
 		debug("batch line %s", batchline);
-		bargc = 1;
-		input = batchline;
-		bargv[bargc] = next_token(&input, " \t\r\n");
-		while ((bargc < 14) && (bargv[bargc] != NULL)) {
-			bargc++;
-			bargv[bargc] = next_token(&input, " \t\r\n");
-		}
-
+		bargc = split_batchline(batchline, bargv, 14, "batch argv");
 		bargv[0] = argv0;
-
-		for(i = 0; i < bargc; i++)
-			debug("batch argv %d: %s", i, bargv[i]);
 		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
@@ -895,7 +895,8 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone.
+	      the zone. Addresses of servers that that did not
+	      respond are also printed.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -959,6 +960,17 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]raflag</option></term>
+	  <listitem>
+	    <para>
+	      Set [do not set] the RA (Recursion Available) bit in
+	      the query. The default is +noraflag. This bit should
+	      be ignored by the server for QUERY.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]rdflag</option></term>
 	  <listitem>
@@ -1102,6 +1114,17 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]tcflag</option></term>
+	  <listitem>
+	    <para>
+	      Set [do not set] the TC (TrunCation) bit in the query.
+	      The default is +notcflag.  This bit should be ignored
+	      by the server for QUERY.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]tcp</option></term>
 	  <listitem>
@@ -710,7 +710,8 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone.
+	      the zone. Addresses of servers that that did not
+	      respond are also printed.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
@@ -757,6 +758,14 @@
 	      the question section as a comment.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]raflag</code></span></dt>
+<dd>
+	    <p>
+	      Set [do not set] the RA (Recursion Available) bit in
+	      the query. The default is +noraflag. This bit should
+	      be ignored by the server for QUERY.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]rdflag</code></span></dt>
 <dd>
 	    <p>
@@ -867,6 +876,14 @@
 	      this query.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]tcflag</code></span></dt>
+<dd>
+	    <p>
+	      Set [do not set] the TC (TrunCation) bit in the query.
+	      The default is +notcflag.  This bit should be ignored
+	      by the server for QUERY.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd>
 	    <p>
@@ -31,12 +31,6 @@
 #endif

 #ifdef WITH_IDN_SUPPORT
-#ifdef WITH_IDNKIT
-#include <idn/result.h>
-#include <idn/log.h>
-#include <idn/resconf.h>
-#include <idn/api.h>
-#endif

 #ifdef WITH_LIBIDN2
 #include <idn2.h>
@@ -63,7 +57,6 @@

 #include <isc/app.h>
 #include <isc/base64.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hex.h>
 #include <isc/lang.h>
@@ -93,7 +86,7 @@

 #include <dig/dig.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -157,9 +150,6 @@ static isc_result_t output_filter(isc_buffer_t *buffer,
 		isc_boolean_t absolute);
 #define MAXDLEN 256

-#ifdef WITH_IDNKIT
-int idnoptions = 0;
-#endif
 #endif /* WITH_IDN_OUT_SUPPORT */

 isc_socket_t *keep = NULL;
@@ -187,7 +177,6 @@ unsigned int digestbits = 0;
 isc_buffer_t *namebuf = NULL;
 dns_tsigkey_t *tsigkey = NULL;
 isc_boolean_t validated = ISC_TRUE;
-isc_entropy_t *entp = NULL;
 isc_mempool_t *commctx = NULL;
 isc_boolean_t debugging = ISC_FALSE;
 isc_boolean_t debugtiming = ISC_FALSE;
@@ -251,18 +240,6 @@ check_next_lookup(dig_lookup_t *lookup);
 static isc_boolean_t
 next_origin(dig_lookup_t *oldlookup);

-char *
-next_token(char **stringp, const char *delim) {
-	char *res;
-
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
-}
-
 static int
 count_dots(char *string) {
 	char *s;
@@ -363,7 +340,7 @@ get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 		if (ip6_int)
 			options |= DNS_BYADDROPT_IPV6INT;
 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname2(&addr, options, name);
+		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -676,6 +653,8 @@ make_empty_lookup(void) {
 	looknew->aaonly = ISC_FALSE;
 	looknew->adflag = ISC_FALSE;
 	looknew->cdflag = ISC_FALSE;
+	looknew->raflag = ISC_FALSE;
+	looknew->tcflag = ISC_FALSE;
 	looknew->print_unknown_format = ISC_FALSE;
 	looknew->zflag = ISC_FALSE;
 	looknew->ns_search_only = ISC_FALSE;
@@ -818,6 +797,8 @@ clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers) {
 	looknew->aaonly = lookold->aaonly;
 	looknew->adflag = lookold->adflag;
 	looknew->cdflag = lookold->cdflag;
+	looknew->raflag = lookold->raflag;
+	looknew->tcflag = lookold->tcflag;
 	looknew->print_unknown_format = lookold->print_unknown_format;
 	looknew->zflag = lookold->zflag;
 	looknew->ns_search_only = lookold->ns_search_only;
@@ -1333,10 +1314,8 @@ setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only) {
 		setup_file_key();
 	else if (keysecret[0] != 0)
 		setup_text_key();
-	result = isc_entropy_getdata(entp, cookie_secret,
-				     sizeof(cookie_secret), NULL, 0);
-	if (result != ISC_R_SUCCESS)
-		fatal("unable to generate cookie secret");
+
+	isc_random_buf(cookie_secret, sizeof(cookie_secret));
 }

 /*%
@@ -1361,7 +1340,7 @@ setup_libs(void) {

 	debug("setup_libs()");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1405,10 +1384,7 @@ setup_libs(void) {
 	result = isc_socketmgr_create(mctx, &socketmgr);
 	check_result(result, "isc_socketmgr_create");

-	result = isc_entropy_create(mctx, &entp);
-	check_result(result, "isc_entropy_create");
-
-	result = dst_lib_init(mctx, entp, 0);
+	result = dst_lib_init(mctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = ISC_TRUE;

@@ -1894,7 +1870,7 @@ followup_lookup(dns_message_t *msg, dig_query_t *query, dns_section_t section)
 		     srv != NULL;
 		     srv = ISC_LIST_HEAD(lookup->my_server_list)) {
 			INSIST(i > 0);
-			isc_random_get(&j);
+			j = isc_random();
 			j %= i;
 			next = ISC_LIST_NEXT(srv, link);
 			while (j-- > 0 && next != NULL) {
@@ -2222,7 +2198,7 @@ setup_lookup(dig_lookup_t *lookup) {
 	dighost_trying(store, lookup);
 	INSIST(dns_name_isabsolute(lookup->name));

-	isc_random_get(&id);
+	id = isc_random();
 	lookup->sendmsg->id = (unsigned short)id & 0xFFFF;
 	lookup->sendmsg->opcode = lookup->opcode;
 	lookup->msgcounter = 0;
@@ -2256,6 +2232,16 @@ setup_lookup(dig_lookup_t *lookup) {
 		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_CD;
 	}

+	if (lookup->raflag) {
+		debug("RA query");
+		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_RA;
+	}
+
+	if (lookup->tcflag) {
+		debug("TC query");
+		lookup->sendmsg->flags |= DNS_MESSAGEFLAG_TC;
+	}
+
 	if (lookup->zflag) {
 		debug("Z query");
 		lookup->sendmsg->flags |= 0x0040U;
@@ -2990,7 +2976,15 @@ connect_timeout(isc_task_t *task, isc_event_t *event) {
 			check_next_lookup(l);
 		}
 	} else {
-		if (!l->ns_search_only) {
+		if (l->ns_search_only) {
+			isc_netaddr_t netaddr;
+			char buf[ISC_NETADDR_FORMATSIZE];
+
+			isc_netaddr_fromsockaddr(&netaddr, &query->sockaddr);
+			isc_netaddr_format(&netaddr, buf, sizeof(buf));
+
+			printf(";; no response from %s\n", buf);
+		} else {
 			fputs(l->cmdline, stdout);
 			printf(";; connection timed out; no servers could be "
 			       "reached\n");
@@ -4216,10 +4210,6 @@ destroy_libs(void) {
 		dst_lib_destroy();
 		is_dst_up = ISC_FALSE;
 	}
-	if (entp != NULL) {
-		debug("detach from entropy");
-		isc_entropy_detach(&entp);
-	}

 	UNLOCK_LOOKUP;
 	DESTROYLOCK(&lookup_lock);
@@ -4289,54 +4279,6 @@ output_filter(isc_buffer_t *buffer, unsigned int used_org,
 #endif

 #ifdef WITH_IDN_SUPPORT
-#ifdef WITH_IDNKIT
-static void
-idnkit_check_result(idn_result_t result, const char *msg) {
-	if (result != idn_success) {
-		fatal("%s: %s", msg, idn_result_tostring(result));
-	}
-}
-
-static void
-idn_initialize(void) {
-	idn_result_t result;
-
-	/* Create configuration context. */
-	result = idn_nameinit(1);
-	idnkit_check_result(result, "idnkit api initialization failed");
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-idn_locale_to_ace(const char *from, char *to, size_t tolen) {
-	char utf8_textname[MXNAME];
-	idn_result_t result;
-
-	result = idn_encodename(IDN_LOCALCONV | IDN_DELIMMAP, from,
-				utf8_textname, sizeof(utf8_textname));
-	idnkit_check_result(result, "idnkit idn_encodename to utf8 failed");
-
-	result = idn_encodename(idnoptions | IDN_LOCALMAP | IDN_NAMEPREP |
-				IDN_IDNCONV | IDN_LENCHECK,
-				utf8_textname, to, tolen);
-	idnkit_check_result(result, "idnkit idn_encodename to idn failed");
-	return (ISC_R_SUCCESS);
-}
-
-static isc_result_t
-idn_ace_to_locale(const char *from, char *to, size_t tolen) {
-	idn_result_t result;
-
-	result = idn_decodename(IDN_DECODE_APP, from, to, tolen);
-	if (result != idn_success) {
-		debug("idnkit idn_decodename failed: %s",
-		      idn_result_tostring(result));
-		return (ISC_R_FAILURE);
-	}
-	return (ISC_R_SUCCESS);
-}
-#endif /* WITH_IDNKIT */
-
 #ifdef WITH_LIBIDN2
 static void
 idn_initialize(void) {
@@ -19,13 +19,6 @@
 #include <locale.h>
 #endif

-#ifdef WITH_IDNKIT
-#include <idn/result.h>
-#include <idn/log.h>
-#include <idn/resconf.h>
-#include <idn/api.h>
-#endif
-
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/netaddr.h>
@@ -720,9 +713,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
 			lookup->rdtypeset = ISC_TRUE;
-#ifdef WITH_IDNKIT
-			idnoptions = 0;
-#endif
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
@@ -735,13 +725,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			} else if (rdtype == dns_rdatatype_any) {
 				if (!lookup->tcp_mode_set)
 					lookup->tcp_mode = ISC_TRUE;
-#ifdef WITH_IDNKIT
-			} else if (rdtype == dns_rdatatype_a ||
-				   rdtype == dns_rdatatype_aaaa ||
-				   rdtype == dns_rdatatype_mx) {
-				idnoptions = IDN_ASCCHECK;
-				list_type = rdtype;
-#endif
 			} else
 				list_type = rdtype;
 			list_addresses = ISC_FALSE;
@@ -770,9 +753,6 @@ parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = dns_rdatatype_any;
-#ifdef WITH_IDNKIT
-			idnoptions = 0;
-#endif
 			list_type = dns_rdatatype_any;
 			list_addresses = ISC_FALSE;
 			lookup->rdtypeset = ISC_TRUE;
@@ -884,9 +864,6 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);

 	fatalexit = 1;
-#ifdef WITH_IDNKIT
-	idnoptions = IDN_ASCCHECK;
-#endif

 	/* setup dighost callbacks */
 	dighost_printmessage = printmessage;
@@ -94,6 +94,8 @@ struct dig_lookup {
 		aaonly,
 		adflag,
 		cdflag,
+		raflag,
+		tcflag,
 		zflag,
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
@@ -269,9 +271,6 @@ extern char *progname;
 extern int tries;
 extern int fatalexit;
 extern isc_boolean_t verbose;
-#ifdef WITH_IDNKIT
-extern int idnoptions;
-#endif

 /*
 * Routines in dighost.c.
@@ -372,9 +371,6 @@ destroy_libs(void);
 void
 set_search_domain(char *domain);

-char *
-next_token(char **stringp, const char *delim);
-
 /*
 * Routines to be defined in dig.c, host.c, and nslookup.c. and
 * then assigned to the appropriate function pointer
@@ -813,12 +813,12 @@ addlookup(char *opt) {

 static void
 do_next_command(char *input) {
-	char *ptr, *arg;
+	char *ptr, *arg, *last;

-	ptr = next_token(&input, " \t\r\n");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(input, " \t\r\n", &last)) == NULL) {
 		return;
-	arg = next_token(&input, " \t\r\n");
+	}
+	arg = strtok_r(NULL, " \t\r\n", &last);
 	if ((strcasecmp(ptr, "set") == 0) &&
 	    (arg != NULL))
 		setoption(arg);
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@

 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+		-DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -23,7 +23,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -54,7 +53,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -72,7 +71,6 @@ int verbose;
 */
 static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;

 /*
 * The domain we are working on
@@ -253,8 +251,8 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load3(*dbp, filename,
-			      dns_masterformat_text, DNS_MASTER_HINT);
+	result = dns_db_load(*dbp, filename,
+			     dns_masterformat_text, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		fatal("can't load %s: %s", filename,
 		      isc_result_totext(result));
@@ -378,9 +376,9 @@ formatset(dns_rdataset_t *rdataset) {
 	 * which just separates fields with spaces. The huge tab stop width
 	 * eliminates any tab characters.
 	 */
-	result = dns_master_stylecreate2(&style, styleflags,
-					 0, 0, 0, 0, 0, 1000000, 0,
-					 mctx);
+	result = dns_master_stylecreate(&style, styleflags,
+					0, 0, 0, 0, 0, 1000000, 0,
+					mctx);
 	check_result(result, "dns_master_stylecreate2 failed");

 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
@@ -670,8 +668,11 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 			}

 			result = dns_dnssec_verify(name, rdataset, ki->dst,
-						   ISC_FALSE, mctx, &sigrdata);
-			if (result != ISC_R_SUCCESS) {
+						   ISC_FALSE, 0, mctx,
+						   &sigrdata, NULL);
+
+			if (result != ISC_R_SUCCESS &&
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1, "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
 					 sig.keyid, isc_result_totext(result));
@@ -1146,7 +1147,7 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -1230,20 +1231,11 @@ main(int argc, char *argv[]) {

 	setup_logging(mctx, &lctx);

-	if (ectx == NULL) {
-		setup_entropy(mctx, NULL, &ectx);
-	}
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize hash");
-	}
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
-	isc_entropy_stopcallbacksources(ectx);

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1393,8 +1385,6 @@ main(int argc, char *argv[]) {
 	free_all_sets();
 	cleanup_logging(&lctx);
 	dst_lib_destroy();
-	isc_hash_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -17,7 +17,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -42,7 +41,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -113,7 +112,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename);
+		result = dns_db_load(db, filename, dns_masterformat_text, 0);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -359,7 +358,6 @@ main(int argc, char **argv) {
 	isc_boolean_t	showall = ISC_FALSE;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;

@@ -372,7 +370,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -475,17 +473,10 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -546,9 +537,7 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -17,7 +17,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -42,7 +41,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -118,8 +117,8 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load3(db, filename, dns_masterformat_text,
-				      DNS_MASTER_NOTTL);
+		result = dns_db_load(db, filename, dns_masterformat_text,
+				     DNS_MASTER_NOTTL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
@@ -297,7 +296,6 @@ main(int argc, char **argv) {
 	int		ch;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 	isc_stdtime_t   now;
@@ -312,7 +310,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -404,17 +402,10 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -457,9 +448,7 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -18,7 +18,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/print.h>
@@ -38,7 +37,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -70,7 +69,7 @@ usage(void) {
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -146,7 +145,6 @@ main(int argc, char **argv) {
 	char		filename[255];
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char		*label = NULL;
@@ -175,7 +173,7 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -347,10 +345,7 @@ main(int argc, char **argv) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	ret = dst_lib_init2(mctx, ectx, engine,
-			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -612,13 +607,12 @@ main(int argc, char **argv) {

 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 				"pkcs11",
 #else
 				engine,
 #endif
 				label, NULL, mctx, &key);
-	isc_entropy_stopcallbacksources(ectx);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -737,7 +731,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
-	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -66,19 +66,19 @@ must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA51
 \fB\-T KEY\fR
 option as well\&.
 .sp
-TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
-\fB\-T KEY\fR\&. Note, however, that
-\fBtsig\-keygen\fR
-produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
-\fBdnssec\-keygen\fR, and will be removed in a future release\&.
-.sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
 option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
-As of BIND 9\&.12\&.0, this option is mandatory except when using the
+This parameter
+\fImust\fR
+be specified except when using the
 \fB\-S\fR
-option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
+option, which copies the algorithm from the predecessor key\&.
+.sp
+In prior releases, HMAC algorithms could be generated for use as TSIG keys, but that feature has been removed as of BIND 9\&.13\&.0\&. Use
+\fBtsig\-keygen\fR
+to generate TSIG keys\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -178,21 +178,6 @@ stderr
 indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that a random number has been found which passed an initial sieve test; \*(Aq+\*(Aq means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies a source of randomness\&. Normally, when generating DNSSEC keys, this option has no effect; the random number generation function provided by the cryptographic library will be used\&.
-.sp
-If that behavior is disabled at compile time, however, the specified file will be used as entropy source for key generation\&.
-randomdev
-is the name of a character device or file containing random data to be used\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.sp
-The default is
-/dev/random
-if the operating system provides it or an equivalent device; if not, the default source of randomness is keyboard input\&.
-.RE
-.PP
 \-S \fIkey\fR
 .RS 4
 Create a new key which is an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the existing key\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&.
@@ -33,7 +33,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/region.h>
@@ -53,7 +52,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -82,10 +81,7 @@ usage(void) {
 				" | NSEC3DSA |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448 | DH |\n");
-	fprintf(stderr, "        HMAC-MD5 | HMAC-SHA1 | HMAC-SHA224 | "
-				"HMAC-SHA256 | \n");
-	fprintf(stderr, "        HMAC-SHA384 | HMAC-SHA512\n");
+	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
 	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
@@ -102,12 +98,6 @@ usage(void) {
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
 	fprintf(stderr, "        ED448:\tignored\n");
-	fprintf(stderr, "        HMAC-MD5:\t[1..512]\n");
-	fprintf(stderr, "        HMAC-SHA1:\t[1..160]\n");
-	fprintf(stderr, "        HMAC-SHA224:\t[1..224]\n");
-	fprintf(stderr, "        HMAC-SHA256:\t[1..256]\n");
-	fprintf(stderr, "        HMAC-SHA384:\t[1..384]\n");
-	fprintf(stderr, "        HMAC-SHA512:\t[1..512]\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
@@ -116,7 +106,7 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -130,7 +120,6 @@ usage(void) {
 			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
-	fprintf(stderr, "    -r <randomdev>: a file containing random data\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
@@ -227,7 +216,6 @@ main(int argc, char **argv) {
 	dst_key_t	*prevkey = NULL;
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 #ifdef USE_PKCS11
 	const char	*engine = PKCS11_ENGINE;
 #else
@@ -259,7 +247,7 @@ main(int argc, char **argv) {
 	if (argc == 1)
 		usage();

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -374,7 +362,8 @@ main(int argc, char **argv) {
 			quiet = ISC_TRUE;
 			break;
 		case 'r':
-			setup_entropy(mctx, isc_commandline_argument, &ectx);
+			fatal("The -r option has been deprecated.\n"
+			      "System random data is always used.\n");
 			break;
 		case 's':
 			signatory = strtol(isc_commandline_argument,
@@ -503,10 +492,7 @@ main(int argc, char **argv) {
 	if (!isatty(0))
 		quiet = ISC_TRUE;

