Provide debugging information for the isc_random function

Merge branch '273-add-home-arpa-to-list-of-empty-zones-rfc-8375' into 'master'
Resolve "Add "HOME.ARPA" to list of empty zones (RFC 8375)" Closes #273 See merge request isc-projects/bind9!297
2018-05-23 21:37:47 +02:00 · 2018-05-22 20:57:19 -04:00 · 2018-05-23 10:48:30 +10:00 · 2018-05-23 10:47:42 +10:00 · 2018-05-22 19:42:35 -04:00 · 2018-05-22 16:32:21 -07:00
1612 changed files with 26199 additions and 302196 deletions
@@ -21,9 +21,10 @@ ans.run
 named.run
 named.memstats
 gen.dSYM/
-.libs/
+.ccache/
 .deps/
 .dirstamp
+.libs/
 unit/atf-src/atf-c++/atf-c++.pc
 unit/atf-src/atf-c/atf-c.pc
 unit/atf-src/atf-c/defs.h
@@ -10,20 +10,6 @@ stages:
  - build
  - test

-.centos-centos6-amd64: &centos_centos6_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
-.centos-centos7-amd64: &centos_centos7_amd64_image
-  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
-  tags:
-    - linux
-    - docker
-    - amd64
-
 .debian-jessie-amd64: &debian_jessie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
  tags:
@@ -112,21 +98,14 @@ stages:
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
-    - autoreconf -fi
+    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr --with-libidn2 --prefix=$HOME/.local --without-make-clean "${EXTRA_CONFIGURE}" || cat config.log
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr/local --with-libidn2
    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
  artifacts:
    expire_in: '1 hour'
    untracked: true

-.install_test: &install_test_job
-  stage: test
-  before_script:
-    - mkdir $HOME/.local
-  script:
-    - make install
-
 .system_test: &system_test_job
  stage: test
  before_script:
@@ -161,19 +140,13 @@ precheck:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: precheck
  script:
-    - sh util/checklibs.sh > checklibs.out
    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
    - rm util/newcopyrights
-    - perl -w util/update_copyrights < util/copyrights
-    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
-    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
-    - xmllint --noout --nonet --html `git ls-files '*.html'`
  artifacts:
    paths:
    - util/newcopyrights
-    - checklibs.out
    expire_in: '1 week'
    when: on_failure

@@ -201,79 +174,60 @@ precheck:debian:sid:amd64:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job

-build:centos:centos6:amd64:
+build:clang:debian:sid:amd64:
  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-    EXTRA_CONFIGURE: "--disable-warn-error"
-  <<: *centos_centos6_amd64_image
-  <<: *build_job
-
-build:centos:centos7:amd64:
-  variables:
-    CC: gcc
-    CFLAGS: "-Wall -Wextra -O2 -g"
-  <<: *centos_centos7_amd64_image
+    CC: clang-6.0
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
+  <<: *debian_sid_amd64_image
  <<: *build_job

 build:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_sid_amd64_image
  <<: *build_job
-    
-build:debian:sid:i386:
+
+build:clang:debian:sid:i386:
+  variables:
+    CC: clang-6.0
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
  <<: *debian_sid_i386_image
  <<: *build_job

-unittest:centos:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos6:amd64
-
-unittest:centos:centos7:amd64:
-  <<: *centos_centos7_amd64_image
-  <<: *unit_test_job
-  dependencies:
-    - build:centos:centos7:amd64
+build:debian:sid:i386:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g"
+  <<: *debian_sid_i386_image
+  <<: *build_job

 unittest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - build:debian:sid:amd64
-    
+
+unittest:clang:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - build:clang:debian:sid:amd64
+
 unittest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
    - build:debian:sid:i386

-systemtest:centos:centos6:amd64:
-  <<: *centos_centos6_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:centos:centos6:amd64
-
-systemtest:centos:centos7:amd64:
-  <<: *centos_centos7_amd64_image
-  <<: *system_test_job
-  dependencies:
-    - build:centos:centos7:amd64
-
 systemtest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
    - build:debian:sid:amd64
-    
+
 systemtest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
    - build:debian:sid:i386
-
-install:debian:sid:amd64:
-  <<: *debian_sid_amd64_image
-  <<: *install_test_job
-  dependencies:
-    - build:debian:sid:amd64
@@ -0,0 +1,42 @@
+<!--
+If the bug you are reporting is potentially security-related - for example,
+if it involves an assertion failure or other crash in `named` that can be
+triggered repeatedly - then please do *NOT* report it here, but send an
+email to [security-officer@isc.org](security-officer@isc.org).
+-->
+
+### Summary
+
+(Summarize the bug encountered concisely.)
+
+### Steps to reproduce
+
+(How one can reproduce the issue - this is very important.)
+
+### What is the current *bug* behavior?
+
+(What actually happens.)
+
+### What is the expected *correct* behavior?
+
+(What you should see instead.)
+
+### Relevant configuration files
+
+(Paste any relevant configuration files - please use code blocks (```)
+to format console output. If submitting the contents of your
+configuration file in a non-confidential Issue, it is advisable to
+obscure key secrets: this can be done automatically by using
+`named-checkconf -px`.)
+
+### Relevant logs and/or screenshots
+
+(Paste any relevant logs - please use code blocks (```) to format console
+output, logs, and code, as it's very hard to read otherwise.)
+
+### Possible fixes
+
+(If you can, link to the line of code that might be responsible for the
+problem.)
+
+/label ~bug
@@ -0,0 +1,11 @@
+### Description
+
+(Describe the problem, use cases, benefits, and/or goals.)
+
+### Request
+
+(Describe the solution you'd like to see.)
+
+### Links / references
+
+/label ~"feature request"
@@ -1,223 +1,28 @@
-	--- 9.12.3 released ---
-
-	--- 9.12.3rc1 released ---
-
-5038.	[bug]		Chaosnet addresses were compared incorrectly.
-			[GL #562]
-
-5035.	[test]		Fixed errors that prevented the DNSRPS subtests
-			from running in the rpz and rpzrecurse system
-			tests. [GL #503]
-
-5034.	[bug]		A race between threads could prevent zone maintenance
-			scheduled immediately after zone load from being
-			performed. [GL #542]
-
-5033.	[bug]		When adding NTAs to multiple views using "rndc nta",
-			the text returned via rndc was incorrectly terminated
-			after the first line, making it look as if only one
-			NTA had been added. Also, it was not possible to
-			differentiate between views with the same name but
-			different classes; this has been corrected with the
-			addition of a "-class" option. [GL #105]
-
-5032.	[func]		Add krb5-selfsub and ms-selfsub update policy rules.
-			[GL #511]
-
-5030.	[bug]		Align CMSG buffers to a 64-bit boundary, fixes crash
-			on architectures with strict alignment. [GL #521]
-
-5028.	[bug]		Spread the initial RRSIG expiration times over the
-			entire working sig-validity-interval when signing a
-			zone in named to even out re-signing and transfer
-			loads. [GL #418]
-
-5026.	[bug]		rndc reconfig should not touch already loaded zones.
-			[GL #276]
-
-5022.	[doc]		Update ms-self, ms-subdomain, krb5-self, and
-			krb5-subdomain documentation. [GL !708]
-
-5021.	[bug]		dig returned a non-zero exit code when it received a
-			reply over TCP after a retry. [GL #487]
-
-5019.	[cleanup]	A message is now logged when ixfr-from-differences is
-			set at zone level for an inline-signed zone. [GL #470]
-
-5018.	[bug]		Fix incorrect sizeof arguments in lib/isc/pk11.c.
-			[GL !588]
-
-5017.	[bug]		lib/isc/pk11.c failed to unlink the session before
-			releasing the lock which is unsafe. [GL !589]
-
-5016.	[bug]		Named could assert with overlapping filter-aaaa and
-			dns64 acls. [GL #445]
-
-5015.	[bug]		Reloading all zones caused zone maintenance to cease
-			for inline-signed zones. [GL #435]
-
-5014.	[bug]		Signatures loaded from the journal for the signed
-			version of an inline-signed zone were not scheduled for
-			refresh. [GL #482]
-
-5013.	[bug]		A referral response with a non-empty ANSWER section was
-			inadvertently being treated as an error. [GL #390]
-
-5012.	[bug]		Fix lock order reversal in pk11_initialize. [GL !590]
-
-5009.	[bug]		Upon an OpenSSL failure, the first error in the OpenSSL
-			error queue was not logged. [GL #476]
-
-5008.	[bug]		"rndc signing -nsec3param ..." requests were silently
-			ignored for zones which were not yet loaded or
-			transferred. [GL #468]
-
-5007.	[cleanup]	Replace custom ISC boolean and integer data types
-			with C99 stdint.h and stdbool.h types. [GL #9]
-
-5006.	[cleanup]	Code preparing a delegation response was extracted from
-			query_delegation() and query_zone_delegation() into a
-			separate function in order to decrease code
-			duplication. [GL #431]
-
-5005.	[bug]		dnssec-verify, and dnssec-signzone at the verification
-			step, failed on some validly signed zones. [GL #442]
-
-5004.	[bug]		'rndc reconfig' could cause inline zones to stop
-			re-signing. [GL #439]
-
-5003.	[bug]		dns_acl_isinsecure did not handle geoip elements.
-			[GL #406]
-
-5002.	[bug]		mdig: Handle malformed +ednsopt option, support 100
-			+ednsopt options per query rather than 100 total and
-			address memory leaks if +ednsopt was specified.
-			[GL #410]
-
-5001.	[bug]		Fix refcount errors on error paths. [GL !563]
-
-5000.	[bug]		named_server_servestale() could leave the server in
-			exclusive mode if an error occured. [GL #441]
-
-4996.	[bug]		dig: Handle malformed +ednsopt option. [GL #403]
-
-4995.	[test]		Add tests for "tcp-self" update policy. [GL !282]
-
-4994.	[bug]		Trust anchor telemetry queries were not being sent
-			upstream for locally served zones. [GL #392]
-
-4992.	[bug]		The wrong address was being logged for trust anchor
-			telemetry queries. [GL #379]
-
-4990.	[bug]		Prevent a possible NULL reference in pkcs11-keygen.
-			[GL #401]
-
-4988.	[bug]		Don't synthesize NXDOMAIN from NSEC for records under
-			a DNAME. [GL #386]
-
-	--- 9.12.2-P1 released ---
-
-4997.	[security]	named could crash during recursive processing
-			of DNAME records when "deny-answer-aliases" was
-			in use. (CVE-2018-5740) [GL #387]
-
-	--- 9.12.2 released ---
-
-	--- 9.12.2rc2 released ---
-
-4984.	[bug]		Improve handling of very large incremental
-			zone transfers to prevent journal corruption. [GL #339]
-
-4983.	[cleanup]	Remove the deprecated flag from "answer-cookie";
-			it will be allowed to persist into 9.13. [GL #275].
-
-4982.	[cleanup]	Return FORMERR if the question section is empty
-			and no COOKIE option is present; this restores
-			older behavior except in the newly specified
-			COOKIE case. [GL #260]
-
-4981.	[bug]		Fix race in cmsg buffer usage in socket code.
-			[GL #180]
-
-4980.	[bug]		Named-checkconf failed to detect bad in-view targets.
-			[GL #288]
-
-4979.	[bug]		Non-libcap builds were not checking whether all
-			requested capabilities are present in the permitted
-			capability set. [GL #321]
-
-4978.	[test]		Fix error handling and resolver configuration in the
-			"rpz" system test. [GL #312]
-
-4977.	[func]		When starting up, log the same details that
-			would be reported by 'named -V'. [GL #247]
-
-4976.	[bug]		Log the label with invalid prefix length correctly
-			when loading RPZ zones. [GL #254]
-
-4975.	[bug]		The server cookie computation for sha1 and sha256 did
-			not match the method described in RFC 7873. [GL #356]
-
-4974.	[bug]		Restore default rrset-order to random. [GL #336]
-
-4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
-			to be const. [GL #341]
-
-4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
-			below a DNAME as out-of-zone data. [GL #298]
-
-4969.	[cleanup]	Refactor zone logging functions. [GL #269]
-
-	--- 9.12.2rc1 released ---
-
-4968.	[bug]		If glue records are signed, attempt to validate them.
-			[GL #209]
-
-4966.	[func]		Add the ability to not return a DNS COOKIE option
-			when one is present in the request (answer-cookie no;).
-			[GL #173]
-
-4965.	[func]		Add support for marking options as deprecated.
-			[GL #322]
-
-4964.	[bug]		Reduce the probabilty of double signature when deleting
-			a DNSKEY by checking if the node is otherwise signed
-			by the algorithm of the key to be deleted. [GL #240]
-
-4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
-			if available, to configure the test interfaces on
-			linux.  [GL #302]
-
-4962.	[cleanup]	Move 'named -T' processing to its own function.
-			[GL #316]
-
-4960.	[security]	When recursion is enabled, but the "allow-recursion"
-			and "allow-query-cache" ACLs are not specified,
-			they should be limited to local networks,
-			but were inadvertently set to match the default
-			"allow-query", thus allowing remote queries.
-			(CVE-2018-5738) [GL #309]
-
-4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
-
-4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
-			[GL #286]
-
-4954.	[func]		Messages about serving of stale answers are now
-			directed to the "serve-stale" logging category.
-			Also clarified serve-stale documentation. [GL !323]
-
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
+	--- 9.13.0 released ---

 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]

-4949.	[bug]		lib/isc/print.c failed to handle floating point
-			output correctly. [GL #261]
+4949.	[placeholder]
+
+4948.	[bug]		When request-nsid is turned on, EDNS NSID options
+			should be logged at level info. Since change 3741
+			they have been logged at debug(3) by mistake.
+			[GL !290]
+
+4947.	[func]		Replace all random functions with isc_random(),
+			isc_random_buf() and isc_random_uniform() API.
+			[GL #221]

 4946.	[bug]		Additional glue was not being returned by resolver
 			for unsigned zones since change 4596. [GL #209]

+4945.	[func]		BIND can no longer be built without DNSSEC support.
+			A cryptography provder (i.e., OpenSSL or a hardware
+			service module with PKCS#11 support) must be
+			available. [GL #244]
+
 4944.	[cleanup]	Silence cppcheck portability warnings in
 			lib/isc/tests/buffer_test.c. [GL #239]

@@ -226,8 +31,25 @@
 			hash table size to 512 entries for 'named -m record'
 			restoring the previous memory footprint. [GL #248]

+4942.	[cleanup]	Consolidate multiple instances of splitting of
+			batchline in dig into a single function. [GL #196]
+
+4941.	[cleanup]	Silence clang static analyzer warnings. [GL #196]
+
+4940.	[cleanup]	Extract the loop in dns__zone_updatesigs() into
+			separate functions to improve code readability.
+			[GL #135]
+
 4939.	[test]		Add basic unit tests for update_sigs(). [GL #135]

+4938.	[placeholder]
+
+4937.	[func]		Remove support for OpenSSL < 1.0.0 [GL #191]
+
+4936.	[func]		Always use OpenSSL or PKCS#11 random data providers,
+			and remove the --{enable,disable}-crypto-rand configure
+			options. [GL #165]
+
 4935.	[func]		Add support for LibreSSL >= 2.7.0 (some OpenSSL 1.1.0
 			call were added). [GL #191]

@@ -246,12 +68,37 @@
 			logged even when an error occurred while updating
 			signatures. [GL #159]

+4931.	[func]		Removed the "rbtdb64" database implementation.
+			[GL #217]
+
 4930.	[bug]		Remove a bogus check in nslookup command line
 			argument processing. [GL #206]

+4929.	[func]		Add the ability to set RA and TC in queries made by
+			dig (+[no]raflag, +[no]tcflag). [GL #213]
+
+4928.	[func]		The "dnskey-sig-validity" option allows
+			"sig-validity-interval" to be overriden for signatures
+			covering DNSKEY RRsets. [GL #145]
+
+4927.	[placeholder]
+
 4926.	[func]		Add root key sentinel support.  To disable, add
 			'root-key-sentinel no;' to named.conf. [GL #37]

+4925.	[func]		Several configuration options that define intervals
+			can now take TTL value suffixes (for example, 2h or 1d)
+			in addition to integer parameters. These include
+			max-cache-ttl, max-ncache-ttl, max-policy-ttl,
+			fstrm-set-reopen-interval, interface-interval, and
+			min-update-interval. [GL #203]
+
+4924.	[cleanup]	Clean up the isc_string_* namespace and leave
+			only strlcpy and strlcat. [GL #178]
+
+4923.	[cleanup]	Refactor socket and socket event options into
+			enum types. [GL !135]
+
 4922.	[bug]		dnstap: Log the destination address of client
 			packets rather than the interface address.
 			[GL #197]
@@ -261,8 +108,20 @@
 			refactoring dns_fixedname_*() macros were turned into
 			functions. [GL #183]

+4920.	[cleanup]	Clean up libdns removing most of the backwards
+			compatibility wrappers.
+
+4919.	[cleanup]	Clean up the isc_hash_* namespace and leave only
+			the FNV-1a hash implementation. [GL #178]
+
 4918.	[bug]		Fix double free after keygen error in dnssec-keygen
 			when OpenSSL >= 1.1.0 is used and RSA_generate_key_ex
+			fails. [GL #109]
+
+4917.	[func]		Support 64 RPZ policy zones by default. [GL #123]
+
+4916.	[func]		Remove IDNA2003 support and the bundled idnkit-1.0
+			library.

 4915.	[func]		Implement IDNA2008 support in dig by adding support
 			for libidn2.  New dig option +idnin has been added,
@@ -297,10 +156,15 @@
 4907.	[test]		Improved the reliability of the 'notify' system
 			test. [GL #59]

+4906.	[func]		Replace getquad() with inet_pton(), completing
+			change #4900. [GL #56]
+
 4905.	[bug]		irs_resconf_load() ignored resolv.conf syntax errors
 			when "domain" or "search" options were present in that
 			file. [GL #110]

+4904.	[bug]		Temporarily revert change #4859. [GL #124]
+
 4903.	[bug]		"check-mx fail;" did not prevent MX records containing
 			IP addresses from being added to a zone by a dynamic
 			update. [GL #112]
@@ -308,11 +172,21 @@
 4902.	[test]		Improved the reliability of the 'ixfr' system
 			test. [GL #66]

+4901.	[func]		"dig +nssearch" now lists the name servers
+			for a domain that time out, as well as the servers
+			that respond. [GL #64]
+
+4900.	[func]		Remove all uses of inet_aton().  As a result of this
+			change, IPv4 addresses are now only accepted in
+			dotted-quad format. [GL #13]
+
 4899.	[test]		Convert most of the remaining system tests to be able
 			to run in parallel, continuing the work from change
 			#4895. To take advantage of this, use "make -jN check",
 			where N is the number of processors to use. [GL #91]

+4898.	[func]		Remove libseccomp based system-call filtering. [GL #93]
+
 4897.	[test]		Update to rpz system test so that it doesn't recurse.
 			[GL #68]

@@ -321,14 +195,6 @@
 4895.	[test]		Allow some system tests to run in parallel.
 			[RT #46602]

-	--- 9.12.1 released ---
-
-	--- 9.12.1rc2 released ---
-
-4904.	[bug]		Temporarily revert change #4859. [GL #124]
-
-	--- 9.12.1rc1 released ---
-
 4894.	[bug]		named could crash while rolling a dnstap output file.
 			[RT #46942]

@@ -338,13 +204,16 @@
 			before all zone loading actions triggered by a previous
 			"rndc reload" command were completed. [RT #47076]

+4891.	[placeholder]
+
+4890.	[func]		Remove unused ondestroy callback from libisc.
+			[isc-projects/bind9!3]
+
 4889.	[func]		Warn about the use of old root keys without the new
 			root key being present.  Warn about dlv.isc.org's
 			key being present. Warn about both managed and
 			trusted root keys being present. [RT #43670]

-	--- 9.12.1b1 released ---
-
 4888.	[test]		Initialize sockets correctly in sample-update so
 			that the nsupdate system test will run on Windows.
 			[RT #47097]
@@ -415,6 +284,9 @@
 			be passed to memmove which is undefined behavior and
 			can lead to bad optimization. [RT #46888]

+4868.	[func]		dnssec-keygen can no longer generate HMAC keys.
+			Use tsig-keygen instead. [RT #46404]
+
 4867.	[cleanup]	Normalize rndc on/off commands (validation,
 			querylog, serve-stale) so they all accept the
 			same synonyms for on/off (yes/no, true/false,
@@ -424,15 +296,33 @@
 			was not disabled) and SHA-1 hash and HMAC support.
 			[RT #46764]

+4865.	[cleanup]	Simplify handling isc_socket_sendto2() return values.
+			[RT #46986]
+
 4864.	[bug]		named acting as a slave for a catalog zone crashed if
 			the latter contained a master definition without an IP
 			address. [RT #45999]

+4863.	[bug]		Fix various other bugs reported by Valgrind's
+			memcheck tool. [RT #46978]
+
+4862.	[bug]		The rdata flags for RRSIG were not being properly set
+			when constructing a rdataslab. [RT #46978]
+
 4861.	[bug]		The isc_crc64 unit test was not endian independent.
 			[RT #46973]

 4860.	[bug]		isc_int8_t should be signed char.  [RT #46973]

+4859.	[bug]		A loop was possible when attempting to validate
+			unsigned CNAME responses from secure zones;
+			this caused a delay in returning SERVFAIL and
+			also increased the chances of encountering
+			CVE-2017-3145. [RT #46839]
+
+4858.	[security]	Addresses could be referenced after being freed
+			in resolver.c, causing an assertion failure.
+			(CVE-2017-3145) [RT #46839]

 4857.	[bug]		Maintain attach/detach semantics for event->db,
 			event->node, event->rdataset and event->sigrdataset
@@ -458,6 +348,16 @@
 4851.	[port]		Support using kyua as well as atf-run to run the unit
 			tests. [RT #46853]

+4850.	[bug]		Named failed to restart with multiple added zones in
+			lmdb database. [RT #46889]
+
+4849.	[bug]		Duplicate zones could appear in the .nzf file if
+			addzone failed. [RT #46435]
+
+4848.	[func]		Zone types "primary" and "secondary" can now be used
+			as synonyms for "master" and "slave" in named.conf.
+			[RT #46713]
+
 4847.	[bug]		dnssec-dnskey-kskonly was not being honored for
 			CDS and CDNSKEY. [RT #46755]

@@ -475,34 +375,6 @@
 4842.	[bug]		Conditionally compile opensslecdsa_link.c to avoid
 			warnings about unused function. [RT #46790]

-	--- 9.12.0 released ---
-
-	--- 9.12.0rc3 released ---
-
-4863.	[bug]		Fix various other bugs reported by Valgrind's
-			memcheck tool. [RT #46978]
-
-4862.	[bug]		The rdata flags for RRSIG were not being properly set
-			when constructing a rdataslab. [RT #46978]
-
-	--- 9.12.0rc2 released ---
-
-4859.	[bug]		A loop was possible when attempting to validate
-			unsigned CNAME responses from secure zones;
-			this caused a delay in returning SERVFAIL and
-			also increased the chances of encountering
-			CVE-2017-3145. [RT #46839]
-
-4858.	[security]	Addresses could be referenced after being freed
-			in resolver.c, causing an assertion failure.
-			(CVE-2017-3145) [RT #46839]
-
-4850.	[bug]		Named failed to restart with multiple added zones in
-			lmdb database. [RT #46889]
-
-4849.	[bug]		Duplicate zones could appear in the .nzf file if
-			addzone failed. [RT #46435]
-
 	--- 9.12.0rc1 released ---

 4841.	[bug]		Address -fsanitize=undefined warnings. [RT #46786]
@@ -791,8 +663,8 @@

 4760.	[func]		Add glue cache statistics counters. [RT #46028]

-4759.	[func]		Add logging channel "trust-anchor-telemetry" to
-			record trust-anchor-telemetry in incoming requests.
+4759.	[func]		Add logging channel "trust-anchor-telementry" to
+			record trust-anchor-telementry in incoming requests.
 			Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
 			are logged.  [RT #46124]

@@ -861,10 +733,10 @@
 			tests when running on terminals that support them.
 			[RT #45977]

-4744.	[bug]		Suppress trust-anchor-telemetry queries if
+4744.	[bug]		Suppress trust-anchor-telementry queries if
 			validation is disabled. [RT #46131]

-4743.	[func]		Exclude trust-anchor-telemetry queries from
+4743.	[func]		Exclude trust-anchor-telementry queries from
 			synth-from-dnssec processing. [RT #46123]

 4742.	[func]		Synthesis of responses from DNSSEC-verified records.
@@ -22,7 +22,7 @@ MANPAGES =	isc-config.sh.1

 HTMLPAGES =	isc-config.sh.html

-MANOBJS =	README HISTORY OPTIONS ${MANPAGES} ${HTMLPAGES}
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}

@BIND9_MAKE_RULES@

@@ -19,9 +19,6 @@ Setting                   Description
                          named-checkzone
 -DNS_RUN_PID_DIR=0        Create default PID files in ${localstatedir}/run
                          rather than ${localstatedir}/run/named/
-                          Increase the maximum number of configurable
-DNS_RPZ_MAX_ZONES=64     response policy zones from 32 to 64; this is the
-                          highest possible setting
                          Disable the use of inline functions to implement
 -DISC_BUFFER_USEINLINE=0  the isc_buffer API: this reduces performance but
                          may be useful when debugging
@@ -23,6 +23,5 @@ Some of these settings are:
 |`-DCHECK_SIBLING=0`|Don't check sibling glue in `named-checkzone`|
 |`-DCHECK_LOCAL=0`|Don't check out-of-zone addresses in `named-checkzone`|
 |`-DNS_RUN_PID_DIR=0`|Create default PID files in `${localstatedir}/run` rather than `${localstatedir}/run/named/`|
-|`-DNS_RPZ_MAX_ZONES=64`|Increase the maximum number of configurable response policy zones from 32 to 64; this is the highest possible setting|
 |`-DISC_BUFFER_USEINLINE=0`|Disable the use of inline functions to implement the `isc_buffer` API: this reduces performance but may be useful when debugging |
 |`-DISC_HEAP_CHECK`|Test heap consistency after every heap operation; used when debugging|
@@ -5,7 +5,7 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.12 features
+ 4. BIND 9.13 features
 5. Building BIND
 6. macOS
 7. Compile-time options
@@ -82,8 +82,8 @@ ISC maintains a public git repository for BIND; details can be found at
 http://www.isc.org/git/.

 Information for BIND contributors can be found in the following files: -
-General information: doc/dev/contrib.md - BIND 9 code style: doc/dev/
-style.md - BIND architecture and developer guide: doc/dev/dev.md
+General information: CONTRIBUTING.md - BIND 9 code style: doc/dev/style.md
+- BIND architecture and developer guide: doc/dev/dev.md

 Patches for BIND may be submitted as Merge Requests in the ISC GitLab
 server at at https://gitlab.isc.org/isc-projects/bind9/merge_requests.
@@ -97,58 +97,13 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.

-BIND 9.12 features
+BIND 9.13 features

-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases. New features
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases. New features
 include:

-  * named and related libraries have been substantially refactored for
-    improved query performance -- particularly on delegation heavy zones
-    -- and for improved readability, maintainability, and testability.
-  * Code implementing the name server query processing logic has been
-    moved into a new libns library, for easier testing and use in tools
-    other than named.
-  * Cached, validated NSEC and other records can now be used to synthesize
-    NXDOMAIN responses.
-  * The DNS Response Policy Service API (DNSRPS) is now supported.
-  * Setting 'max-journal-size default' now limits the size of journal
-    files to twice the size of the zone.
-  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
-    message.
-  * dnstap output files can now be configured to roll automatically when
-    reaching a given size.
-  * Log file timestamps can now also be formatted in ISO 8601 (local) or
-    ISO 8601 (UTC) formats.
-  * Logging channels and dnstap output files can now be configured to use
-    a timestamp as the suffix when rolling to a new file.
-  * 'named-checkconf -l' lists zones found in named.conf.
-  * Added support for the EDNS Padding and Keepalive options.
-  * 'new-zones-directory' option sets the location where the configuration
-    data for zones added by rndc addzone is stored.
-  * The default key algorithm in rndc-confgen is now hmac-sha256.
-  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
-    default without a configure option.
-  * The obsolete isc-hmac-fixup command has been removed.
-
-BIND 9.12.1
-
-BIND 9.12.1 is a maintenance release.
-
-BIND 9.12.2
-
-BIND 9.12.2 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
-CVE-2018-5738.
-
-BIND 9.12.3
-
-BIND 9.12.3 is a maintenance release, and also addresses CVE-2018-5741 by
-correcting faulty documentation and introducing the following new feature:
-
-  * New krb5-selfsub and ms-selfsub rule types for update-policy
-    statements allow updating of subdomains based on a Kerberos or Active
-    Directory machine principal.
+  * TBD

 Building BIND

@@ -15,7 +15,7 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.12 features](#features)
+1. [BIND 9.13 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Compile-time options](#opts)
@@ -95,7 +95,7 @@ ISC maintains a public git repository for BIND; details can be found
 at [http://www.isc.org/git/](http://www.isc.org/git/).

 Information for BIND contributors can be found in the following files:
- General information: [doc/dev/contrib.md](doc/dev/contrib.md)
+- General information: [CONTRIBUTING.md](CONTRIBUTING)
 - BIND 9 code style: [doc/dev/style.md](doc/dev/style.md)
 - BIND architecture and developer guide: [doc/dev/dev.md](doc/dev/dev.md)

@@ -114,59 +114,13 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.

-### <a name="features"/> BIND 9.12 features
+### <a name="features"/> BIND 9.13 features

-BIND 9.12.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.11 and earlier releases.  New features
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
+number of changes from BIND 9.12 and earlier releases.  New features
 include:

-* `named` and related libraries have been substantially refactored for
-  improved query performance -- particularly on delegation heavy zones -- 
-  and for improved readability, maintainability, and testability.
-* Code implementing the name server query processing logic has been moved
-  into a new `libns` library, for easier testing and use in tools other
-  than `named`.
-* Cached, validated NSEC and other records can now be used to synthesize
-  NXDOMAIN responses.
-* The DNS Response Policy Service API (DNSRPS) is now supported.
-* Setting `'max-journal-size default'` now limits the size of journal files
-  to twice the size of the zone.
-* `dnstap-read -x` prints a hex dump of the wire format of each logged
-  DNS message.
-* `dnstap` output files can now be configured to roll automatically when
-  reaching a given size.
-* Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
-  8601 (UTC) formats.
-* Logging channels and `dnstap` output files can now be configured to use a
-  timestamp as the suffix when rolling to a new file.
-* `'named-checkconf -l'` lists zones found in `named.conf`.
-* Added support for the EDNS Padding and Keepalive options.
-* 'new-zones-directory' option sets the location where the configuration
-  data for zones added by rndc addzone is stored.
-* The default key algorithm in `rndc-confgen` is now hmac-sha256.
-* `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
-  by default without a configure option.
-* The obsolete `isc-hmac-fixup` command has been removed.
-
-#### BIND 9.12.1
-
-BIND 9.12.1 is a maintenance release.
-
-#### BIND 9.12.2
-
-BIND 9.12.2 is a maintenance release, and addresses security
-vulnerabilities disclosed in CVE-2018-5736, CVE-2018-5737 and
-CVE-2018-5738.
-
-#### BIND 9.12.3
-
-BIND 9.12.3 is a maintenance release, and also addresses CVE-2018-5741
-by correcting faulty documentation and introducing the following new
-feature:
-
-* New `krb5-selfsub` and `ms-selfsub` rule types for `update-policy`
-  statements allow updating of subdomains based on a Kerberos or
-  Active Directory machine principal.
+* TBD

 ### <a name="build"/> Building BIND

@@ -10,4 +10,4 @@
 # information regarding copyright ownership.

 # Run this script after modifying configure.in to generate configure
-autoreconf -f -i
+autoreconf -i
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
 		${ISC_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES = 	@CRYPTO@ -DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
+CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -88,12 +88,12 @@ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)

 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
 	rm -f ${DESTDIR}${sbindir}/named-compilezone@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkconf@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkzone@EXEEXT@
@@ -14,9 +14,7 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdio.h>
-#include <inttypes.h>

 #ifdef _WIN32
 #include <Winsock2.h>
@@ -90,28 +88,27 @@ static const char *dbtype[] = { "rbt" };

 int debug = 0;
 const char *journal = NULL;
-bool nomerge = true;
+isc_boolean_t nomerge = ISC_TRUE;
 #if CHECK_LOCAL
-bool docheckmx = true;
-bool dochecksrv = true;
-bool docheckns = true;
+isc_boolean_t docheckmx = ISC_TRUE;
+isc_boolean_t dochecksrv = ISC_TRUE;
+isc_boolean_t docheckns = ISC_TRUE;
 #else
-bool docheckmx = false;
-bool dochecksrv = false;
-bool docheckns = false;
+isc_boolean_t docheckmx = ISC_FALSE;
+isc_boolean_t dochecksrv = ISC_FALSE;
+isc_boolean_t docheckns = ISC_FALSE;
 #endif
-unsigned int zone_options = DNS_ZONEOPT_CHECKNS |
-			    DNS_ZONEOPT_CHECKMX |
-			    DNS_ZONEOPT_MANYERRORS |
-			    DNS_ZONEOPT_CHECKNAMES |
-			    DNS_ZONEOPT_CHECKINTEGRITY |
+dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS |
+			     DNS_ZONEOPT_CHECKMX |
+			     DNS_ZONEOPT_MANYERRORS |
+			     DNS_ZONEOPT_CHECKNAMES |
+			     DNS_ZONEOPT_CHECKINTEGRITY |
 #if CHECK_SIBLING
-			    DNS_ZONEOPT_CHECKSIBLING |
+			     DNS_ZONEOPT_CHECKSIBLING |
 #endif
-			    DNS_ZONEOPT_CHECKWILDCARD |
-			    DNS_ZONEOPT_WARNMXCNAME |
-			    DNS_ZONEOPT_WARNSRVCNAME;
-unsigned int zone_options2 = 0;
+			     DNS_ZONEOPT_CHECKWILDCARD |
+			     DNS_ZONEOPT_WARNMXCNAME |
+			     DNS_ZONEOPT_WARNSRVCNAME;

 /*
 * This needs to match the list in bin/named/log.c.
@@ -145,7 +142,7 @@ add(char *key, int value) {

 	if (symtab == NULL) {
 		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
-					   false, &symtab);
+					   ISC_FALSE, &symtab);
 		if (result != ISC_R_SUCCESS)
 			return;
 	}
@@ -161,20 +158,20 @@ add(char *key, int value) {
 		isc_mem_free(sym_mctx, key);
 }

-static bool
+static isc_boolean_t
 logged(char *key, int value) {
 	isc_result_t result;

 	if (symtab == NULL)
-		return (false);
+		return (ISC_FALSE);

 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS)
-		return (true);
-	return (false);
+		return (ISC_TRUE);
+	return (ISC_FALSE);
 }

-static bool
+static isc_boolean_t
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
@@ -185,8 +182,8 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
-	bool answer = true;
-	bool match;
+	isc_boolean_t answer = ISC_TRUE;
+	isc_boolean_t match;
 	const char *type;
 	void *ptr = NULL;
 	int result;
@@ -235,7 +232,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     ownerbuf, namebuf,
 				     cur->ai_canonname);
 			/* XXX950 make fatal for 9.5.0 */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 			add(namebuf, ERR_IS_CNAME);
 		}
 		break;
@@ -251,7 +248,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return (true);
+		return (ISC_TRUE);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -260,7 +257,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}

 	/*
@@ -271,13 +268,13 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	result = dns_rdataset_first(a);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(a, &rdata);
-		match = false;
+		match = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET)
 				continue;
 			ptr = &((struct sockaddr_in *)(cur->ai_addr))->sin_addr;
 			if (memcmp(ptr, rdata.data, rdata.length) == 0) {
-				match = true;
+				match = ISC_TRUE;
 				break;
 			}
 		}
@@ -289,7 +286,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					       addrbuf, sizeof(addrbuf)));
 			add(namebuf, ERR_EXTRA_A);
 			/* XXX950 make fatal for 9.5.0 */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 		}
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(a);
@@ -301,13 +298,13 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	result = dns_rdataset_first(aaaa);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(aaaa, &rdata);
-		match = false;
+		match = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET6)
 				continue;
 			ptr = &((struct sockaddr_in6 *)(cur->ai_addr))->sin6_addr;
 			if (memcmp(ptr, rdata.data, rdata.length) == 0) {
-				match = true;
+				match = ISC_TRUE;
 				break;
 			}
 		}
@@ -319,7 +316,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					       addrbuf, sizeof(addrbuf)));
 			add(namebuf, ERR_EXTRA_AAAA);
 			/* XXX950 make fatal for 9.5.0. */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 		}
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(aaaa);
@@ -330,7 +327,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	 * Check that all addresses appear in the glue.
 	 */
 	if (!logged(namebuf, ERR_MISSING_GLUE)) {
-		bool missing_glue = false;
+		isc_boolean_t missing_glue = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			switch (cur->ai_family) {
 			case AF_INET:
@@ -346,7 +343,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			default:
 				 continue;
 			}
-			match = false;
+			match = ISC_FALSE;
 			if (dns_rdataset_isassociated(rdataset))
 				result = dns_rdataset_first(rdataset);
 			else
@@ -354,7 +351,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			while (result == ISC_R_SUCCESS && !match) {
 				dns_rdataset_current(rdataset, &rdata);
 				if (memcmp(ptr, rdata.data, rdata.length) == 0)
-					match = true;
+					match = ISC_TRUE;
 				dns_rdata_reset(&rdata);
 				result = dns_rdataset_next(rdataset);
 			}
@@ -365,8 +362,8 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					     inet_ntop(cur->ai_family, ptr,
 						       addrbuf, sizeof(addrbuf)));
 				/* XXX950 make fatal for 9.5.0. */
-				/* answer = false; */
-				missing_glue = true;
+				/* answer = ISC_FALSE; */
+				missing_glue = ISC_TRUE;
 			}
 		}
 		if (missing_glue)
@@ -375,11 +372,11 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	freeaddrinfo(ai);
 	return (answer);
 #else
-	return (true);
+	return (ISC_TRUE);
 #endif
 }