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	ret = dst_lib_init2(mctx, ectx, engine,
-			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -544,8 +530,6 @@ main(int argc, char **argv) {
 					"\"-a RSAMD5\"\n");
 			INSIST(freeit == NULL);
 			return (1);
-		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
-			alg = DST_ALG_HMACMD5;
 #else
 			fprintf(stderr,
 				"The use of RSA (RSAMD5) was disabled\n");
@@ -555,47 +539,26 @@ main(int argc, char **argv) {
 			fprintf(stderr, "The use of RSAMD5 was disabled\n");
 			INSIST(freeit == NULL);
 			return (1);
-		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
-			fprintf(stderr,
-				"The use of HMAC-MD5 was disabled\n");
-			return (1);
 #endif
-		} else if (strcasecmp(algname, "HMAC-SHA1") == 0)
-			alg = DST_ALG_HMACSHA1;
-		else if (strcasecmp(algname, "HMAC-SHA224") == 0)
-			alg = DST_ALG_HMACSHA224;
-		else if (strcasecmp(algname, "HMAC-SHA256") == 0)
-			alg = DST_ALG_HMACSHA256;
-		else if (strcasecmp(algname, "HMAC-SHA384") == 0)
-			alg = DST_ALG_HMACSHA384;
-		else if (strcasecmp(algname, "HMAC-SHA512") == 0)
-			alg = DST_ALG_HMACSHA512;
-		else {
+		} else {
 			r.base = algname;
 			r.length = strlen(algname);
 			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS)
+			if (ret != ISC_R_SUCCESS) {
 				fatal("unknown algorithm %s", algname);
-			if (alg == DST_ALG_DH)
+			}
+			if (alg == DST_ALG_DH) {
 				options |= DST_TYPE_KEY;
+			}
 		}

 #ifdef PK11_MD5_DISABLE
-		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
+		INSIST((alg != DNS_KEYALG_RSAMD5));
 #endif

-
-		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
-		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
-		{
-			fprintf(stderr,
-				"Use of dnssec-keygen for HMAC keys is "
-				"deprecated: use tsig-keygen\n");
-		}
-
-		if (!dst_algorithm_supported(alg))
+		if (!dst_algorithm_supported(alg)) {
 			fatal("unsupported algorithm: %d", alg);
+		}

 		if (use_nsec3) {
 			switch (alg) {
@@ -622,20 +585,20 @@ main(int argc, char **argv) {
 		}

 		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
-			if (strcasecmp(type, "NOAUTH") == 0)
+			if (strcasecmp(type, "NOAUTH") == 0) {
 				flags |= DNS_KEYTYPE_NOAUTH;
-			else if (strcasecmp(type, "NOCONF") == 0)
+			} else if (strcasecmp(type, "NOCONF") == 0) {
 				flags |= DNS_KEYTYPE_NOCONF;
-			else if (strcasecmp(type, "NOAUTHCONF") == 0) {
+			} else if (strcasecmp(type, "NOAUTHCONF") == 0) {
 				flags |= (DNS_KEYTYPE_NOAUTH |
 					  DNS_KEYTYPE_NOCONF);
 				if (size < 0)
 					size = 0;
-			}
-			else if (strcasecmp(type, "AUTHCONF") == 0)
+			} else if (strcasecmp(type, "AUTHCONF") == 0) {
 				/* nothing */;
-			else
+			} else {
 				fatal("invalid type %s", type);
+			}
 		}

 		if (size < 0) {
@@ -805,78 +768,18 @@ main(int argc, char **argv) {
 	case DST_ALG_ED448:
 		size = 456;
 		break;
-	case DST_ALG_HMACMD5:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 512)
-			fatal("HMAC-MD5 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 80 || dbits > 128))
-			fatal("HMAC-MD5 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-MD5 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA1:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 160)
-			fatal("HMAC-SHA1 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 80 || dbits > 160))
-			fatal("HMAC-SHA1 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA1 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA224:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 224)
-			fatal("HMAC-SHA224 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 112 || dbits > 224))
-			fatal("HMAC-SHA224 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA224 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA256:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 256)
-			fatal("HMAC-SHA256 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 128 || dbits > 256))
-			fatal("HMAC-SHA256 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA256 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA384:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 384)
-			fatal("HMAC-384 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 192 || dbits > 384))
-			fatal("HMAC-SHA384 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA384 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA512:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 512)
-			fatal("HMAC-SHA512 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 256 || dbits > 512))
-			fatal("HMAC-SHA512 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA512 digest bits %d not divisible by 8",
-			      dbits);
-		break;
 	}

 	if (alg != DNS_KEYALG_DH && generator != 0)
 		fatal("specified DH generator for a non-DH key");

 	if (nametype == NULL) {
-		if ((options & DST_TYPE_KEY) != 0) /* KEY / HMAC */
+		if ((options & DST_TYPE_KEY) != 0) /* KEY */
 			fatal("no nametype specified");
 		flags |= DNS_KEYOWNER_ZONE;	/* DNSKEY */
 	} else if (strcasecmp(nametype, "zone") == 0)
 		flags |= DNS_KEYOWNER_ZONE;
-	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY / HMAC */
+	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
 			 strcasecmp(nametype, "entity") == 0)
 			flags |= DNS_KEYOWNER_ENTITY;
@@ -892,7 +795,7 @@ main(int argc, char **argv) {
 	if (directory == NULL)
 		directory = ".";

-	if ((options & DST_TYPE_KEY) != 0)  /* KEY / HMAC */
+	if ((options & DST_TYPE_KEY) != 0)  /* KEY */
 		flags |= signatory;
 	else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
 		flags |= kskflag;
@@ -913,12 +816,11 @@ main(int argc, char **argv) {
 	}

 	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    (alg == DNS_KEYALG_DH || alg == DST_ALG_HMACMD5 ||
-	     alg == DST_ALG_HMACSHA1 || alg == DST_ALG_HMACSHA224 ||
-	     alg == DST_ALG_HMACSHA256 || alg == DST_ALG_HMACSHA384 ||
-	     alg == DST_ALG_HMACSHA512))
+	    alg == DNS_KEYALG_DH)
+	{
 		fatal("a key with algorithm '%s' cannot be a zone key",
 		      algname);
+	}

 	switch(alg) {
 	case DNS_KEYALG_RSAMD5:
@@ -941,15 +843,6 @@ main(int argc, char **argv) {
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
 		show_progress = ISC_TRUE;
-		/* fall through */
-
-	case DST_ALG_HMACMD5:
-	case DST_ALG_HMACSHA1:
-	case DST_ALG_HMACSHA224:
-	case DST_ALG_HMACSHA256:
-	case DST_ALG_HMACSHA384:
-	case DST_ALG_HMACSHA512:
-		param = 0;
 		break;
 	}

@@ -963,19 +856,17 @@ main(int argc, char **argv) {

 		if (!quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-			ret = dst_key_generate2(name, alg, size, param, flags,
-						protocol, rdclass, mctx, &key,
-						&progress);
+			ret = dst_key_generate(name, alg, size, param, flags,
+					       protocol, rdclass, mctx, &key,
+					       &progress);
 			putc('\n', stderr);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate2(name, alg, size, param, flags,
-						protocol, rdclass, mctx, &key,
-						NULL);
+			ret = dst_key_generate(name, alg, size, param, flags,
+					       protocol, rdclass, mctx, &key,
+					       NULL);
 		}

-		isc_entropy_stopcallbacksources(ectx);
-
 		if (ret != ISC_R_SUCCESS) {
 			char namestr[DNS_NAME_FORMATSIZE];
 			char algstr[DNS_SECALG_FORMATSIZE];
@@ -1128,7 +1019,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
-	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -81,7 +81,6 @@
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -130,16 +129,6 @@
 	    his value will automatically set the <option>-T KEY</option>
 	    option as well.
 	  </para>
-	  <para>
-	    TSIG keys can also be generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <option>-T KEY</option>. Note,
-	    however, that <command>tsig-keygen</command> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <command>dnssec-keygen</command>, and will be removed in a
-	    future release.
-	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -148,10 +137,15 @@
 	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
-	    generated keys was RSASHA1.
+	    This parameter <emphasis>must</emphasis> be specified except
+	    when using the <option>-S</option> option, which copies the
+	    algorithm from the predecessor key.
+	  </para>
+	  <para>
+	    In prior releases, HMAC algorithms could be generated for
+	    use as TSIG keys, but that feature has been removed as of
+	    BIND 9.13.0. Use <command>tsig-keygen</command> to generate
+	    TSIG keys.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -354,31 +348,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies a source of randomness.  Normally, when generating
-	    DNSSEC keys, this option has no effect; the random number
-	    generation function provided by the cryptographic library will
-	    be used.
-	  </para>
-	  <para>
-	    If that behavior is disabled at compile time, however,
-	    the specified file will be used as entropy source
-	    for key generation.  <filename>randomdev</filename> is
-	    the name of a character device or file containing random
-	    data to be used.  The special value <filename>keyboard</filename>
-	    indicates that keyboard input should be used.
-	  </para>
-	  <para>
-	    The default is <filename>/dev/random</filename> if the
-	    operating system provides it or an equivalent device;
-	    if not, the default source of randomness is keyboard input.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-S <replaceable class="parameter">key</replaceable></term>
 	<listitem>
@@ -57,7 +57,6 @@
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
       [<code class="option">-q</code>]
       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
@@ -107,16 +106,6 @@
 	    his value will automatically set the <code class="option">-T KEY</code>
 	    option as well.
 	  </p>
-	  <p>
-	    TSIG keys can also be generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <code class="option">-T KEY</code>. Note,
-	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
-	    future release.
-	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -125,10 +114,15 @@
 	    or NSEC3DSA will be used instead.
 	  </p>
 	  <p>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
-	    generated keys was RSASHA1.
+	    This parameter <span class="emphasis"><em>must</em></span> be specified except
+	    when using the <code class="option">-S</code> option, which copies the
+	    algorithm from the predecessor key.
+	  </p>
+	  <p>
+	    In prior releases, HMAC algorithms could be generated for
+	    use as TSIG keys, but that feature has been removed as of
+	    BIND 9.13.0. Use <span class="command"><strong>tsig-keygen</strong></span> to generate
+	    TSIG keys.
 	  </p>
 	</dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -284,28 +278,6 @@
 	    a satisfactory key.
 	  </p>
 	</dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies a source of randomness.  Normally, when generating
-	    DNSSEC keys, this option has no effect; the random number
-	    generation function provided by the cryptographic library will
-	    be used.
-	  </p>
-	  <p>
-	    If that behavior is disabled at compile time, however,
-	    the specified file will be used as entropy source
-	    for key generation.  <code class="filename">randomdev</code> is
-	    the name of a character device or file containing random
-	    data to be used.  The special value <code class="filename">keyboard</code>
-	    indicates that keyboard input should be used.
-	  </p>
-	  <p>
-	    The default is <code class="filename">/dev/random</code> if the
-	    operating system provides it or an equivalent device;
-	    if not, the default source of randomness is keyboard input.
-	  </p>
-	</dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd>
 	  <p>
@@ -18,7 +18,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -31,7 +30,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -50,7 +49,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -87,7 +86,6 @@ main(int argc, char **argv) {
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
 	int ch;
-	isc_entropy_t *ectx = NULL;
 	dst_key_t *key = NULL;
 	isc_uint32_t flags;
 	isc_buffer_t buf;
@@ -102,7 +100,7 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -180,17 +178,10 @@ main(int argc, char **argv) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init2(mctx, ectx, engine,
-			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("Could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	result = dst_key_fromnamedfile(filename, dir,
 				       DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
@@ -271,9 +262,7 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	if (dir != NULL)
@@ -20,7 +20,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -34,7 +33,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -54,7 +53,7 @@ usage(void) {
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -139,7 +138,6 @@ main(int argc, char **argv) {
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
-	isc_entropy_t	*ectx = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
@@ -180,7 +178,7 @@ main(int argc, char **argv) {

 	setup_logging(mctx, &log);

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -378,17 +376,10 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init2(mctx, ectx, engine,
-			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("Could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	if (predecessor != NULL) {
 		int major, minor;
@@ -672,9 +663,7 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	cleanup_logging(&log);
@@ -39,7 +39,7 @@
 dnssec-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-signzone\fR\ 'u
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -278,11 +278,6 @@ specifies the format version of the raw zone file: if N is 0, the raw file can b
 \fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher; the default is 1\&.
 .RE
 .PP
-\-p
-.RS 4
-Use pseudo\-random data when signing the zone\&. This is faster, but less secure, than using real random data\&. This option may be useful when signing large zones or when the entropy source is limited\&.
-.RE
-.PP
 \-P
 .RS 4
 Disable post sign verification tests\&.
@@ -311,17 +306,6 @@ This option is similar to
 to signatures from keys that are no longer published\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.2 ("Double Signature Zone Signing Key Rollover")\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies the source of randomness\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-S
 .RS 4
 Smart signing: Instructs
@@ -34,7 +34,6 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -80,7 +79,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -130,7 +129,6 @@ static int jitter = 0;
 static isc_boolean_t tryverify = ISC_FALSE;
 static isc_boolean_t printstats = ISC_FALSE;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 static dns_ttl_t zone_soa_min_ttl;
 static dns_ttl_t soa_ttl;
 static FILE *outfp = NULL;
@@ -191,19 +189,6 @@ static dns_ttl_t maxttl = 0;
 static void
 sign(isc_task_t *task, isc_event_t *event);

-/*%
- * Store a copy of 'name' in 'fzonecut' and return a pointer to that copy.
- */
-static dns_name_t *
-savezonecut(dns_fixedname_t *fzonecut, dns_name_t *name) {
-	dns_name_t *result;
-
-	result = dns_fixedname_initname(fzonecut);
-	dns_name_copy(name, result, NULL);
-
-	return (result);
-}
-
 static void
 dumpnode(dns_name_t *name, dns_dbnode_t *node) {
 	dns_rdataset_t rds;
@@ -295,11 +280,10 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,
 	else
 		expiry = endtime;

-	jendtime = (jitter != 0) ? isc_random_jitter(expiry, jitter) : expiry;
+	jendtime = (jitter != 0) ? expiry - isc_random_uniform(jitter) : expiry;
 	isc_buffer_init(&b, array, sizeof(array));
 	result = dns_dnssec_sign(name, rdataset, key, &starttime, &jendtime,
 				 mctx, &b, &trdata);
-	isc_entropy_stopcallbacksources(ectx);
 	if (result != ISC_R_SUCCESS) {
 		fatal("dnskey '%s' failed to sign data: %s",
 		      keystr, isc_result_totext(result));
@@ -308,8 +292,8 @@ signwithkey(dns_name_t *name, dns_rdataset_t *rdataset, dst_key_t *key,

 	if (tryverify) {
 		result = dns_dnssec_verify(name, rdataset, key,
-					   ISC_TRUE, mctx, &trdata);
-		if (result == ISC_R_SUCCESS) {
+					   ISC_TRUE, 0, mctx, &trdata, NULL);
+		if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 			vbprintf(3, "\tsignature verified\n");
 			INCSTAT(nverified);
 		} else {
@@ -469,8 +453,9 @@ setverifies(dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	    dns_rdata_t *rrsig)
 {
 	isc_result_t result;
-	result = dns_dnssec_verify(name, set, key, ISC_FALSE, mctx, rrsig);
-	if (result == ISC_R_SUCCESS) {
+	result = dns_dnssec_verify(name, set, key, ISC_FALSE, 0, mctx, rrsig,
+				   NULL);
+	if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 		INCSTAT(nverified);
 		return (ISC_TRUE);
 	} else {
@@ -917,7 +902,7 @@ opendb(const char *prefix, dns_name_t *name, dns_rdataclass_t rdclass,
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load3(*dbp, filename, inputformat, DNS_MASTER_HINT);
+	result = dns_db_load(*dbp, filename, inputformat, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		dns_db_detach(dbp);
 }
@@ -1500,19 +1485,14 @@ assignwork(isc_task_t *task, isc_task_t *worker) {
 			if (dns_name_issubdomain(name, gorigin) &&
 			    (zonecut == NULL ||
 			     !dns_name_issubdomain(name, zonecut))) {
-				if (is_delegation(gdb, gversion, gorigin,
-						  name, node, NULL))
-				{
-					zonecut = savezonecut(&fzonecut, name);
+				if (is_delegation(gdb, gversion, gorigin, name, node, NULL)) {
+					zonecut = dns_fixedname_initname(&fzonecut);
+					dns_name_copy(name, zonecut, NULL);
 					if (!OPTOUT(nsec3flags) ||
 					    secure(name, node))
 						found = ISC_TRUE;
-				} else if (has_dname(gdb, gversion, node)) {
-					zonecut = savezonecut(&fzonecut, name);
+				} else
 					found = ISC_TRUE;
-				} else {
-					found = ISC_TRUE;
-				}
 			}
 		}

@@ -1751,6 +1731,7 @@ nsecify(void) {
 	dns_rdataset_init(&rdataset);
 	name = dns_fixedname_initname(&fname);
 	nextname = dns_fixedname_initname(&fnextname);
+	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;

 	/*
@@ -1812,12 +1793,11 @@ nsecify(void) {
 		}

 		if (is_delegation(gdb, gversion, gorigin, name, node, &nsttl)) {
-			zonecut = savezonecut(&fzonecut, name);
+			zonecut = dns_fixedname_name(&fzonecut);
+			dns_name_copy(name, zonecut, NULL);
 			remove_sigs(node, ISC_TRUE, 0);
 			if (generateds)
 				add_ds(name, node, nsttl);
-		} else if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
 		}

 		result = dns_dbiterator_next(dbiter);
@@ -2224,6 +2204,7 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 	dns_rdataset_init(&rdataset);
 	name = dns_fixedname_initname(&fname);
 	nextname = dns_fixedname_initname(&fnextname);
+	dns_fixedname_init(&fzonecut);
 	zonecut = NULL;

 	/*
@@ -2257,10 +2238,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			(void)active_node(node);
 		}

-		if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
-		}
-
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2284,7 +2261,8 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, &nsttl))
 			{
-				zonecut = savezonecut(&fzonecut, nextname);
+				zonecut = dns_fixedname_name(&fzonecut);
+				dns_name_copy(nextname, zonecut, NULL);
 				remove_sigs(nextnode, ISC_TRUE, 0);
 				if (generateds)
 					add_ds(nextname, nextnode, nsttl);
@@ -2294,8 +2272,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
-			} else if (has_dname(gdb, gversion, nextnode)) {
-				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -2394,11 +2370,6 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			dns_db_detachnode(gdb, &node);
 			continue;
 		}
-
-		if (has_dname(gdb, gversion, node)) {
-			zonecut = savezonecut(&fzonecut, name);
-		}
-
 		result = dns_dbiterator_next(dbiter);
 		nextnode = NULL;
 		while (result == ISC_R_SUCCESS) {
@@ -2421,15 +2392,14 @@ nsec3ify(unsigned int hashalg, dns_iterations_t iterations,
 			if (is_delegation(gdb, gversion, gorigin,
 					  nextname, nextnode, NULL))
 			{
-				zonecut = savezonecut(&fzonecut, nextname);
+				zonecut = dns_fixedname_name(&fzonecut);
+				dns_name_copy(nextname, zonecut, NULL);
 				if (OPTOUT(nsec3flags) &&
 				    !secure(nextname, nextnode)) {
 					dns_db_detachnode(gdb, &nextnode);
 					result = dns_dbiterator_next(dbiter);
 					continue;
 				}
-			} else if (has_dname(gdb, gversion, nextnode)) {
-				zonecut = savezonecut(&fzonecut, nextname);
 			}
 			dns_db_detachnode(gdb, &nextnode);
 			break;
@@ -2487,7 +2457,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load2(*db, file, inputformat);
+	result = dns_db_load(*db, file, inputformat, 0);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 		fatal("failed loading zone from '%s': %s",
 		      file, isc_result_totext(result));
@@ -2653,7 +2623,7 @@ build_final_keylist(void) {
 	 * Find keys that match this zone in the key repository.
 	 */
 	result = dns_dnssec_findmatchingkeys(gorigin, directory,
-					     mctx, &matchkeys);
+					     now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND) {
 		result = ISC_R_SUCCESS;
 	}
@@ -3000,7 +2970,8 @@ writeset(const char *prefix, dns_rdatatype_t type) {
 	check_result(result, "dns_diff_apply");
 	dns_diff_clear(&diff);