-static bool
+static isc_boolean_t
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
@@ -387,7 +384,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
 	int level = ISC_LOG_ERROR;
-	bool answer = true;
+	isc_boolean_t answer = ISC_TRUE;

 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_CANONNAME;
@@ -431,7 +428,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 					add(namebuf, ERR_IS_MXCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
-					answer = false;
+					answer = ISC_FALSE;
 			}
 		}
 		freeaddrinfo(ai);
@@ -449,7 +446,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return (ISC_TRUE);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -458,14 +455,14 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}
 #else
-	return (true);
+	return (ISC_TRUE);
 #endif
 }

-static bool
+static isc_boolean_t
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
@@ -473,7 +470,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
 	int level = ISC_LOG_ERROR;
-	bool answer = true;
+	isc_boolean_t answer = ISC_TRUE;

 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_CANONNAME;
@@ -516,7 +513,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 					add(namebuf, ERR_IS_SRVCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
-					answer = false;
+					answer = ISC_FALSE;
 			}
 		}
 		freeaddrinfo(ai);
@@ -534,7 +531,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return (ISC_TRUE);

 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -543,10 +540,10 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}
 #else
-	return (true);
+	return (ISC_TRUE);
 #endif
 }

@@ -653,7 +650,7 @@ check_ttls(dns_zone_t *zone, dns_ttl_t maxttl) {
 	if (dbiter != NULL)
 		dns_dbiterator_destroy(&dbiter);
 	if (version != NULL)
-		dns_db_closeversion(db, &version, false);
+		dns_db_closeversion(db, &version, ISC_FALSE);
 	if (db != NULL)
 		dns_db_detach(&db);

@@ -690,7 +687,8 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	CHECK(dns_name_fromtext(origin, &buffer, dns_rootname, 0, NULL));
 	CHECK(dns_zone_setorigin(zone, origin));
 	CHECK(dns_zone_setdbtype(zone, 1, (const char * const *) dbtype));
-	CHECK(dns_zone_setfile2(zone, filename, fileformat));
+	CHECK(dns_zone_setfile(zone, filename, fileformat,
+			       &dns_master_style_default));
 	if (journal != NULL)
 		CHECK(dns_zone_setjournal(zone, journal));

@@ -699,8 +697,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	CHECK(dns_rdataclass_fromtext(&rdclass, &region));

 	dns_zone_setclass(zone, rdclass);
-	dns_zone_setoption(zone, zone_options, true);
-	dns_zone_setoption2(zone, zone_options2, true);
+	dns_zone_setoption(zone, zone_options, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);

 	dns_zone_setmaxttl(zone, maxttl);
@@ -737,7 +734,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 isc_result_t
 dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	  dns_masterformat_t fileformat, const dns_master_style_t *style,
-	  const uint32_t rawversion)
+	  const isc_uint32_t rawversion)
 {
 	isc_result_t result;
 	FILE *output = stdout;
@@ -763,8 +760,8 @@ dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 		}
 	}

-	result = dns_zone_dumptostream3(zone, output, fileformat, style,
-					rawversion);
+	result = dns_zone_dumptostream(zone, output, fileformat, style,
+				       rawversion);
 	if (output != stdout)
 		(void)isc_stdio_close(output);

@@ -792,3 +789,4 @@ DestroySockets(void) {
 	WSACleanup();
 }
 #endif
+
@@ -15,15 +15,13 @@

 /*! \file */

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>

 #include <dns/masterdump.h>
 #include <dns/types.h>
+#include <dns/zone.h>

 ISC_LANG_BEGINDECLS

@@ -38,7 +36,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 isc_result_t
 dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	  dns_masterformat_t fileformat, const dns_master_style_t *style,
-	  const uint32_t rawversion);
+	  const isc_uint32_t rawversion);

 #ifdef _WIN32
 void InitSockets(void);
@@ -47,12 +45,11 @@ void DestroySockets(void);

 extern int debug;
 extern const char *journal;
-extern bool nomerge;
-extern bool docheckmx;
-extern bool docheckns;
-extern bool dochecksrv;
-extern unsigned int zone_options;
-extern unsigned int zone_options2;
+extern isc_boolean_t nomerge;
+extern isc_boolean_t docheckmx;
+extern isc_boolean_t docheckns;
+extern isc_boolean_t dochecksrv;
+extern dns_zoneopt_t zone_options;

 ISC_LANG_ENDDECLS

@@ -15,13 +15,11 @@
 #include <config.h>

 #include <errno.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>

 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -93,18 +91,18 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	return (ISC_R_SUCCESS);
 }

-static bool
+static isc_boolean_t
 get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL)
-			return (false);
+			return (ISC_FALSE);
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS)
-			return (true);
+			return (ISC_TRUE);
 	}
 }

-static bool
+static isc_boolean_t
 get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *checknames;
@@ -115,24 +113,29 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {

 	for (i = 0;; i++) {
 		if (maps[i] == NULL)
-			return (false);
+			return (ISC_FALSE);
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return (true);
+			return (ISC_TRUE);
 		}
 		for (element = cfg_list_first(checknames);
 		     element != NULL;
 		     element = cfg_list_next(element)) {
 			value = cfg_listelt_value(element);
 			type = cfg_tuple_get(value, "type");
-			if (strcasecmp(cfg_obj_asstring(type), "master") != 0)
+			if ((strcasecmp(cfg_obj_asstring(type),
+					"primary") != 0) &&
+			    (strcasecmp(cfg_obj_asstring(type),
+					"master") != 0))
+			{
 				continue;
+			}
 			*obj = cfg_tuple_get(value, "mode");
-			return (true);
+			return (ISC_TRUE);
 		}
 	}
 }
@@ -165,7 +168,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 static isc_result_t
 configure_zone(const char *vclass, const char *view,
 	       const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-	       const cfg_obj_t *config, isc_mem_t *mctx, bool list)
+	       const cfg_obj_t *config, isc_mem_t *mctx, isc_boolean_t list)
 {
 	int i = 0;
 	isc_result_t result;
@@ -246,11 +249,14 @@ configure_zone(const char *vclass, const char *view,
 	 * Skip loading checks for any type other than
 	 * master and redirect
 	 */
-	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0)
+	if (strcasecmp(cfg_obj_asstring(typeobj), "hint") == 0) {
 		return (configure_hint(zfile, zclass, mctx));
-	else if ((strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
-		  (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
+	} else if ((strcasecmp(cfg_obj_asstring(typeobj), "primary") != 0) &&
+		   (strcasecmp(cfg_obj_asstring(typeobj), "master") != 0) &&
+		   (strcasecmp(cfg_obj_asstring(typeobj), "redirect") != 0))
+	{
 		return (ISC_R_SUCCESS);
+	}

 	/*
 	 * Is the redirect zone configured as a slave?
@@ -400,7 +406,7 @@ configure_zone(const char *vclass, const char *view,
 	obj = NULL;
 	if (get_maps(maps, "max-zone-ttl", &obj)) {
 		maxttl = cfg_obj_asuint32(obj);
-		zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+		zone_options |= DNS_ZONEOPT_CHECKTTL;
 	}

 	result = load_zone(mctx, zname, zfile, masterformat,
@@ -414,7 +420,7 @@ configure_zone(const char *vclass, const char *view,
 /*% configure a view */
 static isc_result_t
 configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
-	       const cfg_obj_t *vconfig, isc_mem_t *mctx, bool list)
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx, isc_boolean_t list)
 {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *voptions;
@@ -463,7 +469,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 /*% load zones from the configuration */
 static isc_result_t
 load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
-		      bool list_zones)
+		      isc_boolean_t list_zones)
 {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *views;
@@ -531,13 +537,12 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	int exit_status = 0;
-	isc_entropy_t *ectx = NULL;
-	bool load_zones = false;
-	bool list_zones = false;
-	bool print = false;
+	isc_boolean_t load_zones = ISC_FALSE;
+	isc_boolean_t list_zones = ISC_FALSE;
+	isc_boolean_t print = ISC_FALSE;
 	unsigned int flags = 0;

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	/*
 	 * Process memory debugging argument first.
@@ -561,7 +566,7 @@ main(int argc, char **argv) {
 			break;
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

@@ -572,11 +577,11 @@ main(int argc, char **argv) {
 			break;

 		case 'j':
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;

 		case 'l':
-			list_zones = true;
+			list_zones = ISC_TRUE;
 			break;

 		case 'm':
@@ -592,7 +597,7 @@ main(int argc, char **argv) {
 			break;

 		case 'p':
-			print = true;
+			print = ISC_TRUE;
 			break;

 		case 'v':
@@ -604,10 +609,10 @@ main(int argc, char **argv) {
 			break;

 		case 'z':
-			load_zones = true;
-			docheckmx = false;
-			docheckns = false;
-			dochecksrv = false;
+			load_zones = ISC_TRUE;
+			docheckmx = ISC_FALSE;
+			docheckns = ISC_FALSE;
+			dochecksrv = ISC_FALSE;
 			break;

 		case '?':
@@ -647,10 +652,6 @@ main(int argc, char **argv) {

 	RUNTIME_CHECK(setup_logging(mctx, stdout, &logc) == ISC_R_SUCCESS);

-	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
-		      == ISC_R_SUCCESS);
-
 	dns_result_register();

 	RUNTIME_CHECK(cfg_parser_create(mctx, logc, &parser) == ISC_R_SUCCESS);
@@ -681,9 +682,6 @@ main(int argc, char **argv) {

 	isc_log_destroy(&logc);

-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
-
 	isc_mem_destroy(&mctx);

 #ifdef _WIN32
@@ -14,14 +14,11 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdlib.h>
-#include <inttypes.h>

 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/log.h>
 #include <isc/mem.h>
@@ -48,7 +45,6 @@

 static int quiet = 0;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 dns_zone_t *zone = NULL;
 dns_zonetype_t zonetype = dns_zone_master;
 static int dumpzone = 0;
@@ -110,10 +106,10 @@ main(int argc, char **argv) {
 	dns_masterformat_t inputformat = dns_masterformat_text;
 	dns_masterformat_t outputformat = dns_masterformat_text;
 	dns_masterrawheader_t header;
-	uint32_t rawversion = 1, serialnum = 0;
+	isc_uint32_t rawversion = 1, serialnum = 0;
 	dns_ttl_t maxttl = 0;
-	bool snset = false;
-	bool logdump = false;
+	isc_boolean_t snset = ISC_FALSE;
+	isc_boolean_t logdump = ISC_FALSE;
 	FILE *errout = stdout;
 	char *endp;

@@ -163,7 +159,7 @@ main(int argc, char **argv) {

 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	while ((c = isc_commandline_parse(argc, argv,
 			       "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:M:S:T:W:"))
@@ -181,33 +177,33 @@ main(int argc, char **argv) {
 			if (ARGCMP("full")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY |
 						DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = true;
-				docheckns = true;
-				dochecksrv = true;
+				docheckmx = ISC_TRUE;
+				docheckns = ISC_TRUE;
+				dochecksrv = ISC_TRUE;
 			} else if (ARGCMP("full-sibling")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = true;
-				docheckns = true;
-				dochecksrv = true;
+				docheckmx = ISC_TRUE;
+				docheckns = ISC_TRUE;
+				dochecksrv = ISC_TRUE;
 			} else if (ARGCMP("local")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options |= DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
-				docheckns = false;
-				dochecksrv = false;
+				docheckmx = ISC_FALSE;
+				docheckns = ISC_FALSE;
+				dochecksrv = ISC_FALSE;
 			} else if (ARGCMP("local-sibling")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
-				docheckns = false;
-				dochecksrv = false;
+				docheckmx = ISC_FALSE;
+				docheckns = ISC_FALSE;
+				dochecksrv = ISC_FALSE;
 			} else if (ARGCMP("none")) {
 				zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
-				docheckns = false;
-				dochecksrv = false;
+				docheckmx = ISC_FALSE;
+				docheckns = ISC_FALSE;
+				dochecksrv = ISC_FALSE;
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
@@ -224,12 +220,12 @@ main(int argc, char **argv) {
 			break;

 		case 'j':
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;

 		case 'J':
 			journal = isc_commandline_argument;
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;

 		case 'k':
@@ -250,7 +246,7 @@ main(int argc, char **argv) {
 			break;

 		case 'L':
-			snset = true;
+			snset = ISC_TRUE;
 			endp = NULL;
 			serialnum = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -261,7 +257,7 @@ main(int argc, char **argv) {
 			break;

 		case 'l':
-			zone_options2 |= DNS_ZONEOPT2_CHECKTTL;
+			zone_options |= DNS_ZONEOPT_CHECKTTL;
 			endp = NULL;
 			maxttl = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -509,7 +505,7 @@ main(int argc, char **argv) {
 	     strcmp(output_filename, "/dev/fd/1") == 0 ||
 	     strcmp(output_filename, "/dev/stdout") == 0)) {
 		errout = stderr;
-		logdump = false;
+		logdump = ISC_FALSE;
 	}

 	if (isc_commandline_index + 2 != argc)
@@ -523,9 +519,6 @@ main(int argc, char **argv) {
 	if (!quiet)
 		RUNTIME_CHECK(setup_logging(mctx, errout, &lctx)
 			      == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_entropy_create(mctx, &ectx) == ISC_R_SUCCESS);
-	RUNTIME_CHECK(isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE)
-		      == ISC_R_SUCCESS);

 	dns_result_register();

@@ -557,8 +550,6 @@ main(int argc, char **argv) {
 	destroy();
 	if (lctx != NULL)
 		isc_log_destroy(&lctx);
-	isc_hash_destroy();
-	isc_entropy_detach(&ectx);
 	isc_mem_destroy(&mctx);
 #ifdef _WIN32
 	DestroySockets();
@@ -39,7 +39,7 @@
 ddns-confgen \- ddns key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBtsig\-keygen\fR\ 'u
-\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [name]
+\fBtsig\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [name]
 .HP \w'\fBddns\-confgen\fR\ 'u
 \fBddns\-confgen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-q\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\-s\ \fIname\fR | \-z\ \fIzone\fR]
 .SH "DESCRIPTION"
@@ -109,17 +109,6 @@ only\&.) Quiet mode: Print only the key, with no explanatory text or usage examp
 \fBtsig\-keygen\fR\&.
 .RE
 .PP
-\-r \fIrandomfile\fR
-.RS 4
-Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-s \fIname\fR
 .RS 4
 (\fBddns\-confgen\fR
@@ -19,7 +19,6 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdlib.h>
 #include <stdarg.h>

@@ -27,7 +26,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -38,7 +36,7 @@
 #include <isc/time.h>
 #include <isc/util.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -58,7 +56,7 @@
 static char program[256];
 const char *progname;
 static enum { progmode_keygen, progmode_confgen} progmode;
-bool verbose = false; /* needed by util.c but not used here */
+isc_boolean_t verbose = ISC_FALSE; /* needed by util.c but not used here */

 ISC_PLATFORM_NORETURN_PRE static void
 usage(int status) ISC_PLATFORM_NORETURN_POST;
@@ -68,10 +66,9 @@ usage(int status) {
 	if (progmode == progmode_confgen) {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-k keyname] [-r randomfile] [-q] [-s name | -z zone]\n\
+ %s [-a alg] [-k keyname] [-q] [-s name | -z zone]\n\
  -a alg:        algorithm (default hmac-sha256)\n\
  -k keyname:    name of the key as it will be used in named.conf\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s name:       domain name to be updated using the created key\n\
  -z zone:       name of the zone as it will be used in named.conf\n\
  -q:            quiet mode: print the key, with no explanatory text\n",
@@ -79,9 +76,8 @@ Usage:\n\
 	} else {
 		fprintf(stderr, "\
 Usage:\n\
- %s [-a alg] [-r randomfile] [keyname]\n\
-  -a alg:        algorithm (default hmac-sha256)\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n",
+ %s [-a alg] [keyname]\n\
+  -a alg:        algorithm (default hmac-sha256)\n\n",
 			 progname);
 	}

@@ -91,12 +87,11 @@ Usage:\n\
 int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
-	bool show_final_mem = false;
-	bool quiet = false;
+	isc_boolean_t show_final_mem = ISC_FALSE;
+	isc_boolean_t quiet = ISC_FALSE;
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
-	const char *randomfile = NULL;
 	const char *keyname = NULL;
 	const char *zone = NULL;
 	const char *self_domain = NULL;
@@ -107,7 +102,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -129,13 +124,13 @@ main(int argc, char **argv) {

 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
-		quiet = true;
+		quiet = ISC_TRUE;
 	} else if (PROGCMP("ddns-confgen"))
 		progmode = progmode_confgen;
 	else
 		INSIST(0);

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	while ((ch = isc_commandline_parse(argc, argv,
 					   "a:hk:Mmr:qs:y:z:")) != -1) {
@@ -160,16 +155,16 @@ main(int argc, char **argv) {
 			isc_mem_debugging = ISC_MEM_DEBUGTRACE;
 			break;
 		case 'm':
-			show_final_mem = true;
+			show_final_mem = ISC_TRUE;
 			break;
 		case 'q':
 			if (progmode == progmode_confgen)
-				quiet = true;
+				quiet = ISC_TRUE;
 			else
 				usage(1);
 			break;
 		case 'r':
-			randomfile = isc_commandline_argument;
+			fatal("The -r option has been deprecated.");
 			break;
 		case 's':
 			if (progmode == progmode_confgen)
@@ -236,7 +231,7 @@ main(int argc, char **argv) {

 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, alg, keysize, &key_txtbuffer);


 	if (!quiet)
@@ -46,7 +46,6 @@
      <command>tsig-keygen</command>
      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">algorithm</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat">name</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
@@ -157,23 +156,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-r <replaceable class="parameter">randomfile</replaceable></term>
-	<listitem>
-	  <para>
-            Specifies a source of random data for generating the
-            authorization.  If the operating system does not provide a
-            <filename>/dev/random</filename> or equivalent device, the
-            default source of randomness is keyboard input.
-            <filename>randomdev</filename> specifies the name of a
-            character device or file containing random data to be used
-            instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard input
-            should be used.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-s <replaceable class="parameter">name</replaceable></term>
 	<listitem>
@@ -35,7 +35,6 @@
      <code class="command">tsig-keygen</code> 
       [<code class="option">-a <em class="replaceable"><code>algorithm</code></em></code>]
       [<code class="option">-h</code>]
-       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [name]
    </p></div>
    <div class="cmdsynopsis"><p>
@@ -136,20 +135,6 @@
            This is essentially identical to <span class="command"><strong>tsig-keygen</strong></span>.
 	  </p>
 	</dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd>
-	  <p>
-            Specifies a source of random data for generating the
-            authorization.  If the operating system does not provide a
-            <code class="filename">/dev/random</code> or equivalent device, the
-            default source of randomness is keyboard input.
-            <code class="filename">randomdev</code> specifies the name of a
-            character device or file containing random data to be used
-            instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard input
-            should be used.
-	  </p>
-	</dd>
 <dt><span class="term">-s <em class="replaceable"><code>name</code></em></span></dt>
 <dd>
 	  <p>
@@ -19,7 +19,6 @@

 #include <isc/base64.h>
 #include <isc/buffer.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -113,17 +112,12 @@ alg_bits(dns_secalg_t alg) {
 }

 /*%
- * Generate a key of size 'keysize' using entropy source 'randomfile',
- * and place it in 'key_txtbuffer'
+ * Generate a key of size 'keysize' and place it in 'key_txtbuffer'
 */
 void
-generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
-	     int keysize, isc_buffer_t *key_txtbuffer) {
+generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
+	     isc_buffer_t *key_txtbuffer) {
 	isc_result_t result = ISC_R_SUCCESS;
-	isc_entropysource_t *entropy_source = NULL;
-	int open_keyboard = ISC_ENTROPY_KEYBOARDMAYBE;
-	int entropy_flags = 0;
-	isc_entropy_t *ectx = NULL;
 	isc_buffer_t key_rawbuffer;
 	isc_region_t key_rawregion;
 	char key_rawsecret[64];
@@ -150,31 +144,12 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 		fatal("unsupported algorithm %d\n", alg);
 	}

-
-	DO("create entropy context", isc_entropy_create(mctx, &ectx));
-
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(ectx, true);
-	}
-#endif
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		randomfile = NULL;
-		open_keyboard = ISC_ENTROPY_KEYBOARDYES;
-	}
-	DO("start entropy source", isc_entropy_usebestsource(ectx,
-							     &entropy_source,
-							     randomfile,
-							     open_keyboard));
-
-	entropy_flags = ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY;
-
-	DO("initialize dst library", dst_lib_init(mctx, ectx, entropy_flags));
+	DO("initialize dst library", dst_lib_init(mctx, NULL));

 	DO("generate key", dst_key_generate(dns_rootname, alg,
-					    keysize, 0, 0,
-					    DNS_KEYPROTO_ANY,
-					    dns_rdataclass_in, mctx, &key));
+					    keysize, 0, 0, DNS_KEYPROTO_ANY,
+					    dns_rdataclass_in, mctx, &key,
+					    NULL));

 	isc_buffer_init(&key_rawbuffer, &key_rawsecret, sizeof(key_rawsecret));

@@ -185,17 +160,9 @@ generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
 	DO("bsse64 encode secret", isc_base64_totext(&key_rawregion, -1, "",
 						     key_txtbuffer));

-	/*
-	 * Shut down the entropy source now so the "stop typing" message
-	 * does not muck with the output.
-	 */
-	if (entropy_source != NULL)
-		isc_entropy_destroysource(&entropy_source);
-
 	if (key != NULL)
 		dst_key_free(&key);

-	isc_entropy_detach(&ectx);
 	dst_lib_destroy();
 }

@@ -19,8 +19,8 @@

 ISC_LANG_BEGINDECLS

-void generate_key(isc_mem_t *mctx, const char *randomfile, dns_secalg_t alg,
-		  int keysize, isc_buffer_t *key_txtbuffer);
+void generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
+		  isc_buffer_t *key_txtbuffer);

 void write_key_file(const char *keyfile, const char *user,
 		    const char *keyname, isc_buffer_t *secret,
@@ -39,7 +39,7 @@
 rndc-confgen \- rndc key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBrndc\-confgen\fR\ 'u
-\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-r\ \fR\fB\fIrandomfile\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
+\fBrndc\-confgen\fR [\fB\-a\fR] [\fB\-A\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-c\ \fR\fB\fIkeyfile\fR\fR] [\fB\-h\fR] [\fB\-k\ \fR\fB\fIkeyname\fR\fR] [\fB\-p\ \fR\fB\fIport\fR\fR] [\fB\-s\ \fR\fB\fIaddress\fR\fR] [\fB\-t\ \fR\fB\fIchrootdir\fR\fR] [\fB\-u\ \fR\fB\fIuser\fR\fR]
 .SH "DESCRIPTION"
 .PP
 \fBrndc\-confgen\fR
@@ -147,17 +147,6 @@ listens for connections from
 \fBrndc\fR\&. The default is 953\&.
 .RE
 .PP
-\-r \fIrandomfile\fR
-.RS 4
-Specifies a source of random data for generating the authorization\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-s \fIaddress\fR
 .RS 4
 Specifies the IP address where
@@ -22,7 +22,6 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdlib.h>
 #include <stdarg.h>

@@ -30,7 +29,6 @@
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
@@ -59,7 +57,7 @@
 static char program[256];
 const char *progname;

-bool verbose = false;
+isc_boolean_t verbose = ISC_FALSE;

 const char *keyfile, *keydef;

@@ -71,7 +69,7 @@ usage(int status) {

 	fprintf(stderr, "\
 Usage:\n\
- %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] [-r randomfile] \
+ %s [-a] [-b bits] [-c keyfile] [-k keyname] [-p port] \
 [-s addr] [-t chrootdir] [-u user]\n\
  -a:		 generate just the key clause and write it to keyfile (%s)\n\
  -A alg:	 algorithm (default hmac-sha256)\n\
@@ -79,7 +77,6 @@ Usage:\n\
  -c keyfile:	 specify an alternate key file (requires -a)\n\
  -k keyname:	 the name as it will be used  in named.conf and rndc.conf\n\
  -p port:	 the port named will listen on and rndc will connect to\n\
-  -r randomfile: source of random data (use \"keyboard\" for key timing)\n\
  -s addr:	 the address to which rndc should connect\n\
  -t chrootdir:	 write a keyfile in chrootdir as well (requires -a)\n\
  -u user:	 set the keyfile owner to \"user\" (requires -a)\n",
@@ -90,13 +87,12 @@ Usage:\n\

 int
 main(int argc, char **argv) {
-	bool show_final_mem = false;
+	isc_boolean_t show_final_mem = ISC_FALSE;
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_SUCCESS;
 	const char *keyname = NULL;
-	const char *randomfile = NULL;
 	const char *serveraddr = NULL;
 	dns_secalg_t alg;
 	const char *algname;
@@ -108,7 +104,7 @@ main(int argc, char **argv) {
 	struct in6_addr addr6_dummy;
 	char *chrootdir = NULL;
 	char *user = NULL;
-	bool keyonly = false;
+	isc_boolean_t keyonly = ISC_FALSE;
 	int len;

 	keydef = keyfile = RNDC_KEYFILE;
@@ -123,14 +119,14 @@ main(int argc, char **argv) {
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	while ((ch = isc_commandline_parse(argc, argv,
 					   "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1)
 	{
 		switch (ch) {
 		case 'a':
-			keyonly = true;
+			keyonly = ISC_TRUE;
 			break;
 		case 'A':
 			algname = isc_commandline_argument;
@@ -157,7 +153,7 @@ main(int argc, char **argv) {
 			break;

 		case 'm':
-			show_final_mem = true;
+			show_final_mem = ISC_TRUE;
 			break;
 		case 'p':
 			port = strtol(isc_commandline_argument, &p, 10);
@@ -166,7 +162,7 @@ main(int argc, char **argv) {
 				      isc_commandline_argument);
 			break;
 		case 'r':
-			randomfile = isc_commandline_argument;
+			fatal("The -r option has been deprecated.");
 			break;
 		case 's':
 			serveraddr = isc_commandline_argument;
@@ -181,7 +177,7 @@ main(int argc, char **argv) {
 			user = isc_commandline_argument;
 			break;
 		case 'V':
-			verbose = true;
+			verbose = ISC_TRUE;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -218,7 +214,7 @@ main(int argc, char **argv) {
 	DO("create memory context", isc_mem_create(0, 0, &mctx));
 	isc_buffer_init(&key_txtbuffer, &key_txtsecret, sizeof(key_txtsecret));

-	generate_key(mctx, randomfile, alg, keysize, &key_txtbuffer);
+	generate_key(mctx, alg, keysize, &key_txtbuffer);

 	if (keyonly) {
 		write_key_file(keyfile, chrootdir == NULL ? user : NULL,
@@ -58,7 +58,6 @@
      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
      <arg choice="opt" rep="norepeat"><option>-k <replaceable class="parameter">keyname</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">port</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomfile</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">address</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">chrootdir</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">user</replaceable></option></arg>
@@ -191,24 +190,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-r <replaceable class="parameter">randomfile</replaceable></term>
-        <listitem>
-          <para>
-            Specifies a source of random data for generating the
-            authorization.  If the operating
-            system does not provide a <filename>/dev/random</filename>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <filename>randomdev</filename>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard
-            input should be used.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-s <replaceable class="parameter">address</replaceable></term>
        <listitem>
@@ -40,7 +40,6 @@
       [<code class="option">-h</code>]
       [<code class="option">-k <em class="replaceable"><code>keyname</code></em></code>]
       [<code class="option">-p <em class="replaceable"><code>port</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>randomfile</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>address</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>chrootdir</code></em></code>]
       [<code class="option">-u <em class="replaceable"><code>user</code></em></code>]
@@ -154,21 +153,6 @@
            The default is 953.
          </p>
        </dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomfile</code></em></span></dt>
-<dd>
-          <p>
-            Specifies a source of random data for generating the
-            authorization.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p>
-        </dd>
 <dt><span class="term">-s <em class="replaceable"><code>address</code></em></span></dt>
 <dd>
          <p>
@@ -15,15 +15,15 @@
 #include <config.h>

 #include <stdarg.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>

+#include <isc/boolean.h>
 #include <isc/print.h>

 #include "util.h"

-extern bool verbose;
+extern isc_boolean_t verbose;
 extern const char *progname;

 void
@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =	@CRYPTO@ -DVERSION=\"${VERSION}\" \
+CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
 CWARNINGS =

@@ -24,9 +24,7 @@
 #include <netdb.h>
 #endif

-#include <stdbool.h>
 #include <stdio.h>
-#include <inttypes.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -96,40 +94,40 @@ static const char *port = "53";
 static isc_sockaddr_t *srcaddr4 = NULL, *srcaddr6 = NULL;
 static isc_sockaddr_t a4, a6;
 static char *curqname = NULL, *qname = NULL;
-static bool classset = false;
+static isc_boolean_t classset = ISC_FALSE;
 static dns_rdatatype_t qtype = dns_rdatatype_none;
-static bool typeset = false;
+static isc_boolean_t typeset = ISC_FALSE;

 static unsigned int styleflags = 0;
-static uint32_t splitwidth = 0xffffffff;
-static bool
-	showcomments = true,
-	showdnssec = true,
-	showtrust = true,
-	rrcomments = true,
-	noclass = false,
-	nocrypto = false,
-	nottl = false,
-	multiline = false,
-	short_form = false,
-	print_unknown_format = false;
+static isc_uint32_t splitwidth = 0xffffffff;
+static isc_boolean_t
+	showcomments = ISC_TRUE,
+	showdnssec = ISC_TRUE,
+	showtrust = ISC_TRUE,
+	rrcomments = ISC_TRUE,
+	noclass = ISC_FALSE,
+	nocrypto = ISC_FALSE,
+	nottl = ISC_FALSE,
+	multiline = ISC_FALSE,
+	short_form = ISC_FALSE,
+	print_unknown_format = ISC_FALSE;

-static bool
-	resolve_trace = false,
-	validator_trace = false,
-	message_trace = false;
+static isc_boolean_t
+	resolve_trace = ISC_FALSE,
+	validator_trace = ISC_FALSE,
+	message_trace = ISC_FALSE;

-static bool
-	use_ipv4 = true,
-	use_ipv6 = true;
+static isc_boolean_t
+	use_ipv4 = ISC_TRUE,
+	use_ipv6 = ISC_TRUE;

-static bool
-	cdflag = false,
-	no_sigs = false,
-	root_validation = true,
-	dlv_validation = true;
+static isc_boolean_t
+	cdflag = ISC_FALSE,
+	no_sigs = ISC_FALSE,
+	root_validation = ISC_TRUE,
+	dlv_validation = ISC_TRUE;

-static bool use_tcp = false;
+static isc_boolean_t use_tcp = ISC_FALSE;

 static char *anchorfile = NULL;
 static char *trust_anchor = NULL;
@@ -146,10 +144,10 @@ static char anchortext[] = MANAGED_KEYS;
 * Static function prototypes
 */
 static isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict);
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict);

 static isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);

 static void
@@ -410,7 +408,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	static dns_trust_t trust;
-	static bool first = true;
+	static isc_boolean_t first = ISC_TRUE;
 	isc_buffer_t target;
 	isc_region_t r;
 	char *t = NULL;
@@ -432,7 +430,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 			putchar('\n');
 		print_status(rdataset);
 		trust = rdataset->trust;
-		first = false;
+		first = ISC_FALSE;
 	}

 	do {
@@ -523,17 +521,17 @@ setup_style(dns_master_style_t **stylep) {
 	}

 	if (multiline || (nottl && noclass))
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 24, 32, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 24, 32, 80, 8,
+						splitwidth, mctx);
 	else if (nottl || noclass)
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 32, 40, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 32, 40, 80, 8,
+						splitwidth, mctx);
 	else
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 32, 40, 48, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 32, 40, 48, 80, 8,
+						splitwidth, mctx);

 	if (result == ISC_R_SUCCESS)
 		*stylep = style;
@@ -568,7 +566,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_rdata_dnskey_t keystruct;
-	uint32_t flags, proto, alg;
+	isc_uint32_t flags, proto, alg;
 	const char *keystr, *keynamestr;
 	unsigned char keydata[4096];
 	isc_buffer_t keydatabuf;
@@ -578,7 +576,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname;
 	isc_result_t result;
-	bool match_root = false, match_dlv = false;
+	isc_boolean_t match_root = ISC_FALSE, match_dlv = ISC_FALSE;

 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -623,9 +621,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	if (alg > 0xff)
 		CHECK(ISC_R_RANGE);

-	keystruct.flags = (uint16_t)flags;
-	keystruct.protocol = (uint8_t)proto;
-	keystruct.algorithm = (uint8_t)alg;
+	keystruct.flags = (isc_uint16_t)flags;
+	keystruct.protocol = (isc_uint8_t)proto;
+	keystruct.algorithm = (isc_uint8_t)alg;

 	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
@@ -780,7 +778,7 @@ addserver(dns_client_t *client) {
 	struct in6_addr in6;
 	isc_sockaddr_t *sa;
 	isc_sockaddrlist_t servers;
-	uint32_t destport;
+	isc_uint32_t destport;
 	isc_result_t result;
 	dns_name_t *name = NULL;

@@ -871,7 +869,7 @@ findserver(dns_client_t *client) {
 	irs_resconf_t *resconf = NULL;
 	isc_sockaddrlist_t *nameservers;
 	isc_sockaddr_t *sa, *next;
-	uint32_t destport;
+	isc_uint32_t destport;

 	result = parse_uint(&destport, port, 0xffff, "port");
 	if (result != ISC_R_SUCCESS)
@@ -945,22 +943,10 @@ cleanup:
 	return (result);
 }

-static char *
-next_token(char **stringp, const char *delim) {
-	char *res;
-
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
-}
-
 static isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = isc_parse_uint32(&n, value, 10);
 	if (result == ISC_R_SUCCESS && n > max)
 		result = ISC_R_RANGE;
@@ -976,23 +962,23 @@ parse_uint(uint32_t *uip, const char *value, uint32_t max,
 static void
 plus_option(char *option) {
 	isc_result_t result;
-	char option_store[256];
-	char *cmd, *value, *ptr;
-	bool state = true;
+	char *cmd, *value, *last = NULL;
+	isc_boolean_t state = ISC_TRUE;

-	strlcpy(option_store, option, sizeof(option_store));
-	ptr = option_store;
-	cmd = next_token(&ptr,"=");
+	INSIST(option != NULL);
+
+	cmd = strtok_r(option, "=", &last);
 	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option_store);
+		printf(";; Invalid option %s\n", option);
 		return;
 	}
-	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
-		state = false;
+		state = ISC_FALSE;
 	}

+	value = strtok_r(NULL, "\0", &last);
+
 #define FULLCHECK(A) \
 	do { \
 		size_t _l = strlen(cmd); \
@@ -1015,7 +1001,7 @@ plus_option(char *option) {
 			break;
 		case 'l': /* class */
 			FULLCHECK("class");
-			noclass = !state;
+			noclass = ISC_TF(!state);
 			break;
 		case 'o': /* comments */
 			FULLCHECK("comments");
@@ -1023,7 +1009,7 @@ plus_option(char *option) {
 			break;
 		case 'r': /* crypto */
 			FULLCHECK("crypto");
-			nocrypto = !state;
+			nocrypto = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1096,10 +1082,10 @@ plus_option(char *option) {
 			FULLCHECK("short");
 			short_form = state;
 			if (short_form) {
-				multiline = false;
-				showcomments = false;
-				showtrust = false;
-				showdnssec = false;
+				multiline = ISC_FALSE;
+				showcomments = ISC_FALSE;
+				showtrust = ISC_FALSE;
+				showdnssec = ISC_FALSE;
 			}
 			break;
 		case 'p': /* split */
@@ -1151,7 +1137,7 @@ plus_option(char *option) {
 			break;
 		case 't': /* ttl */
 			FULLCHECK("ttl");
-			nottl = !state;
+			nottl = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1179,11 +1165,11 @@ plus_option(char *option) {
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
 static const char *single_dash_opts = "46himv";
-static bool
-dash_option(char *option, char *next, bool *open_type_class) {
+static isc_boolean_t
+dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 	char opt, *value;
 	isc_result_t result;
-	bool value_from_next;
+	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -1191,7 +1177,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	struct in_addr in4;
 	struct in6_addr in6;
 	in_port_t srcport;
-	uint32_t num;
+	isc_uint32_t num;
 	char *hash;

 	while (strpbrk(option, single_dash_opts) == &option[0]) {
@@ -1207,7 +1193,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				fatal("IPv4 networking not available");
 			if (use_ipv6) {
 				isc_net_disableipv6();
-				use_ipv6 = false;
+				use_ipv6 = ISC_FALSE;
 			}
 			break;
 		case '6':
@@ -1215,7 +1201,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				fatal("IPv6 networking not available");
 			if (use_ipv4) {
 				isc_net_disableipv4();
-				use_ipv4 = false;
+				use_ipv4 = ISC_FALSE;
 			}
 			break;
 		case 'h':
@@ -1223,9 +1209,9 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			exit(0);
 			/* NOTREACHED */
 		case 'i':
-			no_sigs = true;
-			dlv_validation = false;
-			root_validation = false;
+			no_sigs = ISC_TRUE;
+			dlv_validation = ISC_FALSE;
+			root_validation = ISC_FALSE;
 			break;
 		case 'm':
 			/* handled in preparse_args() */
@@ -1240,14 +1226,14 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (strlen(option) > 1U)
 			option = &option[1];
 		else
-			return (false);
+			return (ISC_FALSE);
 	}
 	opt = option[0];
 	if (strlen(option) > 1U) {
-		value_from_next = false;
+		value_from_next = ISC_FALSE;
 		value = &option[1];
 	} else {
-		value_from_next = true;
+		value_from_next = ISC_TRUE;
 		value = next;
 	}
 	if (value == NULL)
@@ -1293,13 +1279,13 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (classset)
 			warn("extra query class");

-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = strlen(value);
 		result = dns_rdataclass_fromtext(&rdclass,
 						 (isc_textregion_t *)&tr);
 		if (result == ISC_R_SUCCESS)
-			classset = true;
+			classset = ISC_TRUE;
 		else if (rdclass != dns_rdataclass_in)
 			warn("ignoring non-IN query class");
 		else
@@ -1324,7 +1310,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fatal("out of memory");
 		return (value_from_next);
 	case 't':
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = strlen(value);
 		result = dns_rdatatype_fromtext(&rdtype,
@@ -1336,13 +1322,13 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			    rdtype == dns_rdatatype_axfr)
 				fatal("Transfer not supported");
 			qtype = rdtype;
-			typeset = true;
+			typeset = ISC_TRUE;
 		} else
 			warn("ignoring invalid type");
 		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value,
-				     false);
+				     ISC_FALSE);
 		if (result == ISC_R_SUCCESS) {
 			if (curqname != NULL) {
 				isc_mem_free(mctx, curqname);
@@ -1354,7 +1340,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			if (typeset)
 				warn("extra query type");
 			qtype = dns_rdatatype_ptr;
-			typeset = true;
+			typeset = ISC_TRUE;
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(1);
@@ -1366,7 +1352,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		usage();
 	}
 	/* NOTREACHED */
-	return (false);
+	return (ISC_FALSE);
 }

 /*
@@ -1375,7 +1361,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 */
 static void
 preparse_args(int argc, char **argv) {
-	bool ipv4only = false, ipv6only = false;
+	isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 	char *option;

 	for (argc--, argv++; argc > 0; argc--, argv++) {
@@ -1392,13 +1378,13 @@ preparse_args(int argc, char **argv) {
 				if (ipv6only) {
 					fatal("only one of -4 and -6 allowed");
 				}
-				ipv4only = true;
+				ipv4only = ISC_TRUE;
 				break;
 			case '6':
 				if (ipv4only) {
 					fatal("only one of -4 and -6 allowed");
 				}
-				ipv6only = true;
+				ipv6only = ISC_TRUE;
 				break;
 			}
 			option = &option[1];
@@ -1418,7 +1404,7 @@ parse_args(int argc, char **argv) {
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	bool open_type_class = true;
+	isc_boolean_t open_type_class = ISC_TRUE;

 	for (; argc > 0; argc--, argv++) {
 		if (argv[0][0] == '@') {
@@ -1457,7 +1443,7 @@ parse_args(int argc, char **argv) {
 					    rdtype == dns_rdatatype_axfr)
 						fatal("Transfer not supported");
 					qtype = rdtype;
-					typeset = true;
+					typeset = ISC_TRUE;
 					continue;
 				}
 				result = dns_rdataclass_fromtext(&rdclass,
@@ -1526,7 +1512,7 @@ reverse_octets(const char *in, char **p, char *end) {
 }

 static isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict) {
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict) {
 	int r;
 	isc_result_t result;
 	isc_netaddr_t addr;
@@ -1540,7 +1526,7 @@ get_reverse(char *reverse, size_t len, char *value, bool strict) {
 		unsigned int options = 0;

 		name = dns_fixedname_initname(&fname);
-		result = dns_byaddr_createptrname2(&addr, options, name);
+		result = dns_byaddr_createptrname(&addr, options, name);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 		dns_name_format(name, reverse, (unsigned int)len);
@@ -1624,8 +1610,8 @@ main(int argc, char *argv[]) {

 	/* Create client */
 	clopt = DNS_CLIENTCREATEOPT_USECACHE;
-	result = dns_client_createx2(mctx, actx, taskmgr, socketmgr, timermgr,
-				     clopt, &client, srcaddr4, srcaddr6);
+	result = dns_client_createx(mctx, actx, taskmgr, socketmgr, timermgr,
+				    clopt, &client, srcaddr4, srcaddr6);
 	if (result != ISC_R_SUCCESS) {
 		delv_log(ISC_LOG_ERROR, "dns_client_create: %s",
 			  isc_result_totext(result));
@@ -21,7 +21,7 @@ CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@
+CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =

 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -41,10 +41,10 @@ DEPLIBS =	${DNSDEPLIBS} ${IRSDEPLIBS} ${BIND9DEPLIBS} \
 		${ISCDEPLIBS} ${ISCCFGDEPLIBS}

 LIBS =		${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
+		${ISCLIBS} @LIBIDN2_LIBS@ @LIBS@

 NOSYMLIBS =	${DNSLIBS} ${IRSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} \
-		${ISCNOSYMLIBS} @IDNKIT_LIBS@ @LIBIDN2_LIBS@ @LIBS@
+		${ISCNOSYMLIBS} @LIBIDN2_LIBS@ @LIBS@

 SUBDIRS =

@@ -99,12 +99,12 @@ install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 	for m in ${MANPAGES}; do \
-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
-	done
+		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
+		done

 uninstall::
 	for m in ${MANPAGES}; do \
-		rm -f ${DESTDIR}${mandir}/man1/$$m || exit 1; \
+		rm -f ${DESTDIR}${mandir}/man1/$$m ; \
 	done
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nslookup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/host@EXEEXT@
@@ -532,7 +532,7 @@ Include an EDNS name server ID request when sending a query\&.
 .RS 4
 When this option is set,
 \fBdig\fR
-attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&.
+attempts to find the authoritative name servers for the zone containing the name being looked up and display the SOA record that each name server has for the zone\&. Addresses of servers that that did not respond are also printed\&.
 .RE
 .PP
 \fB+[no]onesoa\fR
@@ -564,6 +564,11 @@ Print [do not print] the query as it is sent\&. By default, the query is not pri
 Print [do not print] the question section of a query when an answer is returned\&. The default is to print the question section as a comment\&.
 .RE
 .PP
+\fB+[no]raflag\fR
+.RS 4
+Set [do not set] the RA (Recursion Available) bit in the query\&. The default is +noraflag\&. This bit should be ignored by the server for QUERY\&.
+.RE
+.PP
 \fB+[no]rdflag\fR
 .RS 4
 A synonym for
@@ -653,6 +658,11 @@ for short, sends an EDNS CLIENT\-SUBNET option with an empty address and a sourc
 be used when resolving this query\&.
 .RE
 .PP
+\fB+[no]tcflag\fR
+.RS 4
+Set [do not set] the TC (TrunCation) bit in the query\&. The default is +notcflag\&. This bit should be ignored by the server for QUERY\&.
+.RE
+.PP
 \fB+[no]tcp\fR
 .RS 4
 Use [do not use] TCP when querying name servers\&. The default behavior is to use UDP unless a type
@@ -12,9 +12,6 @@
 /*! \file */

 #include <config.h>
-
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <time.h>
 #include <ctype.h>
@@ -64,10 +61,10 @@ static int addresscount = 0;
 static char domainopt[DNS_NAME_MAXTEXT];
 static char hexcookie[81];

-static bool short_form = false, printcmd = true,
-	ip6_int = false, plusquest = false, pluscomm = false,
-	ipv4only = false, ipv6only = false;
-static uint32_t splitwidth = 0xffffffff;
+static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
+	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
+	ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
+static isc_uint32_t splitwidth = 0xffffffff;

 /*% opcode text */
 static const char * const opcodetext[] = {
@@ -208,6 +205,7 @@ help(void) {
 "                 +padding=###        (Set padding block size [0])\n"
 "                 +[no]qr             (Print question before sending)\n"
 "                 +[no]question       (Control display of question section)\n"
+"                 +[no]raflag         (Set RA flag in query (+[no]raflag))\n"
 "                 +[no]rdflag         (Recursive mode (+[no]recurse))\n"
 "                 +[no]recurse        (Recursive mode (+[no]rdflag))\n"
 "                 +retry=###          (Set number of UDP retries) [2]\n"
@@ -220,6 +218,7 @@ help(void) {
 "                 +[no]split=##       (Split hex/base64 fields into chunks)\n"
 "                 +[no]stats          (Control display of statistics)\n"
 "                 +subnet=addr        (Set edns-client-subnet option)\n"
+"                 +[no]tcflag         (Set TC flag in query (+[no]tcflag))\n"
 "                 +[no]tcp            (TCP mode (+[no]vc))\n"
 "                 +timeout=###        (Set query timeout) [5]\n"
 "                 +[no]trace          (Trace delegation down from root [+dnssec])\n"
@@ -241,7 +240,7 @@ help(void) {
 */
 static void
 received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
-	uint64_t diff;
+	isc_uint64_t diff;
 	time_t tnow;
 	struct tm tmnow;
 #ifdef WIN32
@@ -282,7 +281,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 #endif
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
-			       "bytes %" PRIu64 ")\n",
+			       "bytes %" ISC_PRINT_QUADFORMAT "u)\n",
 			       query->rr_count, query->msg_count,
 			       query->byte_count);
 		} else {
@@ -300,18 +299,18 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	} else if (query->lookup->identify && !short_form) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (query->lookup->use_usec)
-			printf(";; Received %" PRIu64 " bytes "
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld us\n\n",
 			       query->lookup->doing_xfr
 				 ? query->byte_count
-				 : (uint64_t)bytes,
+				 : (isc_uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff);
 		else
-			printf(";; Received %" PRIu64 " bytes "
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld ms\n\n",
 			       query->lookup->doing_xfr
 				 ?  query->byte_count
-				 : (uint64_t)bytes,
+				 : (isc_uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff / 1000);
 	}
 }
@@ -333,7 +332,7 @@ trying(char *frm, dig_lookup_t *lookup) {
 static isc_result_t
 say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	isc_result_t result;
-	uint64_t diff;
+	isc_uint64_t diff;
 	char store[sizeof(" in 18446744073709551616 us.")];
 	unsigned int styleflags = 0;

@@ -361,11 +360,10 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
-		if (query->lookup->use_usec) {
-			snprintf(store, sizeof(store), " in %" PRIu64 " us.", diff);
-		} else {
-			snprintf(store, sizeof(store), " in %" PRIu64 " ms.", diff / 1000);
-		}
+		if (query->lookup->use_usec)
+			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u us.", diff);
+		else
+			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u ms.", diff / 1000);
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
@@ -423,7 +421,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 	return (ISC_R_SUCCESS);
 }

-static bool
+static isc_boolean_t
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
@@ -438,16 +436,16 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local))
-			return (true);
+			return (ISC_TRUE);
 	}
-	return (false);
+	return (ISC_FALSE);
 }

 /*
 * Callback from dighost.c to print the reply from a server
 */
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_result_t result;
 	dns_messagetextflag_t flags;
 	isc_buffer_t *buf = NULL;
@@ -484,17 +482,17 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	}
 	if (query->lookup->multiline ||
 	    (query->lookup->nottl && query->lookup->noclass))
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 24, 32, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 24, 32, 80, 8,
+						splitwidth, mctx);
 	else if (query->lookup->nottl || query->lookup->noclass)
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 24, 32, 40, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 24, 32, 40, 80, 8,
+						splitwidth, mctx);
 	else
-		result = dns_master_stylecreate2(&style, styleflags,
-						 24, 32, 40, 48, 80, 8,
-						 splitwidth, mctx);
+		result = dns_master_stylecreate(&style, styleflags,
+						24, 32, 40, 48, 80, 8,
+						splitwidth, mctx);
 	check_result(result, "dns_master_stylecreate");

 	if (query->lookup->cmdline[0] != 0) {
@@ -691,7 +689,7 @@ cleanup:
 static void
 printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	int i;
-	static bool first = true;
+	static isc_boolean_t first = ISC_TRUE;
 	char append[MXNAME];

 	if (printcmd) {
@@ -718,7 +716,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 				 ";; global options:%s%s\n",
 				 short_form ? " +short" : "",
 				 printcmd ? " +cmd" : "");
-			first = false;
+			first = ISC_FALSE;
 			strlcat(lookup->cmdline, append,
 				sizeof(lookup->cmdline));
 		}
@@ -733,28 +731,27 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 */

 static void
-plus_option(const char *option, bool is_batchfile,
+plus_option(char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
-	char option_store[256];
-	char *cmd, *value, *ptr, *code;
-	uint32_t num;
-	bool state = true;
+	char *cmd, *value, *last = NULL, *code, *extra;
+	isc_uint32_t num;
+	isc_boolean_t state = ISC_TRUE;
 	size_t n;

-	strlcpy(option_store, option, sizeof(option_store));
-	ptr = option_store;
-	cmd = next_token(&ptr, "=");
-	if (cmd == NULL) {
-		printf(";; Invalid option %s\n", option_store);
+	INSIST(option != NULL);
+
+	if ((cmd = strtok_r(option, "=", &last)) == NULL) {
+		printf(";; Invalid option %s\n", option);
 		return;
 	}
-	value = ptr;
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
-		state = false;
+		state = ISC_FALSE;
 	}
+	/* parse the rest of the string */
+	value = strtok_r(NULL, "", &last);

 #define FULLCHECK(A) \
 	do { \
@@ -858,7 +855,7 @@ plus_option(const char *option, bool is_batchfile,
 		case 'l': /* class */
 			/* keep +cl for backwards compatibility */
 			FULLCHECK2("cl", "class");
-			lookup->noclass = !state;
+			lookup->noclass = ISC_TF(!state);
 			break;
 		case 'm': /* cmd */
 			FULLCHECK("cmd");
@@ -894,7 +891,7 @@ plus_option(const char *option, bool is_batchfile,
 			break;
 		case 'r':
 			FULLCHECK("crypto");
-			lookup->nocrypto = !state;
+			lookup->nocrypto = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1004,19 +1001,15 @@ plus_option(const char *option, bool is_batchfile,
 							lookup->ednsoptscnt = 0;
 							break;
 						}
-						code = NULL;
-						if (value != NULL) {
-							code = strtok(value,
-								      ":");
-						}
-						if (code == NULL) {
+						if (value == NULL) {
 							warn("ednsopt no "
 							     "code point "
 							     "specified");
 							goto exit_or_usage;
 						}
-						value = strtok(NULL, "\0");
-						save_opt(lookup, code, value);
+						code = strtok_r(value, ":", &last);
+						extra = strtok_r(NULL, "\0", &last);
+						save_opt(lookup, code, extra);
 						break;
 					default:
 						goto invalid_option;
@@ -1163,17 +1156,17 @@ plus_option(const char *option, bool is_batchfile,
 				FULLCHECK("nssearch");
 				lookup->ns_search_only = state;
 				if (state) {
-					lookup->trace_root = true;
-					lookup->recurse = true;
-					lookup->identify = true;
-					lookup->stats = false;
-					lookup->comments = false;
-					lookup->section_additional = false;
-					lookup->section_authority = false;
-					lookup->section_question = false;
+					lookup->trace_root = ISC_TRUE;
+					lookup->recurse = ISC_TRUE;
+					lookup->identify = ISC_TRUE;
+					lookup->stats = ISC_FALSE;
+					lookup->comments = ISC_FALSE;
+					lookup->section_additional = ISC_FALSE;
+					lookup->section_authority = ISC_FALSE;
+					lookup->section_question = ISC_FALSE;
 					lookup->rdtype = dns_rdatatype_ns;
-					lookup->rdtypeset = true;
-					short_form = true;
+					lookup->rdtypeset = ISC_TRUE;
+					short_form = ISC_TRUE;
 					lookup->rrcomments = 0;
 				}
 				break;
@@ -1231,7 +1224,7 @@ plus_option(const char *option, bool is_batchfile,
 			warn("Couldn't parse padding");
 			goto exit_or_usage;
 		}
-		lookup->padding = (uint16_t)num;
+		lookup->padding = (isc_uint16_t)num;
 		break;
 	case 'q':
 		switch (cmd[1]) {
@@ -1251,6 +1244,10 @@ plus_option(const char *option, bool is_batchfile,
 		break;
 	case 'r':
 		switch (cmd[1]) {
+		case 'a': /* raflag */
+			FULLCHECK("raflag");
+			lookup->raflag = state;
+			break;
 		case 'd': /* rdflag */
 			FULLCHECK("rdflag");
 			lookup->recurse = state;
@@ -1303,13 +1300,13 @@ plus_option(const char *option, bool is_batchfile,
 				FULLCHECK("short");
 				short_form = state;
 				if (state) {
-					printcmd = false;
-					lookup->section_additional = false;
-					lookup->section_answer = true;
-					lookup->section_authority = false;
-					lookup->section_question = false;
-					lookup->comments = false;
-					lookup->stats = false;
+					printcmd = ISC_FALSE;
+					lookup->section_additional = ISC_FALSE;
+					lookup->section_answer = ISC_TRUE;
+					lookup->section_authority = ISC_FALSE;
+					lookup->section_question = ISC_FALSE;
+					lookup->comments = ISC_FALSE;
+					lookup->stats = ISC_FALSE;
 					lookup->rrcomments = -1;
 				}
 				break;
@@ -1394,10 +1391,20 @@ plus_option(const char *option, bool is_batchfile,
 	case 't':
 		switch (cmd[1]) {
 		case 'c': /* tcp */
-			FULLCHECK("tcp");
-			if (!is_batchfile) {
-				lookup->tcp_mode = state;
-				lookup->tcp_mode_set = true;
+			switch (cmd[2]) {
+			case 'f':
+				FULLCHECK("tcflag");
+				lookup->tcflag = state;
+				break;
+			case 'p':
+				FULLCHECK("tcp");
+				if (!is_batchfile) {
+					lookup->tcp_mode = state;
+					lookup->tcp_mode_set = ISC_TRUE;
+				}
+				break;
+			default:
+				goto invalid_option;
 			}
 			break;
 		case 'i': /* timeout */
@@ -1426,17 +1433,17 @@ plus_option(const char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = false;
-					lookup->identify = true;
-					lookup->comments = false;
+					lookup->recurse = ISC_FALSE;
+					lookup->identify = ISC_TRUE;
+					lookup->comments = ISC_FALSE;
 					lookup->rrcomments = 0;
-					lookup->stats = false;
-					lookup->section_additional = false;
-					lookup->section_authority = true;
-					lookup->section_question = false;
-					lookup->dnssec = true;
-					lookup->sendcookie = true;
-					usesearch = false;
+					lookup->stats = ISC_FALSE;
+					lookup->section_additional = ISC_FALSE;
+					lookup->section_authority = ISC_TRUE;
+					lookup->section_question = ISC_FALSE;
+					lookup->dnssec = ISC_TRUE;
+					lookup->sendcookie = ISC_TRUE;
+					usesearch = ISC_FALSE;
 				}
 				break;
 			case 'i': /* tries */
@@ -1470,12 +1477,12 @@ plus_option(const char *option, bool is_batchfile,
 				case 0:
 				case 'i': /* ttlid */
 					FULLCHECK2("ttl", "ttlid");
-					lookup->nottl = !state;
+					lookup->nottl = ISC_TF(!state);
 					break;
 				case 'u': /* ttlunits */
 					FULLCHECK("ttlunits");
-					lookup->nottl = false;
-					lookup->ttlunits = state;
+					lookup->nottl = ISC_FALSE;
+					lookup->ttlunits = ISC_TF(state);
 					break;
 				default:
 					goto invalid_option;
@@ -1497,7 +1504,7 @@ plus_option(const char *option, bool is_batchfile,
 		FULLCHECK("vc");
 		if (!is_batchfile) {
 			lookup->tcp_mode = state;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode_set = ISC_TRUE;
 		}
 		break;
 	case 'z': /* zflag */
@@ -1523,19 +1530,19 @@ plus_option(const char *option, bool is_batchfile,
 }

 /*%
- * #true returned if value was used
+ * #ISC_TRUE returned if value was used
 */
 static const char *single_dash_opts = "46dhimnuv";
 static const char *dash_opts = "46bcdfhikmnptvyx";
-static bool
+static isc_boolean_t
 dash_option(char *option, char *next, dig_lookup_t **lookup,
-	    bool *open_type_class, bool *need_clone,
-	    bool config_only, int argc, char **argv,
-	    bool *firstarg)
+	    isc_boolean_t *open_type_class, isc_boolean_t *need_clone,
+	    isc_boolean_t config_only, int argc, char **argv,
+	    isc_boolean_t *firstarg)
 {
-	char opt, *value, *ptr, *ptr2, *ptr3;
+	char opt, *value, *ptr, *ptr2, *ptr3, *last;
 	isc_result_t result;
-	bool value_from_next;
+	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -1544,7 +1551,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	struct in6_addr in6;
 	in_port_t srcport;
 	char *hash, *cmd;
-	uint32_t num;
+	isc_uint32_t num;

 	while (strpbrk(option, single_dash_opts) == &option[0]) {
 		/*
@@ -1557,21 +1564,21 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case '4':
 			if (have_ipv4) {
 				isc_net_disableipv6();
-				have_ipv6 = false;
+				have_ipv6 = ISC_FALSE;
 			} else {
 				fatal("can't find IPv4 networking");
 				/* NOTREACHED */
-				return (false);
+				return (ISC_FALSE);
 			}
 			break;
 		case '6':
 			if (have_ipv6) {
 				isc_net_disableipv4();
-				have_ipv4 = false;
+				have_ipv4 = ISC_FALSE;
 			} else {
 				fatal("can't find IPv6 networking");
 				/* NOTREACHED */
-				return (false);
+				return (ISC_FALSE);
 			}
 			break;
 		case 'd':
@@ -1579,17 +1586,17 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			if (ptr != &option[1]) {
 				cmd = option;
 				FULLCHECK("debug");
-				debugging = true;
-				return (false);
+				debugging = ISC_TRUE;
+				return (ISC_FALSE);
 			} else
-				debugging = true;
+				debugging = ISC_TRUE;
 			break;
 		case 'h':
 			help();
 			exit(0);
 			break;
 		case 'i':
-			ip6_int = true;
+			ip6_int = ISC_TRUE;
 			break;
 		case 'm': /* memdebug */
 			/* memdebug is handled in preparse_args() */
@@ -1598,7 +1605,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			/* deprecated */
 			break;
 		case 'u':
-			(*lookup)->use_usec = true;
+			(*lookup)->use_usec = ISC_TRUE;
 			break;
 		case 'v':
 			version();
@@ -1608,14 +1615,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U)
 			option = &option[1];
 		else
-			return (false);
+			return (ISC_FALSE);
 	}
 	opt = option[0];
 	if (strlen(option) > 1U) {
-		value_from_next = false;
+		value_from_next = ISC_FALSE;
 		value = &option[1];
 	} else {
-		value_from_next = true;
+		value_from_next = ISC_TRUE;
 		value = next;
 	}
 	if (value == NULL)
@@ -1645,20 +1652,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		if (hash != NULL)
 			*hash = '#';
-		specified_source = true;
+		specified_source = ISC_TRUE;
 		return (value_from_next);
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
 		}
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = (unsigned int) strlen(value);
 		result = dns_rdataclass_fromtext(&rdclass,
 						 (isc_textregion_t *)&tr);
 		if (result == ISC_R_SUCCESS) {
 			(*lookup)->rdclass = rdclass;
-			(*lookup)->rdclassset = true;
+			(*lookup)->rdclassset = ISC_TRUE;
 		} else
 			fprintf(stderr, ";; Warning, ignoring "
 				"invalid class %s\n",
@@ -1680,23 +1687,23 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (!config_only) {
 			if (*need_clone)
 				(*lookup) = clone_lookup(default_lookup,
-							 true);
-			*need_clone = true;
+							 ISC_TRUE);
+			*need_clone = ISC_TRUE;
 			strlcpy((*lookup)->textname, value,
 				sizeof((*lookup)->textname));
-			(*lookup)->trace_root = ((*lookup)->trace  ||
-						 (*lookup)->ns_search_only);
-			(*lookup)->new_search = true;
+			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
+						     (*lookup)->ns_search_only);
+			(*lookup)->new_search = ISC_TRUE;
 			if (*firstarg) {
 				printgreeting(argc, argv, *lookup);
-				*firstarg = false;
+				*firstarg = ISC_FALSE;
 			}
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
 		return (value_from_next);
 	case 't':
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
 			rdtype = dns_rdatatype_ixfr;
 			result = ISC_R_SUCCESS;
@@ -1716,9 +1723,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 						"extra type option\n");
 			}
 			if (rdtype == dns_rdatatype_ixfr) {
-				uint32_t serial;
+				isc_uint32_t serial;
 				(*lookup)->rdtype = dns_rdatatype_ixfr;
-				(*lookup)->rdtypeset = true;
+				(*lookup)->rdtypeset = ISC_TRUE;
 				result = parse_uint(&serial, &value[5],
 					   MAXSERIAL, "serial number");
 				if (result != ISC_R_SUCCESS)
@@ -1727,19 +1734,19 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
 				if (!(*lookup)->tcp_mode_set)
-					(*lookup)->tcp_mode = true;
+					(*lookup)->tcp_mode = ISC_TRUE;
 			} else {
 				(*lookup)->rdtype = rdtype;
 				if (!config_only)
-					(*lookup)->rdtypeset = true;
+					(*lookup)->rdtypeset = ISC_TRUE;
 				if (rdtype == dns_rdatatype_axfr) {
 					(*lookup)->section_question = plusquest;
 					(*lookup)->comments = pluscomm;
 				} else if (rdtype == dns_rdatatype_any) {
 					if (!(*lookup)->tcp_mode_set)
-						(*lookup)->tcp_mode = true;
+						(*lookup)->tcp_mode = ISC_TRUE;
 				}
-				(*lookup)->ixfr_serial = false;
+				(*lookup)->ixfr_serial = ISC_FALSE;
 			}
 		} else
 			fprintf(stderr, ";; Warning, ignoring "
@@ -1747,15 +1754,13 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				 value);
 		return (value_from_next);
 	case 'y':
-		ptr = next_token(&value, ":");	/* hmac type or name */
-		if (ptr == NULL) {
+		if ((ptr = strtok_r(value, ":", &last)) == NULL) {
 			usage();
 		}
-		ptr2 = next_token(&value, ":");	/* name or secret */
-		if (ptr2 == NULL)
+		if ((ptr2 = strtok_r(NULL, ":", &last)) == NULL) {	/* name or secret */
 			usage();
-		ptr3 = next_token(&value, ":"); /* secret or NULL */
-		if (ptr3 != NULL) {
+		}
+		if ((ptr3 = strtok_r(NULL, ":", &last)) != NULL) { /* secret or NULL */
 			parse_hmac(ptr);
 			ptr = ptr2;
 			ptr2 = ptr3;
@@ -1767,29 +1772,30 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 #endif
 			digestbits = 0;
 		}
+		/* XXXONDREJ: FIXME */
 		strlcpy(keynametext, ptr, sizeof(keynametext));
 		strlcpy(keysecret, ptr2, sizeof(keysecret));
 		return (value_from_next);
 	case 'x':
 		if (*need_clone)
-			*lookup = clone_lookup(default_lookup, true);
-		*need_clone = true;
+			*lookup = clone_lookup(default_lookup, ISC_TRUE);
+		*need_clone = ISC_TRUE;
 		if (get_reverse(textname, sizeof(textname), value,
-				ip6_int, false) == ISC_R_SUCCESS) {
+				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
-			(*lookup)->trace_root = ((*lookup)->trace  ||
-						 (*lookup)->ns_search_only);
+			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
+						(*lookup)->ns_search_only);
 			(*lookup)->ip6_int = ip6_int;
 			if (!(*lookup)->rdtypeset)
 				(*lookup)->rdtype = dns_rdatatype_ptr;
 			if (!(*lookup)->rdclassset)
 				(*lookup)->rdclass = dns_rdataclass_in;
-			(*lookup)->new_search = true;
+			(*lookup)->new_search = ISC_TRUE;
 			if (*firstarg) {
 				printgreeting(argc, argv, *lookup);
-				*firstarg = false;
+				*firstarg = ISC_FALSE;
 			}
 			ISC_LIST_APPEND(lookup_list, *lookup, link);
 		} else {
@@ -1803,7 +1809,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		usage();
 	}
 	/* NOTREACHED */
-	return (false);
+	return (ISC_FALSE);
 }

 /*%
@@ -1830,19 +1836,19 @@ preparse_args(int argc, char **argv) {
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'm':
-				memdebugging = true;
+				memdebugging = ISC_TRUE;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
-				ipv4only = true;
+				ipv4only = ISC_TRUE;
 				break;
 			case '6':
 				if (ipv4only)
 					fatal("only one of -4 and -6 allowed");
-				ipv6only = true;
+				ipv6only = ISC_TRUE;
 				break;
 			}
 			option = &option[1];
@@ -1850,17 +1856,33 @@ preparse_args(int argc, char **argv) {
 	}
 }

+static int
+split_batchline(char *batchline, char **bargv, int len, const char *msg) {
+	int bargc;
+	char *last = NULL;
+
+	REQUIRE(batchline != NULL);
+
+	for (bargc = 1, bargv[bargc] = strtok_r(batchline, " \t\r\n", &last);
+	     bargc < len && bargv[bargc];
+	     bargv[++bargc] = strtok_r(NULL,  " \t\r\n", &last))
+	{
+		debug("%s %d: %s", msg, bargc, bargv[bargc]);
+	}
+	return (bargc);
+}
+
 static void
-parse_args(bool is_batchfile, bool config_only,
+parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv)
 {
 	isc_result_t result;
 	isc_textregion_t tr;
-	bool firstarg = true;
+	isc_boolean_t firstarg = ISC_TRUE;
 	dig_lookup_t *lookup = NULL;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	bool open_type_class = true;
+	isc_boolean_t open_type_class = ISC_TRUE;
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[64];
@@ -1868,11 +1890,9 @@ parse_args(bool is_batchfile, bool config_only,
 	char **rv;
 #ifndef NOPOSIX
 	char *homedir;
-	char rcfile[256];
+	char rcfile[PATH_MAX];
 #endif
-	char *input;
-	int i;
-	bool need_clone = true;
+	isc_boolean_t need_clone = ISC_TRUE;

 	/*
 	 * The semantics for parsing the args is a bit complex; if
@@ -1889,9 +1909,9 @@ parse_args(bool is_batchfile, bool config_only,
 	if (!is_batchfile) {
 		debug("making new lookup");
 		default_lookup = make_empty_lookup();
-		default_lookup->adflag = true;
+		default_lookup->adflag = ISC_TRUE;
 		default_lookup->edns = 0;
-		default_lookup->sendcookie = true;
+		default_lookup->sendcookie = ISC_TRUE;

 #ifndef NOPOSIX
 		/*
@@ -1903,30 +1923,21 @@ parse_args(bool is_batchfile, bool config_only,
 			unsigned int n;
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
-			if (n < sizeof(rcfile))
+			if (n < sizeof(rcfile)) {
 				batchfp = fopen(rcfile, "r");
+			}
 		}
 		if (batchfp != NULL) {
 			while (fgets(batchline, sizeof(batchline),
-				     batchfp) != 0) {
+				     batchfp) != 0)
+			{
 				debug("config line %s", batchline);
-				bargc = 1;
-				input = batchline;
-				bargv[bargc] = next_token(&input, " \t\r\n");
-				while ((bargc < 62) && (bargv[bargc] != NULL)) {
-					bargc++;
-					bargv[bargc] =
-						next_token(&input, " \t\r\n");
-				}
-
+				bargc = split_batchline(batchline, bargv, 62,
+						        ".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
-
-				for(i = 0; i < bargc; i++)
-					debug(".digrc argv %d: %s",
-					      i, bargv[i]);
-				parse_args(true, true, bargc,
-					   (char **)bargv);
+				parse_args(ISC_TRUE, ISC_TRUE,
+					   bargc, (char **)bargv);
 			}
 			fclose(batchfp);
 		}
@@ -1935,10 +1946,11 @@ parse_args(bool is_batchfile, bool config_only,

 	if (is_batchfile && !config_only) {
 		/* Processing '-f batchfile'. */
-		lookup = clone_lookup(default_lookup, true);
-		need_clone = false;
-	} else
+		lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_FALSE;
+	} else {
 		lookup = default_lookup;
+	}

 	rc = argc;
 	rv = argv;
@@ -2018,10 +2030,10 @@ parse_args(bool is_batchfile, bool config_only,
 							"extra type option\n");
 					}
 					if (rdtype == dns_rdatatype_ixfr) {
-						uint32_t serial;
+						isc_uint32_t serial;
 						lookup->rdtype =
 							dns_rdatatype_ixfr;
-						lookup->rdtypeset = true;
+						lookup->rdtypeset = ISC_TRUE;
 						result = parse_uint(&serial,
 								    &rv[0][5],
 								    MAXSERIAL,
@@ -2034,10 +2046,10 @@ parse_args(bool is_batchfile, bool config_only,
 							plusquest;
 						lookup->comments = pluscomm;
 						if (!lookup->tcp_mode_set)
-							lookup->tcp_mode = true;
+							lookup->tcp_mode = ISC_TRUE;
 					} else {
 						lookup->rdtype = rdtype;
-						lookup->rdtypeset = true;
+						lookup->rdtypeset = ISC_TRUE;
 						if (rdtype ==
 						    dns_rdatatype_axfr) {
 						    lookup->section_question =
@@ -2047,8 +2059,8 @@ parse_args(bool is_batchfile, bool config_only,
 						if (rdtype ==
 						    dns_rdatatype_any &&
 						    !lookup->tcp_mode_set)
-							lookup->tcp_mode = true;
-						lookup->ixfr_serial = false;
+							lookup->tcp_mode = ISC_TRUE;
+						lookup->ixfr_serial = ISC_FALSE;
 					}
 					continue;
 				}
@@ -2060,7 +2072,7 @@ parse_args(bool is_batchfile, bool config_only,
 							"extra class option\n");
 					}
 					lookup->rdclass = rdclass;
-					lookup->rdclassset = true;
+					lookup->rdclassset = ISC_TRUE;
 					continue;
 				}
 			}
@@ -2068,16 +2080,16 @@ parse_args(bool is_batchfile, bool config_only,
 			if (!config_only) {
 				if (need_clone)
 					lookup = clone_lookup(default_lookup,
-								      true);
-				need_clone = true;
+								      ISC_TRUE);
+				need_clone = ISC_TRUE;
 				strlcpy(lookup->textname, rv[0],
 					sizeof(lookup->textname));
-				lookup->trace_root = (lookup->trace  ||
-						      lookup->ns_search_only);
-				lookup->new_search = true;
+				lookup->trace_root = ISC_TF(lookup->trace  ||
+						     lookup->ns_search_only);
+				lookup->new_search = ISC_TRUE;
 				if (firstarg) {
 					printgreeting(argc, argv, lookup);
-					firstarg = false;
+					firstarg = ISC_FALSE;
 				}
 				ISC_LIST_APPEND(lookup_list, lookup, link);
 				debug("looking up %s", lookup->textname);
@@ -2105,24 +2117,15 @@ parse_args(bool is_batchfile, bool config_only,
 		/* XXX Remove code dup from shutdown code */
 	next_line:
 		if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
-			bargc = 1;
 			debug("batch line %s", batchline);
-			if (batchline[0] == '\r' || batchline[0] == '\n'
-			    || batchline[0] == '#' || batchline[0] == ';')
+			if (batchline[0] == '\r' || batchline[0] == '\n' ||
+			    batchline[0] == '#' || batchline[0] == ';')
 				goto next_line;
-			input = batchline;
-			bargv[bargc] = next_token(&input, " \t\r\n");
-			while ((bargc < 14) && (bargv[bargc] != NULL)) {
-				bargc++;
-				bargv[bargc] = next_token(&input, " \t\r\n");
-			}
-
+			bargc = split_batchline(batchline, bargv, 14,
+						"batch argv");
 			bargv[0] = argv[0];
 			argv0 = argv[0];
-
-			for(i = 0; i < bargc; i++)
-				debug("batch argv %d: %s", i, bargv[i]);
-			parse_args(true, false, bargc, (char **)bargv);
+			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 			return;
 		}
 		return;
@@ -2132,17 +2135,17 @@ parse_args(bool is_batchfile, bool config_only,
 	 */
 	if ((lookup_list.head == NULL) && !config_only) {
 		if (need_clone)
-			lookup = clone_lookup(default_lookup, true);
-		need_clone = true;
-		lookup->trace_root = (lookup->trace ||
-				      lookup->ns_search_only);
-		lookup->new_search = true;
+			lookup = clone_lookup(default_lookup, ISC_TRUE);
+		need_clone = ISC_TRUE;
+		lookup->trace_root = ISC_TF(lookup->trace ||
+					    lookup->ns_search_only);
+		lookup->new_search = ISC_TRUE;
 		strlcpy(lookup->textname, ".", sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ns;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 		if (firstarg) {
 			printgreeting(argc, argv, lookup);
-			firstarg = false;
+			firstarg = ISC_FALSE;
 		}
 		ISC_LIST_APPEND(lookup_list, lookup, link);
 	}
@@ -2160,8 +2163,6 @@ query_finished(void) {
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[16];
-	char *input;
-	int i;

 	if (batchname == NULL) {
 		isc_app_shutdown();
@@ -2179,19 +2180,9 @@ query_finished(void) {

 	if (fgets(batchline, sizeof(batchline), batchfp) != 0) {
 		debug("batch line %s", batchline);
-		bargc = 1;
-		input = batchline;
-		bargv[bargc] = next_token(&input, " \t\r\n");
-		while ((bargc < 14) && (bargv[bargc] != NULL)) {
-			bargc++;
-			bargv[bargc] = next_token(&input, " \t\r\n");
-		}
-
+		bargc = split_batchline(batchline, bargv, 14, "batch argv");
 		bargv[0] = argv0;
-
-		for(i = 0; i < bargc; i++)
-			debug("batch argv %d: %s", i, bargv[i]);
-		parse_args(true, false, bargc, (char **)bargv);
+		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
 		batchname = NULL;
@@ -2228,7 +2219,7 @@ void dig_setup(int argc, char **argv)
 	setup_system(ipv4only, ipv6only);
 }