-	result = dns_master_dump(mctx, db, dbversion, style, filename);
+	result = dns_master_dump(mctx, db, dbversion, style, filename,
+				 dns_masterformat_text, NULL);
 	check_result(result, "dns_master_dump");

 	isc_mem_put(mctx, filename, filenamelen);
@@ -3082,13 +3053,11 @@ usage(void) {
 	fprintf(stderr, "\t\tsoa serial format of signed zone file (keep)\n");
 	fprintf(stderr, "\t-D:\n");
 	fprintf(stderr, "\t\toutput only DNSSEC-related records\n");
-	fprintf(stderr, "\t-r randomdev:\n");
-	fprintf(stderr,	"\t\ta file containing random data\n");
 	fprintf(stderr, "\t-a:\t");
 	fprintf(stderr, "verify generated signatures\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -3097,8 +3066,6 @@ usage(void) {
 #else
 	fprintf(stderr, "\t\tname of an OpenSSL engine to use\n");
 #endif
-	fprintf(stderr, "\t-p:\t");
-	fprintf(stderr, "use pseudorandom data (faster but less secure)\n");
 	fprintf(stderr, "\t-P:\t");
 	fprintf(stderr, "disable post-sign verification\n");
 	fprintf(stderr, "\t-Q:\t");
@@ -3188,13 +3155,11 @@ main(int argc, char *argv[]) {
 	dns_dnsseckey_t *key;
 	isc_result_t result;
 	isc_log_t *log = NULL;
-	isc_boolean_t pseudorandom = ISC_FALSE;
 #ifdef USE_PKCS11
 	const char *engine = PKCS11_ENGINE;
 #else
 	const char *engine = NULL;
 #endif
-	unsigned int eflags;
 	isc_boolean_t free_output = ISC_FALSE;
 	int tempfilelen = 0;
 	dns_rdataclass_t rdclass;
@@ -3247,7 +3212,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -3423,7 +3388,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'p':
-			pseudorandom = ISC_TRUE;
+			fatal("The -p option has been deprecated.\n");
 			break;

 		case 'Q':
@@ -3435,7 +3400,7 @@ main(int argc, char *argv[]) {
 			break;

 		case 'r':
-			setup_entropy(mctx, isc_commandline_argument, &ectx);
+			fatal("The -r options has been deprecated.\n");
 			break;

 		case 'S':
@@ -3511,21 +3476,11 @@ main(int argc, char *argv[]) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	eflags = ISC_ENTROPY_BLOCKING;
-	if (!pseudorandom)
-		eflags |= ISC_ENTROPY_GOODONLY;
-
-	result = dst_lib_init2(mctx, ectx, engine, eflags);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not create hash context");
-
 	isc_stdtime_get(&now);

 	if (startstr != NULL) {
@@ -3651,8 +3606,8 @@ main(int argc, char *argv[]) {
 	if (output_dnssec_only && set_maxttl)
 		fatal("option -D cannot be used with -M");

-	result = dns_master_stylecreate(&dsstyle,  DNS_STYLEFLAG_NO_TTL,
-					0, 24, 0, 0, 0, 8, mctx);
+	result = dns_master_stylecreate(&dsstyle, DNS_STYLEFLAG_NO_TTL,
+					0, 24, 0, 0, 0, 8, 0xffffffff, mctx);
 	check_result(result, "dns_master_stylecreate");

 	gdb = NULL;
@@ -3896,9 +3851,9 @@ main(int argc, char *argv[]) {
 			header.flags = DNS_MASTERRAW_SOURCESERIALSET;
 			header.sourceserial = serialnum;
 		}
-		result = dns_master_dumptostream3(mctx, gdb, gversion,
-						  masterstyle, outputformat,
-						  &header, outfp);
+		result = dns_master_dumptostream(mctx, gdb, gversion,
+						 masterstyle, outputformat,
+						 &header, outfp);
 		check_result(result, "dns_master_dumptostream3");
 	}

@@ -3939,9 +3894,7 @@ main(int argc, char *argv[]) {
 	dns_master_styledestroy(&dsstyle, mctx);

 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -78,10 +78,8 @@
      <arg choice="opt" rep="norepeat"><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-p</option></arg>
      <arg choice="opt" rep="norepeat"><option>-Q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S</option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
@@ -508,18 +506,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-p</term>
-        <listitem>
-          <para>
-            Use pseudo-random data when signing the zone.  This is faster,
-            but less secure, than using real random data.  This option
-            may be useful when signing large zones or when the entropy
-            source is limited.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-P</term>
        <listitem>
@@ -571,23 +557,6 @@
          </para>
        </listitem>
      </varlistentry>
-      <varlistentry>
-        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <filename>/dev/random</filename>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <filename>randomdev</filename>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard
-            input should be used.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-S</term>
        <listitem>
@@ -54,10 +54,8 @@
       [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
       [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>]
       [<code class="option">-P</code>]
-       [<code class="option">-p</code>]
       [<code class="option">-Q</code>]
       [<code class="option">-R</code>]
-       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S</code>]
       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
@@ -400,15 +398,6 @@
            can be read by release 9.9.0 or higher; the default is 1.
          </p>
        </dd>
-<dt><span class="term">-p</span></dt>
-<dd>
-          <p>
-            Use pseudo-random data when signing the zone.  This is faster,
-            but less secure, than using real random data.  This option
-            may be useful when signing large zones or when the entropy
-            source is limited.
-          </p>
-        </dd>
 <dt><span class="term">-P</span></dt>
 <dd>
          <p>
@@ -453,20 +442,6 @@
            ("Double Signature Zone Signing Key Rollover").
          </p>
        </dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-          <p>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p>
-        </dd>
 <dt><span class="term">-S</span></dt>
 <dd>
          <p>
@@ -19,7 +19,6 @@
 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -62,7 +61,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -73,7 +72,6 @@ int verbose;

 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_db_t *gdb;			/* The database */
 static dns_dbversion_t *gversion;	/* The database version */
@@ -107,7 +105,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load2(*db, file, inputformat);
+	result = dns_db_load(*db, file, inputformat, 0);
 	switch (result) {
 	case DNS_R_SEENINCLUDE:
 	case ISC_R_SUCCESS:
@@ -151,7 +149,7 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -213,7 +211,7 @@ main(int argc, char *argv[]) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -277,18 +275,11 @@ main(int argc, char *argv[]) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-
-	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not create hash context");
-
 	isc_stdtime_get(&now);

 	rdclass = strtoclass(classname);
@@ -339,8 +330,6 @@ main(int argc, char *argv[]) {

 	cleanup_logging(&log);
 	dst_lib_destroy();
-	isc_hash_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -27,7 +27,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
@@ -73,15 +72,6 @@ struct nsec3_chain_fixed {
 extern int verbose;
 extern const char *program;

-typedef struct entropysource entropysource_t;
-
-struct entropysource {
-	isc_entropysource_t *source;
-	isc_mem_t *mctx;
-	ISC_LINK(entropysource_t) link;
-};
-
-static ISC_LIST(entropysource_t) sources;
 static fatalcallback_t *fatalcallback = NULL;

 void
@@ -222,63 +212,6 @@ cleanup_logging(isc_log_t **logp) {
 	dns_log_setcontext(NULL);
 }

-void
-setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
-	isc_result_t result;
-	isc_entropysource_t *source = NULL;
-	entropysource_t *elt;
-	int usekeyboard = ISC_ENTROPY_KEYBOARDMAYBE;
-
-	REQUIRE(ectx != NULL);
-
-	if (*ectx == NULL) {
-		result = isc_entropy_create(mctx, ectx);
-		if (result != ISC_R_SUCCESS)
-			fatal("could not create entropy object: %s",
-			      isc_result_totext(result));
-		ISC_LIST_INIT(sources);
-	}
-
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(*ectx, ISC_TRUE);
-	}
-#endif
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
-		randomfile = NULL;
-	}
-
-	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
-					   usekeyboard);
-
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize entropy source: %s",
-		      isc_result_totext(result));
-
-	if (source != NULL) {
-		elt = isc_mem_get(mctx, sizeof(*elt));
-		if (elt == NULL)
-			fatal("out of memory");
-		elt->source = source;
-		elt->mctx = mctx;
-		ISC_LINK_INIT(elt, link);
-		ISC_LIST_APPEND(sources, elt, link);
-	}
-}
-
-void
-cleanup_entropy(isc_entropy_t **ectx) {
-	entropysource_t *source;
-	while (!ISC_LIST_EMPTY(sources)) {
-		source = ISC_LIST_HEAD(sources);
-		ISC_LIST_UNLINK(sources, source, link);
-		isc_entropy_destroysource(&source->source);
-		isc_mem_put(source->mctx, source, sizeof(*source));
-	}
-	isc_entropy_detach(ectx);
-}
-
 static isc_stdtime_t
 time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
@@ -506,6 +439,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	dns_secalg_t alg;
 	char filename[ISC_DIR_NAMEMAX];
 	isc_buffer_t fileb;
+	isc_stdtime_t now;

 	if (exact != NULL)
 		*exact = ISC_FALSE;
@@ -515,19 +449,11 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	alg = dst_key_alg(dstkey);

 	/*
-	 * For HMAC and Diffie Hellman just check if there is a
-	 * direct collision as they can't be revoked.  Additionally
-	 * dns_dnssec_findmatchingkeys only handles DNSKEY which is
-	 * not used for HMAC.
+	 * For Diffie Hellman just check if there is a direct collision as
+	 * they can't be revoked.  Additionally dns_dnssec_findmatchingkeys
+	 * only handles DNSKEY which is not used for HMAC.
 	 */
-	switch (alg) {
-	case DST_ALG_HMACMD5:
-	case DST_ALG_HMACSHA1:
-	case DST_ALG_HMACSHA224:
-	case DST_ALG_HMACSHA256:
-	case DST_ALG_HMACSHA384:
-	case DST_ALG_HMACSHA512:
-	case DST_ALG_DH:
+	if (alg == DST_ALG_DH) {
 		isc_buffer_init(&fileb, filename, sizeof(filename));
 		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE,
 					       dir, &fileb);
@@ -537,7 +463,8 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	}

 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, dir, mctx, &matchkeys);
+	isc_stdtime_get(&now);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND)
 		return (ISC_FALSE);

@@ -602,21 +529,6 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	return (ISC_TF(result == ISC_R_SUCCESS));
 }

-isc_boolean_t
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
-	dns_rdataset_t dnameset;
-	isc_result_t result;
-
-	dns_rdataset_init(&dnameset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dname, 0, 0,
-				     &dnameset, NULL);
-	if (dns_rdataset_isassociated(&dnameset)) {
-		dns_rdataset_disassociate(&dnameset);
-	}
-
-	return (ISC_TF(result == ISC_R_SUCCESS));
-}
-
 static isc_boolean_t
 goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name,
 	dns_rdataset_t *keyrdataset, dns_rdataset_t *rdataset, isc_mem_t *mctx)
@@ -647,10 +559,11 @@ goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name,
 			continue;
 		}
 		result = dns_dnssec_verify(name, rdataset, dstkey, ISC_FALSE,
-					   mctx, sigrdata);
+					   0, mctx, sigrdata, NULL);
 		dst_key_free(&dstkey);
-		if (result == ISC_R_SUCCESS)
+		if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
 			return(ISC_TRUE);
+		}
 	}
 	return (ISC_FALSE);
 }
@@ -1769,9 +1682,6 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
 			isdelegation = ISC_TRUE;
-		} else if (has_dname(db, ver, node)) {
-			zonecut = dns_fixedname_name(&fzonecut);
-			dns_name_copy(name, zonecut, NULL);
 		}
 		nextnode = NULL;
 		result = dns_dbiterator_next(dbiter);
@@ -55,12 +55,6 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp);
 void
 cleanup_logging(isc_log_t **logp);

-void
-setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx);
-
-void
-cleanup_entropy(isc_entropy_t **ectx);
-
 dns_ttl_t strtottl(const char *str);

 isc_stdtime_t
@@ -90,13 +84,6 @@ isc_boolean_t
 is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp);

-/*%
- * Return ISC_TRUE if version 'ver' of database 'db' contains a DNAME RRset at
- * 'node'; return ISC_FALSE otherwise.
- */
-isc_boolean_t
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node);
-
 void
 verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		   dns_name_t *origin, isc_mem_t *mctx,
@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
 		${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@

 CWARNINGS =

@@ -27,7 +27,6 @@

 #include <pk11/site.h>

-#include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>

 #include <dns/fixedname.h>
@@ -47,7 +46,6 @@
 /*% default configuration */
 static char defaultconf[] = "\
 options {\n\
-	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
@@ -90,18 +88,12 @@ options {\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
-	prefetch 2 9;\n"
-#if defined(ISC_PLATFORM_CRYPTORANDOM)
-"	random-device none;\n"
-#elif defined(PATH_RANDOMDEV)
-"	random-device \"" PATH_RANDOMDEV "\";\n"
-#endif
-"	recursing-file \"named.recursing\";\n\
+	prefetch 2 9;\n\
+	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
-	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
 #	serial-queries <obsolete>;\n\
@@ -251,6 +243,7 @@ options {\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
 	sig-validity-interval 30; /* days */\n\
+	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
@@ -315,9 +308,8 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf,
-				  CFG_PCTX_NODEPRECATED, conf));
+	return (cfg_parse_buffer3(parser, &b, __FILE__, 0,
+				  &cfg_type_namedconf, conf));
 }

 isc_result_t
@@ -430,18 +422,23 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	const char *str;

 	str = cfg_obj_asstring(zonetypeobj);
-	if (strcasecmp(str, "master") == 0)
+	if (strcasecmp(str, "primary") == 0 ||
+	    strcasecmp(str, "master") == 0)
+	{
 		ztype = dns_zone_master;
-	else if (strcasecmp(str, "slave") == 0)
+	} else if (strcasecmp(str, "secondary") == 0 ||
+		   strcasecmp(str, "slave") == 0)
+	{
 		ztype = dns_zone_slave;
-	else if (strcasecmp(str, "stub") == 0)
+	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
-	else if (strcasecmp(str, "static-stub") == 0)
+	} else if (strcasecmp(str, "static-stub") == 0) {
 		ztype = dns_zone_staticstub;
-	else if (strcasecmp(str, "redirect") == 0)
+	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
-	else
+	} else {
 		INSIST(0);
+	}
 	return (ztype);
 }

@@ -230,7 +230,8 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {

 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);

-	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
+	result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
+			       NULL);

 	if (result != ISC_R_SUCCESS || match <= 0)
 		return (ISC_FALSE);
@@ -325,7 +326,6 @@ static void
 control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	controlconnection_t *conn = NULL;
 	controllistener_t *listener = NULL;
-	named_server_t *server = NULL;
 	controlkey_t *key = NULL;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *response = NULL;
@@ -347,7 +347,6 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {

 	conn = event->ev_arg;
 	listener = conn->listener;
-	server = listener->controls->server;
 	algorithm = DST_ALG_UNKNOWN;
 	secret.rstart = NULL;
 	text = NULL;
@@ -459,8 +458,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-					    sizeof(conn->nonce));
+			isc_random_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -48,8 +48,6 @@ EXTERN unsigned int		named_g_cpus		INIT(0);
 EXTERN unsigned int		named_g_udpdisp		INIT(0);
 EXTERN isc_taskmgr_t *		named_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	named_g_dispatchmgr	INIT(NULL);
-EXTERN isc_entropy_t *		named_g_entropy		INIT(NULL);
-EXTERN isc_entropy_t *		named_g_fallbackentropy	INIT(NULL);
 EXTERN unsigned int		named_g_cpus_detected	INIT(1);

 #ifdef ENABLE_AFL
@@ -1,248 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef NAMED_SECCOMP_H
-#define NAMED_SECCOMP_H 1
-
-/*! \file */
-
-#ifdef HAVE_LIBSECCOMP
-#include <sys/types.h>
-#include <sys/resource.h>
-#include <unistd.h>
-#include <seccomp.h>
-#include <isc/platform.h>
-
-/*%
- * For each architecture, the scmp_syscalls and
- * scmp_syscall_names arrays MUST be kept in sync.
- */
-#ifdef __x86_64__
-int scmp_syscalls[] = {
-	SCMP_SYS(access),
-	SCMP_SYS(open),
-	SCMP_SYS(openat),
-	SCMP_SYS(lseek),
-	SCMP_SYS(clock_gettime),
-	SCMP_SYS(time),
-	SCMP_SYS(read),
-	SCMP_SYS(write),
-	SCMP_SYS(close),
-	SCMP_SYS(brk),
-	SCMP_SYS(poll),
-	SCMP_SYS(select),
-	SCMP_SYS(madvise),
-	SCMP_SYS(mmap),
-	SCMP_SYS(munmap),
-	SCMP_SYS(exit_group),
-	SCMP_SYS(rt_sigprocmask),
-	SCMP_SYS(rt_sigaction),
-	SCMP_SYS(fsync),
-	SCMP_SYS(rt_sigreturn),
-	SCMP_SYS(setsid),
-	SCMP_SYS(chdir),
-	SCMP_SYS(futex),
-	SCMP_SYS(stat),
-	SCMP_SYS(rt_sigsuspend),
-	SCMP_SYS(fstat),
-	SCMP_SYS(epoll_ctl),
-	SCMP_SYS(gettimeofday),
-	SCMP_SYS(getpid),
-#ifdef HAVE_GETRANDOM
-	SCMP_SYS(getrandom),
-#endif
-	SCMP_SYS(rename),
-	SCMP_SYS(unlink),
-	SCMP_SYS(socket),
-	SCMP_SYS(sendto),
-#ifndef ISC_PLATFORM_USETHREADS
-	SCMP_SYS(bind),
-	SCMP_SYS(accept),
-	SCMP_SYS(connect),
-	SCMP_SYS(listen),
-	SCMP_SYS(fcntl),
-	SCMP_SYS(sendmsg),
-	SCMP_SYS(recvmsg),
-	SCMP_SYS(uname),
-	SCMP_SYS(setrlimit),
-	SCMP_SYS(getrlimit),
-	SCMP_SYS(setsockopt),
-	SCMP_SYS(getsockopt),
-	SCMP_SYS(getsockname),
-	SCMP_SYS(lstat),
-	SCMP_SYS(getgid),
-	SCMP_SYS(getegid),
-	SCMP_SYS(getuid),
-	SCMP_SYS(geteuid),
-	SCMP_SYS(setresgid),
-	SCMP_SYS(setresuid),
-	SCMP_SYS(setgid),
-	SCMP_SYS(setuid),
-	SCMP_SYS(prctl),
-	SCMP_SYS(epoll_wait),
-	SCMP_SYS(getdents),
-	SCMP_SYS(utimes),
-	SCMP_SYS(dup),
-#endif
-};
-const char *scmp_syscall_names[] = {
-	"access",
-	"open",
-	"openat",
-	"lseek",
-	"clock_gettime",
-	"time",
-	"read",
-	"write",
-	"close",
-	"brk",
-	"poll",
-	"select",
-	"madvise",
-	"mmap",
-	"munmap",
-	"exit_group",
-	"rt_sigprocmask",
-	"rt_sigaction",
-	"fsync",
-	"rt_sigreturn",
-	"setsid",
-	"chdir",
-	"futex",
-	"stat",
-	"rt_sigsuspend",
-	"fstat",
-	"epoll_ctl",
-	"gettimeofday",
-	"getpid",
-#ifdef HAVE_GETRANDOM
-	"getrandom",
-#endif
-	"rename",
-	"unlink",
-	"socket",
-	"sendto",
-#ifndef ISC_PLATFORM_USETHREADS
-	"bind",
-	"accept",
-	"connect",
-	"listen",
-	"fcntl",
-	"sendmsg",
-	"recvmsg",
-	"uname",
-	"setrlimit",
-	"getrlimit",
-	"setsockopt",
-	"getsockopt",
-	"getsockname",
-	"lstat",
-	"getgid",
-	"getegid",
-	"getuid",
-	"geteuid",
-	"setresgid",
-	"setresuid",
-	"setgid",
-	"setuid",
-	"prctl",
-	"epoll_wait",
-	"getdents",
-	"utimes",
-	"dup",
-#endif
-};
-#endif /* __x86_64__ */
-#ifdef __i386__
-int scmp_syscalls[] = {
-	SCMP_SYS(access),
-	SCMP_SYS(open),
-	SCMP_SYS(clock_gettime),
-	SCMP_SYS(time),
-	SCMP_SYS(read),
-	SCMP_SYS(write),
-	SCMP_SYS(close),
-	SCMP_SYS(brk),
-	SCMP_SYS(poll),
-	SCMP_SYS(_newselect),
-	SCMP_SYS(select),
-	SCMP_SYS(madvise),
-	SCMP_SYS(mmap2),
-	SCMP_SYS(mmap),
-	SCMP_SYS(munmap),
-	SCMP_SYS(exit_group),
-	SCMP_SYS(rt_sigprocmask),
-	SCMP_SYS(sigprocmask),
-	SCMP_SYS(rt_sigaction),
-	SCMP_SYS(socketcall),
-	SCMP_SYS(fsync),
-	SCMP_SYS(sigreturn),
-	SCMP_SYS(setsid),
-	SCMP_SYS(chdir),
-	SCMP_SYS(futex),
-	SCMP_SYS(stat64),
-	SCMP_SYS(rt_sigsuspend),
-	SCMP_SYS(fstat64),
-	SCMP_SYS(epoll_ctl),
-	SCMP_SYS(gettimeofday),
-	SCMP_SYS(getpid),
-#ifdef HAVE_GETRANDOM
-	SCMP_SYS(getrandom),
-#endif
-	SCMP_SYS(unlink),
-#ifndef ISC_PLATFORM_USETHREADS
-	SCMP_SYS(fcntl64),
-#endif
-};
-const char *scmp_syscall_names[] = {
-	"access",
-	"open",
-	"clock_gettime",
-	"time",
-	"read",
-	"write",
-	"close",
-	"brk",
-	"poll",
-	"_newselect",
-	"select",
-	"madvise",
-	"mmap2",
-	"mmap",
-	"munmap",
-	"exit_group",
-	"rt_sigprocmask",
-	"sigprocmask",
-	"rt_sigaction",
-	"socketcall",
-	"fsync",
-	"sigreturn",
-	"setsid",
-	"chdir",
-	"futex",
-	"stat64",
-	"rt_sigsuspend",
-	"fstat64",
-	"epoll_ctl",
-	"gettimeofday",
-	"getpid",
-#ifdef HAVE_GETRANDOM
-	"getrandom",
-#endif
-	"unlink",
-#ifndef ISC_PLATFORM_USETHREADS
-	"fcntl64",
-#endif
-};
-#endif /* __i386__ */
-#endif /* HAVE_LIBSECCOMP */
-
-#endif /* NAMED_SECCOMP_H */
@@ -23,7 +23,7 @@ ISC_LANG_BEGINDECLS