-void dig_query_setup(bool is_batchfile, bool config_only,
+void dig_query_setup(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		int argc, char **argv)
 {
 	debug("dig_query_setup");
@@ -2240,7 +2231,7 @@ void dig_query_setup(bool is_batchfile, bool config_only,
 		setup_text_key();
 	if (domainopt[0] != '\0') {
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	}
 }

@@ -2277,7 +2268,7 @@ int
 main(int argc, char **argv) {

 	dig_setup(argc, argv);
-	dig_query_setup(false, false, argc, argv);
+	dig_query_setup(ISC_FALSE, ISC_FALSE, argc, argv);
 	dig_startup();
 	dig_shutdown();

@@ -895,7 +895,8 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone.
+	      the zone. Addresses of servers that that did not
+	      respond are also printed.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -959,6 +960,17 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]raflag</option></term>
+	  <listitem>
+	    <para>
+	      Set [do not set] the RA (Recursion Available) bit in
+	      the query. The default is +noraflag. This bit should
+	      be ignored by the server for QUERY.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]rdflag</option></term>
 	  <listitem>
@@ -1102,6 +1114,17 @@
 	  </listitem>
 	</varlistentry>

+	<varlistentry>
+	  <term><option>+[no]tcflag</option></term>
+	  <listitem>
+	    <para>
+	      Set [do not set] the TC (TrunCation) bit in the query.
+	      The default is +notcflag.  This bit should be ignored
+	      by the server for QUERY.
+	    </para>
+	  </listitem>
+	</varlistentry>
+
 	<varlistentry>
 	  <term><option>+[no]tcp</option></term>
 	  <listitem>
@@ -710,7 +710,8 @@
 	      attempts to find the authoritative name servers for
 	      the zone containing the name being looked up and
 	      display the SOA record that each name server has for
-	      the zone.
+	      the zone. Addresses of servers that that did not
+	      respond are also printed.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]onesoa</code></span></dt>
@@ -757,6 +758,14 @@
 	      the question section as a comment.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]raflag</code></span></dt>
+<dd>
+	    <p>
+	      Set [do not set] the RA (Recursion Available) bit in
+	      the query. The default is +noraflag. This bit should
+	      be ignored by the server for QUERY.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]rdflag</code></span></dt>
 <dd>
 	    <p>
@@ -867,6 +876,14 @@
 	      this query.
 	    </p>
 	  </dd>
+<dt><span class="term"><code class="option">+[no]tcflag</code></span></dt>
+<dd>
+	    <p>
+	      Set [do not set] the TC (TrunCation) bit in the query.
+	      The default is +notcflag.  This bit should be ignored
+	      by the server for QUERY.
+	    </p>
+	  </dd>
 <dt><span class="term"><code class="option">+[no]tcp</code></span></dt>
 <dd>
 	    <p>
@@ -12,9 +12,6 @@
 /*! \file */

 #include <config.h>
-
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <limits.h>

@@ -22,13 +19,6 @@
 #include <locale.h>
 #endif

-#ifdef WITH_IDNKIT
-#include <idn/result.h>
-#include <idn/log.h>
-#include <idn/resconf.h>
-#include <idn/api.h>
-#endif
-
 #include <isc/app.h>
 #include <isc/commandline.h>
 #include <isc/netaddr.h>
@@ -50,14 +40,14 @@

 #include <dig/dig.h>

-static bool short_form = true, listed_server = false;
-static bool default_lookups = true;
+static isc_boolean_t short_form = ISC_TRUE, listed_server = ISC_FALSE;
+static isc_boolean_t default_lookups = ISC_TRUE;
 static int seen_error = -1;
-static bool list_addresses = true;
-static bool list_almost_all = false;
+static isc_boolean_t list_addresses = ISC_TRUE;
+static isc_boolean_t list_almost_all = ISC_FALSE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
-static bool printed_server = false;
-static bool ipv4only = false, ipv6only = false;
+static isc_boolean_t printed_server = ISC_FALSE;
+static isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;

 static const char *opcodetext[] = {
 	"QUERY",
@@ -234,7 +224,7 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,

 static isc_result_t
 printsection(dns_message_t *msg, dns_section_t sectionid,
-	     const char *section_name, bool headers,
+	     const char *section_name, isc_boolean_t headers,
 	     dig_query_t *query)
 {
 	dns_name_t *name, *print_name;
@@ -245,13 +235,13 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_region_t r;
 	dns_name_t empty_name;
 	char tbuf[4096];
-	bool first;
-	bool no_rdata;
+	isc_boolean_t first;
+	isc_boolean_t no_rdata;

 	if (sectionid == DNS_SECTION_QUESTION)
-		no_rdata = true;
+		no_rdata = ISC_TRUE;
 	else
-		no_rdata = false;
+		no_rdata = ISC_FALSE;

 	if (headers)
 		printf(";; %s SECTION:\n", section_name);
@@ -269,7 +259,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		dns_message_currentname(msg, sectionid, &name);

 		isc_buffer_init(&target, tbuf, sizeof(tbuf));
-		first = true;
+		first = ISC_TRUE;
 		print_name = name;

 		for (rdataset = ISC_LIST_HEAD(name->list);
@@ -293,7 +283,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			if (!short_form) {
 				result = dns_rdataset_totext(rdataset,
 							     print_name,
-							     false,
+							     ISC_FALSE,
 							     no_rdata,
 							     &target);
 				if (result != ISC_R_SUCCESS)
@@ -301,7 +291,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 #ifdef USEINITALWS
 				if (first) {
 					print_name = &empty_name;
-					first = false;
+					first = ISC_FALSE;
 				}
 #else
 				UNUSED(first); /* Shut up compiler. */
@@ -360,7 +350,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 static isc_result_t
 printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,
 	   const dns_name_t *owner, const char *set_name,
-	   bool headers)
+	   isc_boolean_t headers)
 {
 	isc_buffer_t target;
 	isc_result_t result;
@@ -373,7 +363,7 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,

 	isc_buffer_init(&target, tbuf, sizeof(tbuf));

-	result = dns_rdataset_totext(rdataset, owner, false, false,
+	result = dns_rdataset_totext(rdataset, owner, ISC_FALSE, ISC_FALSE,
 				     &target);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -410,8 +400,8 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }

 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
-	bool did_flag = false;
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
+	isc_boolean_t did_flag = ISC_FALSE;
 	dns_rdataset_t *opt, *tsig = NULL;
 	const dns_name_t *tsigname;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -434,7 +424,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 				    sizeof(sockstr));
 		printf("Address: %s\n", sockstr);
 		printf("Aliases: \n\n");
-		printed_server = true;
+		printed_server = ISC_TRUE;
 	}

 	if (msg->rcode != 0) {
@@ -466,22 +456,22 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_aaaa;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_mx;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -495,31 +485,31 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		printf(";; flags: ");
 		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) {
 			printf("qr");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0) {
 			printf("%saa", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
 			printf("%stc", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			printf("%srd", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0) {
 			printf("%sra", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0) {
 			printf("%sad", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
 			printf("%scd", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 			POST(did_flag);
 		}
 		printf("; QUERY: %u, ANSWER: %u, "
@@ -542,7 +532,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
-				      true, query);
+				      ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -550,7 +540,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		if (!short_form)
 			printf("\n");
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
-				      !short_form, query);
+				      ISC_TF(!short_form), query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -559,7 +549,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
-				      true, query);
+				      ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -567,14 +557,14 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL,
-				      "ADDITIONAL", true, query);
+				      "ADDITIONAL", ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
 	if ((tsig != NULL) && !short_form) {
 		printf("\n");
 		result = printrdata(msg, tsig, tsigname,
-				    "PSEUDOSECTION TSIG", true);
+				    "PSEUDOSECTION TSIG", ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -609,7 +599,7 @@ pre_parse_args(int argc, char **argv) {
 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'm':
-			memdebugging = true;
+			memdebugging = ISC_TRUE;
 			if (strcasecmp("trace", isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			else if (strcasecmp("record",
@@ -623,12 +613,12 @@ pre_parse_args(int argc, char **argv) {
 		case '4':
 			if (ipv6only)
 				fatal("only one of -4 and -6 allowed");
-			ipv4only = true;
+			ipv4only = ISC_TRUE;
 			break;
 		case '6':
 			if (ipv4only)
 				fatal("only one of -4 and -6 allowed");
-			ipv6only = true;
+			ipv6only = ISC_TRUE;
 			break;
 		case 'a': break;
 		case 'A': break;
@@ -649,8 +639,8 @@ pre_parse_args(int argc, char **argv) {
 		case 'C': break;
 		case 'D':
 			if (debugging)
-				debugtiming = true;
-			debugging = true;
+				debugtiming = ISC_TRUE;
+			debugging = ISC_TRUE;
 			break;
 		case 'N': break;
 		case 'R': break;
@@ -660,12 +650,12 @@ pre_parse_args(int argc, char **argv) {
 			show_usage();
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;
 	isc_commandline_index = 1;
 }

 static void
-parse_args(bool is_batchfile, int argc, char **argv) {
+parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	char hostname[MXNAME];
 	dig_lookup_t *lookup;
 	int c;
@@ -674,30 +664,30 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	uint32_t serial = 0;
+	isc_uint32_t serial = 0;

 	UNUSED(is_batchfile);

 	lookup = make_empty_lookup();

-	lookup->servfail_stops = false;
-	lookup->comments = false;
+	lookup->servfail_stops = ISC_FALSE;
+	lookup->comments = ISC_FALSE;
 	short_form = !verbose;

 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'l':
-			lookup->tcp_mode = true;
+			lookup->tcp_mode = ISC_TRUE;
 			lookup->rdtype = dns_rdatatype_axfr;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			fatalexit = 3;
 			break;
 		case 'v':
 		case 'd':
-			short_form = false;
+			short_form = ISC_FALSE;
 			break;
 		case 'r':
-			lookup->recurse = false;
+			lookup->recurse = ISC_FALSE;
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument,
@@ -722,33 +712,23 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
-			lookup->rdtypeset = true;
-#ifdef WITH_IDNKIT
-			idnoptions = 0;
-#endif
+			lookup->rdtypeset = ISC_TRUE;
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
-				short_form = false;
-				lookup->tcp_mode = true;
+				short_form = ISC_FALSE;
+				lookup->tcp_mode = ISC_TRUE;
 			} else if (rdtype == dns_rdatatype_ixfr) {
 				lookup->ixfr_serial = serial;
-				lookup->tcp_mode = true;
+				lookup->tcp_mode = ISC_TRUE;
 				list_type = rdtype;
 			} else if (rdtype == dns_rdatatype_any) {
 				if (!lookup->tcp_mode_set)
-					lookup->tcp_mode = true;
-#ifdef WITH_IDNKIT
-			} else if (rdtype == dns_rdatatype_a ||
-				   rdtype == dns_rdatatype_aaaa ||
-				   rdtype == dns_rdatatype_mx) {
-				idnoptions = IDN_ASCCHECK;
-				list_type = rdtype;
-#endif
+					lookup->tcp_mode = ISC_TRUE;
 			} else
 				list_type = rdtype;
-			list_addresses = false;
-			default_lookups = false;
+			list_addresses = ISC_FALSE;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'c':
 			tr.base = isc_commandline_argument;
@@ -762,28 +742,25 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			} else {
 				lookup->rdclass = rdclass;
-				lookup->rdclassset = true;
+				lookup->rdclassset = ISC_TRUE;
 			}
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'A':
-			list_almost_all = true;
+			list_almost_all = ISC_TRUE;
 			/* FALL THROUGH */
 		case 'a':
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = dns_rdatatype_any;
-#ifdef WITH_IDNKIT
-			idnoptions = 0;
-#endif
 			list_type = dns_rdatatype_any;
-			list_addresses = false;
-			lookup->rdtypeset = true;
-			short_form = false;
-			default_lookups = false;
+			list_addresses = ISC_FALSE;
+			lookup->rdtypeset = ISC_TRUE;
+			short_form = ISC_FALSE;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'i':
-			lookup->ip6_int = true;
+			lookup->ip6_int = ISC_TRUE;
 			break;
 		case 'n':
 			/* deprecated */
@@ -809,23 +786,23 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				tries = 2;
 			break;
 		case 'T':
-			lookup->tcp_mode = true;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode = ISC_TRUE;
+			lookup->tcp_mode_set = ISC_TRUE;
 			break;
 		case 'U':
-			lookup->tcp_mode = false;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode = ISC_FALSE;
+			lookup->tcp_mode_set = ISC_TRUE;
 			break;
 		case 'C':
 			debug("showing all SOAs");
 			lookup->rdtype = dns_rdatatype_ns;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->rdclass = dns_rdataclass_in;
-			lookup->rdclassset = true;
-			lookup->ns_search_only = true;
-			lookup->trace_root = true;
-			lookup->identify_previous_line = true;
-			default_lookups = false;
+			lookup->rdclassset = ISC_TRUE;
+			lookup->ns_search_only = ISC_TRUE;
+			lookup->trace_root = ISC_TRUE;
+			lookup->identify_previous_line = ISC_TRUE;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'N':
 			debug("setting NDOTS to %s",
@@ -842,7 +819,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			/* Handled by pre_parse_args(). */
 			break;
 		case 's':
-			lookup->servfail_stops = true;
+			lookup->servfail_stops = ISC_TRUE;
 			break;
 		}
 	}
@@ -857,22 +834,22 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	if (argc > isc_commandline_index + 1) {
 		set_nameserver(argv[isc_commandline_index+1]);
 		debug("server is %s", argv[isc_commandline_index+1]);
-		listed_server = true;
+		listed_server = ISC_TRUE;
 	} else
-		check_ra = true;
+		check_ra = ISC_TRUE;

-	lookup->pending = false;
+	lookup->pending = ISC_FALSE;
 	if (get_reverse(store, sizeof(store), hostname,
-			lookup->ip6_int, true) == ISC_R_SUCCESS) {
+			lookup->ip6_int, ISC_TRUE) == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
-		lookup->rdtypeset = true;
-		default_lookups = false;
+		lookup->rdtypeset = ISC_TRUE;
+		default_lookups = ISC_FALSE;
 	} else {
 		strlcpy(lookup->textname, hostname, sizeof(lookup->textname));
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	}
-	lookup->new_search = true;
+	lookup->new_search = ISC_TRUE;
 	ISC_LIST_APPEND(lookup_list, lookup, link);
 }

@@ -887,9 +864,6 @@ main(int argc, char **argv) {
 	ISC_LIST_INIT(search_list);

 	fatalexit = 1;
-#ifdef WITH_IDNKIT
-	idnoptions = IDN_ASCCHECK;
-#endif

 	/* setup dighost callbacks */
 	dighost_printmessage = printmessage;
@@ -904,7 +878,7 @@ main(int argc, char **argv) {
 	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
-	parse_args(false, argc, argv);
+	parse_args(ISC_FALSE, argc, argv);
 	if (keyfile[0] != 0)
 		setup_file_key();
 	else if (keysecret[0] != 0)
@@ -14,13 +14,11 @@

 /*! \file */

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <dns/rdatalist.h>

 #include <dst/dst.h>

+#include <isc/boolean.h>
 #include <isc/buffer.h>
 #include <isc/bufferlist.h>
 #include <isc/formatcheck.h>
@@ -83,7 +81,7 @@ typedef struct dig_searchlist dig_searchlist_t;

 /*% The dig_lookup structure */
 struct dig_lookup {
-	bool
+	isc_boolean_t
 		pending, /*%< Pending a successful answer */
 		waiting_connect,
 		doing_xfr,
@@ -96,6 +94,8 @@ struct dig_lookup {
 		aaonly,
 		adflag,
 		cdflag,
+		raflag,
+		tcflag,
 		zflag,
 		trace, /*% dig +trace */
 		trace_root, /*% initial query for either +trace or +nssearch */
@@ -139,8 +139,8 @@ struct dig_lookup {
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
 	dns_rdataclass_t rdclass;
-	bool rdtypeset;
-	bool rdclassset;
+	isc_boolean_t rdtypeset;
+	isc_boolean_t rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
 	isc_buffer_t namebuf;
@@ -158,17 +158,17 @@ struct dig_lookup {
 	dig_serverlist_t my_server_list;
 	dig_searchlist_t *origin;
 	dig_query_t *xfr_q;
-	uint32_t retries;
+	isc_uint32_t retries;
 	int nsfound;
-	uint16_t udpsize;
-	int16_t edns;
-	int16_t padding;
-	uint32_t ixfr_serial;
+	isc_uint16_t udpsize;
+	isc_int16_t edns;
+	isc_int16_t padding;
+	isc_uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
 	char rdatastore[MXNAME];
 	dst_context_t *tsigctx;
 	isc_buffer_t *querysig;
-	uint32_t msgcounter;
+	isc_uint32_t msgcounter;
 	dns_fixedname_t fdomain;
 	isc_sockaddr_t *ecs_addr;
 	char *cookie;
@@ -184,7 +184,7 @@ struct dig_lookup {
 /*% The dig_query structure */
 struct dig_query {
 	dig_lookup_t *lookup;
-	bool waiting_connect,
+	isc_boolean_t waiting_connect,
 		pending_free,
 		waiting_senddone,
 		first_pass,
@@ -194,11 +194,11 @@ struct dig_query {
 		recv_made,
 		warn_id,
 		timedout;
-	uint32_t first_rr_serial;
-	uint32_t second_rr_serial;
-	uint32_t msg_count;
-	uint32_t rr_count;
-	bool ixfr_axfr;
+	isc_uint32_t first_rr_serial;
+	isc_uint32_t second_rr_serial;
+	isc_uint32_t msg_count;
+	isc_uint32_t rr_count;
+	isc_boolean_t ixfr_axfr;
 	char *servname;
 	char *userarg;
 	isc_bufferlist_t sendlist,
@@ -216,7 +216,7 @@ struct dig_query {
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
 	isc_time_t time_recv;
-	uint64_t byte_count;
+	isc_uint64_t byte_count;
 	isc_buffer_t sendbuf;
 	isc_timer_t *timer;
 };
@@ -244,7 +244,7 @@ extern dig_serverlist_t server_list;
 extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;

-extern bool check_ra, have_ipv4, have_ipv6, specified_source,
+extern isc_boolean_t check_ra, have_ipv4, have_ipv6, specified_source,
 	usesearch, showsearch;
 extern in_port_t port;
 extern unsigned int timeout;
@@ -260,20 +260,17 @@ extern char keysecret[MXNAME];
 extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
-extern bool validated;
+extern isc_boolean_t validated;
 extern isc_taskmgr_t *taskmgr;
 extern isc_task_t *global_task;
-extern bool free_now;
-extern bool debugging, debugtiming, memdebugging;
-extern bool keep_open;
+extern isc_boolean_t free_now;
+extern isc_boolean_t debugging, debugtiming, memdebugging;
+extern isc_boolean_t keep_open;

 extern char *progname;
 extern int tries;
 extern int fatalexit;
-extern bool verbose;
-#ifdef WITH_IDNKIT
-extern int idnoptions;
-#endif
+extern isc_boolean_t verbose;

 /*
 * Routines in dighost.c.
@@ -285,8 +282,8 @@ int
 getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);

 isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool ip6_int,
-	    bool strict);
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
+	    isc_boolean_t strict);

 ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
@@ -305,7 +302,7 @@ debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 void
 check_result(isc_result_t result, const char *msg);

-bool
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup);

 void
@@ -327,14 +324,14 @@ void
 setup_libs(void);

 void
-setup_system(bool ipv4only, bool ipv6only);
+setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only);

 isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);

 isc_result_t
-parse_xint(uint32_t *uip, const char *value, uint32_t max,
+parse_xint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);

 isc_result_t
@@ -344,13 +341,13 @@ void
 parse_hmac(const char *hmacstr);

 dig_lookup_t *
-requeue_lookup(dig_lookup_t *lookold, bool servers);
+requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers);

 dig_lookup_t *
 make_empty_lookup(void);

 dig_lookup_t *
-clone_lookup(dig_lookup_t *lookold, bool servers);
+clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers);

 dig_server_t *
 make_server(const char *servname, const char *userarg);
@@ -374,15 +371,12 @@ destroy_libs(void);
 void
 set_search_domain(char *domain);

-char *
-next_token(char **stringp, const char *delim);
-
 /*
 * Routines to be defined in dig.c, host.c, and nslookup.c. and
 * then assigned to the appropriate function pointer
 */
 extern isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, bool headers);
+(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers);
 /*%<
 * Print the final result of the lookup.
 */
@@ -424,7 +418,7 @@ dig_setup(int argc, char **argv);
 * Call to supply new parameters for the next lookup
 */
 void
-dig_query_setup(bool, bool, int argc, char **argv);
+dig_query_setup(isc_boolean_t, isc_boolean_t, int argc, char **argv);

 /*%<
 * set the main application event cycle running
@@ -11,8 +11,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <unistd.h>

@@ -55,18 +53,18 @@
 #endif
 #endif

-static bool short_form = true,
-	tcpmode = false, tcpmode_set = false,
-	identify = false, stats = true,
-	comments = true, section_question = true,
-	section_answer = true, section_authority = true,
-	section_additional = true, recurse = true,
-	aaonly = false, nofail = true,
-	default_lookups = true, a_noanswer = false;
+static isc_boolean_t short_form = ISC_TRUE,
+	tcpmode = ISC_FALSE, tcpmode_set = ISC_FALSE,
+	identify = ISC_FALSE, stats = ISC_TRUE,
+	comments = ISC_TRUE, section_question = ISC_TRUE,
+	section_answer = ISC_TRUE, section_authority = ISC_TRUE,
+	section_additional = ISC_TRUE, recurse = ISC_TRUE,
+	aaonly = ISC_FALSE, nofail = ISC_TRUE,
+	default_lookups = ISC_TRUE, a_noanswer = ISC_FALSE;

-static bool interactive;
+static isc_boolean_t interactive;

-static bool in_use = false;
+static isc_boolean_t in_use = ISC_FALSE;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
 static isc_event_t *global_event = NULL;
@@ -215,7 +213,7 @@ printrdata(dns_rdata_t *rdata) {
 	isc_result_t result;
 	isc_buffer_t *b = NULL;
 	unsigned int size = 1024;
-	bool done = false;
+	isc_boolean_t done = ISC_FALSE;

 	if (rdata->type < N_KNOWN_RRTYPES)
 		printf("%s", rtypetext[rdata->type]);
@@ -230,7 +228,7 @@ printrdata(dns_rdata_t *rdata) {
 		if (result == ISC_R_SUCCESS) {
 			printf("%.*s\n", (int)isc_buffer_usedlength(b),
 			       (char *)isc_buffer_base(b));
-			done = true;
+			done = ISC_TRUE;
 		} else if (result != ISC_R_NOSPACE)
 			check_result(result, "dns_rdata_totext");
 		isc_buffer_free(&b);
@@ -239,7 +237,7 @@ printrdata(dns_rdata_t *rdata) {
 }

 static isc_result_t
-printsection(dig_query_t *query, dns_message_t *msg, bool headers,
+printsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	     dns_section_t section) {
 	isc_result_t result, loopresult;
 	dns_name_t *name;
@@ -306,7 +304,7 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 }

 static isc_result_t
-detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
+detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	     dns_section_t section) {
 	isc_result_t result, loopresult;
 	dns_name_t *name;
@@ -431,7 +429,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }

 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	char servtext[ISC_SOCKADDR_FORMATSIZE];

 	/* I've we've gotten this far, we've reached a server. */
@@ -450,10 +448,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	if (!short_form) {
 		puts("------------");
 		/*		detailheader(query, msg);*/
-		detailsection(query, msg, true, DNS_SECTION_QUESTION);
-		detailsection(query, msg, true, DNS_SECTION_ANSWER);
-		detailsection(query, msg, true, DNS_SECTION_AUTHORITY);
-		detailsection(query, msg, true, DNS_SECTION_ADDITIONAL);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_QUESTION);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ANSWER);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_AUTHORITY);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ADDITIONAL);
 		puts("------------");
 	}

@@ -481,12 +479,12 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_aaaa;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -500,7 +498,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		printsection(query, msg, headers, DNS_SECTION_ANSWER);
 	else {
 		if (default_lookups && query->lookup->rdtype == dns_rdatatype_a)
-			a_noanswer = true;
+			a_noanswer = ISC_TRUE;

 		else if (!default_lookups ||
 			 (query->lookup->rdtype == dns_rdatatype_aaaa &&
@@ -522,7 +520,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 }

 static void
-show_settings(bool full, bool serv_only) {
+show_settings(isc_boolean_t full, isc_boolean_t serv_only) {
 	dig_server_t *srv;
 	isc_sockaddr_t sockaddr;
 	dig_searchlist_t *listent;
@@ -567,7 +565,7 @@ show_settings(bool full, bool serv_only) {
 	printf("\n");
 }

-static bool
+static isc_boolean_t
 testtype(char *typetext) {
 	isc_result_t result;
 	isc_textregion_t tr;
@@ -577,14 +575,14 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS)
-		return (true);
+		return (ISC_TRUE);
 	else {
 		printf("unknown query type: %s\n", typetext);
-		return (false);
+		return (ISC_FALSE);
 	}
 }

-static bool
+static isc_boolean_t
 testclass(char *typetext) {
 	isc_result_t result;
 	isc_textregion_t tr;
@@ -594,24 +592,24 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS)
-		return (true);
+		return (ISC_TRUE);
 	else {
 		printf("unknown query class: %s\n", typetext);
-		return (false);
+		return (ISC_FALSE);
 	}
 }

 static void
 set_port(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS)
-		port = (uint16_t) n;
+		port = (isc_uint16_t) n;
 }

 static void
 set_timeout(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, UINT_MAX, "timeout");
 	if (result == ISC_R_SUCCESS)
 		timeout = n;
@@ -619,7 +617,7 @@ set_timeout(const char *value) {

 static void
 set_tries(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, INT_MAX, "tries");
 	if (result == ISC_R_SUCCESS)
 		tries = n;
@@ -627,7 +625,7 @@ set_tries(const char *value) {

 static void
 set_ndots(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, 128, "ndots");
 	if (result == ISC_R_SUCCESS)
 		ndots = n;
@@ -646,7 +644,7 @@ setoption(char *opt) {
 	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))

 	if (CHECKOPT("all", 3)) {
-		show_settings(true, false);
+		show_settings(ISC_TRUE, ISC_FALSE);
 	} else if (strncasecmp(opt, "class=", 6) == 0) {
 		if (testclass(&opt[6]))
 			strlcpy(defclass, &opt[6], sizeof(defclass));
@@ -656,41 +654,41 @@ setoption(char *opt) {
 	} else if (strncasecmp(opt, "type=", 5) == 0) {
 		if (testtype(&opt[5])) {
 			strlcpy(deftype, &opt[5], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "ty=", 3) == 0) {
 		if (testtype(&opt[3])) {
 			strlcpy(deftype, &opt[3], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "querytype=", 10) == 0) {
 		if (testtype(&opt[10])) {
 			strlcpy(deftype, &opt[10], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "query=", 6) == 0) {
 		if (testtype(&opt[6])) {
 			strlcpy(deftype, &opt[6], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "qu=", 3) == 0) {
 		if (testtype(&opt[3])) {
 			strlcpy(deftype, &opt[3], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "q=", 2) == 0) {
 		if (testtype(&opt[2])) {
 			strlcpy(deftype, &opt[2], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "domain=", 7) == 0) {
 		strlcpy(domainopt, &opt[7], sizeof(domainopt));
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "do=", 3) == 0) {
 		strlcpy(domainopt, &opt[3], sizeof(domainopt));
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "port=", 5) == 0) {
 		set_port(&opt[5]);
 	} else if (strncasecmp(opt, "po=", 3) == 0) {
@@ -700,43 +698,43 @@ setoption(char *opt) {
 	} else if (strncasecmp(opt, "t=", 2) == 0) {
 		set_timeout(&opt[2]);
 	} else if (CHECKOPT("recurse", 3)) {
-		recurse = true;
+		recurse = ISC_TRUE;
 	} else if (CHECKOPT("norecurse", 5)) {
-		recurse = false;
+		recurse = ISC_FALSE;
 	} else if (strncasecmp(opt, "retry=", 6) == 0) {
 		set_tries(&opt[6]);
 	} else if (strncasecmp(opt, "ret=", 4) == 0) {
 		set_tries(&opt[4]);
 	} else if (CHECKOPT("defname", 3)) {
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (CHECKOPT("nodefname", 5)) {
-		usesearch = false;
+		usesearch = ISC_FALSE;
 	} else if (CHECKOPT("vc", 2)) {
-		tcpmode = true;
-		tcpmode_set = true;
+		tcpmode = ISC_TRUE;
+		tcpmode_set = ISC_TRUE;
 	} else if (CHECKOPT("novc", 4)) {
-		tcpmode = false;
-		tcpmode_set = true;
+		tcpmode = ISC_FALSE;
+		tcpmode_set = ISC_TRUE;
 	} else if (CHECKOPT("debug", 3)) {
-		short_form = false;
-		showsearch = true;
+		short_form = ISC_FALSE;
+		showsearch = ISC_TRUE;
 	} else if (CHECKOPT("nodebug", 5)) {
-		short_form = true;
-		showsearch = false;
+		short_form = ISC_TRUE;
+		showsearch = ISC_FALSE;
 	} else if (CHECKOPT("d2", 2)) {
-		debugging = true;
+		debugging = ISC_TRUE;
 	} else if (CHECKOPT("nod2", 4)) {
-		debugging = false;
+		debugging = ISC_FALSE;
 	} else if (CHECKOPT("search", 3)) {
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (CHECKOPT("nosearch", 5)) {
-		usesearch = false;
+		usesearch = ISC_FALSE;
 	} else if (CHECKOPT("sil", 3)) {
-		/* deprecation_msg = false; */
+		/* deprecation_msg = ISC_FALSE; */
 	} else if (CHECKOPT("fail", 3)) {
-		nofail=false;
+		nofail=ISC_FALSE;
 	} else if (CHECKOPT("nofail", 5)) {
-		nofail=true;
+		nofail=ISC_TRUE;
 	} else if (strncasecmp(opt, "ndots=", 6) == 0) {
 		set_ndots(&opt[6]);
 	} else {
@@ -755,7 +753,7 @@ addlookup(char *opt) {

 	debug("addlookup()");

-	a_noanswer = false;
+	a_noanswer = ISC_FALSE;

 	tr.base = deftype;
 	tr.length = strlen(deftype);
@@ -772,21 +770,21 @@ addlookup(char *opt) {
 		rdclass = dns_rdataclass_in;
 	}
 	lookup = make_empty_lookup();
-	if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, true)
+	if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, ISC_TRUE)
 	    == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 	} else {
 		strlcpy(lookup->textname, opt, sizeof(lookup->textname));
 		lookup->rdtype = rdtype;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 	}
 	lookup->rdclass = rdclass;
-	lookup->rdclassset = true;
-	lookup->trace = false;
+	lookup->rdclassset = ISC_TRUE;
+	lookup->trace = ISC_FALSE;
 	lookup->trace_root = lookup->trace;
-	lookup->ns_search_only = false;
+	lookup->ns_search_only = ISC_FALSE;
 	lookup->identify = identify;
 	lookup->recurse = recurse;
 	lookup->aaonly = aaonly;
@@ -794,7 +792,7 @@ addlookup(char *opt) {
 	lookup->udpsize = 0;
 	lookup->comments = comments;
 	if (lookup->rdtype == dns_rdatatype_any && !tcpmode_set)
-		lookup->tcp_mode = true;
+		lookup->tcp_mode = ISC_TRUE;
 	else
 		lookup->tcp_mode = tcpmode;
 	lookup->stats = stats;
@@ -802,9 +800,9 @@ addlookup(char *opt) {
 	lookup->section_answer = section_answer;
 	lookup->section_authority = section_authority;
 	lookup->section_additional = section_additional;
-	lookup->new_search = true;
+	lookup->new_search = ISC_TRUE;
 	if (nofail)
-		lookup->servfail_stops = false;
+		lookup->servfail_stops = ISC_FALSE;
 	ISC_LIST_INIT(lookup->q);
 	ISC_LINK_INIT(lookup, link);
 	ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -815,12 +813,12 @@ addlookup(char *opt) {

 static void
 do_next_command(char *input) {
-	char *ptr, *arg;
+	char *ptr, *arg, *last;

-	ptr = next_token(&input, " \t\r\n");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(input, " \t\r\n", &last)) == NULL) {
 		return;
-	arg = next_token(&input, " \t\r\n");
+	}
+	arg = strtok_r(NULL, " \t\r\n", &last);
 	if ((strcasecmp(ptr, "set") == 0) &&
 	    (arg != NULL))
 		setoption(arg);
@@ -828,11 +826,11 @@ do_next_command(char *input) {
 		 (strcasecmp(ptr, "lserver") == 0)) {
 		isc_app_block();
 		set_nameserver(arg);
-		check_ra = false;
+		check_ra = ISC_FALSE;
 		isc_app_unblock();
-		show_settings(true, true);
+		show_settings(ISC_TRUE, ISC_TRUE);
 	} else if (strcasecmp(ptr, "exit") == 0) {
-		in_use = false;
+		in_use = ISC_FALSE;
 	} else if (strcasecmp(ptr, "help") == 0 ||
 		   strcasecmp(ptr, "?") == 0) {
 		printf("The '%s' command is not yet implemented.\n", ptr);
@@ -869,7 +867,7 @@ get_next_command(void) {
 		ptr = fgets(buf, COMMSIZE, stdin);
 	isc_app_unblock();
 	if (ptr == NULL) {
-		in_use = false;
+		in_use = ISC_FALSE;
 	} else
 		do_next_command(ptr);
 #ifdef HAVE_READLINE
@@ -881,9 +879,9 @@ get_next_command(void) {

 static void
 parse_args(int argc, char **argv) {
-	bool have_lookup = false;
+	isc_boolean_t have_lookup = ISC_FALSE;

-	usesearch = true;
+	usesearch = ISC_TRUE;
 	for (argc--, argv++; argc > 0; argc--, argv++) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
@@ -893,15 +891,15 @@ parse_args(int argc, char **argv) {
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else
-				have_lookup = true;
+				have_lookup = ISC_TRUE;
 		} else {
 			if (!have_lookup) {
-				have_lookup = true;
-				in_use = true;
+				have_lookup = ISC_TRUE;
+				in_use = ISC_TRUE;
 				addlookup(argv[0]);
 			} else {
 				set_nameserver(argv[0]);
-				check_ra = false;
+				check_ra = ISC_FALSE;
 			}
 		}
 	}
@@ -972,13 +970,13 @@ int
 main(int argc, char **argv) {
 	isc_result_t result;

-	interactive = isatty(0);
+	interactive = ISC_TF(isatty(0));

 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);

-	check_ra = true;
+	check_ra = ISC_TRUE;

 	/* setup dighost callbacks */
 	dighost_printmessage = printmessage;
@@ -992,7 +990,7 @@ main(int argc, char **argv) {
 	setup_libs();
 	progname = argv[0];

-	setup_system(false, false);
+	setup_system(ISC_FALSE, ISC_FALSE);
 	parse_args(argc, argv);
 	if (keyfile[0] != 0)
 		setup_file_key();
@@ -1006,7 +1004,7 @@ main(int argc, char **argv) {
 	else
 		result = isc_app_onrun(mctx, global_task, getinput, NULL);
 	check_result(result, "isc_app_onrun");
-	in_use = !in_use;
+	in_use = ISC_TF(!in_use);

 	(void)isc_app_run();

@@ -18,7 +18,7 @@ VERSION=@BIND9_VERSION@
 CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@

 CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
-		@CRYPTO@ -DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
+		-DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -116,12 +116,12 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8

 install:: ${TARGETS} installdirs
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done

 uninstall::
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done

 clean distclean::
 	rm -f ${TARGETS}
@@ -19,13 +19,10 @@
 #include <config.h>

 #include <errno.h>
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -56,7 +53,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -74,7 +71,6 @@ int verbose;
 */
 static isc_log_t *lctx = NULL;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;

 /*
 * The domain we are working on
@@ -88,7 +84,7 @@ static dns_rdataclass_t rdclass = dns_rdataclass_in;
 * List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
 * from -a arguments. The size of the array is an arbitrary limit.
 */
-static uint8_t dtype[8];
+static isc_uint8_t dtype[8];

 static const char *startstr  = NULL;	/* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;	/* restrict sig inception times */
@@ -131,7 +127,7 @@ static int nkey; /* number of child zone DNSKEY records */
 typedef struct keyinfo {
 	dns_rdata_t rdata;
 	dst_key_t *dst;
-	uint8_t algo;
+	isc_uint8_t algo;
 	dns_keytag_t tag;
 } keyinfo_t;

@@ -255,14 +251,14 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 			       rdclass, 0, NULL, dbp);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load3(*dbp, filename,
-			      dns_masterformat_text, DNS_MASTER_HINT);
+	result = dns_db_load(*dbp, filename,
+			     dns_masterformat_text, DNS_MASTER_HINT);
 	if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE) {
 		fatal("can't load %s: %s", filename,
 		      isc_result_totext(result));
 	}

-	result = dns_db_findnode(*dbp, name, false, nodep);
+	result = dns_db_findnode(*dbp, name, ISC_FALSE, nodep);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't find %s node in %s", namestr, filename);
 	}
@@ -316,7 +312,7 @@ get_dsset_name(char *filename, size_t size,
 		}
 		isc_buffer_putstr(&buf, prefix);

-		result = dns_name_tofilenametext(name, false, &buf);
+		result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
 		check_result(result, "dns_name_tofilenametext()");
 		if (isc_buffer_availablelength(&buf) == 0) {
 			fatal("%s: pathname too long", path);
@@ -380,9 +376,9 @@ formatset(dns_rdataset_t *rdataset) {
 	 * which just separates fields with spaces. The huge tab stop width
 	 * eliminates any tab characters.
 	 */
-	result = dns_master_stylecreate2(&style, styleflags,
-					 0, 0, 0, 0, 0, 1000000, 0,
-					 mctx);
+	result = dns_master_stylecreate(&style, styleflags,
+					0, 0, 0, 0, 0, 1000000, 0,
+					mctx);
 	check_result(result, "dns_master_stylecreate2 failed");

 	result = isc_buffer_allocate(mctx, &buf, MAX_CDS_RDATA_TEXT_SIZE);
@@ -404,7 +400,7 @@ formatset(dns_rdataset_t *rdataset) {

 static void
 write_parent_set(const char *path, const char *inplace,
-		 bool nsupdate, dns_rdataset_t *rdataset)
+		 isc_boolean_t nsupdate, dns_rdataset_t *rdataset)
 {
 	isc_result_t result;
 	isc_buffer_t *buf = NULL;
@@ -471,7 +467,7 @@ typedef enum { LOOSE, TIGHT } strictness_t;
 /*
 * Find out if any (C)DS record matches a particular (C)DNSKEY.
 */
-static bool
+static isc_boolean_t
 match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 {
 	isc_result_t result;
@@ -485,7 +481,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_t newdsrdata = DNS_RDATA_INIT;
 		dns_rdatatype_t keytype;
-		bool c;
+		isc_boolean_t c;

 		dns_rdataset_current(dsset, &dsrdata);
 		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
@@ -515,13 +511,13 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS",
 				 ds.key_tag, ds.algorithm, ds.digest_type);
-			return (true);
+			return (ISC_TRUE);
 		} else if (strictness == TIGHT) {
 			vbprintf(0, "key does not match %s %d %d %d "
 				"when it looks like it should\n",
 				 c ? "CDS" : "DS",
 				 ds.key_tag, ds.algorithm, ds.digest_type);
-			return (false);
+			return (ISC_FALSE);
 		}
 	}

@@ -532,7 +528,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		 ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);

-	return (false);
+	return (ISC_FALSE);
 }

 /*
@@ -621,12 +617,12 @@ free_keytable(keyinfo_t **keytable_p) {
 * otherwise the key algorithm. This is used by the signature coverage
 * check functions below.
 */
-static uint8_t *
+static isc_uint8_t *
 matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigset)
 {
 	isc_result_t result;
-	uint8_t *algo;
+	isc_uint8_t *algo;
 	int i;

 	algo = isc_mem_get(mctx, nkey);
@@ -672,8 +668,11 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 			}

 			result = dns_dnssec_verify(name, rdataset, ki->dst,
-						   false, mctx, &sigrdata);
-			if (result != ISC_R_SUCCESS) {
+						   ISC_FALSE, 0, mctx,
+						   &sigrdata, NULL);
+
+			if (result != ISC_R_SUCCESS &&
+			    result != DNS_R_FROMWILDCARD) {
 				vbprintf(1, "skip RRSIG by key %d:"
 					 " verification failed: %s\n",
 					 sig.keyid, isc_result_totext(result));
@@ -705,13 +704,13 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 * Consume the result of matching_sigs(). When checking records
 * fetched from the child zone, any working signature is enough.
 */
-static bool
-signed_loose(uint8_t *algo) {
-	bool ok = false;
+static isc_boolean_t
+signed_loose(isc_uint8_t *algo) {
+	isc_boolean_t ok = ISC_FALSE;
 	int i;
 	for (i = 0; i < nkey; i++) {
 		if (algo[i] != 0) {
-			ok = true;
+			ok = ISC_TRUE;
 		}
 	}
 	isc_mem_put(mctx, algo, nkey);
@@ -724,10 +723,10 @@ signed_loose(uint8_t *algo) {
 * key algorithm in the DS RRset must have a signature in the DNSKEY
 * RRset.
 */
-static bool
-signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
+static isc_boolean_t
+signed_strict(dns_rdataset_t *dsset, isc_uint8_t *algo) {
 	isc_result_t result;
-	bool all_ok = true;
+	isc_boolean_t all_ok = ISC_TRUE;

 	for (result = dns_rdataset_first(dsset);
 	     result == ISC_R_SUCCESS;
@@ -735,23 +734,23 @@ signed_strict(dns_rdataset_t *dsset, uint8_t *algo) {
 	{
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_ds_t ds;
-		bool ds_ok;
+		isc_boolean_t ds_ok;
 		int i;

 		dns_rdataset_current(dsset, &dsrdata);
 		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
 		check_result(result, "dns_rdata_tostruct(DS)");

-		ds_ok = false;
+		ds_ok = ISC_FALSE;
 		for (i = 0; i < nkey; i++) {
 			if (algo[i] == ds.algorithm) {
-				ds_ok = true;
+				ds_ok = ISC_TRUE;
 			}
 		}
 		if (!ds_ok) {
 			vbprintf(0, "missing signature for algorithm %d "
 				 "(key %d)\n", ds.algorithm, ds.key_tag);
-			all_ok = false;
+			all_ok = ISC_FALSE;
 		}
 	}

@@ -849,14 +848,14 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 */
 static int
 cmp_dtype(const void *ap, const void *bp) {
-	int a = *(const uint8_t *)ap;
-	int b = *(const uint8_t *)bp;
+	int a = *(const isc_uint8_t *)ap;
+	int b = *(const isc_uint8_t *)bp;
 	return (a - b);
 }

 static void
 add_dtype(const char *dn) {
-	uint8_t dt;
+	isc_uint8_t dt;
 	unsigned i, n;

 	dt = strtodsdigest(dn);
@@ -873,7 +872,7 @@ add_dtype(const char *dn) {

 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata,
-		uint32_t ttl, dns_rdataset_t *rdset)
+		isc_uint32_t ttl, dns_rdataset_t *rdset)
 {
 	unsigned int size = 16;
 	for (;;) {
@@ -935,14 +934,14 @@ rdata_cmp(const void *rdata1, const void *rdata2) {
 * Ensure that every key identified by the DS RRset has the same set of
 * digest types.
 */
-static bool
+static isc_boolean_t
 consistent_digests(dns_rdataset_t *dsset) {
 	isc_result_t result;
 	dns_rdata_t *arrdata;
 	dns_rdata_ds_t *ds;
 	dns_keytag_t key_tag;
-	uint8_t algorithm;
-	bool match;
+	isc_uint8_t algorithm;
+	isc_boolean_t match;
 	int i, j, n, d;

 	/*
@@ -996,7 +995,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Check subsequent keys match the first one
 	 */
-	match = true;
+	match = ISC_TRUE;
 	while (i < n) {
 		key_tag = ds[i].key_tag;
 		algorithm = ds[i].algorithm;
@@ -1005,7 +1004,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 			    ds[i+j].algorithm != algorithm ||
 			    ds[i+j].digest_type != ds[j].digest_type)
 			{
-				match = false;
+				match = ISC_FALSE;
 			}
 		}
 		i += d;
@@ -1040,7 +1039,7 @@ print_diff(const char *cmd, dns_rdataset_t *rdataset) {
 }

 static void
-update_diff(const char *cmd, uint32_t ttl,
+update_diff(const char *cmd, isc_uint32_t ttl,
 	    dns_rdataset_t *addset, dns_rdataset_t *delset)
 {
 	isc_result_t result;
@@ -1048,7 +1047,7 @@ update_diff(const char *cmd, uint32_t ttl,
 	dns_dbnode_t *node;
 	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
-	uint32_t save;
+	isc_uint32_t save;

 	db = NULL;
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
@@ -1060,7 +1059,7 @@ update_diff(const char *cmd, uint32_t ttl,
 	check_result(result, "dns_db_newversion()");

 	node = NULL;
-	result = dns_db_findnode(db, name, true, &node);
+	result = dns_db_findnode(db, name, ISC_TRUE, &node);
 	check_result(result, "dns_db_findnode()");

 	dns_rdataset_init(&diffset);
@@ -1084,12 +1083,12 @@ update_diff(const char *cmd, uint32_t ttl,
 	}

 	dns_db_detachnode(db, &node);
-	dns_db_closeversion(db, &ver, false);
+	dns_db_closeversion(db, &ver, ISC_FALSE);
 	dns_db_detach(&db);
 }

 static void
-nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
+nsdiff(isc_uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	if (ttl == 0) {
 		vbprintf(1, "warning: no TTL in nsupdate script\n");
 	}
@@ -1137,9 +1136,9 @@ main(int argc, char *argv[]) {
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
 	isc_result_t result;
-	bool prefer_cdnskey = false;
-	bool nsupdate = false;
-	uint32_t ttl = 0;
+	isc_boolean_t prefer_cdnskey = ISC_FALSE;
+	isc_boolean_t nsupdate = ISC_FALSE;
+	isc_uint32_t ttl = 0;
 	int ch;
 	char *endp;

@@ -1148,12 +1147,12 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 #define OPTIONS "a:c:Dd:f:i:ms:T:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
@@ -1165,7 +1164,7 @@ main(int argc, char *argv[]) {
 			rdclass = strtoclass(isc_commandline_argument);
 			break;
 		case 'D':
-			prefer_cdnskey = true;
+			prefer_cdnskey = ISC_TRUE;
 			break;
 		case 'd':
 			ds_path = isc_commandline_argument;
@@ -1198,7 +1197,7 @@ main(int argc, char *argv[]) {
 			ttl = strtottl(isc_commandline_argument);
 			break;
 		case 'u':
-			nsupdate = true;
+			nsupdate = ISC_TRUE;
 			break;
 		case 'V':
 			/* Does not return. */
@@ -1232,20 +1231,11 @@ main(int argc, char *argv[]) {

 	setup_logging(mctx, &lctx);

-	if (ectx == NULL) {
-		setup_entropy(mctx, NULL, &ectx);
-	}
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS) {
-		fatal("could not initialize hash");
-	}
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS) {
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
-	isc_entropy_stopcallbacksources(ectx);

 	if (ds_path == NULL) {
 		fatal("missing -d DS pathname");
@@ -1395,8 +1385,6 @@ main(int argc, char *argv[]) {
 	free_all_sets();
 	cleanup_logging(&lctx);
 	dst_lib_destroy();
-	isc_hash_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10) {
 		isc_mem_stats(mctx, stdout);
 	}
@@ -13,13 +13,10 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -44,7 +41,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -61,8 +58,8 @@ static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;
 static dns_name_t	*name = NULL;
 static isc_mem_t	*mctx = NULL;
-static uint32_t	ttl;
-static bool	emitttl = false;
+static isc_uint32_t	ttl;
+static isc_boolean_t	emitttl = ISC_FALSE;

 static isc_result_t
 initname(char *setname) {
@@ -115,13 +112,13 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load(db, filename);
+		result = dns_db_load(db, filename, dns_masterformat_text, 0);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
 	}

-	result = dns_db_findnode(db, name, false, &node);
+	result = dns_db_findnode(db, name, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't find %s node in %s", setname, filename);

@@ -162,7 +159,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 		return (ISC_R_NOSPACE);
 	isc_buffer_putstr(&buf, "keyset-");

-	result = dns_name_tofilenametext(name, false, &buf);
+	result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0)
 		return (ISC_R_NOSPACE);
@@ -236,8 +233,8 @@ logkey(dns_rdata_t *rdata)
 }

 static void
-emit(unsigned int dtype, bool showall, char *lookaside,
-     bool cds, dns_rdata_t *rdata)
+emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
+     isc_boolean_t cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
 	unsigned char buf[DNS_DS_BUFFERSIZE];
@@ -266,7 +263,7 @@ emit(unsigned int dtype, bool showall, char *lookaside,
 	if (result != ISC_R_SUCCESS)
 		fatal("can't build record");

-	result = dns_name_totext(name, false, &nameb);
+	result = dns_name_totext(name, ISC_FALSE, &nameb);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't print name");

@@ -355,13 +352,12 @@ main(int argc, char **argv) {
 	char		*endp;
 	int		ch;
 	unsigned int	dtype = DNS_DSDIGEST_SHA1;
-	bool	cds = false;
-	bool	both = true;
-	bool	usekeyset = false;
-	bool	showall = false;
+	isc_boolean_t	cds = ISC_FALSE;
+	isc_boolean_t	both = ISC_TRUE;
+	isc_boolean_t	usekeyset = ISC_FALSE;
+	isc_boolean_t	showall = ISC_FALSE;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;

@@ -374,36 +370,36 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 #define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
 			dtype = DNS_DSDIGEST_SHA1;
-			both = false;
+			both = ISC_FALSE;
 			break;
 		case '2':
 			dtype = DNS_DSDIGEST_SHA256;
-			both = false;
+			both = ISC_FALSE;
 			break;
 		case 'A':
-			showall = true;
+			showall = ISC_TRUE;
 			break;
 		case 'a':
 			dtype = strtodsdigest(isc_commandline_argument);
-			both = false;
+			both = ISC_FALSE;
 			break;
 		case 'C':
 			if (lookaside != NULL)
 				fatal("lookaside and CDS are mutually"
 				      " exclusive");
-			cds = true;
+			cds = ISC_TRUE;
 			break;
 		case 'c':
 			classname = isc_commandline_argument;
@@ -429,10 +425,10 @@ main(int argc, char **argv) {
 				fatal("lookaside must be a non-empty string");
 			break;
 		case 's':
-			usekeyset = true;
+			usekeyset = ISC_TRUE;
 			break;
 		case 'T':
-			emitttl = true;
+			emitttl = ISC_TRUE;
 			ttl = strtottl(isc_commandline_argument);
 			break;
 		case 'v':
@@ -470,24 +466,17 @@ main(int argc, char **argv) {

 	/* When not using -f, -A is implicit */
 	if (filename == NULL)
-		showall = true;
+		showall = ISC_TRUE;

 	if (argc < isc_commandline_index + 1 && filename == NULL)
 		fatal("the key file name was not specified");
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -548,9 +537,7 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -13,12 +13,10 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdlib.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
 #include <isc/print.h>
@@ -43,7 +41,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -60,13 +58,13 @@ static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;
 static dns_name_t	*name = NULL;
 static isc_mem_t	*mctx = NULL;
-static bool	setpub = false, setdel = false;
-static bool	setttl = false;
+static isc_boolean_t	setpub = ISC_FALSE, setdel = ISC_FALSE;
+static isc_boolean_t	setttl = ISC_FALSE;
 static isc_stdtime_t	pub = 0, del = 0;
 static dns_ttl_t	ttl = 0;
 static isc_stdtime_t	syncadd = 0, syncdel = 0;
-static bool	setsyncadd = false;
-static bool	setsyncdel = false;
+static isc_boolean_t	setsyncadd = ISC_FALSE;
+static isc_boolean_t	setsyncdel = ISC_FALSE;

 static isc_result_t
 initname(char *setname) {
@@ -119,14 +117,14 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 		db_load_from_stream(db, stdin);
 		filename = "input";
 	} else {
-		result = dns_db_load3(db, filename, dns_masterformat_text,
-				      DNS_MASTER_NOTTL);
+		result = dns_db_load(db, filename, dns_masterformat_text,
+				     DNS_MASTER_NOTTL);
 		if (result != ISC_R_SUCCESS && result != DNS_R_SEENINCLUDE)
 			fatal("can't load %s: %s", filename,
 			      isc_result_totext(result));
 	}

-	result = dns_db_findnode(db, name, false, &node);
+	result = dns_db_findnode(db, name, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't find %s node in %s", setname, filename);

@@ -228,7 +226,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 		dst_key_free(&tmp);
 	}

-	dst_key_setexternal(key, true);
+	dst_key_setexternal(key, ISC_TRUE);
 	if (setpub)
 		dst_key_settime(key, DST_TIME_PUBLISH, pub);
 	if (setdel)
@@ -298,7 +296,6 @@ main(int argc, char **argv) {
 	int		ch;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataset_t	rdataset;
 	dns_rdata_t	rdata;
 	isc_stdtime_t   now;
@@ -313,12 +310,12 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 #define CMDLINE_FLAGS "D:f:hK:L:P:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
@@ -349,7 +346,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
+			setttl = ISC_TRUE;
 			break;
 		case 'P':
 			/* -Psync ? */
@@ -405,17 +402,10 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init(mctx, ectx,
-			      ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, NULL);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	setup_logging(mctx, &log);

@@ -458,9 +448,7 @@ main(int argc, char **argv) {
 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	cleanup_logging(&log);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -14,13 +14,10 @@
 #include <config.h>

 #include <ctype.h>
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/region.h>
 #include <isc/print.h>
@@ -40,7 +37,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -72,7 +69,7 @@ usage(void) {
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -c class (default: IN)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -137,9 +134,9 @@ main(int argc, char **argv) {
 	dst_key_t	*key = NULL;
 	dns_fixedname_t	fname;
 	dns_name_t	*name;
-	uint16_t	flags = 0, kskflag = 0, revflag = 0;
+	isc_uint16_t	flags = 0, kskflag = 0, revflag = 0;
 	dns_secalg_t	alg;
-	bool	oldstyle = false;
+	isc_boolean_t	oldstyle = ISC_FALSE;
 	isc_mem_t	*mctx = NULL;
 	int		ch;
 	int		protocol = -1, signatory = 0;
@@ -148,7 +145,6 @@ main(int argc, char **argv) {
 	char		filename[255];
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 	dns_rdataclass_t rdclass;
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	char		*label = NULL;
@@ -157,32 +153,32 @@ main(int argc, char **argv) {
 	isc_stdtime_t	inactive = 0, deltime = 0;
 	isc_stdtime_t	now;
 	int		prepub = -1;
-	bool	setpub = false, setact = false;
-	bool	setrev = false, setinact = false;
-	bool	setdel = false, setttl = false;
-	bool	unsetpub = false, unsetact = false;
-	bool	unsetrev = false, unsetinact = false;
-	bool	unsetdel = false;
-	bool	genonly = false;
-	bool	use_nsec3 = false;
-	bool   avoid_collisions = true;
-	bool	exact;
+	isc_boolean_t	setpub = ISC_FALSE, setact = ISC_FALSE;
+	isc_boolean_t	setrev = ISC_FALSE, setinact = ISC_FALSE;
+	isc_boolean_t	setdel = ISC_FALSE, setttl = ISC_FALSE;
+	isc_boolean_t	unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
+	isc_boolean_t	unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
+	isc_boolean_t	unsetdel = ISC_FALSE;
+	isc_boolean_t	genonly = ISC_FALSE;
+	isc_boolean_t	use_nsec3 = ISC_FALSE;
+	isc_boolean_t   avoid_collisions = ISC_TRUE;
+	isc_boolean_t	exact;
 	unsigned char	c;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
-	bool	unsetsyncadd = false, setsyncadd = false;
-	bool	unsetsyncdel = false, setsyncdel = false;
+	isc_boolean_t	unsetsyncadd = ISC_FALSE, setsyncadd = ISC_FALSE;
+	isc_boolean_t	unsetsyncdel = ISC_FALSE, setsyncdel = ISC_FALSE;

 	if (argc == 1)
 		usage();

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	isc_stdtime_get(&now);

@@ -190,13 +186,13 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 	    switch (ch) {
 		case '3':
-			use_nsec3 = true;
+			use_nsec3 = ISC_TRUE;
 			break;
 		case 'a':
 			algname = isc_commandline_argument;
 			break;
 		case 'C':
-			oldstyle = true;
+			oldstyle = ISC_TRUE;
 			break;
 		case 'c':
 			classname = isc_commandline_argument;
@@ -226,7 +222,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
+			setttl = ISC_TRUE;
 			break;
 		case 'l':
 			label = isc_mem_strdup(mctx, isc_commandline_argument);
@@ -249,10 +245,10 @@ main(int argc, char **argv) {
 				fatal("-v must be followed by a number");
 			break;
 		case 'y':
-			avoid_collisions = false;
+			avoid_collisions = ISC_FALSE;
 			break;
 		case 'G':
-			genonly = true;
+			genonly = ISC_TRUE;
 			break;
 		case 'P':
 			/* -Psync ? */
@@ -349,10 +345,7 @@ main(int argc, char **argv) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	ret = dst_lib_init2(mctx, ectx, engine,
-			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -467,14 +460,14 @@ main(int argc, char **argv) {
 				      "prepublication interval.");

 			if (!setpub && !setact) {
-				setpub = setact = true;
+				setpub = setact = ISC_TRUE;
 				publish = now;
 				activate = now + prepub;
 			} else if (setpub && !setact) {
-				setact = true;
+				setact = ISC_TRUE;
 				activate = publish + prepub;
 			} else if (setact && !setpub) {
-				setpub = true;
+				setpub = ISC_TRUE;
 				publish = activate - prepub;
 			}

@@ -562,7 +555,7 @@ main(int argc, char **argv) {
 					"You can use dnssec-settime -D to "
 					"change this.\n", program, keystr);

-		setpub = setact = true;
+		setpub = setact = ISC_TRUE;
 	}

 	if (nametype == NULL) {
@@ -614,13 +607,12 @@ main(int argc, char **argv) {

 	/* associate the key */
 	ret = dst_key_fromlabel(name, alg, flags, protocol, rdclass,
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 				"pkcs11",
 #else
 				engine,
 #endif
 				label, NULL, mctx, &key);
-	isc_entropy_stopcallbacksources(ectx);

 	if (ret != ISC_R_SUCCESS) {
 		char namestr[DNS_NAME_FORMATSIZE];
@@ -739,7 +731,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
-	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -39,7 +39,7 @@
 dnssec-keygen \- DNSSEC key generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keygen\fR\ 'u
-\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
+\fBdnssec\-keygen\fR [\fB\-a\ \fR\fB\fIalgorithm\fR\fR] [\fB\-b\ \fR\fB\fIkeysize\fR\fR] [\fB\-n\ \fR\fB\fInametype\fR\fR] [\fB\-3\fR] [\fB\-A\ \fR\fB\fIdate/offset\fR\fR] [\fB\-C\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-D\ \fR\fB\fIdate/offset\fR\fR] [\fB\-D\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-f\ \fR\fB\fIflag\fR\fR] [\fB\-G\fR] [\fB\-g\ \fR\fB\fIgenerator\fR\fR] [\fB\-h\fR] [\fB\-I\ \fR\fB\fIdate/offset\fR\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\fR] [\fB\-L\ \fR\fB\fIttl\fR\fR] [\fB\-P\ \fR\fB\fIdate/offset\fR\fR] [\fB\-P\ sync\ \fR\fB\fIdate/offset\fR\fR] [\fB\-p\ \fR\fB\fIprotocol\fR\fR] [\fB\-q\fR] [\fB\-R\ \fR\fB\fIdate/offset\fR\fR] [\fB\-S\ \fR\fB\fIkey\fR\fR] [\fB\-s\ \fR\fB\fIstrength\fR\fR] [\fB\-t\ \fR\fB\fItype\fR\fR] [\fB\-V\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-z\fR] {name}
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keygen\fR
@@ -66,19 +66,19 @@ must be one of RSAMD5, RSASHA1, DSA, NSEC3RSASHA1, NSEC3DSA, RSASHA256, RSASHA51
 \fB\-T KEY\fR
 option as well\&.
 .sp
-TSIG keys can also be generated by setting the value to one of HMAC\-MD5, HMAC\-SHA1, HMAC\-SHA224, HMAC\-SHA256, HMAC\-SHA384, or HMAC\-SHA512\&. As with DH, specifying these values will automatically set
-\fB\-T KEY\fR\&. Note, however, that
-\fBtsig\-keygen\fR
-produces TSIG keys in a more useful format\&. These algorithms have been deprecated in
-\fBdnssec\-keygen\fR, and will be removed in a future release\&.
-.sp
 These values are case insensitive\&. In some cases, abbreviations are supported, such as ECDSA256 for ECDSAP256SHA256 and ECDSA384 for ECDSAP384SHA384\&. If RSASHA1 or DSA is specified along with the
 \fB\-3\fR
 option, then NSEC3RSASHA1 or NSEC3DSA will be used instead\&.
 .sp
-As of BIND 9\&.12\&.0, this option is mandatory except when using the
+This parameter
+\fImust\fR
+be specified except when using the
 \fB\-S\fR
-option, which copies the algorithm from the predecessor key\&. Previously, the default for newly generated keys was RSASHA1\&.
+option, which copies the algorithm from the predecessor key\&.
+.sp
+In prior releases, HMAC algorithms could be generated for use as TSIG keys, but that feature has been removed as of BIND 9\&.13\&.0\&. Use
+\fBtsig\-keygen\fR
+to generate TSIG keys\&.
 .RE
 .PP
 \-b \fIkeysize\fR
@@ -178,21 +178,6 @@ stderr
 indicating the progress of the key generation\&. A \*(Aq\&.\*(Aq indicates that a random number has been found which passed an initial sieve test; \*(Aq+\*(Aq means a number has passed a single round of the Miller\-Rabin primality test; a space means that the number has passed all the tests and is a satisfactory key\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies a source of randomness\&. Normally, when generating DNSSEC keys, this option has no effect; the random number generation function provided by the cryptographic library will be used\&.
-.sp
-If that behavior is disabled at compile time, however, the specified file will be used as entropy source for key generation\&.
-randomdev
-is the name of a character device or file containing random data to be used\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.sp
-The default is
-/dev/random
-if the operating system provides it or an equivalent device; if not, the default source of randomness is keyboard input\&.
-.RE
-.PP
 \-S \fIkey\fR
 .RS 4
 Create a new key which is an explicit successor to an existing key\&. The name, algorithm, size, and type of the key will be set to match the existing key\&. The activation date of the new key will be set to the inactivation date of the existing one\&. The publication date will be set to the activation date minus the prepublication interval, which defaults to 30 days\&.
@@ -28,14 +28,11 @@
 #include <config.h>

 #include <ctype.h>
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <unistd.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/region.h>
@@ -55,7 +52,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -84,10 +81,7 @@ usage(void) {
 				" | NSEC3DSA |\n");
 	fprintf(stderr, "        RSASHA256 | RSASHA512 | ECCGOST |\n");
 	fprintf(stderr, "        ECDSAP256SHA256 | ECDSAP384SHA384 |\n");
-	fprintf(stderr, "        ED25519 | ED448 | DH |\n");
-	fprintf(stderr, "        HMAC-MD5 | HMAC-SHA1 | HMAC-SHA224 | "
-				"HMAC-SHA256 | \n");
-	fprintf(stderr, "        HMAC-SHA384 | HMAC-SHA512\n");
+	fprintf(stderr, "        ED25519 | ED448 | DH\n");
 	fprintf(stderr, "    -3: use NSEC3-capable algorithm\n");
 	fprintf(stderr, "    -b <key size in bits>:\n");
 	fprintf(stderr, "        RSAMD5:\t[1024..%d]\n", MAX_RSA);
@@ -104,12 +98,6 @@ usage(void) {
 	fprintf(stderr, "        ECDSAP384SHA384:\tignored\n");
 	fprintf(stderr, "        ED25519:\tignored\n");
 	fprintf(stderr, "        ED448:\tignored\n");
-	fprintf(stderr, "        HMAC-MD5:\t[1..512]\n");
-	fprintf(stderr, "        HMAC-SHA1:\t[1..160]\n");
-	fprintf(stderr, "        HMAC-SHA224:\t[1..224]\n");
-	fprintf(stderr, "        HMAC-SHA256:\t[1..256]\n");
-	fprintf(stderr, "        HMAC-SHA384:\t[1..384]\n");
-	fprintf(stderr, "        HMAC-SHA512:\t[1..512]\n");
 	fprintf(stderr, "        (key size defaults are set according to\n"
 			"        algorithm and usage (ZSK or KSK)\n");
 	fprintf(stderr, "    -n <nametype>: ZONE | HOST | ENTITY | "
@@ -118,7 +106,7 @@ usage(void) {
 	fprintf(stderr, "    -c <class>: (default: IN)\n");
 	fprintf(stderr, "    -d <digest bits> (0 => max, default)\n");
 	fprintf(stderr, "    -E <engine>:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "        path to PKCS#11 provider library "
 				"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -132,7 +120,6 @@ usage(void) {
 			"(DH only)\n");
 	fprintf(stderr, "    -L <ttl>: default key TTL\n");
 	fprintf(stderr, "    -p <protocol>: (default: 3 [dnssec])\n");
-	fprintf(stderr, "    -r <randomdev>: a file containing random data\n");
 	fprintf(stderr, "    -s <strength>: strength value this key signs DNS "
 			"records with (default: 0)\n");
 	fprintf(stderr, "    -T <rrtype>: DNSKEY | KEY (default: DNSKEY; "
@@ -175,9 +162,9 @@ usage(void) {
 	exit (-1);
 }

-static bool
+static isc_boolean_t
 dsa_size_ok(int size) {
-	return (size >= 512 && size <= 1024 && size % 64 == 0);
+	return (ISC_TF(size >= 512 && size <= 1024 && size % 64 == 0));
 }

 static void
@@ -214,10 +201,10 @@ main(int argc, char **argv) {
 	dst_key_t	*key = NULL;
 	dns_fixedname_t	fname;
 	dns_name_t	*name;
-	uint16_t	flags = 0, kskflag = 0, revflag = 0;
+	isc_uint16_t	flags = 0, kskflag = 0, revflag = 0;
 	dns_secalg_t	alg;
-	bool	conflict = false, null_key = false;
-	bool	oldstyle = false;
+	isc_boolean_t	conflict = ISC_FALSE, null_key = ISC_FALSE;
+	isc_boolean_t	oldstyle = ISC_FALSE;
 	isc_mem_t	*mctx = NULL;
 	int		ch, generator = 0, param = 0;
 	int		protocol = -1, size = -1, signatory = 0;
@@ -229,7 +216,6 @@ main(int argc, char **argv) {
 	dst_key_t	*prevkey = NULL;
 	isc_buffer_t	buf;
 	isc_log_t	*log = NULL;
-	isc_entropy_t	*ectx = NULL;
 #ifdef USE_PKCS11
 	const char	*engine = PKCS11_ENGINE;
 #else
@@ -239,34 +225,34 @@ main(int argc, char **argv) {
 	int		options = DST_TYPE_PRIVATE | DST_TYPE_PUBLIC;
 	int		dbits = 0;
 	dns_ttl_t	ttl = 0;
-	bool	use_nsec3 = false;
+	isc_boolean_t	use_nsec3 = ISC_FALSE;
 	isc_stdtime_t	publish = 0, activate = 0, revokekey = 0;
 	isc_stdtime_t	inactive = 0, deltime = 0;
 	isc_stdtime_t	now;
 	int		prepub = -1;
-	bool	setpub = false, setact = false;
-	bool	setrev = false, setinact = false;
-	bool	setdel = false, setttl = false;
-	bool	unsetpub = false, unsetact = false;
-	bool	unsetrev = false, unsetinact = false;
-	bool	unsetdel = false;
-	bool	genonly = false;
-	bool	quiet = false;
-	bool	show_progress = false;
+	isc_boolean_t	setpub = ISC_FALSE, setact = ISC_FALSE;
+	isc_boolean_t	setrev = ISC_FALSE, setinact = ISC_FALSE;
+	isc_boolean_t	setdel = ISC_FALSE, setttl = ISC_FALSE;
+	isc_boolean_t	unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
+	isc_boolean_t	unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
+	isc_boolean_t	unsetdel = ISC_FALSE;
+	isc_boolean_t	genonly = ISC_FALSE;
+	isc_boolean_t	quiet = ISC_FALSE;
+	isc_boolean_t	show_progress = ISC_FALSE;
 	unsigned char	c;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
-	bool	setsyncadd = false;
-	bool	setsyncdel = false;
+	isc_boolean_t	setsyncadd = ISC_FALSE;
+	isc_boolean_t	setsyncdel = ISC_FALSE;

 	if (argc == 1)
 		usage();

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	/*
 	 * Process memory debugging argument first.
@@ -291,7 +277,7 @@ main(int argc, char **argv) {
 			break;
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;

 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);

@@ -300,7 +286,7 @@ main(int argc, char **argv) {
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 	    switch (ch) {
 		case '3':
-			use_nsec3 = true;
+			use_nsec3 = ISC_TRUE;
 			break;
 		case 'a':
 			algname = isc_commandline_argument;
@@ -311,7 +297,7 @@ main(int argc, char **argv) {
 				fatal("-b requires a non-negative number");
 			break;
 		case 'C':
-			oldstyle = true;
+			oldstyle = ISC_TRUE;
 			break;
 		case 'c':
 			classname = isc_commandline_argument;
@@ -327,7 +313,7 @@ main(int argc, char **argv) {
 		case 'e':
 			fprintf(stderr,
 				"phased-out option -e "
-				"(was 'use (RSA) large exponent')\n");
+				"(was 'use (RSA) large exponent)\n");
 			break;
 		case 'f':
 			c = (unsigned char)(isc_commandline_argument[0]);
@@ -359,7 +345,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
+			setttl = ISC_TRUE;
 			break;
 		case 'n':
 			nametype = isc_commandline_argument;
@@ -373,10 +359,11 @@ main(int argc, char **argv) {
 				      "[0..255]");
 			break;
 		case 'q':
-			quiet = true;
+			quiet = ISC_TRUE;
 			break;
 		case 'r':
-			setup_entropy(mctx, isc_commandline_argument, &ectx);
+			fatal("The -r option has been deprecated.\n"
+			      "System random data is always used.\n");
 			break;
 		case 's':
 			signatory = strtol(isc_commandline_argument,
@@ -409,7 +396,7 @@ main(int argc, char **argv) {
 			/* already the default */
 			break;
 		case 'G':
-			genonly = true;
+			genonly = ISC_TRUE;
 			break;
 		case 'P':
 			/* -Psync ? */
@@ -503,12 +490,9 @@ main(int argc, char **argv) {
 	}

 	if (!isatty(0))
-		quiet = true;
+		quiet = ISC_TRUE;

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	ret = dst_lib_init2(mctx, ectx, engine,
-			    ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	ret = dst_lib_init(mctx, engine);
 	if (ret != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(ret));
@@ -546,8 +530,6 @@ main(int argc, char **argv) {
 					"\"-a RSAMD5\"\n");
 			INSIST(freeit == NULL);
 			return (1);
-		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
-			alg = DST_ALG_HMACMD5;
 #else
 			fprintf(stderr,
 				"The use of RSA (RSAMD5) was disabled\n");
@@ -557,47 +539,26 @@ main(int argc, char **argv) {
 			fprintf(stderr, "The use of RSAMD5 was disabled\n");
 			INSIST(freeit == NULL);
 			return (1);
-		} else if (strcasecmp(algname, "HMAC-MD5") == 0) {
-			fprintf(stderr,
-				"The use of HMAC-MD5 was disabled\n");
-			return (1);
 #endif
-		} else if (strcasecmp(algname, "HMAC-SHA1") == 0)
-			alg = DST_ALG_HMACSHA1;
-		else if (strcasecmp(algname, "HMAC-SHA224") == 0)
-			alg = DST_ALG_HMACSHA224;
-		else if (strcasecmp(algname, "HMAC-SHA256") == 0)
-			alg = DST_ALG_HMACSHA256;
-		else if (strcasecmp(algname, "HMAC-SHA384") == 0)
-			alg = DST_ALG_HMACSHA384;
-		else if (strcasecmp(algname, "HMAC-SHA512") == 0)
-			alg = DST_ALG_HMACSHA512;
-		else {
+		} else {
 			r.base = algname;
 			r.length = strlen(algname);
 			ret = dns_secalg_fromtext(&alg, &r);
-			if (ret != ISC_R_SUCCESS)
+			if (ret != ISC_R_SUCCESS) {
 				fatal("unknown algorithm %s", algname);
-			if (alg == DST_ALG_DH)
+			}
+			if (alg == DST_ALG_DH) {
 				options |= DST_TYPE_KEY;
+			}
 		}

 #ifdef PK11_MD5_DISABLE
-		INSIST((alg != DNS_KEYALG_RSAMD5) && (alg != DST_ALG_HMACMD5));
+		INSIST((alg != DNS_KEYALG_RSAMD5));
 #endif

-
-		if (alg == DST_ALG_HMACMD5 || alg == DST_ALG_HMACSHA1 ||
-		    alg == DST_ALG_HMACSHA224 || alg == DST_ALG_HMACSHA256 ||
-		    alg == DST_ALG_HMACSHA384 || alg == DST_ALG_HMACSHA512)
-		{
-			fprintf(stderr,
-				"Use of dnssec-keygen for HMAC keys is "
-				"deprecated: use tsig-keygen\n");
-		}
-
-		if (!dst_algorithm_supported(alg))
+		if (!dst_algorithm_supported(alg)) {
 			fatal("unsupported algorithm: %d", alg);
+		}

 		if (use_nsec3) {
 			switch (alg) {
@@ -624,20 +585,20 @@ main(int argc, char **argv) {
 		}

 		if (type != NULL && (options & DST_TYPE_KEY) != 0) {
-			if (strcasecmp(type, "NOAUTH") == 0)
+			if (strcasecmp(type, "NOAUTH") == 0) {
 				flags |= DNS_KEYTYPE_NOAUTH;
-			else if (strcasecmp(type, "NOCONF") == 0)
+			} else if (strcasecmp(type, "NOCONF") == 0) {
 				flags |= DNS_KEYTYPE_NOCONF;
-			else if (strcasecmp(type, "NOAUTHCONF") == 0) {
+			} else if (strcasecmp(type, "NOAUTHCONF") == 0) {
 				flags |= (DNS_KEYTYPE_NOAUTH |
 					  DNS_KEYTYPE_NOCONF);
 				if (size < 0)
 					size = 0;
-			}
-			else if (strcasecmp(type, "AUTHCONF") == 0)
+			} else if (strcasecmp(type, "AUTHCONF") == 0) {
 				/* nothing */;
-			else
+			} else {
 				fatal("invalid type %s", type);
+			}
 		}

 		if (size < 0) {
@@ -675,14 +636,14 @@ main(int argc, char **argv) {
 				      "prepublication interval.");

 			if (!setpub && !setact) {
-				setpub = setact = true;
+				setpub = setact = ISC_TRUE;
 				publish = now;
 				activate = now + prepub;
 			} else if (setpub && !setact) {
-				setact = true;
+				setact = ISC_TRUE;
 				activate = publish + prepub;
 			} else if (setact && !setpub) {
-				setpub = true;
+				setpub = ISC_TRUE;
 				publish = activate - prepub;
 			}