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
+			 dns_tkeyctx_t **tctxp);
 /*%<
 * 	Create a TKEY context and configure it, including the default DH key
 *	and default domain, according to 'options'.
@@ -31,7 +31,6 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *	Requires:
 *\li		'cfg' is a valid configuration options object.
 *\li		'mctx' is not NULL
- *\li		'ectx' is not NULL
 *\li		'tctx' is not NULL
 *\li		'*tctx' is NULL
 *
@@ -21,7 +21,6 @@
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
@@ -45,7 +44,7 @@
 #include <dns/view.h>

 #include <dst/result.h>
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -72,12 +71,11 @@
 #include <named/os.h>
 #include <named/server.h>
 #include <named/main.h>
-#include <named/seccomp.h>
 #ifdef HAVE_LIBSCF
 #include <named/smf_globals.h>
 #endif

-#ifdef OPENSSL
+#if HAVE_OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
 #endif
@@ -131,7 +129,6 @@ static unsigned int delay = 0;
 static isc_boolean_t nonearest = ISC_FALSE;
 static isc_boolean_t notcp = ISC_FALSE;
 static isc_boolean_t fixedlocal = ISC_FALSE;
-static isc_boolean_t sigvalinsecs = ISC_FALSE;

 /*
 * -4 and -6
@@ -467,96 +464,12 @@ parse_fuzz_arg(void) {
 	}
 }

-static void
-parse_T_opt(char *option) {
-	const char *p;
-	/*
-	 * force the server to behave (or misbehave) in
-	 * specified ways for testing purposes.
-	 *
-	 * clienttest: make clients single shot with their
-	 * 	       own memory context.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
-	 * dscp=x:     check that dscp values are as
-	 * 	       expected and assert otherwise.
-	 */
-	if (!strcmp(option, "clienttest")) {
-		clienttest = ISC_TRUE;
-	} else if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
-		dropedns = ISC_TRUE;
-	} else if (!strncmp(option, "dscp=", 5)) {
-		isc_dscp_check_value = atoi(option + 5);
-	} else if (!strcmp(option, "fixedlocal")) {
-		fixedlocal = ISC_TRUE;
-	} else if (!strcmp(option, "keepstderr")) {
-		named_g_keepstderr = ISC_TRUE;
-	} else if (!strcmp(option, "noaa")) {
-		noaa = ISC_TRUE;
-	} else if (!strcmp(option, "noedns")) {
-		noedns = ISC_TRUE;
-	} else if (!strcmp(option, "nonearest")) {
-		nonearest = ISC_TRUE;
-	} else if (!strcmp(option, "nosoa")) {
-		nosoa = ISC_TRUE;
-	} else if (!strcmp(option, "nosyslog")) {
-		named_g_nosyslog = ISC_TRUE;
-	} else if (!strcmp(option, "notcp")) {
-		notcp = ISC_TRUE;
-	} else if (!strcmp(option, "maxudp512")) {
-		maxudp = 512;
-	} else if (!strcmp(option, "maxudp1460")) {
-		maxudp = 1460;
-	} else if (!strncmp(option, "maxudp=", 7)) {
-		maxudp = atoi(option + 7);
-	} else if (!strncmp(option, "mkeytimers=", 11)) {
-		p = strtok(option + 11, "/");
-		if (p == NULL) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		dns_zone_mkey_hour = atoi(p);
-		if (dns_zone_mkey_hour == 0) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		p = strtok(NULL, "/");
-		if (p == NULL) {
-			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_day = atoi(p);
-		if (dns_zone_mkey_day < dns_zone_mkey_hour)
-			named_main_earlyfatal("bad mkeytimer");
-
-		p = strtok(NULL, "/");
-		if (p == NULL) {
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_month = atoi(p);
-		if (dns_zone_mkey_month < dns_zone_mkey_day) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-	} else if (!strcmp(option, "sigvalinsecs")) {
-		sigvalinsecs = ISC_TRUE;
-	} else if (!strncmp(option, "tat=", 4)) {
-		named_g_tat_interval = atoi(option + 4);
-	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
-	}
-}
-
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
 	int port;
 	const char *p;
+	char *last;

 	save_command_line(argc, argv);

@@ -651,7 +564,95 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_chrootdir = isc_commandline_argument;
 			break;
 		case 'T':	/* NOT DOCUMENTED */
-			parse_T_opt(isc_commandline_argument);
+			/*
+			 * force the server to behave (or misbehave) in
+			 * specified ways for testing purposes.
+			 *
+			 * clienttest: make clients single shot with their
+			 * 	       own memory context.
+			 * delay=xxxx: delay client responses by xxxx ms to
+			 *	       simulate remote servers.
+			 * dscp=x:     check that dscp values are as
+			 * 	       expected and assert otherwise.
+			 */
+			if (!strcmp(isc_commandline_argument, "clienttest"))
+				clienttest = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nosoa"))
+				nosoa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noaa"))
+				noaa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp512"))
+				maxudp = 512;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp1460"))
+				maxudp = 1460;
+			else if (!strcmp(isc_commandline_argument, "dropedns"))
+				dropedns = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noedns"))
+				noedns = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument,
+					  "maxudp=", 7))
+				maxudp = atoi(isc_commandline_argument + 7);
+			else if (!strncmp(isc_commandline_argument,
+					  "delay=", 6))
+				delay = atoi(isc_commandline_argument + 6);
+			else if (!strcmp(isc_commandline_argument, "nosyslog"))
+				named_g_nosyslog = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nonearest"))
+				nonearest = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
+				isc_dscp_check_value =
+					   atoi(isc_commandline_argument + 5);
+			else if (!strncmp(isc_commandline_argument,
+					  "mkeytimers=", 11))
+			{
+				p = strtok_r(isc_commandline_argument + 11, "/", &last);
+				if (p == NULL)
+					named_main_earlyfatal("bad mkeytimer");
+				dns_zone_mkey_hour = atoi(p);
+				if (dns_zone_mkey_hour == 0)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_day =
+						(24 * dns_zone_mkey_hour);
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_day = atoi(p);
+				if (dns_zone_mkey_day < dns_zone_mkey_hour)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_month = atoi(p);
+				if (dns_zone_mkey_month < dns_zone_mkey_day)
+					named_main_earlyfatal("bad mkeytimer");
+			} else if (!strcmp(isc_commandline_argument, "notcp"))
+				notcp = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "tat=", 4))
+			{
+				named_g_tat_interval =
+					   atoi(isc_commandline_argument + 4);
+			} else if (!strcmp(isc_commandline_argument,
+					 "keepstderr"))
+			{
+				named_g_keepstderr = ISC_TRUE;
+			} else if (!strcmp(isc_commandline_argument,
+					   "fixedlocal"))
+			{
+				fixedlocal = ISC_TRUE;
+			} else {
+				fprintf(stderr, "unknown -T flag '%s\n",
+					isc_commandline_argument);
+			}
 			break;
 		case 'U':
 			named_g_udpdisp = parse_int(isc_commandline_argument,
@@ -692,7 +693,7 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef __SUNPRO_C
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
-#ifdef OPENSSL
+#if HAVE_OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
@@ -843,23 +844,6 @@ create_managers(void) {
 			      ISC_LOG_INFO, "using up to %u sockets", socks);
 	}

-	result = isc_entropy_create(named_g_mctx, &named_g_entropy);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_entropy_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
-	result = isc_hash_create(named_g_mctx, named_g_entropy,
-				 DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_hash_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
 	return (ISC_R_SUCCESS);
 }

@@ -871,13 +855,6 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
-
-	/*
-	 * isc_hash_destroy() cannot be called as long as a resolver may be
-	 * running.  Calling this after isc_taskmgr_destroy() ensures the
-	 * call is safe.
-	 */
-	isc_hash_destroy();
 }

 static void
@@ -909,60 +886,6 @@ dump_symboltable(void) {
 	}
 }

-#ifdef HAVE_LIBSECCOMP
-static void
-setup_seccomp() {
-	scmp_filter_ctx ctx;
-	unsigned int i;
-	int ret;
-
-	/* Make sure the lists are in sync */
-	INSIST((sizeof(scmp_syscalls) / sizeof(int)) ==
-	       (sizeof(scmp_syscall_names) / sizeof(const char *)));
-
-	ctx = seccomp_init(SCMP_ACT_KILL);
-	if (ctx == NULL) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-			      "libseccomp activation failed");
-		return;
-	}
-
-	for (i = 0 ; i < sizeof(scmp_syscalls)/sizeof(*(scmp_syscalls)); i++) {
-		ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW,
-				       scmp_syscalls[i], 0);
-		if (ret < 0)
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-				      "libseccomp rule failed: %s",
-				      scmp_syscall_names[i]);
-
-		else
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_MAIN, ISC_LOG_DEBUG(9),
-				      "added libseccomp rule: %s",
-				      scmp_syscall_names[i]);
-	}
-
-	ret = seccomp_load(ctx);
-	if (ret < 0) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-			      "libseccomp unable to load filter");
-	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "libseccomp sandboxing active");
-	}
-
-	/*
-	 * Release filter in ctx. Filters already loaded are not
-	 * affected.
-	 */
-	seccomp_release(ctx);
-}
-#endif /* HAVE_LIBSECCOMP */
-
 static void
 setup(void) {
 	isc_result_t result;
@@ -998,30 +921,6 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */

-#ifdef PATH_RANDOMDEV
-	/*
-	 * Initialize system's random device as fallback entropy source
-	 * if running chroot'ed.
-	 */
-	if (named_g_chrootdir != NULL) {
-		result = isc_entropy_create(named_g_mctx,
-					    &named_g_fallbackentropy);
-		if (result != ISC_R_SUCCESS)
-			named_main_earlyfatal("isc_entropy_create() failed: %s",
-					   isc_result_totext(result));
-
-		result = isc_entropy_createfilesource(named_g_fallbackentropy,
-						      PATH_RANDOMDEV);
-		if (result != ISC_R_SUCCESS) {
-			named_main_earlywarning("could not open pre-chroot "
-					     "entropy source %s: %s",
-					     PATH_RANDOMDEV,
-					     isc_result_totext(result));
-			isc_entropy_detach(&named_g_fallbackentropy);
-		}
-	}
-#endif
-
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
@@ -1084,85 +983,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "running as: %s%s",
 		      program_name, saved_command_line);
-#ifdef __clang__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by CLANG %s", __VERSION__);
-#else
-#if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by ICC %s", __VERSION__);
-#else
-#ifdef __GNUC__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by GCC %s", __VERSION__);
-#endif
-#endif
-#endif
-#ifdef _MSC_VER
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by MSVC %d", _MSC_VER);
-#endif
-#ifdef __SUNPRO_C
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by Solaris Studio %x", __SUNPRO_C);
-#endif
-#ifdef OPENSSL
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with OpenSSL version: %s",
-		      OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-    OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      OpenSSL_version(OPENSSL_VERSION));
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#endif
-#ifdef HAVE_LIBXML2
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libxml2 version: %s",
-		      LIBXML_DOTTED_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libxml2 version: %s", xmlParserVersion);
-#endif
-#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libjson-c version: %s", JSON_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libjson-c version: %s", json_c_version());
-#endif
-#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with zlib version: %s", ZLIB_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to zlib version: %s", zlibVersion());
-#endif
-#ifdef ISC_PLATFORM_USETHREADS
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1296,14 +1116,8 @@ setup(void) {
 		ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE);
 	if (disable6)
 		ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE);
-	if (sigvalinsecs)
-		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, ISC_TRUE);

 	named_g_server->sctx->delay = delay;
-
-#ifdef HAVE_LIBSECCOMP
-	setup_seccomp();
-#endif /* HAVE_LIBSECCOMP */
 }

 static void
@@ -1313,10 +1127,6 @@ cleanup(void) {
 	if (named_g_mapped != NULL)
 		dns_acl_detach(&named_g_mapped);

-	isc_entropy_detach(&named_g_entropy);
-	if (named_g_fallbackentropy != NULL)
-		isc_entropy_detach(&named_g_fallbackentropy);
-
 	named_server_destroy(&named_g_server);

 	named_builtin_deinit();
@@ -1469,7 +1279,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 	dst_result_register();
 	isccc_result_register();
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2018-01-22
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-01\-22" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,7 +199,6 @@ options {
 	    ] [ dscp \fIinteger\fR ];
 	alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
 	    * ) ] [ dscp \fIinteger\fR ];
-	answer\-cookie \fIboolean\fR;
 	attach\-cache \fIstring\fR;
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
@@ -218,8 +217,9 @@ options {
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check\-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -307,7 +307,8 @@ options {
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
 	interface\-interval \fIinteger\fR;
-	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
+	ixfr\-from\-differences ( primary | master | secondary | slave |
+	    \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
 	lame\-ttl \fIttlval\fR;
@@ -419,7 +420,6 @@ options {
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
-	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
 	secroots\-file \fIquoted_string\fR;
@@ -585,8 +585,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check\-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -652,7 +653,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    | \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
 	glue\-cache \fIboolean\fR;
 	inline\-signing \fIboolean\fR;
-	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
+	ixfr\-from\-differences ( primary | master | secondary | slave |
+	    \fIboolean\fR );
 	key \fIstring\fR {
 		algorithm \fIstring\fR;
 		secret \fIstring\fR;
@@ -753,7 +755,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
-	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
 	send\-cookie \fIboolean\fR;
@@ -903,8 +904,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 		transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port (
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		try\-tcp\-refresh \fIboolean\fR;
-		type ( delegation\-only | forward | hint | master | redirect
-		    | slave | static\-stub | stub );
+		type ( primary | master | secondary | slave |
+		    delegation\-only | forward | hint | redirect |
+		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
 		update\-policy ( local | { ( deny | grant ) \fIstring\fR (
 		    6to4\-self | external | krb5\-self | krb5\-subdomain |
@@ -1008,8 +1010,8 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	try\-tcp\-refresh \fIboolean\fR;
-	type ( delegation\-only | forward | hint | master | redirect | slave
-	    | static\-stub | stub );
+	type ( primary | master | secondary | slave | delegation\-only |
+	    forward | hint | redirect | static\-stub | stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
 	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-06-21</date>
+    <date>2018-01-22</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -192,7 +192,6 @@ options {
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	alt-transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
-	answer-cookie <replaceable>boolean</replaceable>;
 	attach-cache <replaceable>string</replaceable>;
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
@@ -211,8 +210,9 @@ options {
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -300,7 +300,8 @@ options {
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
 	interface-interval <replaceable>integer</replaceable>;
-	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
+	ixfr-from-differences ( primary | master | secondary | slave |
+	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
 	lame-ttl <replaceable>ttlval</replaceable>;
@@ -412,7 +413,6 @@ options {
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
-	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	secroots-file <replaceable>quoted_string</replaceable>;
@@ -562,8 +562,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -629,7 +630,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
 	glue-cache <replaceable>boolean</replaceable>;
 	inline-signing <replaceable>boolean</replaceable>;
-	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
+	ixfr-from-differences ( primary | master | secondary | slave |
+	    <replaceable>boolean</replaceable> );
 	key <replaceable>string</replaceable> {
 		algorithm <replaceable>string</replaceable>;
 		secret <replaceable>string</replaceable>;
@@ -730,7 +732,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
-	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	send-cookie <replaceable>boolean</replaceable>;
@@ -880,8 +881,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port (
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		try-tcp-refresh <replaceable>boolean</replaceable>;
-		type ( delegation-only | forward | hint | master | redirect
-		    | slave | static-stub | stub );
+		type ( primary | master | secondary | slave |
+		    delegation-only | forward | hint | redirect |
+		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
 		    6to4-self | external | krb5-self | krb5-subdomain |
@@ -981,8 +983,8 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	try-tcp-refresh <replaceable>boolean</replaceable>;
-	type ( delegation-only | forward | hint | master | redirect | slave
-	    | static-stub | stub );
+	type ( primary | master | secondary | slave | delegation-only |
+	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
@@ -180,7 +180,6 @@ options
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
 	    * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
-	answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	attach-cache <em class="replaceable"><code>string</code></em>;<br>
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
@@ -199,8 +198,9 @@ options
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( master | slave | response<br>
-	    ) ( fail | warn | ignore );<br>
+	check-names ( primary | master |<br>
+	    secondary | slave | response ) (<br>
+	    fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -288,7 +288,8 @@ options
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
 	interface-interval <em class="replaceable"><code>integer</code></em>;<br>
-	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
+	ixfr-from-differences ( primary | master | secondary | slave |<br>
+	    <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
 	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
@@ -400,7 +401,6 @@ options
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
 	secroots-file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -554,8 +554,9 @@ view
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( master | slave | response<br>
-	    ) ( fail | warn | ignore );<br>
+	check-names ( primary | master |<br>
+	    secondary | slave | response ) (<br>
+	    fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -621,7 +622,8 @@ view
 	    | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
+	ixfr-from-differences ( primary | master | secondary | slave |<br>
+	    <em class="replaceable"><code>boolean</code></em> );<br>
 	key <em class="replaceable"><code>string</code></em> {<br>
 		algorithm <em class="replaceable"><code>string</code></em>;<br>
 		secret <em class="replaceable"><code>string</code></em>;<br>
@@ -722,7 +724,6 @@ view
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
 	send-cookie <em class="replaceable"><code>boolean</code></em>;<br>
@@ -872,8 +873,9 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( delegation-only | forward | hint | master | redirect<br>
-		    | slave | static-stub | stub );<br>
+		type ( primary | master | secondary | slave |<br>
+		    delegation-only | forward | hint | redirect |<br>
+		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 		update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
 		    6to4-self | external | krb5-self | krb5-subdomain |<br>
@@ -974,8 +976,8 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( delegation-only | forward | hint | master | redirect | slave<br>
-	    | static-stub | stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
 	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
@@ -25,7 +25,6 @@
 #include <isc/base64.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/hex.h>
@@ -871,8 +870,8 @@ load_view_keys(const cfg_obj_t *keys, const cfg_obj_t *vconfig,
 			 * initializing key; that's why 'managed'
 			 * is duplicated below.
 			 */
-			CHECK(dns_keytable_add2(secroots, managed,
-						managed, &dstkey));
+			CHECK(dns_keytable_add(secroots, managed,
+					       managed, &dstkey));
 		}
 	}

@@ -3349,7 +3348,7 @@ create_empty_zone(dns_zone_t *zone, dns_name_t *name, dns_view_t *view,
 		dns_db_closeversion(db, &version, ISC_TRUE);
 		CHECK(dns_zone_replacedb(zone, db, ISC_FALSE));
 	}
-	dns_zone_setoption2(zone, DNS_ZONEOPT2_AUTOEMPTY, ISC_TRUE);
+	dns_zone_setoption(zone, DNS_ZONEOPT_AUTOEMPTY, ISC_TRUE);
 	dns_zone_setview(zone, view);
 	CHECK(dns_view_addzone(view, zone));

@@ -3551,7 +3550,7 @@ configure_dnstap(const cfg_obj_t **maps, dns_view_t *view) {
 			fstrm_iothr_options_set_reopen_interval(fopt, i);
 		}

-		CHECKM(dns_dt_create2(named_g_mctx, dmode, dpath,
+		CHECKM(dns_dt_create(named_g_mctx, dmode, dpath,
 				      &fopt, named_g_server->task,
 				      &named_g_server->dtenv),
 		       "unable to create dnstap environment");
@@ -3614,8 +3613,8 @@ create_mapped_acl(void) {
 	if (result != ISC_R_SUCCESS)
 		return (result);

-	result = dns_iptable_addprefix2(acl->iptable, &addr, 96,
-					ISC_TRUE, ISC_FALSE);
+	result = dns_iptable_addprefix(acl->iptable, &addr, 96,
+				       ISC_TRUE, ISC_FALSE);
 	if (result == ISC_R_SUCCESS)
 		dns_acl_attach(acl, &named_g_mapped);
 	dns_acl_detach(&acl);
@@ -3727,6 +3726,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	CHECKM(named_config_getport(config, &port), "port");
 	dns_view_setdstport(view, port);

+	CHECK(configure_view_acl(vconfig, config, named_g_config,
+				 "allow-query", NULL, actx,
+				 named_g_mctx, &view->queryacl));
+
 	/*
 	 * Make the list of response policy zone names for a view that
 	 * is used for real lookups and so cares about hints.
@@ -4091,7 +4094,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj = NULL;
 	result = named_config_get(maps, "max-stale-ttl", &obj);
 	INSIST(result == ISC_R_SUCCESS);
-	max_stale_ttl = ISC_MAX(cfg_obj_asuint32(obj), 1);
+	max_stale_ttl = cfg_obj_asuint32(obj);

 	obj = NULL;
 	result = named_config_get(maps, "stale-answer-enable", &obj);
@@ -4203,10 +4206,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			isc_mem_setname(cmctx, "cache", NULL);
 			CHECK(isc_mem_create(0, 0, &hmctx));
 			isc_mem_setname(hmctx, "cache_heap", NULL);
-			CHECK(dns_cache_create3(cmctx, hmctx, named_g_taskmgr,
-						named_g_timermgr, view->rdclass,
-						cachename, "rbt", 0, NULL,
-						&cache));
+			CHECK(dns_cache_create(cmctx, hmctx, named_g_taskmgr,
+					       named_g_timermgr, view->rdclass,
+					       cachename, "rbt", 0, NULL,
+					       &cache));
 			isc_mem_detach(&cmctx);
 			isc_mem_detach(&hmctx);
 		}
@@ -4224,7 +4227,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		ISC_LINK_INIT(nsc, link);
 		ISC_LIST_APPEND(*cachelist, nsc, link);
 	}
-	dns_view_setcache2(view, cache, shared_cache);
+	dns_view_setcache(view, cache, shared_cache);

 	/*
 	 * cache-file cannot be inherited if views are present, but this
@@ -4695,35 +4698,21 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				 "allow-query-cache-on", NULL, actx,
 				 named_g_mctx, &view->cacheonacl));
 	/*
-	 * Set the "allow-query", "allow-query-cache", "allow-recursion",
-	 * and "allow-recursion-on" ACLs if configured in named.conf, but
-	 * NOT from the global defaults. This is done by leaving the third
-	 * argument to configure_view_acl() NULL.
-	 *
-	 * We ignore the global defaults here because these ACLs
-	 * can inherit from each other.  If any are still unset after
-	 * applying the inheritance rules, we'll look up the defaults at
-	 * that time.
+	 * Set "allow-query-cache", "allow-recursion", and
+	 * "allow-recursion-on" acls if configured in named.conf.
+	 * (Ignore the global defaults for now, because these ACLs
+	 * can inherit from each other when only some of them set at
+	 * the options/view level.)
 	 */
-
-	/* named.conf only */
-	CHECK(configure_view_acl(vconfig, config, NULL,
-				 "allow-query", NULL, actx,
-				 named_g_mctx, &view->queryacl));
-
-	/* named.conf only */
-	CHECK(configure_view_acl(vconfig, config, NULL,
-				 "allow-query-cache", NULL, actx,
-				 named_g_mctx, &view->cacheacl));
+	CHECK(configure_view_acl(vconfig, config, NULL, "allow-query-cache",
+				 NULL, actx, named_g_mctx, &view->cacheacl));

 	if (strcmp(view->name, "_bind") != 0 &&
 	    view->rdclass != dns_rdataclass_chaos)
 	{
-		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion", NULL, actx,
 					 named_g_mctx, &view->recursionacl));
-		/* named.conf only */
 		CHECK(configure_view_acl(vconfig, config, NULL,
 					 "allow-recursion-on", NULL, actx,
 					 named_g_mctx, &view->recursiononacl));
@@ -4761,21 +4750,18 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		 * the global config.
 		 */
 		if (view->recursionacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion", NULL,
 						 actx, named_g_mctx,
 						 &view->recursionacl));
 		}
 		if (view->recursiononacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-recursion-on", NULL,
 						 actx, named_g_mctx,
 						 &view->recursiononacl));
 		}
 		if (view->cacheacl == NULL) {
-			/* global default only */
 			CHECK(configure_view_acl(NULL, NULL, named_g_config,
 						 "allow-query-cache", NULL,
 						 actx, named_g_mctx,
@@ -4789,14 +4775,6 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		CHECK(dns_acl_none(mctx, &view->cacheacl));
 	}

-	if (view->queryacl == NULL) {
-		/* global default only */
-		CHECK(configure_view_acl(NULL, NULL, named_g_config,
-					 "allow-query", NULL,
-					 actx, named_g_mctx,
-					 &view->queryacl));
-	}
-
 	/*
 	 * Ignore case when compressing responses to the specified
 	 * clients. This causes case not always to be preserved,
@@ -5276,7 +5254,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			 * empty zone for it.
 			 */
 			result = dns_fwdtable_find(view->fwdtable, name,
-						   &dnsforwarders);
+						   NULL, &dnsforwarders);
 			if (result == ISC_R_SUCCESS &&
 			    dnsforwarders->fwdpolicy == dns_fwdpolicy_only)
 				continue;
@@ -5693,12 +5671,7 @@ create_view(const cfg_obj_t *vconfig, dns_viewlist_t *viewlist,
 	if (result != ISC_R_SUCCESS)
 		return (result);

-	result = isc_entropy_getdata(named_g_entropy, view->secret,
-				     sizeof(view->secret), NULL, 0);
-	if (result != ISC_R_SUCCESS) {
-		dns_view_detach(&view);
-		return (result);
-	}
+	isc_random_buf(view->secret, sizeof(view->secret));

 	ISC_LIST_APPEND(*viewlist, view, link);
 	dns_view_attach(view, viewp);
@@ -6062,7 +6035,9 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	dns_zone_setadded(zone, added);

 	signing = NULL;
-	if ((strcasecmp(ztypestr, "master") == 0 ||
+	if ((strcasecmp(ztypestr, "primary") == 0 ||
+	     strcasecmp(ztypestr, "master") == 0 ||
+	     strcasecmp(ztypestr, "secondary") == 0 ||
 	     strcasecmp(ztypestr, "slave") == 0) &&
 	    cfg_map_get(zoptions, "inline-signing", &signing) == ISC_R_SUCCESS &&
 	    cfg_obj_asboolean(signing))
@@ -6164,7 +6139,8 @@ add_keydata_zone(dns_view_t *view, const char *directory, isc_mem_t *mctx) {
 				defaultview ? "managed-keys" : view->name,
 				defaultview ? "bind" : "mkeys",
 				filename, sizeof(filename)));
-	CHECK(dns_zone_setfile(zone, filename));
+	CHECK(dns_zone_setfile(zone, filename, dns_masterformat_text,
+			       &dns_master_style_default));

 	dns_zone_setview(zone, view);
 	dns_zone_settype(zone, dns_zone_key);
@@ -6285,8 +6261,8 @@ add_listenelt(isc_mem_t *mctx, ns_listenlist_t *list, isc_sockaddr_t *addr,
 		if (result != ISC_R_SUCCESS)
 			return (result);

-		result = dns_iptable_addprefix(src_acl->iptable,
-					       &netaddr, 128, ISC_TRUE);
+		result = dns_iptable_addprefix(src_acl->iptable, &netaddr,
+					       128, ISC_TRUE, ISC_FALSE);
 		if (result != ISC_R_SUCCESS)
 			goto clean;

@@ -6583,9 +6559,9 @@ dotat(dns_keytable_t *keytable, dns_keynode_t *keynode, void *arg) {

 	result = dns_resolver_createfetch(view->resolver, tatname,
 					  dns_rdatatype_null, NULL, NULL,
-					  NULL, 0, tat->task, tat_done, tat,
-					  &tat->rdataset, &tat->sigrdataset,
-					  &tat->fetch);
+					  NULL, NULL, 0, 0, 0, NULL, tat->task,
+					  tat_done, tat, &tat->rdataset,
+					  &tat->sigrdataset, &tat->fetch);

 	if (result != ISC_R_SUCCESS) {
 		isc_task_detach(&tat->task);
@@ -6837,7 +6813,7 @@ generate_session_key(const char *filename, const char *keynamestr,
 	/* generate key */
 	result = dst_key_generate(keyname, algtype, bits, 1, 0,
 				  DNS_KEYPROTO_ANY, dns_rdataclass_in,
-				  mctx, &key);
+				  mctx, &key, NULL);
 	if (result != ISC_R_SUCCESS)
 		return (result);

@@ -8531,8 +8507,7 @@ load_configuration(const char *filename, named_server_t *server,
 	/* Load the TKEY information from the configuration. */
 	if (options != NULL) {
 		dns_tkeyctx_t *t = NULL;
-		CHECKM(named_tkeyctx_fromconfig(options, named_g_mctx,
-						named_g_entropy, &t),
+		CHECKM(named_tkeyctx_fromconfig(options, named_g_mctx, &t),
 		       "configuring TKEY");
 		if (server->sctx->tkeyctx != NULL) {
 			dns_tkeyctx_destroy(&server->sctx->tkeyctx);
@@ -8547,72 +8522,6 @@ load_configuration(const char *filename, named_server_t *server,
 					named_g_aclconfctx),
 	       "binding control channel(s)");

-	/*
-	 * Open the source of entropy.
-	 */
-	if (first_time) {
-		const char *randomdev = NULL;
-		int level = ISC_LOG_ERROR;
-		obj = NULL;
-		result = named_config_get(maps, "random-device", &obj);
-		if (result == ISC_R_SUCCESS) {
-			if (!cfg_obj_isvoid(obj)) {
-				level = ISC_LOG_INFO;
-				randomdev = cfg_obj_asstring(obj);
-			}
-		}
-		if (randomdev == NULL) {
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-			isc_entropy_usehook(named_g_entropy, ISC_TRUE);
-#else
-			if ((obj != NULL) && !cfg_obj_isvoid(obj))
-				level = ISC_LOG_INFO;
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_SERVER, level,
-				      "no source of entropy found");
-			if ((obj == NULL) || cfg_obj_isvoid(obj)) {
-				CHECK(ISC_R_FAILURE);
-			}
-#endif
-		} else {
-			result = isc_entropy_createfilesource(named_g_entropy,
-							      randomdev);
-#ifdef PATH_RANDOMDEV
-			if (named_g_fallbackentropy != NULL) {
-				level = ISC_LOG_INFO;
-			}
-#endif
-			if (result != ISC_R_SUCCESS) {
-				isc_log_write(named_g_lctx,
-					      NAMED_LOGCATEGORY_GENERAL,
-					      NAMED_LOGMODULE_SERVER,
-					      level,
-					      "could not open "
-					      "entropy source %s: %s",
-					      randomdev,
-					      isc_result_totext(result));
-			}
-#ifdef PATH_RANDOMDEV
-			if (named_g_fallbackentropy != NULL) {
-				if (result != ISC_R_SUCCESS) {
-					isc_log_write(named_g_lctx,
-						      NAMED_LOGCATEGORY_GENERAL,
-						      NAMED_LOGMODULE_SERVER,
-						      ISC_LOG_INFO,
-						      "using pre-chroot "
-						      "entropy source %s",
-						      PATH_RANDOMDEV);
-					isc_entropy_detach(&named_g_entropy);
-					isc_entropy_attach(
-						   named_g_fallbackentropy,
-						   &named_g_entropy);
-				}
-				isc_entropy_detach(&named_g_fallbackentropy);
-			}
-#endif
-		}
-	}
-
 #ifdef HAVE_LMDB
 	/*
 	 * If we're using LMDB, we may have created newzones databases
@@ -8850,11 +8759,6 @@ load_configuration(const char *filename, named_server_t *server,
 		server->flushonshutdown = ISC_FALSE;
 	}

-	obj = NULL;
-	result = named_config_get(maps, "answer-cookie", &obj);
-	INSIST(result == ISC_R_SUCCESS);
-	server->sctx->answercookie = cfg_obj_asboolean(obj);
-
 	obj = NULL;
 	result = named_config_get(maps, "cookie-algorithm", &obj);
 	INSIST(result == ISC_R_SUCCESS);
@@ -8947,14 +8851,8 @@ load_configuration(const char *filename, named_server_t *server,
 			}
 		}
 	} else {
-		result = isc_entropy_getdata(named_g_entropy,
-					     server->sctx->secret,
-					     sizeof(server->sctx->secret),
-					     NULL,
-					     0);
-		if (result != ISC_R_SUCCESS) {
-			goto cleanup;
-		}
+		isc_random_buf(server->sctx->secret,
+			       sizeof(server->sctx->secret));
 	}

 	/*
@@ -9032,7 +8930,7 @@ load_configuration(const char *filename, named_server_t *server,
 		{
 			dns_view_setviewrevert(view);
 			(void)dns_zt_apply(view->zonetable, ISC_FALSE,
-					   removed, view);
+					   NULL, removed, view);
 		}
 		dns_view_detach(&view);
 	}
@@ -9208,8 +9106,7 @@ run_server(isc_task_t *task, isc_event_t *event) {

 	isc_event_free(&event);

-	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, named_g_entropy,
-					  &named_g_dispatchmgr),
+	CHECKFATAL(dns_dispatchmgr_create(named_g_mctx, &named_g_dispatchmgr),
 		   "creating dispatch manager");

 	dns_dispatchmgr_setstats(named_g_dispatchmgr, server->resolverstats);
@@ -9267,8 +9164,6 @@ run_server(isc_task_t *task, isc_event_t *event) {
 	CHECKFATAL(load_configuration(named_g_conffile, server, ISC_TRUE),
 		   "loading configuration");

-	isc_hash_init();
-
 	CHECKFATAL(load_zones(server, ISC_TRUE, ISC_FALSE), "loading zones");
 #ifdef ENABLE_AFL
 	named_g_run_done = ISC_TRUE;
@@ -9445,8 +9340,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	server->in_roothints = NULL;

 	/* Must be first. */
-	CHECKFATAL(dst_lib_init2(named_g_mctx, named_g_entropy,
-				 named_g_engine, ISC_ENTROPY_GOODONLY),
+	CHECKFATAL(dst_lib_init(named_g_mctx, named_g_engine),
 		   "initializing DST");

 	CHECKFATAL(dns_rootns_create(mctx, dns_rdataclass_in, NULL,
@@ -9476,8 +9370,7 @@ named_server_create(isc_mem_t *mctx, named_server_t **serverp) {
 	isc_taskmgr_setexcltask(named_g_taskmgr, server->task);

 	server->sctx = NULL;
-	CHECKFATAL(ns_server_create(mctx, named_g_entropy,
-				    get_matching_view,
+	CHECKFATAL(ns_server_create(mctx, get_matching_view,
 				    &server->sctx),
 		   "creating server context");

@@ -10400,7 +10293,7 @@ add_view_tolist(struct dumpcontext *dctx, dns_view_t *view) {
 	ISC_LIST_INIT(vle->zonelist);
 	ISC_LIST_APPEND(dctx->viewlist, vle, link);
 	if (dctx->dumpzones)
-		result = dns_zt_apply(view->zonetable, ISC_TRUE,
+		result = dns_zt_apply(view->zonetable, ISC_TRUE, NULL,
 				      add_zone_tolist, dctx);
 	return (result);
 }
@@ -10897,7 +10790,7 @@ named_server_validation(named_server_t *server, isc_lex_t *lex,
 	{
 		if (ptr != NULL && strcasecmp(ptr, view->name) != 0)
 			continue;
-		CHECK(dns_view_flushcache(view));
+		CHECK(dns_view_flushcache(view, ISC_FALSE));

 		if (set) {
 			view->enablevalidation = enable;
@@ -10988,7 +10881,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 		if (ptr != NULL && !nsc->needflush)
 			continue;
 		nsc->needflush = ISC_TRUE;
-		result = dns_view_flushcache2(nsc->primaryview, ISC_FALSE);
+		result = dns_view_flushcache(nsc->primaryview, ISC_FALSE);
 		if (result != ISC_R_SUCCESS) {
 			flushed = ISC_FALSE;
 			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
@@ -11019,7 +10912,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex) {
 		     nsc = ISC_LIST_NEXT(nsc, link)) {
 			if (!nsc->needflush || nsc->cache != view->cache)
 				continue;
-			result = dns_view_flushcache2(view, ISC_TRUE);
+			result = dns_view_flushcache(view, ISC_TRUE);
 			if (result != ISC_R_SUCCESS) {
 				flushed = ISC_FALSE;
 				isc_log_write(named_g_lctx,
@@ -11639,7 +11532,7 @@ named_server_sync(named_server_t *server, isc_lex_t *lex, isc_buffer_t **text) {
 		     view != NULL;
 		     view = ISC_LIST_NEXT(view, link)) {
 			result = dns_zt_apply(view->zonetable, ISC_FALSE,
-					      synczone, &cleanup);
+					      NULL, synczone, &cleanup);
 			if (result != ISC_R_SUCCESS &&
 			    tresult == ISC_R_SUCCESS)
 				tresult = result;
@@ -13635,7 +13528,7 @@ generate_salt(unsigned char *salt, size_t saltlen) {
 	if (saltlen > 256U)
 		return (ISC_R_RANGE);

-	isc_rng_randombytes(named_g_server->sctx->rngctx, salt, saltlen);
+	isc_random_buf(salt, saltlen);

 	r.base = salt;
 	r.length = (unsigned int) saltlen;
@@ -13950,10 +13843,18 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 	}