@@ -768,7 +729,7 @@ main(int argc, char **argv) {
 					"You can use dnssec-settime -D to "
 					"change this.\n", program, keystr);

-		setpub = setact = true;
+		setpub = setact = ISC_TRUE;
 	}

 	switch (alg) {
@@ -807,78 +768,18 @@ main(int argc, char **argv) {
 	case DST_ALG_ED448:
 		size = 456;
 		break;
-	case DST_ALG_HMACMD5:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 512)
-			fatal("HMAC-MD5 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 80 || dbits > 128))
-			fatal("HMAC-MD5 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-MD5 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA1:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 160)
-			fatal("HMAC-SHA1 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 80 || dbits > 160))
-			fatal("HMAC-SHA1 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA1 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA224:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 224)
-			fatal("HMAC-SHA224 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 112 || dbits > 224))
-			fatal("HMAC-SHA224 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA224 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA256:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 256)
-			fatal("HMAC-SHA256 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 128 || dbits > 256))
-			fatal("HMAC-SHA256 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA256 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA384:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 384)
-			fatal("HMAC-384 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 192 || dbits > 384))
-			fatal("HMAC-SHA384 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA384 digest bits %d not divisible by 8",
-			      dbits);
-		break;
-	case DST_ALG_HMACSHA512:
-		options |= DST_TYPE_KEY;
-		if (size < 1 || size > 512)
-			fatal("HMAC-SHA512 key size %d out of range", size);
-		if (dbits != 0 && (dbits < 256 || dbits > 512))
-			fatal("HMAC-SHA512 digest bits %d out of range", dbits);
-		if ((dbits % 8) != 0)
-			fatal("HMAC-SHA512 digest bits %d not divisible by 8",
-			      dbits);
-		break;
 	}

 	if (alg != DNS_KEYALG_DH && generator != 0)
 		fatal("specified DH generator for a non-DH key");

 	if (nametype == NULL) {
-		if ((options & DST_TYPE_KEY) != 0) /* KEY / HMAC */
+		if ((options & DST_TYPE_KEY) != 0) /* KEY */
 			fatal("no nametype specified");
 		flags |= DNS_KEYOWNER_ZONE;	/* DNSKEY */
 	} else if (strcasecmp(nametype, "zone") == 0)
 		flags |= DNS_KEYOWNER_ZONE;
-	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY / HMAC */
+	else if ((options & DST_TYPE_KEY) != 0)	{ /* KEY */
 		if (strcasecmp(nametype, "host") == 0 ||
 			 strcasecmp(nametype, "entity") == 0)
 			flags |= DNS_KEYOWNER_ENTITY;
@@ -894,7 +795,7 @@ main(int argc, char **argv) {
 	if (directory == NULL)
 		directory = ".";

-	if ((options & DST_TYPE_KEY) != 0)  /* KEY / HMAC */
+	if ((options & DST_TYPE_KEY) != 0)  /* KEY */
 		flags |= signatory;
 	else if ((flags & DNS_KEYOWNER_ZONE) != 0) { /* DNSKEY */
 		flags |= kskflag;
@@ -915,12 +816,11 @@ main(int argc, char **argv) {
 	}

 	if ((flags & DNS_KEYFLAG_OWNERMASK) == DNS_KEYOWNER_ZONE &&
-	    (alg == DNS_KEYALG_DH || alg == DST_ALG_HMACMD5 ||
-	     alg == DST_ALG_HMACSHA1 || alg == DST_ALG_HMACSHA224 ||
-	     alg == DST_ALG_HMACSHA256 || alg == DST_ALG_HMACSHA384 ||
-	     alg == DST_ALG_HMACSHA512))
+	    alg == DNS_KEYALG_DH)
+	{
 		fatal("a key with algorithm '%s' cannot be a zone key",
 		      algname);
+	}

 	switch(alg) {
 	case DNS_KEYALG_RSAMD5:
@@ -928,7 +828,7 @@ main(int argc, char **argv) {
 	case DNS_KEYALG_NSEC3RSASHA1:
 	case DNS_KEYALG_RSASHA256:
 	case DNS_KEYALG_RSASHA512:
-		show_progress = true;
+		show_progress = ISC_TRUE;
 		break;

 	case DNS_KEYALG_DH:
@@ -942,42 +842,31 @@ main(int argc, char **argv) {
 	case DST_ALG_ECDSA384:
 	case DST_ALG_ED25519:
 	case DST_ALG_ED448:
-		show_progress = true;
-		/* fall through */
-
-	case DST_ALG_HMACMD5:
-	case DST_ALG_HMACSHA1:
-	case DST_ALG_HMACSHA224:
-	case DST_ALG_HMACSHA256:
-	case DST_ALG_HMACSHA384:
-	case DST_ALG_HMACSHA512:
-		param = 0;
+		show_progress = ISC_TRUE;
 		break;
 	}

 	if ((flags & DNS_KEYFLAG_TYPEMASK) == DNS_KEYTYPE_NOKEY)
-		null_key = true;
+		null_key = ISC_TRUE;

 	isc_buffer_init(&buf, filename, sizeof(filename) - 1);

 	do {
-		conflict = false;
+		conflict = ISC_FALSE;

 		if (!quiet && show_progress) {
 			fprintf(stderr, "Generating key pair.");
-			ret = dst_key_generate2(name, alg, size, param, flags,
-						protocol, rdclass, mctx, &key,
-						&progress);
+			ret = dst_key_generate(name, alg, size, param, flags,
+					       protocol, rdclass, mctx, &key,
+					       &progress);
 			putc('\n', stderr);
 			fflush(stderr);
 		} else {
-			ret = dst_key_generate2(name, alg, size, param, flags,
-						protocol, rdclass, mctx, &key,
-						NULL);
+			ret = dst_key_generate(name, alg, size, param, flags,
+					       protocol, rdclass, mctx, &key,
+					       NULL);
 		}

-		isc_entropy_stopcallbacksources(ectx);
-
 		if (ret != ISC_R_SUCCESS) {
 			char namestr[DNS_NAME_FORMATSIZE];
 			char algstr[DNS_SECALG_FORMATSIZE];
@@ -1084,7 +973,7 @@ main(int argc, char **argv) {
 		 * or another key being revoked.
 		 */
 		if (key_collision(key, name, directory, mctx, NULL)) {
-			conflict = true;
+			conflict = ISC_TRUE;
 			if (null_key) {
 				dst_key_free(&key);
 				break;
@@ -1105,7 +994,7 @@ main(int argc, char **argv) {

 			dst_key_free(&key);
 		}
-	} while (conflict == true);
+	} while (conflict == ISC_TRUE);

 	if (conflict)
 		fatal("cannot generate a null key due to possible key ID "
@@ -1130,7 +1019,6 @@ main(int argc, char **argv) {
 		dst_key_free(&prevkey);

 	cleanup_logging(&log);
-	cleanup_entropy(&ectx);
 	dst_lib_destroy();
 	dns_name_destroy();
 	if (verbose > 10)
@@ -81,7 +81,6 @@
      <arg choice="opt" rep="norepeat"><option>-p <replaceable class="parameter">protocol</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">date/offset</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S <replaceable class="parameter">key</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">strength</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">type</replaceable></option></arg>
@@ -130,16 +129,6 @@
 	    his value will automatically set the <option>-T KEY</option>
 	    option as well.
 	  </para>
-	  <para>
-	    TSIG keys can also be generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <option>-T KEY</option>. Note,
-	    however, that <command>tsig-keygen</command> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <command>dnssec-keygen</command>, and will be removed in a
-	    future release.
-	  </para>
 	  <para>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -148,10 +137,15 @@
 	    or NSEC3DSA will be used instead.
 	  </para>
 	  <para>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <option>-S</option> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
-	    generated keys was RSASHA1.
+	    This parameter <emphasis>must</emphasis> be specified except
+	    when using the <option>-S</option> option, which copies the
+	    algorithm from the predecessor key.
+	  </para>
+	  <para>
+	    In prior releases, HMAC algorithms could be generated for
+	    use as TSIG keys, but that feature has been removed as of
+	    BIND 9.13.0. Use <command>tsig-keygen</command> to generate
+	    TSIG keys.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -354,31 +348,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-r <replaceable class="parameter">randomdev</replaceable></term>
-	<listitem>
-	  <para>
-	    Specifies a source of randomness.  Normally, when generating
-	    DNSSEC keys, this option has no effect; the random number
-	    generation function provided by the cryptographic library will
-	    be used.
-	  </para>
-	  <para>
-	    If that behavior is disabled at compile time, however,
-	    the specified file will be used as entropy source
-	    for key generation.  <filename>randomdev</filename> is
-	    the name of a character device or file containing random
-	    data to be used.  The special value <filename>keyboard</filename>
-	    indicates that keyboard input should be used.
-	  </para>
-	  <para>
-	    The default is <filename>/dev/random</filename> if the
-	    operating system provides it or an equivalent device;
-	    if not, the default source of randomness is keyboard input.
-	  </para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-S <replaceable class="parameter">key</replaceable></term>
 	<listitem>
@@ -57,7 +57,6 @@
       [<code class="option">-p <em class="replaceable"><code>protocol</code></em></code>]
       [<code class="option">-q</code>]
       [<code class="option">-R <em class="replaceable"><code>date/offset</code></em></code>]
-       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S <em class="replaceable"><code>key</code></em></code>]
       [<code class="option">-s <em class="replaceable"><code>strength</code></em></code>]
       [<code class="option">-t <em class="replaceable"><code>type</code></em></code>]
@@ -107,16 +106,6 @@
 	    his value will automatically set the <code class="option">-T KEY</code>
 	    option as well.
 	  </p>
-	  <p>
-	    TSIG keys can also be generated by setting the value to
-	    one of HMAC-MD5, HMAC-SHA1, HMAC-SHA224, HMAC-SHA256,
-	    HMAC-SHA384, or HMAC-SHA512.  As with DH, specifying these
-	    values will automatically set <code class="option">-T KEY</code>. Note,
-	    however, that <span class="command"><strong>tsig-keygen</strong></span> produces TSIG keys
-	    in a more useful format. These algorithms have been deprecated
-	    in <span class="command"><strong>dnssec-keygen</strong></span>, and will be removed in a
-	    future release.
-	  </p>
 	  <p>
 	    These values are case insensitive. In some cases, abbreviations
 	    are supported, such as ECDSA256 for ECDSAP256SHA256 and
@@ -125,10 +114,15 @@
 	    or NSEC3DSA will be used instead.
 	  </p>
 	  <p>
-	    As of BIND 9.12.0, this option is mandatory except when using
-	    the <code class="option">-S</code> option, which copies the algorithm from
-	    the predecessor key.  Previously, the default for newly
-	    generated keys was RSASHA1.
+	    This parameter <span class="emphasis"><em>must</em></span> be specified except
+	    when using the <code class="option">-S</code> option, which copies the
+	    algorithm from the predecessor key.
+	  </p>
+	  <p>
+	    In prior releases, HMAC algorithms could be generated for
+	    use as TSIG keys, but that feature has been removed as of
+	    BIND 9.13.0. Use <span class="command"><strong>tsig-keygen</strong></span> to generate
+	    TSIG keys.
 	  </p>
 	</dd>
 <dt><span class="term">-b <em class="replaceable"><code>keysize</code></em></span></dt>
@@ -284,28 +278,6 @@
 	    a satisfactory key.
 	  </p>
 	</dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-	  <p>
-	    Specifies a source of randomness.  Normally, when generating
-	    DNSSEC keys, this option has no effect; the random number
-	    generation function provided by the cryptographic library will
-	    be used.
-	  </p>
-	  <p>
-	    If that behavior is disabled at compile time, however,
-	    the specified file will be used as entropy source
-	    for key generation.  <code class="filename">randomdev</code> is
-	    the name of a character device or file containing random
-	    data to be used.  The special value <code class="filename">keyboard</code>
-	    indicates that keyboard input should be used.
-	  </p>
-	  <p>
-	    The default is <code class="filename">/dev/random</code> if the
-	    operating system provides it or an equivalent device;
-	    if not, the default source of randomness is keyboard input.
-	  </p>
-	</dd>
 <dt><span class="term">-S <em class="replaceable"><code>key</code></em></span></dt>
 <dd>
 	  <p>
@@ -13,14 +13,11 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <unistd.h>

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -33,7 +30,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -52,7 +49,7 @@ usage(void) {
 	fprintf(stderr, "Usage:\n");
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "    -E engine:    specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -89,13 +86,12 @@ main(int argc, char **argv) {
 	char keystr[DST_KEY_FORMATSIZE];
 	char *endp;
 	int ch;
-	isc_entropy_t *ectx = NULL;
 	dst_key_t *key = NULL;
-	uint32_t flags;
+	isc_uint32_t flags;
 	isc_buffer_t buf;
-	bool force = false;
-	bool removefile = false;
-	bool id = false;
+	isc_boolean_t force = ISC_FALSE;
+	isc_boolean_t removefile = ISC_FALSE;
+	isc_boolean_t id = ISC_FALSE;

 	if (argc == 1)
 		usage();
@@ -104,12 +100,12 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("Out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	while ((ch = isc_commandline_parse(argc, argv, "E:fK:rRhv:V")) != -1) {
 		switch (ch) {
@@ -117,7 +113,7 @@ main(int argc, char **argv) {
 			engine = isc_commandline_argument;
 			break;
 		    case 'f':
-			force = true;
+			force = ISC_TRUE;
 			break;
 		    case 'K':
 			/*
@@ -131,10 +127,10 @@ main(int argc, char **argv) {
 			}
 			break;
 		    case 'r':
-			removefile = true;
+			removefile = ISC_TRUE;
 			break;
 		    case 'R':
-			id = true;
+			id = ISC_TRUE;
 			break;
 		    case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
@@ -182,17 +178,10 @@ main(int argc, char **argv) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init2(mctx, ectx, engine,
-			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("Could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	result = dst_key_fromnamedfile(filename, dir,
 				       DST_TYPE_PUBLIC|DST_TYPE_PRIVATE,
@@ -273,9 +262,7 @@ main(int argc, char **argv) {

 cleanup:
 	dst_key_free(&key);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	if (dir != NULL)
@@ -13,8 +13,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <unistd.h>
 #include <errno.h>
@@ -22,7 +20,6 @@

 #include <isc/buffer.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/mem.h>
@@ -36,7 +33,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -56,7 +53,7 @@ usage(void) {
 	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "General options:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "    -E engine:          specify PKCS#11 provider "
 					"(default: %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -105,7 +102,7 @@ usage(void) {
 }

 static void
-printtime(dst_key_t *key, int type, const char *tag, bool epoch,
+printtime(dst_key_t *key, int type, const char *tag, isc_boolean_t epoch,
 	  FILE *stream)
 {
 	isc_result_t result;
@@ -141,7 +138,6 @@ main(int argc, char **argv) {
 	char		keystr[DST_KEY_FORMATSIZE];
 	char		*endp, *p;
 	int		ch;
-	isc_entropy_t	*ectx = NULL;
 	const char	*predecessor = NULL;
 	dst_key_t	*prevkey = NULL;
 	dst_key_t	*key = NULL;
@@ -149,29 +145,29 @@ main(int argc, char **argv) {
 	dns_name_t	*name = NULL;
 	dns_secalg_t 	alg = 0;
 	unsigned int 	size = 0;
-	uint16_t	flags = 0;
+	isc_uint16_t	flags = 0;
 	int		prepub = -1;
 	dns_ttl_t	ttl = 0;
 	isc_stdtime_t	now;
 	isc_stdtime_t	pub = 0, act = 0, rev = 0, inact = 0, del = 0;
 	isc_stdtime_t	prevact = 0, previnact = 0, prevdel = 0;
-	bool	setpub = false, setact = false;
-	bool	setrev = false, setinact = false;
-	bool	setdel = false, setttl = false;
-	bool	unsetpub = false, unsetact = false;
-	bool	unsetrev = false, unsetinact = false;
-	bool	unsetdel = false;
-	bool	printcreate = false, printpub = false;
-	bool	printact = false,  printrev = false;
-	bool	printinact = false, printdel = false;
-	bool	force = false;
-	bool   epoch = false;
-	bool   changed = false;
+	isc_boolean_t	setpub = ISC_FALSE, setact = ISC_FALSE;
+	isc_boolean_t	setrev = ISC_FALSE, setinact = ISC_FALSE;
+	isc_boolean_t	setdel = ISC_FALSE, setttl = ISC_FALSE;
+	isc_boolean_t	unsetpub = ISC_FALSE, unsetact = ISC_FALSE;
+	isc_boolean_t	unsetrev = ISC_FALSE, unsetinact = ISC_FALSE;
+	isc_boolean_t	unsetdel = ISC_FALSE;
+	isc_boolean_t	printcreate = ISC_FALSE, printpub = ISC_FALSE;
+	isc_boolean_t	printact = ISC_FALSE,  printrev = ISC_FALSE;
+	isc_boolean_t	printinact = ISC_FALSE, printdel = ISC_FALSE;
+	isc_boolean_t	force = ISC_FALSE;
+	isc_boolean_t   epoch = ISC_FALSE;
+	isc_boolean_t   changed = ISC_FALSE;
 	isc_log_t       *log = NULL;
 	isc_stdtime_t	syncadd = 0, syncdel = 0;
-	bool	unsetsyncadd = false, setsyncadd = false;
-	bool	unsetsyncdel = false, setsyncdel = false;
-	bool	printsyncadd = false, printsyncdel = false;
+	isc_boolean_t	unsetsyncadd = ISC_FALSE, setsyncadd = ISC_FALSE;
+	isc_boolean_t	unsetsyncdel = ISC_FALSE, setsyncdel = ISC_FALSE;
+	isc_boolean_t	printsyncadd = ISC_FALSE, printsyncdel = ISC_FALSE;

 	if (argc == 1)
 		usage();
@@ -182,12 +178,12 @@ main(int argc, char **argv) {

 	setup_logging(mctx, &log);

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	isc_stdtime_get(&now);

@@ -198,51 +194,51 @@ main(int argc, char **argv) {
 			engine = isc_commandline_argument;
 			break;
 		case 'f':
-			force = true;
+			force = ISC_TRUE;
 			break;
 		case 'p':
 			p = isc_commandline_argument;
 			if (!strcasecmp(p, "all")) {
-				printcreate = true;
-				printpub = true;
-				printact = true;
-				printrev = true;
-				printinact = true;
-				printdel = true;
-				printsyncadd = true;
-				printsyncdel = true;
+				printcreate = ISC_TRUE;
+				printpub = ISC_TRUE;
+				printact = ISC_TRUE;
+				printrev = ISC_TRUE;
+				printinact = ISC_TRUE;
+				printdel = ISC_TRUE;
+				printsyncadd = ISC_TRUE;
+				printsyncdel = ISC_TRUE;
 				break;
 			}

 			do {
 				switch (*p++) {
 				case 'C':
-					printcreate = true;
+					printcreate = ISC_TRUE;
 					break;
 				case 'P':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
-						printsyncadd = true;
+						printsyncadd = ISC_TRUE;
 						break;
 					}
-					printpub = true;
+					printpub = ISC_TRUE;
 					break;
 				case 'A':
-					printact = true;
+					printact = ISC_TRUE;
 					break;
 				case 'R':
-					printrev = true;
+					printrev = ISC_TRUE;
 					break;
 				case 'I':
-					printinact = true;
+					printinact = ISC_TRUE;
 					break;
 				case 'D':
 					if (!strncmp(p, "sync", 4)) {
 						p += 4;
-						printsyncdel = true;
+						printsyncdel = ISC_TRUE;
 						break;
 					}
-					printdel = true;
+					printdel = ISC_TRUE;
 					break;
 				case ' ':
 					break;
@@ -253,7 +249,7 @@ main(int argc, char **argv) {
 			} while (*p != '\0');
 			break;
 		case 'u':
-			epoch = true;
+			epoch = ISC_TRUE;
 			break;
 		case 'K':
 			/*
@@ -269,7 +265,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
+			setttl = ISC_TRUE;
 			break;
 		case 'v':
 			verbose = strtol(isc_commandline_argument, &endp, 0);
@@ -283,7 +279,7 @@ main(int argc, char **argv) {
 					fatal("-P sync specified more than "
 					      "once");

-				changed = true;
+				changed = ISC_TRUE;
 				syncadd = strtotime(isc_commandline_argument,
 						   now, now, &setsyncadd);
 				unsetsyncadd = !setsyncadd;
@@ -293,7 +289,7 @@ main(int argc, char **argv) {
 			if (setpub || unsetpub)
 				fatal("-P specified more than once");

-			changed = true;
+			changed = ISC_TRUE;
 			pub = strtotime(isc_commandline_argument,
 					now, now, &setpub);
 			unsetpub = !setpub;
@@ -302,7 +298,7 @@ main(int argc, char **argv) {
 			if (setact || unsetact)
 				fatal("-A specified more than once");

-			changed = true;
+			changed = ISC_TRUE;
 			act = strtotime(isc_commandline_argument,
 					now, now, &setact);
 			unsetact = !setact;
@@ -311,7 +307,7 @@ main(int argc, char **argv) {
 			if (setrev || unsetrev)
 				fatal("-R specified more than once");

-			changed = true;
+			changed = ISC_TRUE;
 			rev = strtotime(isc_commandline_argument,
 					now, now, &setrev);
 			unsetrev = !setrev;
@@ -320,7 +316,7 @@ main(int argc, char **argv) {
 			if (setinact || unsetinact)
 				fatal("-I specified more than once");

-			changed = true;
+			changed = ISC_TRUE;
 			inact = strtotime(isc_commandline_argument,
 					now, now, &setinact);
 			unsetinact = !setinact;
@@ -332,7 +328,7 @@ main(int argc, char **argv) {
 					fatal("-D sync specified more than "
 					      "once");

-				changed = true;
+				changed = ISC_TRUE;
 				syncdel = strtotime(isc_commandline_argument,
 						   now, now, &setsyncdel);
 				unsetsyncdel = !setsyncdel;
@@ -343,7 +339,7 @@ main(int argc, char **argv) {
 			if (setdel || unsetdel)
 				fatal("-D specified more than once");

-			changed = true;
+			changed = ISC_TRUE;
 			del = strtotime(isc_commandline_argument,
 					now, now, &setdel);
 			unsetdel = !setdel;
@@ -380,17 +376,10 @@ main(int argc, char **argv) {
 	if (argc > isc_commandline_index + 1)
 		fatal("Extraneous arguments");

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-	result = dst_lib_init2(mctx, ectx, engine,
-			       ISC_ENTROPY_BLOCKING | ISC_ENTROPY_GOODONLY);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("Could not initialize dst: %s",
 		      isc_result_totext(result));
-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("Could not initialize hash");
-	isc_entropy_stopcallbacksources(ectx);

 	if (predecessor != NULL) {
 		int major, minor;
@@ -461,7 +450,7 @@ main(int argc, char **argv) {
 					"before it is scheduled to be "
 					"inactive.\n", program);

-		changed = setpub = setact = true;
+		changed = setpub = setact = ISC_TRUE;
 	} else {
 		if (prepub < 0)
 			prepub = 0;
@@ -473,10 +462,10 @@ main(int argc, char **argv) {
 				      "prepublication interval.");

 			if (setpub && !setact) {
-				setact = true;
+				setact = ISC_TRUE;
 				act = pub + prepub;
 			} else if (setact && !setpub) {
-				setpub = true;
+				setpub = ISC_TRUE;
 				pub = act - prepub;
 			}

@@ -607,11 +596,11 @@ main(int argc, char **argv) {
 	if (force && !changed) {
 		dst_key_settime(key, DST_TIME_PUBLISH, now);
 		dst_key_settime(key, DST_TIME_ACTIVATE, now);
-		changed = true;
+		changed = ISC_TRUE;
 	}

 	if (!changed && setttl)
-		changed = true;
+		changed = ISC_TRUE;

 	/*
 	 * Print out time values, if -p was used.
@@ -674,9 +663,7 @@ main(int argc, char **argv) {
 	if (prevkey != NULL)
 		dst_key_free(&prevkey);
 	dst_key_free(&key);
-	isc_hash_destroy();
 	dst_lib_destroy();
-	cleanup_entropy(&ectx);
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	cleanup_logging(&log);
@@ -39,7 +39,7 @@
 dnssec-signzone \- DNSSEC zone signing tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-signzone\fR\ 'u
-\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-p\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-r\ \fR\fB\fIrandomdev\fR\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
+\fBdnssec\-signzone\fR [\fB\-a\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-d\ \fR\fB\fIdirectory\fR\fR] [\fB\-D\fR] [\fB\-E\ \fR\fB\fIengine\fR\fR] [\fB\-e\ \fR\fB\fIend\-time\fR\fR] [\fB\-f\ \fR\fB\fIoutput\-file\fR\fR] [\fB\-g\fR] [\fB\-h\fR] [\fB\-i\ \fR\fB\fIinterval\fR\fR] [\fB\-I\ \fR\fB\fIinput\-format\fR\fR] [\fB\-j\ \fR\fB\fIjitter\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-k\ \fR\fB\fIkey\fR\fR] [\fB\-L\ \fR\fB\fIserial\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-M\ \fR\fB\fImaxttl\fR\fR] [\fB\-N\ \fR\fB\fIsoa\-serial\-format\fR\fR] [\fB\-o\ \fR\fB\fIorigin\fR\fR] [\fB\-O\ \fR\fB\fIoutput\-format\fR\fR] [\fB\-P\fR] [\fB\-Q\fR] [\fB\-R\fR] [\fB\-S\fR] [\fB\-s\ \fR\fB\fIstart\-time\fR\fR] [\fB\-T\ \fR\fB\fIttl\fR\fR] [\fB\-t\fR] [\fB\-u\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-V\fR] [\fB\-X\ \fR\fB\fIextended\ end\-time\fR\fR] [\fB\-x\fR] [\fB\-z\fR] [\fB\-3\ \fR\fB\fIsalt\fR\fR] [\fB\-H\ \fR\fB\fIiterations\fR\fR] [\fB\-A\fR] {zonefile} [key...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-signzone\fR
@@ -278,11 +278,6 @@ specifies the format version of the raw zone file: if N is 0, the raw file can b
 \fBnamed\fR; if N is 1, the file can be read by release 9\&.9\&.0 or higher; the default is 1\&.
 .RE
 .PP
-\-p
-.RS 4
-Use pseudo\-random data when signing the zone\&. This is faster, but less secure, than using real random data\&. This option may be useful when signing large zones or when the entropy source is limited\&.
-.RE
-.PP
 \-P
 .RS 4
 Disable post sign verification tests\&.
@@ -311,17 +306,6 @@ This option is similar to
 to signatures from keys that are no longer published\&. This enables ZSK rollover using the procedure described in RFC 4641, section 4\&.2\&.1\&.2 ("Double Signature Zone Signing Key Rollover")\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies the source of randomness\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&.
-.RE
-.PP
 \-S
 .RS 4
 Smart signing: Instructs
@@ -78,10 +78,8 @@
      <arg choice="opt" rep="norepeat"><option>-o <replaceable class="parameter">origin</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-O <replaceable class="parameter">output-format</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-P</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-p</option></arg>
      <arg choice="opt" rep="norepeat"><option>-Q</option></arg>
      <arg choice="opt" rep="norepeat"><option>-R</option></arg>
-      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-S</option></arg>
      <arg choice="opt" rep="norepeat"><option>-s <replaceable class="parameter">start-time</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">ttl</replaceable></option></arg>
@@ -508,18 +506,6 @@
        </listitem>
      </varlistentry>

-      <varlistentry>
-        <term>-p</term>
-        <listitem>
-          <para>
-            Use pseudo-random data when signing the zone.  This is faster,
-            but less secure, than using real random data.  This option
-            may be useful when signing large zones or when the entropy
-            source is limited.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-P</term>
        <listitem>
@@ -571,23 +557,6 @@
          </para>
        </listitem>
      </varlistentry>
-      <varlistentry>
-        <term>-r <replaceable class="parameter">randomdev</replaceable></term>
-        <listitem>
-          <para>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <filename>/dev/random</filename>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <filename>randomdev</filename>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <filename>keyboard</filename> indicates that keyboard
-            input should be used.
-          </para>
-        </listitem>
-      </varlistentry>
-
      <varlistentry>
        <term>-S</term>
        <listitem>
@@ -54,10 +54,8 @@
       [<code class="option">-o <em class="replaceable"><code>origin</code></em></code>]
       [<code class="option">-O <em class="replaceable"><code>output-format</code></em></code>]
       [<code class="option">-P</code>]
-       [<code class="option">-p</code>]
       [<code class="option">-Q</code>]
       [<code class="option">-R</code>]
-       [<code class="option">-r <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-S</code>]
       [<code class="option">-s <em class="replaceable"><code>start-time</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>ttl</code></em></code>]
@@ -400,15 +398,6 @@
            can be read by release 9.9.0 or higher; the default is 1.
          </p>
        </dd>
-<dt><span class="term">-p</span></dt>
-<dd>
-          <p>
-            Use pseudo-random data when signing the zone.  This is faster,
-            but less secure, than using real random data.  This option
-            may be useful when signing large zones or when the entropy
-            source is limited.
-          </p>
-        </dd>
 <dt><span class="term">-P</span></dt>
 <dd>
          <p>
@@ -453,20 +442,6 @@
            ("Double Signature Zone Signing Key Rollover").
          </p>
        </dd>
-<dt><span class="term">-r <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-          <p>
-            Specifies the source of randomness.  If the operating
-            system does not provide a <code class="filename">/dev/random</code>
-            or equivalent device, the default source of randomness
-            is keyboard input.  <code class="filename">randomdev</code>
-            specifies
-            the name of a character device or file containing random
-            data to be used instead of the default.  The special value
-            <code class="filename">keyboard</code> indicates that keyboard
-            input should be used.
-          </p>
-        </dd>
 <dt><span class="term">-S</span></dt>
 <dd>
          <p>
@@ -13,14 +13,12 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdlib.h>
 #include <time.h>

 #include <isc/app.h>
 #include <isc/base32.h>
 #include <isc/commandline.h>
-#include <isc/entropy.h>
 #include <isc/event.h>
 #include <isc/file.h>
 #include <isc/hash.h>
@@ -63,7 +61,7 @@

 #include <dst/dst.h>

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -74,14 +72,13 @@ int verbose;

 static isc_stdtime_t now;
 static isc_mem_t *mctx = NULL;
-static isc_entropy_t *ectx = NULL;
 static dns_masterformat_t inputformat = dns_masterformat_text;
 static dns_db_t *gdb;			/* The database */
 static dns_dbversion_t *gversion;	/* The database version */
 static dns_rdataclass_t gclass;		/* The class */
 static dns_name_t *gorigin;		/* The database origin */
-static bool ignore_kskflag = false;
-static bool keyset_kskonly = false;
+static isc_boolean_t ignore_kskflag = ISC_FALSE;
+static isc_boolean_t keyset_kskonly = ISC_FALSE;

 /*%
 * Load the zone file from disk
@@ -108,7 +105,7 @@ loadzone(char *file, char *origin, dns_rdataclass_t rdclass, dns_db_t **db) {
 			       rdclass, 0, NULL, db);
 	check_result(result, "dns_db_create()");

-	result = dns_db_load2(*db, file, inputformat);
+	result = dns_db_load(*db, file, inputformat, 0);
 	switch (result) {
 	case DNS_R_SEENINCLUDE:
 	case ISC_R_SUCCESS:
@@ -152,7 +149,7 @@ usage(void) {
 	fprintf(stderr, "\t\tfile format of input zonefile (text)\n");
 	fprintf(stderr, "\t-c class (IN)\n");
 	fprintf(stderr, "\t-E engine:\n");
-#if defined(PKCS11CRYPTO)
+#if HAVE_PKCS11
 	fprintf(stderr, "\t\tpath to PKCS#11 provider library "
 		"(default is %s)\n", PK11_LIB_LOCATION);
 #elif defined(USE_PKCS11)
@@ -207,19 +204,19 @@ main(int argc, char *argv[]) {
 			break;
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;
 	check_result(isc_app_start(), "isc_app_start");

 	result = isc_mem_create(0, 0, &mctx);
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");

-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();

-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;

 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (ch) {
@@ -250,11 +247,11 @@ main(int argc, char *argv[]) {
 			break;

 		case 'x':
-			keyset_kskonly = true;
+			keyset_kskonly = ISC_TRUE;
 			break;

 		case 'z':
-			ignore_kskflag = true;
+			ignore_kskflag = ISC_TRUE;
 			break;

 		case '?':
@@ -278,18 +275,11 @@ main(int argc, char *argv[]) {
 		}
 	}

-	if (ectx == NULL)
-		setup_entropy(mctx, NULL, &ectx);
-
-	result = dst_lib_init2(mctx, ectx, engine, ISC_ENTROPY_BLOCKING);
+	result = dst_lib_init(mctx, engine);
 	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));

-	result = isc_hash_create(mctx, ectx, DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS)
-		fatal("could not create hash context");
-
 	isc_stdtime_get(&now);

 	rdclass = strtoclass(classname);
@@ -335,13 +325,11 @@ main(int argc, char *argv[]) {
 	verifyzone(gdb, gversion, gorigin, mctx,
 		   ignore_kskflag, keyset_kskonly);

-	dns_db_closeversion(gdb, &gversion, false);
+	dns_db_closeversion(gdb, &gversion, ISC_FALSE);
 	dns_db_detach(&gdb);

 	cleanup_logging(&log);
 	dst_lib_destroy();
-	isc_hash_destroy();
-	cleanup_entropy(&ectx);
 	dns_name_destroy();
 	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
@@ -17,8 +17,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>

 #ifdef _WIN32
@@ -29,7 +27,6 @@
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/heap.h>
 #include <isc/list.h>
@@ -63,10 +60,10 @@
 static isc_heap_t *expected_chains, *found_chains;

 struct nsec3_chain_fixed {
-	uint8_t	hash;
-	uint8_t	salt_length;
-	uint8_t	next_length;
-	uint16_t	iterations;
+	isc_uint8_t	hash;
+	isc_uint8_t	salt_length;
+	isc_uint8_t	next_length;
+	isc_uint16_t	iterations;
 	/* unsigned char salt[0]; */
 	/* unsigned char owner[0]; */
 	/* unsigned char next[0]; */
@@ -75,15 +72,6 @@ struct nsec3_chain_fixed {
 extern int verbose;
 extern const char *program;

-typedef struct entropysource entropysource_t;
-
-struct entropysource {
-	isc_entropysource_t *source;
-	isc_mem_t *mctx;
-	ISC_LINK(entropysource_t) link;
-};
-
-static ISC_LIST(entropysource_t) sources;
 static fatalcallback_t *fatalcallback = NULL;

 void
@@ -224,63 +212,6 @@ cleanup_logging(isc_log_t **logp) {
 	dns_log_setcontext(NULL);
 }

-void
-setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx) {
-	isc_result_t result;
-	isc_entropysource_t *source = NULL;
-	entropysource_t *elt;
-	int usekeyboard = ISC_ENTROPY_KEYBOARDMAYBE;
-
-	REQUIRE(ectx != NULL);
-
-	if (*ectx == NULL) {
-		result = isc_entropy_create(mctx, ectx);
-		if (result != ISC_R_SUCCESS)
-			fatal("could not create entropy object: %s",
-			      isc_result_totext(result));
-		ISC_LIST_INIT(sources);
-	}
-
-#ifdef ISC_PLATFORM_CRYPTORANDOM
-	if (randomfile == NULL) {
-		isc_entropy_usehook(*ectx, true);
-	}
-#endif
-	if (randomfile != NULL && strcmp(randomfile, "keyboard") == 0) {
-		usekeyboard = ISC_ENTROPY_KEYBOARDYES;
-		randomfile = NULL;
-	}
-
-	result = isc_entropy_usebestsource(*ectx, &source, randomfile,
-					   usekeyboard);
-
-	if (result != ISC_R_SUCCESS)
-		fatal("could not initialize entropy source: %s",
-		      isc_result_totext(result));
-
-	if (source != NULL) {
-		elt = isc_mem_get(mctx, sizeof(*elt));
-		if (elt == NULL)
-			fatal("out of memory");
-		elt->source = source;
-		elt->mctx = mctx;
-		ISC_LINK_INIT(elt, link);
-		ISC_LIST_APPEND(sources, elt, link);
-	}
-}
-
-void
-cleanup_entropy(isc_entropy_t **ectx) {
-	entropysource_t *source;
-	while (!ISC_LIST_EMPTY(sources)) {
-		source = ISC_LIST_HEAD(sources);
-		ISC_LIST_UNLINK(sources, source, link);
-		isc_entropy_destroysource(&source->source);
-		isc_mem_put(source->mctx, source, sizeof(*source));
-	}
-	isc_entropy_detach(ectx);
-}
-
 static isc_stdtime_t
 time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	switch (suffix[0]) {
@@ -315,10 +246,10 @@ time_units(isc_stdtime_t offset, char *suffix, const char *str) {
 	return(0); /* silence compiler warning */
 }

-static inline bool
+static inline isc_boolean_t
 isnone(const char *str) {
-	return ((strcasecmp(str, "none") == 0) ||
-		(strcasecmp(str, "never") == 0));
+	return (ISC_TF((strcasecmp(str, "none") == 0) ||
+		       (strcasecmp(str, "never") == 0)));
 }

 dns_ttl_t
@@ -338,10 +269,10 @@ strtottl(const char *str) {
 }

 isc_stdtime_t
-strtotime(const char *str, int64_t now, int64_t base,
-	  bool *setp)
+strtotime(const char *str, isc_int64_t now, isc_int64_t base,
+	  isc_boolean_t *setp)
 {
-	int64_t val, offset;
+	isc_int64_t val, offset;
 	isc_result_t result;
 	const char *orig = str;
 	char *endp;
@@ -349,12 +280,12 @@ strtotime(const char *str, int64_t now, int64_t base,

 	if (isnone(str)) {
 		if (setp != NULL)
-			*setp = false;
+			*setp = ISC_FALSE;
 		return ((isc_stdtime_t) 0);
 	}

 	if (setp != NULL)
-		*setp = true;
+		*setp = ISC_TRUE;

 	if ((str[0] == '0' || str[0] == '-') && str[1] == '\0')
 		return ((isc_stdtime_t) 0);
@@ -495,53 +426,47 @@ set_keyversion(dst_key_t *key) {
 	}
 }