 	/* Serial number */
-	serial = dns_zone_getserial(mayberaw);
+	result = dns_zone_getserial(mayberaw, &serial);
+	/* XXXWPK TODO this is to mirror old behavior with dns_zone_getserial */
+	if (result != ISC_R_SUCCESS) {
+		serial = 0;
+	}
 	snprintf(serbuf, sizeof(serbuf), "%u", serial);
 	if (hasraw) {
-		signed_serial = dns_zone_getserial(zone);
+		result = dns_zone_getserial(zone, &signed_serial);
+		/* XXXWPK TODO ut supra */
+		if (result != ISC_R_SUCCESS) {
+			serial = 0;
+		}
 		snprintf(sserbuf, sizeof(sserbuf), "%u", signed_serial);
 	}

@@ -100,7 +100,7 @@ user_zonetype( dns_zone_t *zone ) {
 	};
 	const struct zt *tp;

-	if ((dns_zone_getoptions2(zone) & DNS_ZONEOPT2_AUTOEMPTY) != 0)
+	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0)
 		return ("builtin");

 	view = dns_zone_getview(zone);
@@ -1494,7 +1494,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer)); /* type */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
-	if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
+	if (dns_zone_getserial(zone, &serial) == ISC_R_SUCCESS)
 		TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
 	else
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
@@ -1916,7 +1916,7 @@ generatexml(named_server_t *server, isc_uint32_t flags,
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
 			result = dns_zt_apply(view->zonetable, ISC_TRUE,
-					      zone_xmlrender, writer);
+					      NULL, zone_xmlrender, writer);
 			if (result != ISC_R_SUCCESS)
 				goto error;
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
@@ -2271,7 +2271,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
 	class_only = classbuf;

-	if (dns_zone_getserial2(zone, &serial) != ISC_R_SUCCESS)
+	if (dns_zone_getserial(zone, &serial) != ISC_R_SUCCESS)
 		zoneobj = addzone(zone_name_only, class_only,
 				  user_zonetype(zone), 0, ISC_FALSE);
 	else
@@ -2609,8 +2609,10 @@ generatejson(named_server_t *server, size_t *msglen,
 			CHECKMEM(za);

 			if ((flags & STATS_JSON_ZONES) != 0) {
-				result = dns_zt_apply(view->zonetable, ISC_TRUE,
-						      zone_jsonrender, za);
+				result = dns_zt_apply(view->zonetable,
+						      ISC_TRUE,
+						      NULL, zone_jsonrender,
+						      za);
 				if (result != ISC_R_SUCCESS) {
 					goto error;
 				}
@@ -3104,6 +3106,7 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	   isc_httpdfree_t **freecb, void **freecb_args)
 {
 	isc_result_t result;
+	char *_headers = NULL;

 	UNUSED(url);
 	UNUSED(querystring);
@@ -3115,30 +3118,45 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,

 	if (urlinfo->isstatic) {
 		isc_time_t when;
-		char *p = strcasestr(headers, "If-Modified-Since: ");
+		char *line, *saveptr;
+		const char *if_modified_since = "If-Modified-Since: ";
+		_headers = strdup(headers);

-		if (p != NULL) {
-			time_t t1, t2;
-			p += strlen("If-Modified-Since: ");
-			result = isc_time_parsehttptimestamp(p, &when);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+		if (_headers == NULL) {
+			goto send;
+		}

-			result = isc_time_secondsastimet(&when, &t1);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+		saveptr = NULL;
+		for (line = strtok_r(_headers, "\n", &saveptr);
+		     line;
+		     line = strtok_r(NULL, "\n", &saveptr)) {
+			if (strncasecmp(line, if_modified_since,
+					strlen(if_modified_since)) == 0) {
+				time_t t1, t2;
+				line += strlen(if_modified_since);
+				result = isc_time_parsehttptimestamp(line, &when);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			result = isc_time_secondsastimet(&urlinfo->loadtime,
-							 &t2);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+				result = isc_time_secondsastimet(&when, &t1);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			if (t1 < t2)
-				goto send;
+				result = isc_time_secondsastimet(&urlinfo->loadtime, &t2);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			*retcode = 304;
-			*retmsg = "Not modified";
-			return (ISC_R_SUCCESS);
+				if (t1 < t2) {
+					goto send;
+				}
+
+				*retcode = 304;
+				*retmsg = "Not modified";
+				goto end;
+			}
 		}
 	}

@@ -3147,7 +3165,8 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	*retmsg = "OK";
 	isc_buffer_reinit(b, xslmsg, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
-
+end:
+	free(_headers);
 	return (ISC_R_SUCCESS);
 }

@@ -3177,7 +3196,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);

 	LOCK(&listener->lock);
-	if (dns_acl_match(&netaddr, NULL, listener->acl, env,
+	if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
 			  &match, NULL) == ISC_R_SUCCESS && match > 0)
 	{
 		UNLOCK(&listener->lock);
@@ -45,7 +45,7 @@

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
+			 dns_tkeyctx_t **tctxp)
 {
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
@@ -57,7 +57,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 	const cfg_obj_t *obj;
 	int type;

-	result = dns_tkeyctx_create(mctx, ectx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);

@@ -17,7 +17,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =	@CRYPTO@
+CDEFINES =
 CWARNINGS =

 OBJS =		os.@O@ dlz_dlopen_driver.@O@
@@ -231,47 +231,18 @@ linux_setcaps(cap_t caps) {
 		cap_free(curcaps); \
 	} while (0)
 #else
-#define SET_CAP(flag) \
-	do { \
-		if (curcaps & (1 << (flag))) { \
-			caps |= (1 << (flag)); \
-		} \
-	} while (0)
+#define SET_CAP(flag) do { caps |= (1 << (flag)); } while (0)
 #define INIT_CAP do { caps = 0; } while (0)
 #endif /* HAVE_LIBCAP */

-#ifndef HAVE_LIBCAP
-/*%
- * Store the bitmask representing the permitted capability set in 'capsp'.  To
- * match libcap-enabled behavior, capget() syscall errors are not reported,
- * they just cause 'capsp' to be set to 0, which effectively prevents any
- * capability from being subsequently requested.
- */
-static void
-linux_getpermittedcaps(cap_t *capsp) {
-	struct __user_cap_header_struct caphead;
-	struct __user_cap_data_struct curcaps;
-
-	memset(&caphead, 0, sizeof(caphead));
-	caphead.version = _LINUX_CAPABILITY_VERSION;
-	caphead.pid = 0;
-	memset(&curcaps, 0, sizeof(curcaps));
-	syscall(SYS_capget, &caphead, &curcaps);
-
-	*capsp = curcaps.permitted;
-}
-#endif /* HAVE_LIBCAP */
-
 static void
 linux_initialprivs(void) {
-	cap_t curcaps;
 	cap_t caps;
 #ifdef HAVE_LIBCAP
+	cap_t curcaps;
 	cap_value_t capval;
 	char strbuf[ISC_STRERRORSIZE];
 	int err;
-#else
-	linux_getpermittedcaps(&curcaps);
 #endif

 	/*%
@@ -336,14 +307,12 @@ linux_initialprivs(void) {

 static void
 linux_minprivs(void) {
-	cap_t curcaps;
 	cap_t caps;
 #ifdef HAVE_LIBCAP
+	cap_t curcaps;
 	cap_value_t capval;
 	char strbuf[ISC_STRERRORSIZE];
 	int err;
-#else
-	linux_getpermittedcaps(&curcaps);
 #endif

 	INIT_CAP;
@@ -1034,36 +1003,24 @@ named_os_gethostname(char *buf, size_t len) {
 	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
 }

-static char *
-next_token(char **stringp, const char *delim) {
-	char *res;
-
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
-}
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text) {
-	char *input, *ptr;
+	char *last, *ptr;
 	pid_t pid;

-	input = command;

 	/* Skip the command name. */
-	ptr = next_token(&input, " \t");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(command, " \t", &last)) == NULL) {
 		return;
+	}

-	ptr = next_token(&input, " \t");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(NULL, " \t", &last)) == NULL) {
 		return;
+	}

-	if (strcmp(ptr, "-p") != 0)
+	if (strcmp(ptr, "-p") != 0) {
 		return;
+	}

 #ifdef HAVE_LINUXTHREADS
 	pid = mainpid;
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup>
    <Filter Include="Source Files">
@@ -99,9 +99,6 @@
    <ClInclude Include="..\include\named\main.h">
      <Filter>Header Files</Filter>
    </ClInclude>
-    <ClInclude Include="..\include\named\seccomp.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
    <ClInclude Include="..\include\named\server.h">
      <Filter>Header Files</Filter>
    </ClInclude>
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
@@ -132,7 +132,6 @@
    <ClInclude Include="..\include\named\log.h" />
    <ClInclude Include="..\include\named\logconf.h" />
    <ClInclude Include="..\include\named\main.h" />
-    <ClInclude Include="..\include\named\seccomp.h" />
    <ClInclude Include="..\include\named\server.h" />
    <ClInclude Include="..\include\named\statschannel.h" />
    <ClInclude Include="..\include\named\tkeyconf.h" />
@@ -1048,21 +1048,21 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;

-		RETERR(dns_zone_setfile3(raw, filename,
-					 masterformat, masterstyle));
+		RETERR(dns_zone_setfile(raw, filename,
+					masterformat, masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 		if (signedname == NULL)
 			return (ISC_R_NOMEMORY);

 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		result = dns_zone_setfile3(zone, signedname,
-					   dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	} else
-		RETERR(dns_zone_setfile3(zone, filename,
-					 masterformat, masterstyle));
+		RETERR(dns_zone_setfile(zone, filename,
+					masterformat, masterstyle));

 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
@@ -1285,16 +1285,25 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "ixfr-from-differences", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		if (cfg_obj_isboolean(obj))
+		if (cfg_obj_isboolean(obj)) {
 			ixfrdiff = cfg_obj_asboolean(obj);
-		else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
-			 ztype == dns_zone_master)
+		} else if ((strcasecmp(cfg_obj_asstring(obj),
+				       "primary") == 0 ||
+			   strcasecmp(cfg_obj_asstring(obj),
+				       "master") == 0) &&
+			   ztype == dns_zone_master)
+		{
 			ixfrdiff = ISC_TRUE;
-		else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
-			ztype == dns_zone_slave)
+		} else if ((strcasecmp(cfg_obj_asstring(obj),
+				       "secondary") == 0 ||
+			   strcasecmp(cfg_obj_asstring(obj),
+				       "slave") == 0) &&
+			   ztype == dns_zone_slave)
+		{
 			ixfrdiff = ISC_TRUE;
-		else
+		} else {
 			ixfrdiff = ISC_FALSE;
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS,
 					   ISC_TRUE);
@@ -1429,36 +1438,37 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	if (ztype == dns_zone_master || raw != NULL) {
-		const cfg_obj_t *validity, *resign;
 		isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
-		isc_boolean_t sigvalinsecs;
+
+		obj = NULL;
+		result = named_config_get(maps, "dnskey-sig-validity", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		seconds = cfg_obj_asuint32(obj) * 86400;
+		dns_zone_setkeyvalidityinterval(zone, seconds);

 		obj = NULL;
 		result = named_config_get(maps, "sig-validity-interval", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		{
+			const cfg_obj_t *validity, *resign;

-		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
-						   NS_SERVER_SIGVALINSECS);
-		validity = cfg_tuple_get(obj, "validity");
-		seconds = cfg_obj_asuint32(validity);
-		if (!sigvalinsecs) {
-			seconds *= 86400;
-		}
-		dns_zone_setsigvalidityinterval(zone, seconds);
+			validity = cfg_tuple_get(obj, "validity");
+			seconds = cfg_obj_asuint32(validity) * 86400;
+			dns_zone_setsigvalidityinterval(zone, seconds);

-		resign = cfg_tuple_get(obj, "re-sign");
-		if (cfg_obj_isvoid(resign)) {
-			seconds /= 4;
-		} else if (!sigvalinsecs) {
-			if (seconds > 7 * 86400) {
-				seconds = cfg_obj_asuint32(resign) * 86400;
+			resign = cfg_tuple_get(obj, "re-sign");
+			if (cfg_obj_isvoid(resign)) {
+				seconds /= 4;
 			} else {
-				seconds = cfg_obj_asuint32(resign) * 3600;
+				if (seconds > 7 * 86400)
+					seconds = cfg_obj_asuint32(resign) *
+							86400;
+				else
+					seconds = cfg_obj_asuint32(resign) *
+							3600;
 			}
-		} else {
-			seconds = cfg_obj_asuint32(resign);
+			dns_zone_setsigresigninginterval(zone, seconds);
 		}
-		dns_zone_setsigresigninginterval(zone, seconds);

 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);
@@ -23,7 +23,7 @@ CINCLUDES =	${DNS_INCLUDES} ${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${ISCCFG_INCLUDES} ${IRS_INCLUDES} ${DST_GSSAPI_INC} \
 		@DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@ @USE_GSSAPI@
+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_GSSAPI@
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -39,7 +39,7 @@
 nsupdate \- Dynamic DNS update utility
 .SH "SYNOPSIS"
 .HP \w'\fBnsupdate\fR\ 'u
-\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-i\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-R\ \fR\fB\fIrandomdev\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [filename]
+\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-i\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [filename]
 .SH "DESCRIPTION"
 .PP
 \fBnsupdate\fR
@@ -160,17 +160,6 @@ option\&.
 The number of UDP retries\&. The default is 3\&. If zero, only one update request will be made\&.
 .RE
 .PP
-\-R \fIrandomdev\fR
-.RS 4
-Where to obtain randomness\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&. This option may be specified multiple times\&.
-.RE
-.PP
 \-t \fItimeout\fR
 .RS 4
 The maximum time an update request can take before it is aborted\&. The default is 300 seconds\&. Zero can be used to disable the timeout\&.
@@ -23,7 +23,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -174,7 +173,6 @@ static isc_sockaddr_t *localaddr4 = NULL;
 static isc_sockaddr_t *localaddr6 = NULL;
 static const char *keyfile = NULL;
 static char *keystr = NULL;
-static isc_entropy_t *entropy = NULL;
 static isc_boolean_t shuttingdown = ISC_FALSE;
 static FILE *input;
 static isc_boolean_t interactive = ISC_TRUE;
@@ -244,73 +242,6 @@ error(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 #define STATUS_QUIT	(isc_uint16_t)2
 #define STATUS_SYNTAX	(isc_uint16_t)3

-typedef struct entropysource entropysource_t;
-
-struct entropysource {
-	isc_entropysource_t *source;
-	isc_mem_t *mctx;
-	ISC_LINK(entropysource_t) link;
-};
-
-static ISC_LIST(entropysource_t) sources;
-
-static void
-setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
-	isc_result_t result;
-	isc_entropysource_t *source = NULL;
-	entropysource_t *elt;
-	int usekeyboard = ISC_ENTROPY_KEYBOARDMAYBE;
-
-	REQUIRE(ectx != NULL);
-
-	if (*ectx == NULL) {
-		result = isc_entropy_create(mctx, ectx);
-		if (result != ISC_R_SUCCESS)
-			fatal("could not create entropy object: %s",
-			      isc_result_totext(result));
-		ISC_LIST_INIT(sources);
-	}
-
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
-		randomfile = NULL;
-	}
-
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(*ectx, ISC_TRUE);
-	}
-#endif
-	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
-					   usekeyboard);
-
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize entropy source: %s",
-		      isc_result_totext(result));
-
-	if (source != NULL) {
-		elt = isc_mem_get(mctx, sizeof(*elt));
-		if (elt == NULL)
-			fatal("out of memory");
-		elt->source = source;
-		elt->mctx = mctx;
-		ISC_LINK_INIT(elt, link);
-		ISC_LIST_APPEND(sources, elt, link);
-	}
-}
-
-static void
-cleanup_entropy(isc_entropy_t **ectx) {
-	entropysource_t *source;
-	while (!ISC_LIST_EMPTY(sources)) {
-		source = ISC_LIST_HEAD(sources);
-		ISC_LIST_UNLINK(sources, source, link);
-		isc_entropy_destroysource(&source->source);
-		isc_mem_put(source->mctx, source, sizeof(*source));
-	}
-	isc_entropy_detach(ectx);
-}
-
 static void
 master_from_servers(void) {

@@ -800,8 +731,6 @@ doshutdown(void) {
 		is_dst_up = ISC_FALSE;
 	}

-	cleanup_entropy(&entropy);
-
 	ddebug("Destroying request manager");
 	dns_requestmgr_detach(&requestmgr);

@@ -967,13 +896,7 @@ setup_system(void) {

 	irs_resconf_destroy(&resconf);

-	if (entropy == NULL)
-		setup_entropy(gmctx, NULL, &entropy);
-
-	result = isc_hash_create(gmctx, entropy, DNS_NAME_MAXWIRE);
-	check_result(result, "isc_hash_create");
-
-	result = dns_dispatchmgr_create(gmctx, entropy, &dispatchmgr);
+	result = dns_dispatchmgr_create(gmctx, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");

 	result = isc_socketmgr_create(gmctx, &socketmgr);
@@ -991,13 +914,10 @@ setup_system(void) {
 	result = isc_task_onshutdown(global_task, shutdown_program, NULL);
 	check_result(result, "isc_task_onshutdown");

-	result = dst_lib_init(gmctx, entropy, 0);
+	result = dst_lib_init(gmctx, NULL);
 	check_result(result, "dst_lib_init");
 	is_dst_up = ISC_TRUE;

-	/* moved after dst_lib_init() */
-	isc_hash_init();
-
 	attrmask = DNS_DISPATCHATTR_UDP | DNS_DISPATCHATTR_TCP;
 	attrmask |= DNS_DISPATCHATTR_IPV4 | DNS_DISPATCHATTR_IPV6;

@@ -1144,7 +1064,7 @@ pre_parse_args(int argc, char **argv) {
 }

 static void
-parse_args(int argc, char **argv, isc_mem_t *mctx, isc_entropy_t **ectx) {
+parse_args(int argc, char **argv) {
 	int ch;
 	isc_uint32_t i;
 	isc_result_t result;
@@ -1251,7 +1171,7 @@ parse_args(int argc, char **argv, isc_mem_t *mctx, isc_entropy_t **ectx) {
 			break;

 		case 'R':
-			setup_entropy(mctx, isc_commandline_argument, ectx);
+			fatal("The -R options has been deprecated.\n");
 			break;

 		default:
@@ -2495,11 +2415,11 @@ send_update(dns_name_t *zone, isc_sockaddr_t *master) {
 	if (updatemsg->tsigname)
 		updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS;

-	result = dns_request_createvia3(requestmgr, updatemsg, srcaddr,
-					master, options, tsigkey, timeout,
-					udp_timeout, udp_retries, global_task,
-					update_completed, NULL, &request);
-	check_result(result, "dns_request_createvia3");
+	result = dns_request_createvia(requestmgr, updatemsg, srcaddr,
+				       master, -1, options, tsigkey, timeout,
+				       udp_timeout, udp_retries, global_task,
+				       update_completed, NULL, &request);
+	check_result(result, "dns_request_createvia");

 	if (debugging)
 		show_message(stdout, updatemsg, "Outgoing update query:");
@@ -2604,13 +2524,13 @@ recvsoa(isc_task_t *task, isc_event_t *event) {
 		else
 			srcaddr = localaddr4;

-		result = dns_request_createvia3(requestmgr, soaquery, srcaddr,
-						addr, 0, NULL,
-						FIND_TIMEOUT * 20,
-						FIND_TIMEOUT, 3,
-						global_task, recvsoa, reqinfo,
-						&request);
-		check_result(result, "dns_request_createvia3");
+		result = dns_request_createvia(requestmgr, soaquery, srcaddr,
+					       addr, -1, 0, NULL,
+					       FIND_TIMEOUT * 20,
+					       FIND_TIMEOUT, 3,
+					       global_task, recvsoa, reqinfo,
+					       &request);
+		check_result(result, "dns_request_createvia");
 		requests++;
 		return;
 	}
@@ -2806,11 +2726,11 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	else
 		srcaddr = localaddr4;