-bool
+isc_boolean_t
 key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact)
+	      isc_mem_t *mctx, isc_boolean_t *exact)
 {
 	isc_result_t result;
-	bool conflict = false;
+	isc_boolean_t conflict = ISC_FALSE;
 	dns_dnsseckeylist_t matchkeys;
 	dns_dnsseckey_t *key = NULL;
-	uint16_t id, oldid;
-	uint32_t rid, roldid;
+	isc_uint16_t id, oldid;
+	isc_uint32_t rid, roldid;
 	dns_secalg_t alg;
 	char filename[ISC_DIR_NAMEMAX];
 	isc_buffer_t fileb;
+	isc_stdtime_t now;

 	if (exact != NULL)
-		*exact = false;
+		*exact = ISC_FALSE;

 	id = dst_key_id(dstkey);
 	rid = dst_key_rid(dstkey);
 	alg = dst_key_alg(dstkey);

 	/*
-	 * For HMAC and Diffie Hellman just check if there is a
-	 * direct collision as they can't be revoked.  Additionally
-	 * dns_dnssec_findmatchingkeys only handles DNSKEY which is
-	 * not used for HMAC.
+	 * For Diffie Hellman just check if there is a direct collision as
+	 * they can't be revoked.  Additionally dns_dnssec_findmatchingkeys
+	 * only handles DNSKEY which is not used for HMAC.
 	 */
-	switch (alg) {
-	case DST_ALG_HMACMD5:
-	case DST_ALG_HMACSHA1:
-	case DST_ALG_HMACSHA224:
-	case DST_ALG_HMACSHA256:
-	case DST_ALG_HMACSHA384:
-	case DST_ALG_HMACSHA512:
-	case DST_ALG_DH:
+	if (alg == DST_ALG_DH) {
 		isc_buffer_init(&fileb, filename, sizeof(filename));
 		result = dst_key_buildfilename(dstkey, DST_TYPE_PRIVATE,
 					       dir, &fileb);
 		if (result != ISC_R_SUCCESS)
-			return (true);
+			return (ISC_TRUE);
 		return (isc_file_exists(filename));
 	}

 	ISC_LIST_INIT(matchkeys);
-	result = dns_dnssec_findmatchingkeys(name, dir, mctx, &matchkeys);
+	isc_stdtime_get(&now);
+	result = dns_dnssec_findmatchingkeys(name, dir, now, mctx, &matchkeys);
 	if (result == ISC_R_NOTFOUND)
-		return (false);
+		return (ISC_FALSE);

 	while (!ISC_LIST_EMPTY(matchkeys) && !conflict) {
 		key = ISC_LIST_HEAD(matchkeys);
@@ -552,7 +477,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 		roldid = dst_key_rid(key->key);

 		if (oldid == rid || roldid == id || id == oldid) {
-			conflict = true;
+			conflict = ISC_TRUE;
 			if (id != oldid) {
 				if (verbose > 1)
 					fprintf(stderr, "Key ID %d could "
@@ -560,7 +485,7 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 						id, oldid);
 			} else {
 				if (exact != NULL)
-					*exact = true;
+					*exact = ISC_TRUE;
 				if (verbose > 1)
 					fprintf(stderr, "Key ID %d exists\n",
 						id);
@@ -582,15 +507,15 @@ key_collision(dst_key_t *dstkey, dns_name_t *name, const char *dir,
 	return (conflict);
 }

-bool
+isc_boolean_t
 is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
-	      dns_name_t *name, dns_dbnode_t *node, uint32_t *ttlp)
+	      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp)
 {
 	dns_rdataset_t nsset;
 	isc_result_t result;

 	if (dns_name_equal(name, origin))
-		return (false);
+		return (ISC_FALSE);

 	dns_rdataset_init(&nsset);
 	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_ns,
@@ -601,25 +526,10 @@ is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		dns_rdataset_disassociate(&nsset);
 	}

-	return (result == ISC_R_SUCCESS);
+	return (ISC_TF(result == ISC_R_SUCCESS));
 }

-bool
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
-	dns_rdataset_t dnameset;
-	isc_result_t result;
-
-	dns_rdataset_init(&dnameset);
-	result = dns_db_findrdataset(db, node, ver, dns_rdatatype_dname, 0, 0,
-				     &dnameset, NULL);
-	if (dns_rdataset_isassociated(&dnameset)) {
-		dns_rdataset_disassociate(&dnameset);
-	}
-
-	return (result == ISC_R_SUCCESS);
-}
-
-static bool
+static isc_boolean_t
 goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name,
 	dns_rdataset_t *keyrdataset, dns_rdataset_t *rdataset, isc_mem_t *mctx)
 {
@@ -641,35 +551,21 @@ goodsig(dns_name_t *origin, dns_rdata_t *sigrdata, dns_name_t *name,
 		result = dns_dnssec_keyfromrdata(origin, &rdata, mctx,
 						 &dstkey);
 		if (result != ISC_R_SUCCESS)
-			return (false);
+			return (ISC_FALSE);
 		if (sig.algorithm != key.algorithm ||
 		    sig.keyid != dst_key_id(dstkey) ||
 		    !dns_name_equal(&sig.signer, origin)) {
 			dst_key_free(&dstkey);
 			continue;
 		}
-		result = dns_dnssec_verify(name, rdataset, dstkey, false,
-					   mctx, sigrdata);
+		result = dns_dnssec_verify(name, rdataset, dstkey, ISC_FALSE,
+					   0, mctx, sigrdata, NULL);
 		dst_key_free(&dstkey);
-		if (result == ISC_R_SUCCESS)
-			return(true);
+		if (result == ISC_R_SUCCESS || result == DNS_R_FROMWILDCARD) {
+			return(ISC_TRUE);
+		}
 	}
-	return (false);
-}
-
-static bool
-nsec_bitmap_equal(dns_rdata_nsec_t *nsec, dns_rdata_t *rdata) {
-	isc_result_t result;
-	dns_rdata_nsec_t tmpnsec;
-
-	result = dns_rdata_tostruct(rdata, &tmpnsec, NULL);
-	RUNTIME_CHECK(result == ISC_R_SUCCESS);
-
-	if (nsec->len != tmpnsec.len ||
-	    memcmp(nsec->typebits, tmpnsec.typebits, nsec->len) != 0) {
-		return (false);
-	}
-	return (true);
+	return (ISC_FALSE);
 }

 static isc_result_t
@@ -715,7 +611,7 @@ verifynsec(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *name,
 	result = dns_nsec_buildrdata(db, ver, node, nextname, buffer,
 				     &tmprdata);
 	check_result(result, "dns_nsec_buildrdata()");
-	if (!nsec_bitmap_equal(&nsec, &tmprdata)) {
+	if (dns_rdata_compare(&rdata, &tmprdata) != 0) {
 		dns_name_format(name, namebuf, sizeof(namebuf));
 		fprintf(stderr, "Bad NSEC record for %s, bit map "
 				"mismatch\n", namebuf);
@@ -769,7 +665,7 @@ check_no_rrsig(dns_db_t *db, dns_dbversion_t *ver, dns_rdataset_t *rdataset,
 	dns_rdatasetiter_destroy(&rdsiter);
 }

-static bool
+static isc_boolean_t
 chain_compare(void *arg1, void *arg2) {
 	struct nsec3_chain_fixed *e1 = arg1, *e2 = arg2;
 	size_t len;
@@ -778,43 +674,43 @@ chain_compare(void *arg1, void *arg2) {
 	 * Do each element in turn to get a stable sort.
 	 */
 	if (e1->hash < e2->hash)
-		return (true);
+		return (ISC_TRUE);
 	if (e1->hash > e2->hash)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->iterations < e2->iterations)
-		return (true);
+		return (ISC_TRUE);
 	if (e1->iterations > e2->iterations)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->salt_length < e2->salt_length)
-		return (true);
+		return (ISC_TRUE);
 	if (e1->salt_length > e2->salt_length)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->next_length < e2->next_length)
-		return (true);
+		return (ISC_TRUE);
 	if (e1->next_length > e2->next_length)
-		return (false);
+		return (ISC_FALSE);
 	len = e1->salt_length + 2 * e1->next_length;
 	if (memcmp(e1 + 1, e2 + 1, len) < 0)
-		return (true);
-	return (false);
+		return (ISC_TRUE);
+	return (ISC_FALSE);
 }

-static bool
+static isc_boolean_t
 chain_equal(struct nsec3_chain_fixed *e1, struct nsec3_chain_fixed *e2) {
 	size_t len;

 	if (e1->hash != e2->hash)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->iterations != e2->iterations)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->salt_length != e2->salt_length)
-		return (false);
+		return (ISC_FALSE);
 	if (e1->next_length != e2->next_length)
-		return (false);
+		return (ISC_FALSE);
 	len = e1->salt_length + 2 * e1->next_length;
 	if (memcmp(e1 + 1, e2 + 1, len) != 0)
-		return (false);
-	return (true);
+		return (ISC_FALSE);
+	return (ISC_TRUE);
 }

 static isc_result_t
@@ -934,7 +830,7 @@ match_nsec3(dns_name_t *name, isc_mem_t *mctx,
 	return (result);
 }

-static bool
+static isc_boolean_t
 innsec3params(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) {
 	dns_rdata_nsec3param_t nsec3param;
 	isc_result_t result;
@@ -953,9 +849,9 @@ innsec3params(dns_rdata_nsec3_t *nsec3, dns_rdataset_t *nsec3paramset) {
 		    nsec3param.salt_length == nsec3->salt_length &&
 		    memcmp(nsec3param.salt, nsec3->salt,
 			   nsec3->salt_length) == 0)
-			return (true);
+			return (ISC_TRUE);
 	}
-	return (false);
+	return (ISC_FALSE);
 }

 static isc_result_t
@@ -1014,7 +910,7 @@ record_found(dns_db_t *db, dns_dbversion_t *ver, isc_mem_t *mctx,
 	return (ISC_R_SUCCESS);
 }

-static bool
+static isc_boolean_t
 isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	 dns_rdata_t *nsec3rdata)
 {
@@ -1028,7 +924,7 @@ isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	dns_dbnode_t *node = NULL;
 	unsigned char rawhash[NSEC3_MAX_HASH_LENGTH];
 	size_t rhsize = sizeof(rawhash);
-	bool ret;
+	isc_boolean_t ret;

 	result = dns_rdata_tostruct(nsec3rdata, &nsec3param, NULL);
 	check_result(result, "dns_rdata_tostruct()");
@@ -1041,12 +937,12 @@ isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,

 	dns_rdataset_init(&rdataset);
 	hashname = dns_fixedname_name(&fixed);
-	result = dns_db_findnsec3node(db, hashname, false, &node);
+	result = dns_db_findnsec3node(db, hashname, ISC_FALSE, &node);
 	if (result == ISC_R_SUCCESS)
 		result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3,
 					     0, 0, &rdataset, NULL);
 	if (result != ISC_R_SUCCESS)
-		return (false);
+		return (ISC_FALSE);

 	result = dns_rdataset_first(&rdataset);
 	check_result(result, "dns_rdataset_first()");
@@ -1055,9 +951,9 @@ isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,

 	result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
 	if (result != ISC_R_SUCCESS)
-		ret = false;
+		ret = ISC_FALSE;
 	else
-		ret = (nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
+		ret = ISC_TF((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);

 	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
@@ -1070,7 +966,7 @@ isoptout(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 static isc_result_t
 verifynsec3(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	    isc_mem_t *mctx, dns_name_t *name, dns_rdata_t *rdata,
-	    bool delegation, bool empty,
+	    isc_boolean_t delegation, isc_boolean_t empty,
 	    unsigned char types[8192], unsigned int maxtype)
 {
 	char namebuf[DNS_NAME_FORMATSIZE];
@@ -1083,7 +979,7 @@ verifynsec3(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	dns_dbnode_t *node = NULL;
 	unsigned char rawhash[NSEC3_MAX_HASH_LENGTH];
 	size_t rhsize = sizeof(rawhash);
-	bool optout;
+	isc_boolean_t optout;

 	result = dns_rdata_tostruct(rdata, &nsec3param, NULL);
 	check_result(result, "dns_rdata_tostruct()");
@@ -1110,7 +1006,7 @@ verifynsec3(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	 */
 	dns_rdataset_init(&rdataset);
 	hashname = dns_fixedname_name(&fixed);
-	result = dns_db_findnsec3node(db, hashname, false, &node);
+	result = dns_db_findnsec3node(db, hashname, ISC_FALSE, &node);
 	if (result == ISC_R_SUCCESS)
 		result = dns_db_findrdataset(db, node, ver, dns_rdatatype_nsec3,
 					     0, 0, &rdataset, NULL);
@@ -1142,7 +1038,7 @@ verifynsec3(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 static isc_result_t
 verifynsec3s(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	     isc_mem_t *mctx, dns_name_t *name, dns_rdataset_t *nsec3paramset,
-	     bool delegation, bool empty,
+	     isc_boolean_t delegation, isc_boolean_t empty,
 	     unsigned char types[8192], unsigned int maxtype)
 {
 	isc_result_t result;
@@ -1243,7 +1139,7 @@ verifyset(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 static isc_result_t
 verifynode(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	   isc_mem_t *mctx, dns_name_t *name, dns_dbnode_t *node,
-	   bool delegation, dns_rdataset_t *keyrdataset,
+	   isc_boolean_t delegation, dns_rdataset_t *keyrdataset,
 	   unsigned char *act_algorithms, unsigned char *bad_algorithms,
 	   dns_rdataset_t *nsecset, dns_rdataset_t *nsec3paramset,
 	   dns_name_t *nextname)
@@ -1299,7 +1195,7 @@ verifynode(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,

 	if (nsec3paramset != NULL && dns_rdataset_isassociated(nsec3paramset)) {
 		tresult = verifynsec3s(db, ver, origin, mctx, name,
-				       nsec3paramset, delegation, false,
+				       nsec3paramset, delegation, ISC_FALSE,
 				       types, maxtype);
 		if (result == ISC_R_SUCCESS && tresult != ISC_R_SUCCESS)
 			result = tresult;
@@ -1307,7 +1203,7 @@ verifynode(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 	return (result);
 }

-static bool
+static isc_boolean_t
 is_empty(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 	dns_rdatasetiter_t *rdsiter = NULL;
 	isc_result_t result;
@@ -1317,8 +1213,8 @@ is_empty(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node) {
 	result = dns_rdatasetiter_first(rdsiter);
 	dns_rdatasetiter_destroy(&rdsiter);
 	if (result == ISC_R_NOMORE)
-		return (true);
-	return (false);
+		return (ISC_TRUE);
+	return (ISC_FALSE);
 }

 static void
@@ -1341,7 +1237,7 @@ check_no_nsec(dns_name_t *name, dns_dbnode_t *node, dns_db_t *db,
 		dns_rdataset_disassociate(&rdataset);
 }

-static bool
+static isc_boolean_t
 newchain(const struct nsec3_chain_fixed *first,
 	 const struct nsec3_chain_fixed *e)
 {
@@ -1350,8 +1246,8 @@ newchain(const struct nsec3_chain_fixed *first,
 	    first->salt_length != e->salt_length ||
 	    first->next_length != e->next_length ||
 	    memcmp(first + 1, e + 1, first->salt_length) != 0)
-		return (true);
-	return (false);
+		return (ISC_TRUE);
+	return (ISC_FALSE);
 }

 static void
@@ -1362,7 +1258,7 @@ free_element(isc_mem_t *mctx, struct nsec3_chain_fixed *e) {
 	isc_mem_put(mctx, e, len);
 }

-static bool
+static isc_boolean_t
 checknext(const struct nsec3_chain_fixed *first,
 	  const struct nsec3_chain_fixed *e)
 {
@@ -1376,7 +1272,7 @@ checknext(const struct nsec3_chain_fixed *first,
 	d2 += e->salt_length;

 	if (memcmp(d1, d2, first->next_length) == 0)
-		return (true);
+		return (ISC_TRUE);

 	DE_CONST(d1 - first->next_length, sr.base);
 	sr.length = first->next_length;
@@ -1398,7 +1294,7 @@ checknext(const struct nsec3_chain_fixed *first,
 	isc_base32hex_totext(&sr, 1, "", &b);
 	fprintf(stderr, "Found: %.*s\n", (int) isc_buffer_usedlength(&b), buf);

-	return (false);
+	return (ISC_FALSE);
 }

 #define EXPECTEDANDFOUND "Expected and found NSEC3 chains not equal\n"
@@ -1490,7 +1386,7 @@ verify_nsec3_chains(isc_mem_t *mctx) {
 static isc_result_t
 verifyemptynodes(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 		 isc_mem_t *mctx, dns_name_t *name, dns_name_t *prevname,
-		 bool isdelegation, dns_rdataset_t *nsec3paramset)
+		 isc_boolean_t isdelegation, dns_rdataset_t *nsec3paramset)
 {
 	dns_namereln_t reln;
 	int order;
@@ -1514,7 +1410,7 @@ verifyemptynodes(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 			     dns_rdataset_isassociated(nsec3paramset)) {
 				tresult = verifynsec3s(db, ver, origin, mctx,
 						       &suffix, nsec3paramset,
-						       isdelegation, true,
+						       isdelegation, ISC_TRUE,
 						       NULL, 0);
 				if (result == ISC_R_SUCCESS &&
 				    tresult != ISC_R_SUCCESS)
@@ -1540,7 +1436,7 @@ verifyemptynodes(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
 void
 verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 	   dns_name_t *origin, isc_mem_t *mctx,
-	   bool ignore_kskflag, bool keyset_kskonly)
+	   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly)
 {
 	char algbuf[80];
 	dns_dbiterator_t *dbiter = NULL;
@@ -1554,10 +1450,10 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 	dns_rdataset_t nsecset, nsecsigs;
 	dns_rdataset_t nsec3paramset, nsec3paramsigs;
 	int i;
-	bool done = false;
-	bool first = true;
-	bool goodksk = false;
-	bool goodzsk = false;
+	isc_boolean_t done = ISC_FALSE;
+	isc_boolean_t first = ISC_TRUE;
+	isc_boolean_t goodksk = ISC_FALSE;
+	isc_boolean_t goodzsk = ISC_FALSE;
 	isc_result_t result, vresult = ISC_R_UNSET;
 	unsigned char revoked_ksk[256];
 	unsigned char revoked_zsk[256];
@@ -1575,7 +1471,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 				 &found_chains);
 	check_result(result, "isc_heap_create()");

-	result = dns_db_findnode(db, origin, false, &node);
+	result = dns_db_findnode(db, origin, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		fatal("failed to find the zone's origin: %s",
 		      isc_result_totext(result));
@@ -1654,7 +1550,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		else if ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0) {
 			if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0 &&
 			    !dns_dnssec_selfsigns(&rdata, origin, &keyset,
-						  &keysigs, false,
+						  &keysigs, ISC_FALSE,
 						  mctx)) {
 				char namebuf[DNS_NAME_FORMATSIZE];
 				char buffer[1024];
@@ -1677,21 +1573,21 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 				revoked_zsk[dnskey.algorithm]++;
 		} else if ((dnskey.flags & DNS_KEYFLAG_KSK) != 0) {
 			if (dns_dnssec_selfsigns(&rdata, origin, &keyset,
-						 &keysigs, false, mctx)) {
+						 &keysigs, ISC_FALSE, mctx)) {
 				if (ksk_algorithms[dnskey.algorithm] != 255)
 					ksk_algorithms[dnskey.algorithm]++;
-				goodksk = true;
+				goodksk = ISC_TRUE;
 			} else {
 				if (standby_ksk[dnskey.algorithm] != 255)
 					standby_ksk[dnskey.algorithm]++;
 			}
 		} else if (dns_dnssec_selfsigns(&rdata, origin, &keyset,
-						&keysigs, false, mctx)) {
+						&keysigs, ISC_FALSE, mctx)) {
 			if (zsk_algorithms[dnskey.algorithm] != 255)
 				zsk_algorithms[dnskey.algorithm]++;
-			goodzsk = true;
+			goodzsk = ISC_TRUE;
 		} else if (dns_dnssec_signs(&rdata, origin, &soaset,
-					    &soasigs, false, mctx)) {
+					    &soasigs, ISC_FALSE, mctx)) {
 			if (zsk_algorithms[dnskey.algorithm] != 255)
 				zsk_algorithms[dnskey.algorithm]++;
 		} else {
@@ -1768,7 +1664,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 	check_result(result, "dns_dbiterator_first()");

 	while (!done) {
-		bool isdelegation = false;
+		isc_boolean_t isdelegation = ISC_FALSE;

 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
@@ -1777,7 +1673,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 			dns_db_detachnode(db, &node);
 			result = dns_dbiterator_next(dbiter);
 			if (result == ISC_R_NOMORE)
-				done = true;
+				done = ISC_TRUE;
 			else
 				check_result(result, "dns_dbiterator_next()");
 			continue;
@@ -1785,10 +1681,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		if (is_delegation(db, ver, origin, name, node, NULL)) {
 			zonecut = dns_fixedname_name(&fzonecut);
 			dns_name_copy(name, zonecut, NULL);
-			isdelegation = true;
-		} else if (has_dname(db, ver, node)) {
-			zonecut = dns_fixedname_name(&fzonecut);
-			dns_name_copy(name, zonecut, NULL);
+			isdelegation = ISC_TRUE;
 		}
 		nextnode = NULL;
 		result = dns_dbiterator_next(dbiter);
@@ -1814,7 +1707,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 			break;
 		}
 		if (result == ISC_R_NOMORE) {
-			done = true;
+			done = ISC_TRUE;
 			nextname = origin;
 		} else if (result != ISC_R_SUCCESS)
 			fatal("iterating through the database failed: %s",
@@ -1850,7 +1743,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		result = dns_dbiterator_current(dbiter, &node, name);
 		check_dns_dbiterator_current(result);
 		result = verifynode(db, ver, origin, mctx, name, node,
-				    false, &keyset, act_algorithms,
+				    ISC_FALSE, &keyset, act_algorithms,
 				    bad_algorithms, NULL, NULL, NULL);
 		check_result(result, "verifynode");
 		record_found(db, ver, mctx, name, node, &nsec3paramset);
@@ -1883,7 +1776,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 					"for the following algorithms:");
 			dns_secalg_format(i, algbuf, sizeof(algbuf));
 			fprintf(stderr, " %s", algbuf);
-			first = false;
+			first = ISC_FALSE;
 		}
 	}
 	if (!first) {
@@ -1924,7 +1817,7 @@ verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 	}
 }

-bool
+isc_boolean_t
 isoptarg(const char *arg, char **argv, void(*usage)(void)) {
 	if (!strcasecmp(isc_commandline_argument, arg)) {
 		if (argv[isc_commandline_index] == NULL) {
@@ -1936,9 +1829,9 @@ isoptarg(const char *arg, char **argv, void(*usage)(void)) {
 		isc_commandline_argument = argv[isc_commandline_index];
 		/* skip to next arguement */
 		isc_commandline_index++;
-		return (true);
+		return (ISC_TRUE);
 	}
-	return (false);
+	return (ISC_FALSE);
 }

 #ifdef _WIN32
@@ -13,9 +13,6 @@
 #ifndef DNSSECTOOL_H
 #define DNSSECTOOL_H 1

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/log.h>
 #include <isc/stdtime.h>
 #include <dns/rdatastruct.h>
@@ -58,17 +55,11 @@ setup_logging(isc_mem_t *mctx, isc_log_t **logp);
 void
 cleanup_logging(isc_log_t **logp);

-void
-setup_entropy(isc_mem_t *mctx, const char *randomfile, isc_entropy_t **ectx);
-
-void
-cleanup_entropy(isc_entropy_t **ectx);
-
 dns_ttl_t strtottl(const char *str);

 isc_stdtime_t
-strtotime(const char *str, int64_t now, int64_t base,
-	  bool *setp);
+strtotime(const char *str, isc_int64_t now, isc_int64_t base,
+	  isc_boolean_t *setp);

 unsigned int
 strtodsdigest(const char *str);
@@ -85,27 +76,20 @@ check_keyversion(dst_key_t *key, char *keystr);
 void
 set_keyversion(dst_key_t *key);

-bool
+isc_boolean_t
 key_collision(dst_key_t *key, dns_name_t *name, const char *dir,
-	      isc_mem_t *mctx, bool *exact);
+	      isc_mem_t *mctx, isc_boolean_t *exact);

-bool
+isc_boolean_t
 is_delegation(dns_db_t *db, dns_dbversion_t *ver, dns_name_t *origin,
-		      dns_name_t *name, dns_dbnode_t *node, uint32_t *ttlp);
-
-/*%
- * Return true if version 'ver' of database 'db' contains a DNAME RRset at
- * 'node'; return false otherwise.
- */
-bool
-has_dname(dns_db_t *db, dns_dbversion_t *ver, dns_dbnode_t *node);
+		      dns_name_t *name, dns_dbnode_t *node, isc_uint32_t *ttlp);

 void
 verifyzone(dns_db_t *db, dns_dbversion_t *ver,
 		   dns_name_t *origin, isc_mem_t *mctx,
-		   bool ignore_kskflag, bool keyset_kskonly);
+		   isc_boolean_t ignore_kskflag, isc_boolean_t keyset_kskonly);

-bool
+isc_boolean_t
 isoptarg(const char *arg, char **argv, void (*usage)(void));

 #ifdef _WIN32
@@ -48,7 +48,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/unix/include -I. \
 		${ISC_INCLUDES} ${DLZDRIVER_INCLUDES} \
 		${DBDRIVER_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@ @CRYPTO@
+CDEFINES =      @CONTRIB_DLZ@ @USE_PKCS11@ @PKCS11_ENGINE@

 CWARNINGS =

@@ -13,7 +13,6 @@

 #include <config.h>

-#include <inttypes.h>
 #include <stdlib.h>

 #include <isc/buffer.h>
@@ -28,7 +27,6 @@

 #include <pk11/site.h>

-#include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>

 #include <dns/fixedname.h>
@@ -48,7 +46,6 @@
 /*% default configuration */
 static char defaultconf[] = "\
 options {\n\
-	answer-cookie true;\n\
 	automatic-interface-scan yes;\n\
 	bindkeys-file \"" NAMED_SYSCONFDIR "/bind.keys\";\n\
 #	blackhole {none;};\n"
@@ -91,18 +88,12 @@ options {\n\
 	nta-recheck 300;\n\
 #	pid-file \"" NAMED_LOCALSTATEDIR "/run/named/named.pid\"; \n\
 	port 53;\n\
-	prefetch 2 9;\n"
-#if defined(ISC_PLATFORM_CRYPTORANDOM)
-"	random-device none;\n"
-#elif defined(PATH_RANDOMDEV)
-"	random-device \"" PATH_RANDOMDEV "\";\n"
-#endif
-"	recursing-file \"named.recursing\";\n\
+	prefetch 2 9;\n\
+	recursing-file \"named.recursing\";\n\
 	recursive-clients 1000;\n\
 	request-nsid false;\n\
 	reserved-sockets 512;\n\
 	resolver-query-timeout 10;\n\
-	rrset-order { order random; };\n\
 	secroots-file \"named.secroots\";\n\
 	send-cookie true;\n\
 #	serial-queries <obsolete>;\n\
@@ -252,6 +243,7 @@ options {\n\
 	sig-signing-signatures 10;\n\
 	sig-signing-type 65534;\n\
 	sig-validity-interval 30; /* days */\n\
+	dnskey-sig-validity 0; /* default: sig-validity-interval */\n\
 	transfer-source *;\n\
 	transfer-source-v6 *;\n\
 	try-tcp-refresh yes; /* BIND 8 compat */\n\
@@ -316,9 +308,8 @@ named_config_parsedefaults(cfg_parser_t *parser, cfg_obj_t **conf) {

 	isc_buffer_init(&b, defaultconf, sizeof(defaultconf) - 1);
 	isc_buffer_add(&b, sizeof(defaultconf) - 1);
-	return (cfg_parse_buffer4(parser, &b, __FILE__, 0,
-				  &cfg_type_namedconf,
-				  CFG_PCTX_NODEPRECATED, conf));
+	return (cfg_parse_buffer3(parser, &b, __FILE__, 0,
+				  &cfg_type_namedconf, conf));
 }

 isc_result_t
@@ -431,18 +422,23 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	const char *str;

 	str = cfg_obj_asstring(zonetypeobj);
-	if (strcasecmp(str, "master") == 0)
+	if (strcasecmp(str, "primary") == 0 ||
+	    strcasecmp(str, "master") == 0)
+	{
 		ztype = dns_zone_master;
-	else if (strcasecmp(str, "slave") == 0)
+	} else if (strcasecmp(str, "secondary") == 0 ||
+		   strcasecmp(str, "slave") == 0)
+	{
 		ztype = dns_zone_slave;
-	else if (strcasecmp(str, "stub") == 0)
+	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
-	else if (strcasecmp(str, "static-stub") == 0)
+	} else if (strcasecmp(str, "static-stub") == 0) {
 		ztype = dns_zone_staticstub;
-	else if (strcasecmp(str, "redirect") == 0)
+	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
-	else
+	} else {
 		INSIST(0);
+	}
 	return (ztype);
 }

@@ -450,7 +446,7 @@ isc_result_t
 named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
 		    in_port_t defport, isc_mem_t *mctx,
 		    isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
-		    uint32_t *countp)
+		    isc_uint32_t *countp)
 {
 	int count, i = 0;
 	const cfg_obj_t *addrlist;
@@ -470,8 +466,8 @@ named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,

 	portobj = cfg_tuple_get(list, "port");
 	if (cfg_obj_isuint32(portobj)) {
-		uint32_t val = cfg_obj_asuint32(portobj);
-		if (val > UINT16_MAX) {
+		isc_uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > ISC_UINT16_MAX) {
 			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			return (ISC_R_RANGE);
@@ -541,7 +537,7 @@ named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,

 void
 named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-		       isc_dscp_t **dscpsp, uint32_t count)
+		       isc_dscp_t **dscpsp, isc_uint32_t count)
 {
 	INSIST(addrsp != NULL && *addrsp != NULL);
 	INSIST(dscpsp == NULL || *dscpsp != NULL);
@@ -587,9 +583,9 @@ isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			  isc_mem_t *mctx, dns_ipkeylist_t *ipkl)
 {
-	uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
-	uint32_t listcount = 0, l = 0, j;
-	uint32_t stackcount = 0, pushed = 0;
+	isc_uint32_t addrcount = 0, dscpcount = 0, keycount = 0, i = 0;
+	isc_uint32_t listcount = 0, l = 0, j;
+	isc_uint32_t stackcount = 0, pushed = 0;
 	isc_result_t result;
 	const cfg_listelt_t *element;
 	const cfg_obj_t *addrlist;
@@ -633,8 +629,8 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 	dscpobj = cfg_tuple_get(list, "dscp");

 	if (cfg_obj_isuint32(portobj)) {
-		uint32_t val = cfg_obj_asuint32(portobj);
-		if (val > UINT16_MAX) {
+		isc_uint32_t val = cfg_obj_asuint32(portobj);
+		if (val > ISC_UINT16_MAX) {
 			cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 				    "port '%u' out of range", val);
 			result = ISC_R_RANGE;
@@ -678,7 +674,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			/* Grow lists? */
 			if (listcount == l) {
 				void * tmp;
-				uint32_t newlen = listcount + 16;
+				isc_uint32_t newlen = listcount + 16;
 				size_t newsize, oldsize;

 				newsize = newlen * sizeof(*lists);
@@ -713,7 +709,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
 			/* Grow stack? */
 			if (stackcount == pushed) {
 				void * tmp;
-				uint32_t newlen = stackcount + 16;
+				isc_uint32_t newlen = stackcount + 16;
 				size_t newsize, oldsize;

 				newsize = newlen * sizeof(*stack);
@@ -741,7 +737,7 @@ named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,

 		if (i == addrcount) {
 			void * tmp;
-			uint32_t newlen = addrcount + 16;
+			isc_uint32_t newlen = addrcount + 16;
 			size_t newsize, oldsize;

 			newsize = newlen * sizeof(isc_sockaddr_t);
@@ -914,7 +910,7 @@ named_config_getport(const cfg_obj_t *config, in_port_t *portp) {

 	result = named_config_get(maps, "port", &portobj);
 	INSIST(result == ISC_R_SUCCESS);
-	if (cfg_obj_asuint32(portobj) >= UINT16_MAX) {
+	if (cfg_obj_asuint32(portobj) >= ISC_UINT16_MAX) {
 		cfg_obj_log(portobj, named_g_lctx, ISC_LOG_ERROR,
 			    "port '%u' out of range",
 			    cfg_obj_asuint32(portobj));
@@ -954,7 +950,7 @@ struct keyalgorithms {
 	enum { hmacnone, hmacmd5, hmacsha1, hmacsha224,
 	       hmacsha256, hmacsha384, hmacsha512 } hmac;
 	unsigned int type;
-	uint16_t size;
+	isc_uint16_t size;
 } algorithms[] = {
 #ifndef PK11_MD5_DISABLE
 	{ "hmac-md5", hmacmd5, DST_ALG_HMACMD5, 128 },
@@ -971,18 +967,18 @@ struct keyalgorithms {

 isc_result_t
 named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
-			     uint16_t *digestbits)
+			     isc_uint16_t *digestbits)
 {
 	return (named_config_getkeyalgorithm2(str, name, NULL, digestbits));
 }

 isc_result_t
 named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
-			      unsigned int *typep, uint16_t *digestbits)
+			      unsigned int *typep, isc_uint16_t *digestbits)
 {
 	int i;
 	size_t len = 0;
-	uint16_t bits;
+	isc_uint16_t bits;
 	isc_result_t result;

 	for (i = 0; algorithms[i].str != NULL; i++) {
@@ -14,7 +14,7 @@

 #include <config.h>

-#include <stdbool.h>
+
 #include <isc/app.h>
 #include <isc/event.h>
 #include <isc/lex.h>
@@ -59,9 +59,9 @@ getcommand(isc_lex_t *lex, char **cmdp) {
 	return (ISC_R_SUCCESS);
 }

-static inline bool
+static inline isc_boolean_t
 command_compare(const char *str, const char *command) {
-	return (strcasecmp(str, command) == 0);
+	return ISC_TF(strcasecmp(str, command) == 0);
 }

 /*%
@@ -69,7 +69,7 @@ command_compare(const char *str, const char *command) {
 * when a control channel message is received.
 */
 isc_result_t
-named_control_docommand(isccc_sexpr_t *message, bool readonly,
+named_control_docommand(isccc_sexpr_t *message, isc_boolean_t readonly,
 			isc_buffer_t **text)
 {
 	isccc_sexpr_t *data;
@@ -184,7 +184,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		 */
 #endif
 		/* Do not flush master files */
-		named_server_flushonshutdown(named_g_server, false);
+		named_server_flushonshutdown(named_g_server, ISC_FALSE);
 		named_os_shutdownmsg(cmdline, *text);
 		isc_app_shutdown();
 		result = ISC_R_SUCCESS;
@@ -201,7 +201,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		if (named_smf_got_instance == 1 && named_smf_chroot == 0)
 			named_smf_want_disable = 1;
 #endif
-		named_server_flushonshutdown(named_g_server, true);
+		named_server_flushonshutdown(named_g_server, ISC_TRUE);
 		named_os_shutdownmsg(cmdline, *text);
 		isc_app_shutdown();
 		result = ISC_R_SUCCESS;
@@ -223,9 +223,9 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_FLUSH)) {
 		result = named_server_flushcache(named_g_server, lex);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHNAME)) {
-		result = named_server_flushnode(named_g_server, lex, false);
+		result = named_server_flushnode(named_g_server, lex, ISC_FALSE);
 	} else if (command_compare(command, NAMED_COMMAND_FLUSHTREE)) {
-		result = named_server_flushnode(named_g_server, lex, true);
+		result = named_server_flushnode(named_g_server, lex, ISC_TRUE);
 	} else if (command_compare(command, NAMED_COMMAND_STATUS)) {
 		result = named_server_status(named_g_server, text);
 	} else if (command_compare(command, NAMED_COMMAND_TSIGLIST)) {
@@ -233,11 +233,11 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 	} else if (command_compare(command, NAMED_COMMAND_TSIGDELETE)) {
 		result = named_server_tsigdelete(named_g_server, lex, text);
 	} else if (command_compare(command, NAMED_COMMAND_FREEZE)) {
-		result = named_server_freeze(named_g_server, true, lex,
+		result = named_server_freeze(named_g_server, ISC_TRUE, lex,
 					     text);
 	} else if (command_compare(command, NAMED_COMMAND_UNFREEZE) ||
 		   command_compare(command, NAMED_COMMAND_THAW)) {
-		result = named_server_freeze(named_g_server, false, lex,
+		result = named_server_freeze(named_g_server, ISC_FALSE, lex,
 					     text);
 	} else if (command_compare(command, NAMED_COMMAND_SCAN)) {
 		result = ISC_R_SUCCESS;
@@ -13,9 +13,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/event.h>
@@ -67,7 +64,7 @@ typedef ISC_LIST(controllistener_t) controllistenerlist_t;

 struct controlkey {
 	char *				keyname;
-	uint32_t			algorithm;
+	isc_uint32_t			algorithm;
 	isc_region_t			secret;
 	ISC_LINK(controlkey_t)		link;
 };
@@ -75,12 +72,12 @@ struct controlkey {
 struct controlconnection {
 	isc_socket_t *			sock;
 	isccc_ccmsg_t			ccmsg;
-	bool			ccmsg_valid;
-	bool			sending;
+	isc_boolean_t			ccmsg_valid;
+	isc_boolean_t			sending;
 	isc_timer_t *			timer;
 	isc_buffer_t *			buffer;
 	controllistener_t *		listener;
-	uint32_t			nonce;
+	isc_uint32_t			nonce;
 	ISC_LINK(controlconnection_t)	link;
 };