-	result = dns_request_createvia3(requestmgr, msg, srcaddr, destaddr, 0,
-					default_servers ? NULL : tsigkey,
-					FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
-					global_task, recvsoa, reqinfo, request);
-	check_result(result, "dns_request_createvia3");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr, -1,
+				       0, default_servers ? NULL : tsigkey,
+				       FIND_TIMEOUT * 20, FIND_TIMEOUT, 3,
+				       global_task, recvsoa, reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	requests++;
 }

@@ -2916,33 +2836,31 @@ start_gssrequest(dns_name_t *master) {
 	if (realm == NULL)
 		get_ticket_realm(gmctx);

-	result = isc_string_printf(servicename, sizeof(servicename),
-				   "DNS/%s%s", namestr, realm ? realm : "");
-	if (result != ISC_R_SUCCESS)
-		fatal("isc_string_printf(servicename) failed: %s",
-		      isc_result_totext(result));
+	result = snprintf(servicename, sizeof(servicename), "DNS/%s%s", namestr, realm ? realm : "");
+	RUNTIME_CHECK(result < sizeof(servicename));
 	isc_buffer_init(&buf, servicename, strlen(servicename));
 	isc_buffer_add(&buf, strlen(servicename));
 	result = dns_name_fromtext(servname, &buf, dns_rootname, 0, NULL);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(servname) failed: %s",
 		      isc_result_totext(result));
+	}

 	keyname = dns_fixedname_initname(&fkname);

-	isc_random_get(&val);
-	result = isc_string_printf(mykeystr, sizeof(mykeystr), "%u.sig-%s",
-				   val, namestr);
-	if (result != ISC_R_SUCCESS)
-		fatal("isc_string_printf(mykeystr) failed: %s",
-		      isc_result_totext(result));
+	val = isc_random();
+
+	result = snprintf(mykeystr, sizeof(mykeystr), "%u.sig-%s", val, namestr);
+	RUNTIME_CHECK(result <= sizeof(mykeystr));
+
 	isc_buffer_init(&buf, mykeystr, strlen(mykeystr));
 	isc_buffer_add(&buf, strlen(mykeystr));

 	result = dns_name_fromtext(keyname, &buf, dns_rootname, 0, NULL);
-	if (result != ISC_R_SUCCESS)
+	if (result != ISC_R_SUCCESS) {
 		fatal("dns_name_fromtext(keyname) failed: %s",
 		      isc_result_totext(result));
+	}

 	/* Windows doesn't recognize name compression in the key name. */
 	keyname->attributes |= DNS_NAMEATTR_NOCOMPRESS;
@@ -3002,11 +2920,11 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg,
 	else
 		srcaddr = localaddr4;

-	result = dns_request_createvia3(requestmgr, msg, srcaddr, destaddr,
-					options, tsigkey, FIND_TIMEOUT * 20,
-					FIND_TIMEOUT, 3, global_task, recvgss,
-					reqinfo, request);
-	check_result(result, "dns_request_createvia3");
+	result = dns_request_createvia(requestmgr, msg, srcaddr, destaddr,
+				       -1, options, tsigkey, FIND_TIMEOUT * 20,
+				       FIND_TIMEOUT, 3, global_task, recvgss,
+				       reqinfo, request);
+	check_result(result, "dns_request_createvia");
 	if (debugging)
 		show_message(stdout, msg, "Outgoing update query:");
 	requests++;
@@ -3297,9 +3215,6 @@ cleanup(void) {
 	ddebug("Shutting down timer manager");
 	isc_timermgr_destroy(&timermgr);

-	ddebug("Destroying hash context");
-	isc_hash_destroy();
-
 	ddebug("Destroying name state");
 	dns_name_destroy();

@@ -3362,7 +3277,7 @@ main(int argc, char **argv) {
 	result = isc_mem_create(0, 0, &gmctx);
 	check_result(result, "isc_mem_create");

-	parse_args(argc, argv, gmctx, &entropy);
+	parse_args(argc, argv);

 	setup_system();

@@ -70,7 +70,6 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">timeout</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">udptimeout</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">udpretries</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-v</option></arg>
      <arg choice="opt" rep="norepeat"><option>-T</option></arg>
      <arg choice="opt" rep="norepeat"><option>-P</option></arg>
@@ -269,22 +268,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-R <replaceable class="parameter">randomdev</replaceable></term>
-	<listitem>
-	<para>
-	  Where to obtain randomness. If the operating system
-	  does not provide a <filename>/dev/random</filename> or
-	  equivalent device, the default source of randomness is keyboard
-	  input.  <filename>randomdev</filename> specifies the name of
-	  a character device or file containing random data to be used
-	  instead of the default.  The special value
-	  <filename>keyboard</filename> indicates that keyboard input
-	  should be used.  This option may be specified multiple times.
-	</para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-t <replaceable class="parameter">timeout</replaceable></term>
 	<listitem>
@@ -46,7 +46,6 @@
       [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>]
       [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>]
       [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>]
-       [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-v</code>]
       [<code class="option">-T</code>]
       [<code class="option">-P</code>]
@@ -214,19 +213,6 @@
 	    one update request will be made.
 	  </p>
 	</dd>
-<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-	<p>
-	  Where to obtain randomness. If the operating system
-	  does not provide a <code class="filename">/dev/random</code> or
-	  equivalent device, the default source of randomness is keyboard
-	  input.  <code class="filename">randomdev</code> specifies the name of
-	  a character device or file containing random data to be used
-	  instead of the default.  The special value
-	  <code class="filename">keyboard</code> indicates that keyboard input
-	  should be used.  This option may be specified multiple times.
-	</p>
-	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
 <dd>
 	  <p>
@@ -39,7 +39,7 @@
 dnssec-keymgr \- Ensures correct DNSKEY coverage for a zone based on a defined policy
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keymgr\fR\ 'u
-\fBdnssec\-keymgr\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-c\ \fR\fB\fIfile\fR\fR] [\fB\-f\fR] [\fB\-k\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-z\fR] [\fB\-g\ \fR\fB\fIpath\fR\fR] [\fB\-r\ \fR\fB\fIpath\fR\fR] [\fB\-s\ \fR\fB\fIpath\fR\fR] [zone...]
+\fBdnssec\-keymgr\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-c\ \fR\fB\fIfile\fR\fR] [\fB\-f\fR] [\fB\-k\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-z\fR] [\fB\-g\ \fR\fB\fIpath\fR\fR] [\fB\-s\ \fR\fB\fIpath\fR\fR] [zone...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keymgr\fR
@@ -123,15 +123,6 @@ and
 \fBdnssec\-settime\fR\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies a path to a file containing random data\&. This is passed to the
-\fBdnssec\-keygen\fR
-binary using its
-\fB\-r\fR
-option\&.
-.RE
-.PP
 \-s \fIsettime\-path\fR
 .RS 4
 Specifies a path to a
@@ -49,7 +49,6 @@
      <arg choice="opt" rep="norepeat"><option>-v</option></arg>
      <arg choice="opt" rep="norepeat"><option>-z</option></arg>
      <arg choice="opt" rep="norepeat"><option>-g <replaceable class="parameter">path</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">path</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">path</replaceable></option></arg>
      <arg choice="opt" rep="repeat">zone</arg>
    </cmdsynopsis>
@@ -187,18 +186,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies a path to a file containing random data.
-	    This is passed to the <command>dnssec-keygen</command> binary
-	    using its <option>-r</option> option.
-<!-- TODO: what to do about "-r keyboard"? -->
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-s <replaceable class="parameter">settime-path</replaceable></term>
 	<listitem>
@@ -41,7 +41,6 @@
       [<code class="option">-v</code>]
       [<code class="option">-z</code>]
       [<code class="option">-g <em class="replaceable"><code>path</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>path</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>path</code></em></code>]
       [zone...]
    </p></div>
@@ -160,15 +159,6 @@
 	    and <span class="command"><strong>dnssec-settime</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies a path to a file containing random data.
-	    This is passed to the <span class="command"><strong>dnssec-keygen</strong></span> binary
-	    using its <code class="option">-r</code> option.
-
-	  </p>
-	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>settime-path</code></em></span></dt>
 <dd>
 	  <p>
@@ -76,7 +76,7 @@ def parse_args():
                        help='Path to \'dnssec-keygen\'',
                        metavar='path')
    parser.add_argument('-r', dest='randomdev', type=str, default=None,
-                        help='Path to a file containing random data to pass to \'dnssec-keygen\'',
+                        help='DEPRECATED',
                        metavar='path')
    parser.add_argument('-s', dest='settime', default=settime, type=str,
                        help='Path to \'dnssec-settime\'',
@@ -97,6 +97,9 @@ def parse_args():

    args = parser.parse_args()

+    if args.randomdev:
+        fatal("ERROR: -r option has been deprecated.")
+    
    if args.no_zsk and args.no_ksk:
        fatal("ERROR: -z and -k cannot be used together.")

@@ -524,25 +524,13 @@ See also
 \fBrndc managed\-keys\fR\&.
 .RE
 .PP
-\fBserve\-stale ( on | off | reset | status ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
+\fBserve\-stale ( on | off | status | reset ) \fR\fB[\fIclass\fR [\fIview\fR]]\fR
 .RS 4
-Enable, disable, reset, or report the current status of the serving of stale answers as configured in
-named\&.conf\&.
+Enable, disable, or reset the serving of stale answers as configured in named\&.conf\&. Serving of stale answers will remain disabled across
+named\&.conf
+reloads if disabled via rndc until it is reset via rndc\&.
 .sp
-If serving of stale answers is disabled by
-\fBrndc\-serve\-stale off\fR, then it will remain disabled even if
-\fBnamed\fR
-is reloaded or reconfigured\&.
-\fBrndc serve\-stale reset\fR
-restores the setting as configured in
-named\&.conf\&.
-.sp
-\fBrndc serve\-stale status\fR
-will report whether serving of stale answers is currently enabled, disabled by the configuration, or disabled by
-\fBrndc\fR\&. It will also report the values of
-\fBstale\-answer\-ttl\fR
-and
-\fBmax\-stale\-ttl\fR\&.
+Status will report whether serving of stale answers is currently enabled, disabled or not configured for a view\&. If serving of stale records is configured then the values of stale\-answer\-ttl and max\-stale\-ttl are reported\&.
 .RE
 .PP
 \fBshowzone \fR\fB\fIzone\fR\fR\fB \fR\fB[\fIclass\fR [\fIview\fR]]\fR\fB \fR
@@ -930,7 +930,7 @@ main(int argc, char **argv) {
 	if (argc < 1)
 		usage(1);

-	isc_random_get(&serial);
+	serial = isc_random();

 	DO("create memory context", isc_mem_create(0, 0, &rndc_mctx));
 	DO("create socket manager", isc_socketmgr_create(rndc_mctx, &socketmgr));
@@ -785,28 +785,20 @@
      </varlistentry>

      <varlistentry>
-	<term><userinput>serve-stale ( on | off | reset | status ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
+	<term><userinput>serve-stale ( on | off | status | reset ) <optional><replaceable>class</replaceable> <optional><replaceable>view</replaceable></optional></optional></userinput></term>
 	<listitem>
 	  <para>
-	    Enable, disable, reset, or report the current status
-            of the serving of stale answers as configured in
-            <filename>named.conf</filename>.
+	    Enable, disable, or reset the serving of stale answers
+	    as configured in named.conf. Serving of stale answers
+	    will remain disabled across <filename>named.conf</filename>
+	    reloads if disabled via rndc until it is reset via rndc.
 	  </para>
 	  <para>
-            If serving of stale answers is disabled by
-            <command>rndc-serve-stale off</command>, then it
-	    will remain disabled even if <command>named</command>
-            is reloaded or reconfigured.
-            <command>rndc serve-stale reset</command> restores
-            the setting as configured in <filename>named.conf</filename>.
-	  </para>
-	  <para>
-	    <command>rndc serve-stale status</command> will report
-            whether serving of stale answers is currently enabled,
-            disabled by the configuration, or disabled by
-            <command>rndc</command>.  It will also report the
-	    values of <command>stale-answer-ttl</command> and
-	    <command>max-stale-ttl</command>.
+	    Status will report whether serving of stale answers is
+	    currently enabled, disabled or not configured for a
+	    view.  If serving of stale records is configured then
+	    the values of stale-answer-ttl and max-stale-ttl are
+	    reported.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -664,28 +664,20 @@
 	    See also <span class="command"><strong>rndc managed-keys</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | reset | status ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
+<dt><span class="term"><strong class="userinput"><code>serve-stale ( on | off | status | reset ) [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>]</code></strong></span></dt>
 <dd>
 	  <p>
-	    Enable, disable, reset, or report the current status
-            of the serving of stale answers as configured in
-            <code class="filename">named.conf</code>.
+	    Enable, disable, or reset the serving of stale answers
+	    as configured in named.conf. Serving of stale answers
+	    will remain disabled across <code class="filename">named.conf</code>
+	    reloads if disabled via rndc until it is reset via rndc.
 	  </p>
 	  <p>
-            If serving of stale answers is disabled by
-            <span class="command"><strong>rndc-serve-stale off</strong></span>, then it
-	    will remain disabled even if <span class="command"><strong>named</strong></span>
-            is reloaded or reconfigured.
-            <span class="command"><strong>rndc serve-stale reset</strong></span> restores
-            the setting as configured in <code class="filename">named.conf</code>.
-	  </p>
-	  <p>
-	    <span class="command"><strong>rndc serve-stale status</strong></span> will report
-            whether serving of stale answers is currently enabled,
-            disabled by the configuration, or disabled by
-            <span class="command"><strong>rndc</strong></span>.  It will also report the
-	    values of <span class="command"><strong>stale-answer-ttl</strong></span> and
-	    <span class="command"><strong>max-stale-ttl</strong></span>.
+	    Status will report whether serving of stale answers is
+	    currently enabled, disabled or not configured for a
+	    view.  If serving of stale records is configured then
+	    the values of stale-answer-ttl and max-stale-ttl are
+	    reported.
 	  </p>
 	</dd>
 <dt><span class="term"><strong class="userinput"><code>showzone <em class="replaceable"><code>zone</code></em> [<span class="optional"><em class="replaceable"><code>class</code></em> [<span class="optional"><em class="replaceable"><code>view</code></em></span>]</span>] </code></strong></span></dt>
@@ -1,5 +1,4 @@
 .libs
-genrandom
 headerdep_test.sh
 nxtify
 sdig
@@ -16,7 +16,7 @@ top_srcdir =	@top_srcdir@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 		@DST_OPENSSL_INC@

-CDEFINES =	@CRYPTO@
+CDEFINES =
 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@

@@ -79,7 +79,7 @@ clean distclean::
 check: test

 test:
-	@for dir in $(SUBDIRS) ;\
+	@for dir in $(TESTDIRS) ;\
 	do \
 		( cd $$dir; $(MAKE) test ) ;\
 	done
@@ -12,7 +12,6 @@
 /*! \file */
 #include <config.h>

-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -38,9 +37,8 @@

 isc_mem_t *mctx = NULL;
 isc_log_t *lctx = NULL;
-isc_entropy_t *ectx = NULL;

-static isc_boolean_t hash_active = ISC_FALSE, dst_active = ISC_FALSE;
+static isc_boolean_t dst_active = ISC_FALSE;

 /*
 * Logging categories: this needs to match the list in bin/named/log.c.
@@ -74,7 +72,7 @@ loadzone(dns_db_t **db, const char *origin, const char *filename) {
 	if (result != ISC_R_SUCCESS)
 		return (result);

-	result = dns_db_load(*db, filename);
+	result = dns_db_load(*db, filename, dns_masterformat_text, 0);
 	return (result);
 }

@@ -98,14 +96,10 @@ main(int argc, char **argv) {

 	isc_mem_debugging |= ISC_MEM_DEBUGRECORD;
 	CHECK(isc_mem_create(0, 0, &mctx));
-	CHECK(isc_entropy_create(mctx, &ectx));

-	CHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING));
+	CHECK(dst_lib_init(mctx, NULL));
 	dst_active = ISC_TRUE;

-	CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE));
-	hash_active = ISC_TRUE;
-
 	CHECK(isc_log_create(mctx, &lctx, &logconfig));
 	isc_log_registercategories(lctx, categories);
 	isc_log_setcontext(lctx);
@@ -152,12 +146,6 @@ main(int argc, char **argv) {
 		dst_lib_destroy();
 		dst_active = ISC_FALSE;
 	}
-	if (hash_active) {
-		isc_hash_destroy();
-		hash_active = ISC_FALSE;
-	}
-	if (ectx != NULL)
-		isc_entropy_detach(&ectx);
 	if (mctx != NULL)
 		isc_mem_destroy(&mctx);

@@ -16,7 +16,7 @@ top_srcdir =	@top_srcdir@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} ${ISCCFG_INCLUDES} \
 		@DST_OPENSSL_INC@ @DST_GSSAPI_INC@

-CDEFINES =	@CRYPTO@ @USE_GSSAPI@
+CDEFINES =	@USE_GSSAPI@

 CWARNINGS =
 BACKTRACECFLAGS = @BACKTRACECFLAGS@
@@ -47,8 +47,6 @@ XTARGETS =	adb_test@EXEEXT@ \
 		byname_test@EXEEXT@ \
 		db_test@EXEEXT@ \
 		dst_test@EXEEXT@ \
-		entropy_test@EXEEXT@ \
-		entropy2_test@EXEEXT@ \
 		gsstest@EXEEXT@ \
 		hash_test@EXEEXT@ \
 		fsaccess_test@EXEEXT@ \
@@ -80,8 +78,6 @@ XSRCS =		adb_test.c \
 		byname_test.c \
 		db_test.c \
 		dst_test.c \
-		entropy_test.c \
-		entropy2_test.c \
 		hash_test.c \
 		fsaccess_test.c \
 		gsstest.c \
@@ -19,7 +19,6 @@

 #include <isc/app.h>
 #include <isc/buffer.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/print.h>
 #include <isc/socket.h>
@@ -44,7 +43,6 @@ struct client {
 };

 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 static isc_mempool_t *cmp;
 static isc_log_t *lctx;
 static isc_logconfig_t *lcfg;
@@ -160,7 +158,7 @@ create_managers(void) {
 	check_result(result, "isc_socketmgr_create");

 	dispatchmgr = NULL;
-	result = dns_dispatchmgr_create(mctx, NULL, &dispatchmgr);
+	result = dns_dispatchmgr_create(mctx, &dispatchmgr);
 	check_result(result, "dns_dispatchmgr_create");
 }

@@ -180,10 +178,11 @@ create_view(void) {
 	 * Cache.
 	 */
 	cache = NULL;
-	result = dns_cache_create(mctx, taskmgr, timermgr, dns_rdataclass_in,
-				  "rbt", 0, NULL, &cache);
+	result = dns_cache_create(mctx, mctx, taskmgr, timermgr,
+				  dns_rdataclass_in, "", "rbt", 0, NULL,
+				  &cache);
 	check_result(result, "dns_cache_create");
-	dns_view_setcache(view, cache);
+	dns_view_setcache(view, cache, ISC_FALSE);
 	dns_cache_detach(&cache);

 	{
@@ -258,7 +257,8 @@ lookup(const char *target) {
 	options |= DNS_ADBFIND_GLUEOK;
 	result = dns_adb_createfind(adb, t2, lookup_callback, client,
 				    &client->name, dns_rootname, 0, options,
-				    now, NULL, view->dstport, &client->find);
+				    now, NULL, view->dstport, 0, NULL,
+				    &client->find);
 	if (result != ISC_R_SUCCESS)
 		printf("DNS_ADB_CREATEFIND -> %s\n", dns_result_totext(result));
 	dns_adb_dumpfind(client->find, stderr);
@@ -304,11 +304,6 @@ main(int argc, char **argv) {
 		      == ISC_R_SUCCESS);
 	isc_mempool_setname(cmp, "adb test clients");

-	result = isc_entropy_create(mctx, &ectx);
-	check_result(result, "isc_entropy_create()");
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	check_result(result, "isc_hash_create()");
-
 	result = isc_log_create(mctx, &lctx, &lcfg);
 	check_result(result, "isc_log_create()");
 	isc_log_setcontext(lctx);
@@ -418,9 +413,6 @@ main(int argc, char **argv) {

 	isc_log_destroy(&lctx);

-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
-
 	isc_mempool_destroy(&cmp);
 	isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -121,7 +121,7 @@ main(int argc, char *argv[]) {
 	isc_task_setname(task, "byaddr", NULL);

 	dispatchmgr = NULL;
-	RUNTIME_CHECK(dns_dispatchmgr_create(mctx, NULL, &dispatchmgr)
+	RUNTIME_CHECK(dns_dispatchmgr_create(mctx, &dispatchmgr)
 		      == ISC_R_SUCCESS);

 	timermgr = NULL;
@@ -130,8 +130,8 @@ main(int argc, char *argv[]) {
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

 	cache = NULL;
-	RUNTIME_CHECK(dns_cache_create(mctx, taskmgr, timermgr,
-				       dns_rdataclass_in, "rbt", 0, NULL,
+	RUNTIME_CHECK(dns_cache_create(mctx, mctx, taskmgr, timermgr,
+				       dns_rdataclass_in, "", "rbt", 0, NULL,
 				       &cache) == ISC_R_SUCCESS);

 	view = NULL;
@@ -203,7 +203,7 @@ main(int argc, char *argv[]) {
 			      == ISC_R_SUCCESS);
 	}

-	dns_view_setcache(view, cache);
+	dns_view_setcache(view, cache, ISC_FALSE);
 	dns_view_freeze(view);

 	dns_cache_detach(&cache);
@@ -19,7 +19,6 @@

 #include <isc/app.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/netaddr.h>
 #include <isc/print.h>
@@ -37,7 +36,6 @@
 #include <dns/result.h>

 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 static isc_taskmgr_t *taskmgr;
 static dns_view_t *view = NULL;
 static dns_adbfind_t *find = NULL;
@@ -118,7 +116,7 @@ do_find(isc_boolean_t want_event) {
 				    dns_fixedname_name(&fixed),
 				    dns_rootname, 0, options, 0,
 				    dns_fixedname_name(&target), 0,
-				    &find);
+				    0, NULL, &find);
 	if (result == ISC_R_SUCCESS) {
 		if (!ISC_LIST_EMPTY(find->list)) {
 			/*
@@ -206,10 +204,6 @@ main(int argc, char *argv[]) {
 	mctx = NULL;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

-	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
-		      == ISC_R_SUCCESS);
-
 	while ((ch = isc_commandline_parse(argc, argv, "d:vw:")) != -1) {
 		switch (ch) {
 		case 'd':
@@ -241,7 +235,7 @@ main(int argc, char *argv[]) {
 	isc_task_setname(task, "byname", NULL);

 	dispatchmgr = NULL;
-	RUNTIME_CHECK(dns_dispatchmgr_create(mctx, NULL, &dispatchmgr)
+	RUNTIME_CHECK(dns_dispatchmgr_create(mctx, &dispatchmgr)
 		      == ISC_R_SUCCESS);

 	timermgr = NULL;
@@ -250,8 +244,8 @@ main(int argc, char *argv[]) {
 	RUNTIME_CHECK(isc_socketmgr_create(mctx, &socketmgr) == ISC_R_SUCCESS);

 	cache = NULL;
-	RUNTIME_CHECK(dns_cache_create(mctx, taskmgr, timermgr,
-				       dns_rdataclass_in, "rbt", 0, NULL,
+	RUNTIME_CHECK(dns_cache_create(mctx, mctx, taskmgr, timermgr,
+				       dns_rdataclass_in, "", "rbt", 0, NULL,
 				       &cache) == ISC_R_SUCCESS);

 	view = NULL;
@@ -322,7 +316,7 @@ main(int argc, char *argv[]) {
 			      == ISC_R_SUCCESS);
 	}

-	dns_view_setcache(view, cache);
+	dns_view_setcache(view, cache, ISC_FALSE);
 	dns_view_freeze(view);

 	dns_cache_detach(&cache);
@@ -354,9 +348,6 @@ main(int argc, char *argv[]) {

 	isc_log_destroy(&lctx);

-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
-
 	if (verbose)
 		isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -268,7 +268,7 @@ load(const char *filename, const char *origintext, isc_boolean_t cache) {
 	}

 	printf("loading %s (%s)\n", filename, origintext);
-	result = dns_db_load(dbi->db, filename);
+	result = dns_db_load(dbi->db, filename, dns_masterformat_text, 0);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		dns_db_detach(&dbi->db);
 		isc_mem_put(mctx, dbi, sizeof(*dbi));
@@ -16,7 +16,6 @@
 #include <unistd.h>		/* XXX */

 #include <isc/buffer.h>
-#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/region.h>
@@ -52,8 +51,8 @@ use(dst_key_t *key, isc_mem_t *mctx) {
 	isc_buffer_add(&databuf, strlen(data));
 	isc_buffer_usedregion(&databuf, &datareg);

-	ret = dst_context_create3(key, mctx,
-				  DNS_LOGCATEGORY_GENERAL, ISC_TRUE, &ctx);
+	ret = dst_context_create(key, mctx,
+				 DNS_LOGCATEGORY_GENERAL, ISC_TRUE, 0, &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
 		       isc_result_totext(ret));
@@ -73,8 +72,8 @@ use(dst_key_t *key, isc_mem_t *mctx) {

 	isc_buffer_forward(&sigbuf, 1);
 	isc_buffer_remainingregion(&sigbuf, &sigreg);
-	ret = dst_context_create3(key, mctx,
-				  DNS_LOGCATEGORY_GENERAL, ISC_FALSE, &ctx);
+	ret = dst_context_create(key, mctx,
+				 DNS_LOGCATEGORY_GENERAL, ISC_FALSE, 0, &ctx);
 	if (ret != ISC_R_SUCCESS) {
 		printf("contextcreate(%u) returned: %s\n", dst_key_alg(key),
 		       isc_result_totext(ret));
@@ -214,7 +213,7 @@ generate(int alg, isc_mem_t *mctx) {
 	dst_key_t *key = NULL;

 	ret = dst_key_generate(dns_rootname, alg, 512, 0, 0, 0,
-			       dns_rdataclass_in, mctx, &key);
+			       dns_rdataclass_in, mctx, &key, NULL);
 	printf("generate(%d) returned: %s\n", alg, isc_result_totext(ret));
 	if (ret != ISC_R_SUCCESS)
 		return;
@@ -228,7 +227,6 @@ generate(int alg, isc_mem_t *mctx) {
 int
 main(void) {
 	isc_mem_t *mctx = NULL;
-	isc_entropy_t *ectx = NULL;
 	isc_buffer_t b;
 	dns_fixedname_t fname;
 	dns_name_t *name;
@@ -248,13 +246,7 @@ main(void) {

 	dns_result_register();

-	result = isc_entropy_create(mctx, &ectx);
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	result = isc_entropy_createfilesource(ectx, "randomfile");
-	if (result != ISC_R_SUCCESS)
-		return (1);
-	dst_lib_init(mctx, ectx, ISC_ENTROPY_BLOCKING|ISC_ENTROPY_GOODONLY);
+	dst_lib_init(mctx, NULL);

 	name = dns_fixedname_initname(&fname);
 	isc_buffer_constinit(&b, "test.", 5);
@@ -282,7 +274,6 @@ main(void) {
 	generate(DST_ALG_HMACMD5, mctx);

 	dst_lib_destroy();
-	isc_entropy_detach(&ectx);

 	isc_mem_put(mctx, current, 256);
 /*	isc_mem_stats(mctx, stdout);*/
@@ -1,167 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <isc/entropy.h>
-#include <isc/keyboard.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/string.h>
-#include <isc/time.h>
-#include <isc/util.h>
-
-static void
-hex_dump(const char *msg, void *data, unsigned int length) {
-	unsigned int len;
-	unsigned char *base;
-	isc_boolean_t first = ISC_TRUE;
-
-	base = data;
-
-	printf("DUMP of %u bytes:  %s\n\t", length, msg);
-	for (len = 0; len < length; len++) {
-		if (len % 16 == 0 && !first)
-			printf("\n\t");
-		printf("%02x ", base[len]);
-		first = ISC_FALSE;
-	}
-	printf("\n");
-}
-
-static void
-CHECK(const char *msg, isc_result_t result) {
-	if (result != ISC_R_SUCCESS) {
-		printf("FAILURE:  %s:  %s\n", msg, isc_result_totext(result));
-		exit(1);
-	}
-}
-
-static isc_result_t
-start(isc_entropysource_t *source, void *arg, isc_boolean_t blocking) {
-	isc_keyboard_t *kbd = (isc_keyboard_t *)arg;
-
-	UNUSED(source);
-
-	if (blocking)
-		printf("start called, blocking mode.\n");
-	else
-		printf("start called, non-blocking mode.\n");
-
-	return (isc_keyboard_open(kbd));
-}
-
-static void
-stop(isc_entropysource_t *source, void *arg) {
-	isc_keyboard_t *kbd = (isc_keyboard_t *)arg;
-
-	UNUSED(source);
-
-	printf("ENOUGH!  Stop typing, please.\r\n");
-
-	(void)isc_keyboard_close(kbd, 3);
-	printf("stop called\n");
-}
-
-static isc_result_t
-get(isc_entropysource_t *source, void *arg, isc_boolean_t blocking) {
-	isc_keyboard_t *kbd = (isc_keyboard_t *)arg;
-	isc_result_t result;
-	isc_time_t t;
-	isc_uint32_t sample;
-	isc_uint32_t extra;
-	unsigned char c;
-
-	if (!blocking)
-		return (ISC_R_NOENTROPY);
-
-	result = isc_keyboard_getchar(kbd, &c);
-	if (result != ISC_R_SUCCESS)
-		return (result);
-
-	TIME_NOW(&t);
-
-	sample = isc_time_nanoseconds(&t);
-	extra = c;
-
-	result = isc_entropy_addcallbacksample(source, sample, extra);
-	if (result != ISC_R_SUCCESS) {
-		printf("\r\n");
-		return (result);
-	}
-
-	printf(".");
-	fflush(stdout);
-
-	return (result);
-}
-
-int
-main(int argc, char **argv) {
-	isc_mem_t *mctx;
-	unsigned char buffer[512];
-	isc_entropy_t *ent;
-	isc_entropysource_t *source;
-	unsigned int returned;
-	unsigned int flags;
-	isc_result_t result;
-	isc_keyboard_t kbd;
-
-	UNUSED(argc);
-	UNUSED(argv);
-
-	mctx = NULL;
-	CHECK("isc_mem_create()",
-	      isc_mem_create(0, 0, &mctx));
-
-	ent = NULL;
-	CHECK("isc_entropy_create()",
-	      isc_entropy_create(mctx, &ent));
-
-	isc_entropy_stats(ent, stderr);
-
-	source = NULL;
-	result = isc_entropy_createcallbacksource(ent, start, get, stop, &kbd,
-						  &source);
-	CHECK("isc_entropy_createcallbacksource()", result);
-
-	fprintf(stderr,
-		"Reading 32 bytes of GOOD random data only, partial OK\n");
-
-	flags = 0;
-	flags |= ISC_ENTROPY_GOODONLY;
-	flags |= ISC_ENTROPY_PARTIAL;
-	flags |= ISC_ENTROPY_BLOCKING;
-	returned = 0;
-	result = isc_entropy_getdata(ent, buffer, 32, &returned, flags);
-	if (result == ISC_R_NOENTROPY) {
-		fprintf(stderr, "No entropy.\r\n");
-	}
-
-	isc_entropy_stopcallbacksources(ent);
-
-	hex_dump("good data only:", buffer, returned);
-
-	isc_entropy_stats(ent, stderr);
-
-	isc_entropy_destroysource(&source);
-	isc_entropy_detach(&ent);
-
-	isc_mem_stats(mctx, stderr);
-	isc_mem_destroy(&mctx);
-
-	return (0);
-}
@@ -1,132 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-/*! \file */
-
-#include <config.h>
-
-#include <stdio.h>
-#include <stdlib.h>
-
-#include <isc/entropy.h>
-#include <isc/mem.h>
-#include <isc/print.h>
-#include <isc/string.h>
-#include <isc/util.h>
-
-static void
-hex_dump(const char *msg, void *data, unsigned int length) {
-	unsigned int len;
-	unsigned char *base;
-	isc_boolean_t first = ISC_TRUE;
-
-	base = data;
-
-	printf("DUMP of %u bytes:  %s\n\t", length, msg);
-	for (len = 0; len < length; len++) {
-		if (len % 16 == 0 && !first)
-			printf("\n\t");
-		printf("%02x ", base[len]);
-		first = ISC_FALSE;
-	}
-	printf("\n");
-}
-
-static void
-CHECK(const char *msg, isc_result_t result) {
-	if (result != ISC_R_SUCCESS) {
-		printf("FAILURE:  %s:  %s\n", msg, isc_result_totext(result));
-		exit(1);
-	}
-}
-
-int
-main(int argc, char **argv) {
-	isc_mem_t *mctx;
-	unsigned char buffer[512];
-	isc_entropy_t *ent;
-	unsigned int returned;
-	unsigned int flags;
-	isc_result_t result;
-
-	UNUSED(argc);
-	UNUSED(argv);
-
-	mctx = NULL;
-	CHECK("isc_mem_create()",
-	      isc_mem_create(0, 0, &mctx));
-
-	ent = NULL;
-	CHECK("isc_entropy_create()",
-	      isc_entropy_create(mctx, &ent));
-
-	isc_entropy_stats(ent, stderr);
-
-#if 1
-	CHECK("isc_entropy_createfilesource() 1",
-	      isc_entropy_createfilesource(ent, "/dev/random"));
-	CHECK("isc_entropy_createfilesource() 2",
-	      isc_entropy_createfilesource(ent, "/dev/random"));
-#else
-	CHECK("isc_entropy_createfilesource() 3",
-	      isc_entropy_createfilesource(ent, "/tmp/foo"));
-#endif
-
-	fprintf(stderr,
-		"Reading 32 bytes of GOOD random data only, partial OK\n");
-
-	flags = 0;
-	flags |= ISC_ENTROPY_GOODONLY;
-	flags |= ISC_ENTROPY_PARTIAL;
-	result = isc_entropy_getdata(ent, buffer, 32, &returned, flags);
-	if (result == ISC_R_NOENTROPY) {
-		fprintf(stderr, "No entropy.\n");
-		goto any;
-	}
-	hex_dump("good data only:", buffer, returned);
-
- any:
-	isc_entropy_stats(ent, stderr);
-	CHECK("isc_entropy_getdata() pseudorandom",
-	      isc_entropy_getdata(ent, buffer, 128, NULL, 0));
-	hex_dump("pseudorandom data", buffer, 128);
-
-	isc_entropy_stats(ent, stderr);
-	flags = 0;
-	flags |= ISC_ENTROPY_GOODONLY;
-	flags |= ISC_ENTROPY_BLOCKING;
-	result = isc_entropy_getdata(ent, buffer, sizeof(buffer), &returned,
-				     flags);
-	CHECK("good data only, blocking mode", result);
-	hex_dump("blocking mode data", buffer, sizeof(buffer));
-
-	{
-		isc_entropy_t *entcopy1 = NULL;
-		isc_entropy_t *entcopy2 = NULL;
-		isc_entropy_t *entcopy3 = NULL;
-
-		isc_entropy_attach(ent, &entcopy1);
-		isc_entropy_attach(ent, &entcopy2);
-		isc_entropy_attach(ent, &entcopy3);
-
-		isc_entropy_stats(ent, stderr);
-
-		isc_entropy_detach(&entcopy1);
-		isc_entropy_detach(&entcopy2);
-		isc_entropy_detach(&entcopy3);
-	}
-
-	isc_entropy_detach(&ent);
-	isc_mem_stats(mctx, stderr);
-	isc_mem_destroy(&mctx);
-
-	return (0);
-}
@@ -17,7 +17,6 @@

 #include <isc/app.h>
 #include <isc/base64.h>
-#include <isc/entropy.h>
 #include <isc/log.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -435,7 +434,6 @@ main(int argc, char *argv[]) {
 	dns_dispatchmgr_t *dispatchmgr;
 	dns_dispatch_t *dispatchv4;
 	dns_view_t *view;
-	isc_entropy_t *ectx;
 	isc_task_t *task;
 	isc_log_t *lctx = NULL;
 	isc_logconfig_t *lcfg = NULL;
@@ -471,11 +469,7 @@ main(int argc, char *argv[]) {

 	isc_log_setdebuglevel(lctx, 9);

-	ectx = NULL;
-	RUNCHECK(isc_entropy_create(mctx, &ectx));
-	RUNCHECK(isc_entropy_createfilesource(ectx, "/dev/urandom"));
-
-	RUNCHECK(dst_lib_init(mctx, ectx, ISC_ENTROPY_GOODONLY));
+	RUNCHECK(dst_lib_init(mctx, NULL));

 	taskmgr = NULL;
 	RUNCHECK(isc_taskmgr_create(mctx, 1, 0, &taskmgr));
@@ -486,7 +480,7 @@ main(int argc, char *argv[]) {
 	socketmgr = NULL;
 	RUNCHECK(isc_socketmgr_create(mctx, &socketmgr));
 	dispatchmgr = NULL;
-	RUNCHECK(dns_dispatchmgr_create(mctx, ectx, &dispatchmgr));
+	RUNCHECK(dns_dispatchmgr_create(mctx, &dispatchmgr));
 	isc_sockaddr_any(&bind_any);
 	attrs = DNS_DISPATCHATTR_UDP |
 		DNS_DISPATCHATTR_MAKEQUERY |
@@ -543,7 +537,6 @@ main(int argc, char *argv[]) {
 	dns_view_detach(&view);

 	dst_lib_destroy();
-	isc_entropy_detach(&ectx);

 	isc_mem_stats(mctx, stdout);
 	isc_mem_destroy(&mctx);
@@ -79,8 +79,9 @@ main(int argc, char *argv[]) {
 		callbacks.add = print_dataset;

 		result = dns_master_loadfile(argv[1], &origin, &origin,
-					     dns_rdataclass_in, 0,
-					     &callbacks, mctx);
+					     dns_rdataclass_in, 0, 0,
+					     &callbacks, NULL, NULL, mctx,
+					     dns_masterformat_text, 0);
 		fprintf(stdout, "dns_master_loadfile: %s\n",
 			dns_result_totext(result));
 	}
@@ -136,7 +136,7 @@ nsecify(char *filename) {
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
 			       dns_rdataclass_in, 0, NULL, &db);
 	check_result(result, "dns_db_create()");
-	result = dns_db_load(db, filename);
+	result = dns_db_load(db, filename, dns_masterformat_text, 0);
 	if (result == DNS_R_SEENINCLUDE)
 		result = ISC_R_SUCCESS;
 	check_result(result, "dns_db_load()");
@@ -19,7 +19,6 @@
 #include <isc/boolean.h>
 #include <isc/assertions.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/error.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -59,7 +58,6 @@ isc_mem_t *mctx;
 unsigned char qdata[1024], rdata[1024];
 isc_buffer_t qbuffer, rbuffer;
 isc_taskmgr_t *taskmgr;
-isc_entropy_t *ent = NULL;
 isc_task_t *task1;
 isc_log_t *lctx = NULL;
 isc_logconfig_t *logconfig = NULL;
@@ -224,8 +222,7 @@ main(int argc, char *argv[]) {
 		}
 	}

-	RUNTIME_CHECK(isc_entropy_create(mctx, &ent) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(dst_lib_init(mctx, ent, 0) == ISC_R_SUCCESS);
+	RUNTIME_CHECK(dst_lib_init(mctx, NULL) == ISC_R_SUCCESS);

 	dns_result_register();
 	dst_result_register();
@@ -279,8 +276,6 @@ main(int argc, char *argv[]) {

 	dst_lib_destroy();

-	isc_entropy_detach(&ent);
-
 	isc_log_destroy(&lctx);

 	if (verbose)
--- a/Show More
+++ b/Show More