@@ -91,22 +88,22 @@ struct controllistener {
 	isc_sockaddr_t			address;
 	isc_socket_t *			sock;
 	dns_acl_t *			acl;
-	bool			listening;
-	bool			exiting;
+	isc_boolean_t			listening;
+	isc_boolean_t			exiting;
 	controlkeylist_t		keys;
 	controlconnectionlist_t		connections;
 	isc_sockettype_t		type;
-	uint32_t			perm;
-	uint32_t			owner;
-	uint32_t			group;
-	bool			readonly;
+	isc_uint32_t			perm;
+	isc_uint32_t			owner;
+	isc_uint32_t			group;
+	isc_boolean_t			readonly;
 	ISC_LINK(controllistener_t)	link;
 };

 struct named_controls {
 	named_server_t			*server;
 	controllistenerlist_t 		listeners;
-	bool			shuttingdown;
+	isc_boolean_t			shuttingdown;
 	isccc_symtab_t			*symtab;
 };

@@ -204,8 +201,8 @@ shutdown_listener(controllistener_t *listener) {
 			      NAMED_LOGMODULE_CONTROL, ISC_LOG_NOTICE,
 			      "stopping command channel on %s", socktext);
 		if (listener->type == isc_sockettype_unix)
-			isc_socket_cleanunix(&listener->address, true);
-		listener->exiting = true;
+			isc_socket_cleanunix(&listener->address, ISC_TRUE);
+		listener->exiting = ISC_TRUE;
 	}

 	for (conn = ISC_LIST_HEAD(listener->connections);
@@ -223,7 +220,7 @@ shutdown_listener(controllistener_t *listener) {
 	maybe_free_listener(listener);
 }

-static bool
+static isc_boolean_t
 address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {
 	dns_aclenv_t *env =
 		ns_interfacemgr_getaclenv(named_g_server->interfacemgr);
@@ -233,12 +230,13 @@ address_ok(isc_sockaddr_t *sockaddr, dns_acl_t *acl) {

 	isc_netaddr_fromsockaddr(&netaddr, sockaddr);

-	result = dns_acl_match(&netaddr, NULL, acl, env, &match, NULL);
+	result = dns_acl_match(&netaddr, NULL, NULL, 0, NULL, acl, env, &match,
+			       NULL);

 	if (result != ISC_R_SUCCESS || match <= 0)
-		return (false);
+		return (ISC_FALSE);
 	else
-		return (true);
+		return (ISC_TRUE);
 }

 static isc_result_t
@@ -252,7 +250,7 @@ control_accept(controllistener_t *listener) {
 				 "isc_socket_accept() failed: %s",
 				 isc_result_totext(result));
 	else
-		listener->listening = true;
+		listener->listening = ISC_TRUE;
 	return (result);
 }

@@ -285,7 +283,7 @@ control_senddone(isc_task_t *task, isc_event_t *event) {

 	UNUSED(task);

-	conn->sending = false;
+	conn->sending = ISC_FALSE;

 	if (sevent->result != ISC_R_SUCCESS &&
 	    sevent->result != ISC_R_CANCELED)
@@ -328,11 +326,10 @@ static void
 control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	controlconnection_t *conn = NULL;
 	controllistener_t *listener = NULL;
-	named_server_t *server = NULL;
 	controlkey_t *key = NULL;
 	isccc_sexpr_t *request = NULL;
 	isccc_sexpr_t *response = NULL;
-	uint32_t algorithm;
+	isc_uint32_t algorithm;
 	isccc_region_t secret;
 	isc_stdtime_t now;
 	isc_buffer_t b;
@@ -343,14 +340,13 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	isccc_sexpr_t *_ctrl = NULL;
 	isccc_time_t sent;
 	isccc_time_t exp;
-	uint32_t nonce;
+	isc_uint32_t nonce;
 	isccc_sexpr_t *data = NULL;

 	REQUIRE(event->ev_type == ISCCC_EVENT_CCMSG);

 	conn = event->ev_arg;
 	listener = conn->listener;
-	server = listener->controls->server;
 	algorithm = DST_ALG_UNKNOWN;
 	secret.rstart = NULL;
 	text = NULL;
@@ -462,8 +458,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (conn->nonce == 0) {
 		while (conn->nonce == 0) {
-			isc_rng_randombytes(server->sctx->rngctx, &conn->nonce,
-					    sizeof(conn->nonce));
+			isc_random_buf(&conn->nonce, sizeof(conn->nonce));
 		}
 		eresult = ISC_R_SUCCESS;
 	} else
@@ -525,7 +520,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 	result = isc_socket_send(conn->sock, &r, task, control_senddone, conn);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup_response;
-	conn->sending = true;
+	conn->sending = ISC_TRUE;

 	isc_mem_put(listener->mctx, secret.rstart, REGION_SIZE(secret));
 	isccc_sexpr_free(&request);
@@ -545,7 +540,7 @@ control_recvmessage(isc_task_t *task, isc_event_t *event) {
 cleanup:
 	isc_socket_detach(&conn->sock);
 	isccc_ccmsg_invalidate(&conn->ccmsg);
-	conn->ccmsg_valid = false;
+	conn->ccmsg_valid = ISC_FALSE;
 	maybe_free_connection(conn);
 	maybe_free_listener(listener);
 }
@@ -578,8 +573,8 @@ newconnection(controllistener_t *listener, isc_socket_t *sock) {
 	/* Set a 32 KiB upper limit on incoming message. */
 	isccc_ccmsg_setmaxsize(&conn->ccmsg, 32768);

-	conn->ccmsg_valid = true;
-	conn->sending = false;
+	conn->ccmsg_valid = ISC_TRUE;
+	conn->sending = ISC_FALSE;
 	conn->buffer = NULL;
 	conn->timer = NULL;
 	isc_interval_set(&interval, 60, 0);
@@ -626,7 +621,7 @@ control_newconn(isc_task_t *task, isc_event_t *event) {

 	UNUSED(task);

-	listener->listening = false;
+	listener->listening = ISC_FALSE;

 	if (nevent->result != ISC_R_SUCCESS) {
 		if (nevent->result == ISC_R_CANCELED) {
@@ -690,7 +685,7 @@ controls_shutdown(named_controls_t *controls) {
 void
 named_controls_shutdown(named_controls_t *controls) {
 	controls_shutdown(controls);
-	controls->shuttingdown = true;
+	controls->shuttingdown = ISC_TRUE;
 }

 static isc_result_t
@@ -1096,7 +1091,7 @@ update_listener(named_controls_t *cp, controllistener_t **listenerp,
 			      socktext, isc_result_totext(result));

 	if (result == ISC_R_SUCCESS && type == isc_sockettype_unix) {
-		uint32_t perm, owner, group;
+		isc_uint32_t perm, owner, group;
 		perm  = cfg_obj_asuint32(cfg_tuple_get(control, "perm"));
 		owner = cfg_obj_asuint32(cfg_tuple_get(control, "owner"));
 		group = cfg_obj_asuint32(cfg_tuple_get(control, "group"));
@@ -1143,14 +1138,14 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 		listener->task = cp->server->task;
 		listener->address = *addr;
 		listener->sock = NULL;
-		listener->listening = false;
-		listener->exiting = false;
+		listener->listening = ISC_FALSE;
+		listener->exiting = ISC_FALSE;
 		listener->acl = NULL;
 		listener->type = type;
 		listener->perm = 0;
 		listener->owner = 0;
 		listener->group = 0;
-		listener->readonly = false;
+		listener->readonly = ISC_FALSE;
 		ISC_LINK_INIT(listener, link);
 		ISC_LIST_INIT(listener->keys);
 		ISC_LIST_INIT(listener->connections);
@@ -1213,7 +1208,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,
 	}

 	if (result == ISC_R_SUCCESS && type == isc_sockettype_unix)
-		isc_socket_cleanunix(&listener->address, false);
+		isc_socket_cleanunix(&listener->address, ISC_FALSE);

 	if (result == ISC_R_SUCCESS)
 		result = isc_socket_create(named_g_socketmgr,
@@ -1224,7 +1219,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,

 #ifndef ISC_ALLOW_MAPPED
 	if (result == ISC_R_SUCCESS)
-		isc_socket_ipv6only(listener->sock, true);
+		isc_socket_ipv6only(listener->sock, ISC_TRUE);
 #endif

 	if (result == ISC_R_SUCCESS)
@@ -1255,7 +1250,7 @@ add_listener(named_controls_t *cp, controllistener_t **listenerp,

 	} else {
 		if (listener != NULL) {
-			listener->exiting = true;
+			listener->exiting = ISC_TRUE;
 			free_listener(listener);
 		}

@@ -1515,7 +1510,7 @@ named_controls_create(named_server_t *server, named_controls_t **ctrlsp) {
 		return (ISC_R_NOMEMORY);
 	controls->server = server;
 	ISC_LIST_INIT(controls->listeners);
-	controls->shuttingdown = false;
+	controls->shuttingdown = ISC_FALSE;
 	controls->symtab = NULL;
 	result = isccc_cc_createsymtab(&controls->symtab);
 	if (result != ISC_R_SUCCESS) {
@@ -11,9 +11,6 @@

 #include "config.h"

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <named/fuzz.h>

 #ifdef ENABLE_AFL
@@ -47,7 +44,7 @@
 */
 static pthread_cond_t cond;
 static pthread_mutex_t mutex;
-static bool ready;
+static isc_boolean_t ready;

 /*
 * In "client:" mode, this thread reads fuzzed query messages from AFL
@@ -125,7 +122,7 @@ fuzz_thread_client(void *arg) {
 				free(buf);
 				close(sockfd);
 				named_server_flushonshutdown(named_g_server,
-							     false);
+							     ISC_FALSE);
 				isc_app_shutdown();
 				return (NULL);
 			}
@@ -135,7 +132,7 @@ fuzz_thread_client(void *arg) {

 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);

-		ready = false;
+		ready = ISC_FALSE;

 		sent = sendto(sockfd, buf, length, 0,
 			      (struct sockaddr *) &servaddr, sizeof(servaddr));
@@ -156,7 +153,7 @@ fuzz_thread_client(void *arg) {
 	free(buf);
 	close(sockfd);

-	named_server_flushonshutdown(named_g_server, false);
+	named_server_flushonshutdown(named_g_server, ISC_FALSE);
 	isc_app_shutdown();

 	return (NULL);
@@ -203,7 +200,7 @@ fuzz_thread_resolver(void *arg) {
 	 * have to be updated. 0x8d, 0xf6 at the start is the ID field
 	 * which will be made to match the query.
 	 */
-	const uint8_t dnskey_wf[] = {
+	const isc_uint8_t dnskey_wf[] = {
 		0x8d, 0xf6, 0x84, 0x00, 0x00, 0x01, 0x00, 0x02,
 		0x00, 0x00, 0x00, 0x01, 0x07, 0x65, 0x78, 0x61,
 		0x6d, 0x70, 0x6c, 0x65, 0x00, 0x00, 0x30, 0x00,
@@ -285,12 +282,12 @@ fuzz_thread_resolver(void *arg) {
 	int sockfd;
 	int listenfd;
 	int loop;
-	uint16_t qtype;
+	isc_uint16_t qtype;
 	char *buf, *rbuf;
 	char *nameptr;
 	unsigned int i;
-	uint8_t llen;
-	uint64_t seed;
+	isc_uint8_t llen;
+	isc_uint64_t seed;

 	UNUSED(arg);

@@ -388,7 +385,7 @@ fuzz_thread_resolver(void *arg) {
 				close(sockfd);
 				close(listenfd);
 				named_server_flushonshutdown(named_g_server,
-							     false);
+							     ISC_FALSE);
 				isc_app_shutdown();
 				return (NULL);
 			}
@@ -402,7 +399,7 @@ fuzz_thread_resolver(void *arg) {

 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);

-		ready = false;
+		ready = ISC_FALSE;

 		/* Use a unique query ID. */
 		seed = 1664525 * seed + 1013904223;
@@ -552,7 +549,7 @@ fuzz_thread_resolver(void *arg) {
 				 * "example."
 				 */
 				if ((nameptr - buf) < (length - 2)) {
-					uint8_t hb, lb;
+					isc_uint8_t hb, lb;
 					hb = *nameptr++;
 					lb = *nameptr++;
 					qtype = (hb << 8) | lb;
@@ -580,10 +577,9 @@ fuzz_thread_resolver(void *arg) {
 	}

 	free(buf);
-	free(rbuf);
 	close(sockfd);
 	close(listenfd);
-	named_server_flushonshutdown(named_g_server, false);
+	named_server_flushonshutdown(named_g_server, ISC_FALSE);
 	isc_app_shutdown();

 	/*
@@ -690,7 +686,7 @@ fuzz_thread_tcp(void *arg) {

 		RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);

-		ready = false;
+		ready = ISC_FALSE;
 		yes = 1;
 		sockfd = socket(AF_INET, SOCK_STREAM, 0);

@@ -721,7 +717,7 @@ fuzz_thread_tcp(void *arg) {

 	free(buf);
 	close(sockfd);
-	named_server_flushonshutdown(named_g_server, false);
+	named_server_flushonshutdown(named_g_server, ISC_FALSE);
 	isc_app_shutdown();

 	return (NULL);
@@ -738,7 +734,7 @@ void
 named_fuzz_notify(void) {
 #ifdef ENABLE_AFL
 	if (getenv("AFL_CMIN")) {
-		named_server_flushonshutdown(named_g_server, false);
+		named_server_flushonshutdown(named_g_server, ISC_FALSE);
 		isc_app_shutdown();
 		return;
 	}
@@ -747,7 +743,7 @@ named_fuzz_notify(void) {

 	RUNTIME_CHECK(pthread_mutex_lock(&mutex) == 0);

-	ready = true;
+	ready = ISC_TRUE;

 	RUNTIME_CHECK(pthread_cond_signal(&cond) == 0);
 	RUNTIME_CHECK(pthread_mutex_unlock(&mutex) == 0);
@@ -15,8 +15,6 @@

 /*! \file */

-#include <inttypes.h>
-
 #include <isccfg/cfg.h>

 #include <dns/types.h>
@@ -51,11 +49,11 @@ isc_result_t
 named_config_getiplist(const cfg_obj_t *config, const cfg_obj_t *list,
 		    in_port_t defport, isc_mem_t *mctx,
 		    isc_sockaddr_t **addrsp, isc_dscp_t **dscpsp,
-		    uint32_t *countp);
+		    isc_uint32_t *countp);

 void
 named_config_putiplist(isc_mem_t *mctx, isc_sockaddr_t **addrsp,
-		    isc_dscp_t **dscpsp, uint32_t count);
+		    isc_dscp_t **dscpsp, isc_uint32_t count);

 isc_result_t
 named_config_getipandkeylist(const cfg_obj_t *config, const cfg_obj_t *list,
@@ -66,10 +64,10 @@ named_config_getport(const cfg_obj_t *config, in_port_t *portp);

 isc_result_t
 named_config_getkeyalgorithm(const char *str, const dns_name_t **name,
-			  uint16_t *digestbits);
+			  isc_uint16_t *digestbits);
 isc_result_t
 named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
-			   unsigned int *typep, uint16_t *digestbits);
+			   unsigned int *typep, isc_uint16_t *digestbits);

 isc_result_t
 named_config_getdscp(const cfg_obj_t *config, isc_dscp_t *dscpp);
@@ -17,7 +17,6 @@
 * The name server command channel.
 */

-#include <stdbool.h>
 #include <isccc/types.h>

 #include <isccfg/aclconf.h>
@@ -102,7 +101,7 @@ named_controls_shutdown(named_controls_t *controls);
 */

 isc_result_t
-named_control_docommand(isccc_sexpr_t *message, bool readonly,
+named_control_docommand(isccc_sexpr_t *message, isc_boolean_t readonly,
 			isc_buffer_t **text);

 #endif /* NAMED_CONTROL_H */
@@ -14,7 +14,6 @@

 /*! \file */

-#include <stdbool.h>
 #include <isc/rwlock.h>
 #include <isc/log.h>
 #include <isc/net.h>
@@ -49,12 +48,10 @@ EXTERN unsigned int		named_g_cpus		INIT(0);
 EXTERN unsigned int		named_g_udpdisp		INIT(0);
 EXTERN isc_taskmgr_t *		named_g_taskmgr		INIT(NULL);
 EXTERN dns_dispatchmgr_t *	named_g_dispatchmgr	INIT(NULL);
-EXTERN isc_entropy_t *		named_g_entropy		INIT(NULL);
-EXTERN isc_entropy_t *		named_g_fallbackentropy	INIT(NULL);
 EXTERN unsigned int		named_g_cpus_detected	INIT(1);

 #ifdef ENABLE_AFL
-EXTERN bool		named_g_run_done	INIT(false);
+EXTERN isc_boolean_t		named_g_run_done	INIT(ISC_FALSE);
 #endif
 /*
 * XXXRTH  We're going to want multiple timer managers eventually.  One
@@ -97,7 +94,7 @@ EXTERN const char *		named_g_keyfile		INIT(NAMED_SYSCONFDIR

 EXTERN dns_tsigkey_t *		named_g_sessionkey	INIT(NULL);
 EXTERN dns_name_t		named_g_sessionkeyname;
-EXTERN bool		named_g_conffileset	INIT(false);
+EXTERN isc_boolean_t		named_g_conffileset	INIT(ISC_FALSE);
 EXTERN cfg_aclconfctx_t *	named_g_aclconfctx	INIT(NULL);

 /*
@@ -111,11 +108,11 @@ EXTERN isc_resourcevalue_t	named_g_initopenfiles	INIT(0);
 /*
 * Misc.
 */
-EXTERN bool		named_g_coreok		INIT(true);
+EXTERN isc_boolean_t		named_g_coreok		INIT(ISC_TRUE);
 EXTERN const char *		named_g_chrootdir	INIT(NULL);
-EXTERN bool		named_g_foreground	INIT(false);
-EXTERN bool		named_g_logstderr	INIT(false);
-EXTERN bool		named_g_nosyslog	INIT(false);
+EXTERN isc_boolean_t		named_g_foreground	INIT(ISC_FALSE);
+EXTERN isc_boolean_t		named_g_logstderr	INIT(ISC_FALSE);
+EXTERN isc_boolean_t		named_g_nosyslog	INIT(ISC_FALSE);
 EXTERN const char *		named_g_logfile		INIT(NULL);

 EXTERN const char *		named_g_defaultsessionkeyfile
@@ -124,7 +121,7 @@ EXTERN const char *		named_g_defaultsessionkeyfile
 EXTERN const char *		named_g_defaultlockfile	INIT(NAMED_LOCALSTATEDIR
 							     "/run/named/"
 							     "named.lock");
-EXTERN bool		named_g_forcelock	INIT(false);
+EXTERN isc_boolean_t		named_g_forcelock	INIT(ISC_FALSE);

 #if NAMED_RUN_PID_DIR
 EXTERN const char *		named_g_defaultpidfile 	INIT(NAMED_LOCALSTATEDIR
@@ -153,8 +150,8 @@ EXTERN const char *		named_g_engine		INIT(NULL);

 EXTERN isc_time_t		named_g_boottime;
 EXTERN isc_time_t		named_g_configtime;
-EXTERN bool		named_g_memstatistics	INIT(false);
-EXTERN bool		named_g_keepstderr	INIT(false);
+EXTERN isc_boolean_t		named_g_memstatistics	INIT(ISC_FALSE);
+EXTERN isc_boolean_t		named_g_keepstderr	INIT(ISC_FALSE);

 EXTERN unsigned int		named_g_tat_interval	INIT(24*3600);

@@ -34,7 +34,7 @@
 #define NAMED_LOGMODULE_CONTROL		(&named_g_modules[2])

 isc_result_t
-named_log_init(bool safe);
+named_log_init(isc_boolean_t safe);
 /*%
 * Initialize the logging system and set up an initial default
 * logging default configuration that will be used until the
@@ -1,248 +0,0 @@
-/*
- * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
- *
- * This Source Code Form is subject to the terms of the Mozilla Public
- * License, v. 2.0. If a copy of the MPL was not distributed with this
- * file, You can obtain one at http://mozilla.org/MPL/2.0/.
- *
- * See the COPYRIGHT file distributed with this work for additional
- * information regarding copyright ownership.
- */
-
-#ifndef NAMED_SECCOMP_H
-#define NAMED_SECCOMP_H 1
-
-/*! \file */
-
-#ifdef HAVE_LIBSECCOMP
-#include <sys/types.h>
-#include <sys/resource.h>
-#include <unistd.h>
-#include <seccomp.h>
-#include <isc/platform.h>
-
-/*%
- * For each architecture, the scmp_syscalls and
- * scmp_syscall_names arrays MUST be kept in sync.
- */
-#ifdef __x86_64__
-int scmp_syscalls[] = {
-	SCMP_SYS(access),
-	SCMP_SYS(open),
-	SCMP_SYS(openat),
-	SCMP_SYS(lseek),
-	SCMP_SYS(clock_gettime),
-	SCMP_SYS(time),
-	SCMP_SYS(read),
-	SCMP_SYS(write),
-	SCMP_SYS(close),
-	SCMP_SYS(brk),
-	SCMP_SYS(poll),
-	SCMP_SYS(select),
-	SCMP_SYS(madvise),
-	SCMP_SYS(mmap),
-	SCMP_SYS(munmap),
-	SCMP_SYS(exit_group),
-	SCMP_SYS(rt_sigprocmask),
-	SCMP_SYS(rt_sigaction),
-	SCMP_SYS(fsync),
-	SCMP_SYS(rt_sigreturn),
-	SCMP_SYS(setsid),
-	SCMP_SYS(chdir),
-	SCMP_SYS(futex),
-	SCMP_SYS(stat),
-	SCMP_SYS(rt_sigsuspend),
-	SCMP_SYS(fstat),
-	SCMP_SYS(epoll_ctl),
-	SCMP_SYS(gettimeofday),
-	SCMP_SYS(getpid),
-#ifdef HAVE_GETRANDOM
-	SCMP_SYS(getrandom),
-#endif
-	SCMP_SYS(rename),
-	SCMP_SYS(unlink),
-	SCMP_SYS(socket),
-	SCMP_SYS(sendto),
-#ifndef ISC_PLATFORM_USETHREADS
-	SCMP_SYS(bind),
-	SCMP_SYS(accept),
-	SCMP_SYS(connect),
-	SCMP_SYS(listen),
-	SCMP_SYS(fcntl),
-	SCMP_SYS(sendmsg),
-	SCMP_SYS(recvmsg),
-	SCMP_SYS(uname),
-	SCMP_SYS(setrlimit),
-	SCMP_SYS(getrlimit),
-	SCMP_SYS(setsockopt),
-	SCMP_SYS(getsockopt),
-	SCMP_SYS(getsockname),
-	SCMP_SYS(lstat),
-	SCMP_SYS(getgid),
-	SCMP_SYS(getegid),
-	SCMP_SYS(getuid),
-	SCMP_SYS(geteuid),
-	SCMP_SYS(setresgid),
-	SCMP_SYS(setresuid),
-	SCMP_SYS(setgid),
-	SCMP_SYS(setuid),
-	SCMP_SYS(prctl),
-	SCMP_SYS(epoll_wait),
-	SCMP_SYS(getdents),
-	SCMP_SYS(utimes),
-	SCMP_SYS(dup),
-#endif
-};
-const char *scmp_syscall_names[] = {
-	"access",
-	"open",
-	"openat",
-	"lseek",
-	"clock_gettime",
-	"time",
-	"read",
-	"write",
-	"close",
-	"brk",
-	"poll",
-	"select",
-	"madvise",
-	"mmap",
-	"munmap",
-	"exit_group",
-	"rt_sigprocmask",
-	"rt_sigaction",
-	"fsync",
-	"rt_sigreturn",
-	"setsid",
-	"chdir",
-	"futex",
-	"stat",
-	"rt_sigsuspend",
-	"fstat",
-	"epoll_ctl",
-	"gettimeofday",
-	"getpid",
-#ifdef HAVE_GETRANDOM
-	"getrandom",
-#endif
-	"rename",
-	"unlink",
-	"socket",
-	"sendto",
-#ifndef ISC_PLATFORM_USETHREADS
-	"bind",
-	"accept",
-	"connect",
-	"listen",
-	"fcntl",
-	"sendmsg",
-	"recvmsg",
-	"uname",
-	"setrlimit",
-	"getrlimit",
-	"setsockopt",
-	"getsockopt",
-	"getsockname",
-	"lstat",
-	"getgid",
-	"getegid",
-	"getuid",
-	"geteuid",
-	"setresgid",
-	"setresuid",
-	"setgid",
-	"setuid",
-	"prctl",
-	"epoll_wait",
-	"getdents",
-	"utimes",
-	"dup",
-#endif
-};
-#endif /* __x86_64__ */
-#ifdef __i386__
-int scmp_syscalls[] = {
-	SCMP_SYS(access),
-	SCMP_SYS(open),
-	SCMP_SYS(clock_gettime),
-	SCMP_SYS(time),
-	SCMP_SYS(read),
-	SCMP_SYS(write),
-	SCMP_SYS(close),
-	SCMP_SYS(brk),
-	SCMP_SYS(poll),
-	SCMP_SYS(_newselect),
-	SCMP_SYS(select),
-	SCMP_SYS(madvise),
-	SCMP_SYS(mmap2),
-	SCMP_SYS(mmap),
-	SCMP_SYS(munmap),
-	SCMP_SYS(exit_group),
-	SCMP_SYS(rt_sigprocmask),
-	SCMP_SYS(sigprocmask),
-	SCMP_SYS(rt_sigaction),
-	SCMP_SYS(socketcall),
-	SCMP_SYS(fsync),
-	SCMP_SYS(sigreturn),
-	SCMP_SYS(setsid),
-	SCMP_SYS(chdir),
-	SCMP_SYS(futex),
-	SCMP_SYS(stat64),
-	SCMP_SYS(rt_sigsuspend),
-	SCMP_SYS(fstat64),
-	SCMP_SYS(epoll_ctl),
-	SCMP_SYS(gettimeofday),
-	SCMP_SYS(getpid),
-#ifdef HAVE_GETRANDOM
-	SCMP_SYS(getrandom),
-#endif
-	SCMP_SYS(unlink),
-#ifndef ISC_PLATFORM_USETHREADS
-	SCMP_SYS(fcntl64),
-#endif
-};
-const char *scmp_syscall_names[] = {
-	"access",
-	"open",
-	"clock_gettime",
-	"time",
-	"read",
-	"write",
-	"close",
-	"brk",
-	"poll",
-	"_newselect",
-	"select",
-	"madvise",
-	"mmap2",
-	"mmap",
-	"munmap",
-	"exit_group",
-	"rt_sigprocmask",
-	"sigprocmask",
-	"rt_sigaction",
-	"socketcall",
-	"fsync",
-	"sigreturn",
-	"setsid",
-	"chdir",
-	"futex",
-	"stat64",
-	"rt_sigsuspend",
-	"fstat64",
-	"epoll_ctl",
-	"gettimeofday",
-	"getpid",
-#ifdef HAVE_GETRANDOM
-	"getrandom",
-#endif
-	"unlink",
-#ifndef ISC_PLATFORM_USETHREADS
-	"fcntl64",
-#endif
-};
-#endif /* __i386__ */
-#endif /* HAVE_LIBSECCOMP */
-
-#endif /* NAMED_SECCOMP_H */
@@ -14,9 +14,6 @@

 /*! \file */

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/log.h>
 #include <isc/magic.h>
 #include <isc/quota.h>
@@ -56,9 +53,9 @@ struct named_server {
 	char *			secrootsfile;	/*%< Secroots file name */
 	char *			bindkeysfile;	/*%< bind.keys file name */
 	char *			recfile;	/*%< Recursive file name */
-	bool		version_set;	/*%< User has set version */
+	isc_boolean_t		version_set;	/*%< User has set version */
 	char *			version;	/*%< User-specified version */
-	bool		hostname_set;	/*%< User has set hostname */
+	isc_boolean_t		hostname_set;	/*%< User has set hostname */
 	char *			hostname;	/*%< User-specified hostname */

 	/* Server data structures. */
@@ -73,13 +70,13 @@ struct named_server {
 	isc_timer_t *		pps_timer;
 	isc_timer_t *		tat_timer;

-	uint32_t		interface_interval;
-	uint32_t		heartbeat_interval;
+	isc_uint32_t		interface_interval;
+	isc_uint32_t		heartbeat_interval;

 	isc_mutex_t		reload_event_lock;
 	isc_event_t *		reload_event;

-	bool		flushonshutdown;
+	isc_boolean_t		flushonshutdown;

 	named_cachelist_t	cachelist;	/*%< Possibly shared caches */
 	isc_stats_t *		zonestats;	/*% Zone management stats */
@@ -96,8 +93,8 @@ struct named_server {
 	char			*session_keyfile;
 	dns_name_t		*session_keyname;
 	unsigned int		session_keyalg;
-	uint16_t		session_keybits;
-	bool		interface_auto;
+	isc_uint16_t		session_keybits;
+	isc_boolean_t		interface_auto;
 	unsigned char		secret[32];	/*%< Server Cookie Secret */
 	ns_cookiealg_t		cookiealg;

@@ -140,7 +137,7 @@ named_server_scan_interfaces(named_server_t *server);
 */

 void
-named_server_flushonshutdown(named_server_t *server, bool flush);
+named_server_flushonshutdown(named_server_t *server, isc_boolean_t flush);
 /*%<
 * Inform the server that the zones should be flushed to disk on shutdown.
 */
@@ -237,7 +234,7 @@ named_server_flushcache(named_server_t *server, isc_lex_t *lex);
 */
 isc_result_t
 named_server_flushnode(named_server_t *server, isc_lex_t *lex,
-		    bool tree);
+		    isc_boolean_t tree);

 /*%
 * Report the server's status.
@@ -262,7 +259,7 @@ named_server_tsigdelete(named_server_t *server, isc_lex_t *lex,
 * Enable or disable updates for a zone.
 */
 isc_result_t
-named_server_freeze(named_server_t *server, bool freeze,
+named_server_freeze(named_server_t *server, isc_boolean_t freeze,
 		 isc_lex_t *lex, isc_buffer_t **text);

 /*%
@@ -342,7 +339,7 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 */
 isc_result_t
 named_server_nta(named_server_t *server, isc_lex_t *lex,
-		 bool readonly, isc_buffer_t **text);
+		 isc_boolean_t readonly, isc_buffer_t **text);

 /*%
 * Generates a test sequence that is only for use in system tests. The
@@ -23,7 +23,7 @@ ISC_LANG_BEGINDECLS

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp);
+			 dns_tkeyctx_t **tctxp);
 /*%<
 * 	Create a TKEY context and configure it, including the default DH key
 *	and default domain, according to 'options'.
@@ -31,7 +31,6 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 *	Requires:
 *\li		'cfg' is a valid configuration options object.
 *\li		'mctx' is not NULL
- *\li		'ectx' is not NULL
 *\li		'tctx' is not NULL
 *\li		'*tctx' is NULL
 *
@@ -14,7 +14,6 @@

 /*! \file */

-#include <stdbool.h>
 #include <isc/lang.h>
 #include <isc/types.h>

@@ -42,13 +41,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 * \li	'zone' to be initialized.
 */

-bool
+isc_boolean_t
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig);
 /*%<
 * If 'zone' can be safely reconfigured according to the configuration
- * data in 'zconfig', return true.  If the configuration data is so
+ * data in 'zconfig', return ISC_TRUE.  If the configuration data is so
 * different from the current zone state that the zone needs to be destroyed
- * and recreated, return false.
+ * and recreated, return ISC_FALSE.
 */

 isc_result_t
@@ -50,7 +50,7 @@ static isc_logmodule_t modules[] = {
 };

 isc_result_t
-named_log_init(bool safe) {
+named_log_init(isc_boolean_t safe) {
 	isc_result_t result;
 	isc_logconfig_t *lcfg = NULL;

@@ -13,9 +13,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/file.h>
 #include <isc/offset.h>
 #include <isc/print.h>
@@ -139,10 +136,10 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 				 cfg_tuple_get(fileobj, "versions");
 		const cfg_obj_t *suffixobj =
 				 cfg_tuple_get(fileobj, "suffix");
-		int32_t versions = ISC_LOG_ROLLNEVER;
+		isc_int32_t versions = ISC_LOG_ROLLNEVER;
 		isc_log_rollsuffix_t suffix = isc_log_rollsuffix_increment;
 		isc_offset_t size = 0;
-		uint64_t maxoffset;
+		isc_uint64_t maxoffset;

 		/*
 		 * isc_offset_t is a signed integer type, so the maximum
@@ -305,8 +302,8 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 	const cfg_obj_t *channels = NULL;
 	const cfg_obj_t *categories = NULL;
 	const cfg_listelt_t *element;
-	bool default_set = false;
-	bool unmatched_set = false;
+	isc_boolean_t default_set = ISC_FALSE;
+	isc_boolean_t unmatched_set = ISC_FALSE;
 	const cfg_obj_t *catname;

 	if (logconfig != NULL)
@@ -331,12 +328,12 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		if (!default_set) {
 			catname = cfg_tuple_get(category, "name");
 			if (strcmp(cfg_obj_asstring(catname), "default") == 0)
-				default_set = true;
+				default_set = ISC_TRUE;
 		}
 		if (!unmatched_set) {
 			catname = cfg_tuple_get(category, "name");
 			if (strcmp(cfg_obj_asstring(catname), "unmatched") == 0)
-				unmatched_set = true;
+				unmatched_set = ISC_TRUE;
 		}
 	}

@@ -14,8 +14,6 @@
 #include <config.h>

 #include <ctype.h>
-#include <inttypes.h>
-#include <stdbool.h>
 #include <stdlib.h>
 #include <string.h>

@@ -23,7 +21,6 @@
 #include <isc/backtrace.h>
 #include <isc/commandline.h>
 #include <isc/dir.h>
-#include <isc/entropy.h>
 #include <isc/file.h>
 #include <isc/hash.h>
 #include <isc/httpd.h>
@@ -47,7 +44,7 @@
 #include <dns/view.h>

 #include <dst/result.h>
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif

@@ -74,12 +71,11 @@
 #include <named/os.h>
 #include <named/server.h>
 #include <named/main.h>
-#include <named/seccomp.h>
 #ifdef HAVE_LIBSCF
 #include <named/smf_globals.h>
 #endif

-#ifdef OPENSSL
+#if HAVE_OPENSSL
 #include <openssl/opensslv.h>
 #include <openssl/crypto.h>
 #endif
@@ -113,7 +109,7 @@ LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_hour;
 LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_day;
 LIBDNS_EXTERNAL_DATA extern unsigned int dns_zone_mkey_month;

-static bool	want_stats = false;
+static isc_boolean_t	want_stats = ISC_FALSE;
 static char		program_name[ISC_DIR_NAMEMAX] = "named";
 static char		absolute_conffile[ISC_DIR_PATHMAX];
 static char		saved_command_line[512];
@@ -124,22 +120,21 @@ static int		maxudp = 0;
 /*
 * -T options:
 */
-static bool clienttest = false;
-static bool dropedns = false;
-static bool noedns = false;
-static bool nosoa = false;
-static bool noaa = false;
+static isc_boolean_t clienttest = ISC_FALSE;
+static isc_boolean_t dropedns = ISC_FALSE;
+static isc_boolean_t noedns = ISC_FALSE;
+static isc_boolean_t nosoa = ISC_FALSE;
+static isc_boolean_t noaa = ISC_FALSE;
 static unsigned int delay = 0;
-static bool nonearest = false;
-static bool notcp = false;
-static bool fixedlocal = false;
-static bool sigvalinsecs = false;
+static isc_boolean_t nonearest = ISC_FALSE;
+static isc_boolean_t notcp = ISC_FALSE;
+static isc_boolean_t fixedlocal = ISC_FALSE;

 /*
 * -4 and -6
 */
-static bool disable6 = false;
-static bool disable4 = false;
+static isc_boolean_t disable6 = ISC_FALSE;
+static isc_boolean_t disable4 = ISC_FALSE;

 void
 named_main_earlywarning(const char *format, ...) {
@@ -342,7 +337,7 @@ save_command_line(int argc, char *argv[]) {
 	char *dst;
 	char *eob;
 	const char truncated[] = "...";
-	bool quoted = false;
+	isc_boolean_t quoted = ISC_FALSE;

 	dst = saved_command_line;
 	eob = saved_command_line + sizeof(saved_command_line);
@@ -362,10 +357,10 @@ save_command_line(int argc, char *argv[]) {
 			    *src == '-' || *src == '_' ||
 			    *src == '.' || *src == '/') {
 				*dst++ = *src++;
-				quoted = false;
+				quoted = ISC_FALSE;
 			} else {
 				*dst++ = '\\';
-				quoted = true;
+				quoted = ISC_TRUE;
 			}
 		}
 	}
@@ -396,25 +391,25 @@ parse_int(char *arg, const char *desc) {
 static struct flag_def {
 	const char *name;
 	unsigned int value;
-	bool negate;
+	isc_boolean_t negate;
 } mem_debug_flags[] = {
-	{ "none", 0, false },
-	{ "trace",  ISC_MEM_DEBUGTRACE, false },
-	{ "record", ISC_MEM_DEBUGRECORD, false },
-	{ "usage", ISC_MEM_DEBUGUSAGE, false },
-	{ "size", ISC_MEM_DEBUGSIZE, false },
-	{ "mctx", ISC_MEM_DEBUGCTX, false },
-	{ NULL, 0, false }
+	{ "none", 0, ISC_FALSE },
+	{ "trace",  ISC_MEM_DEBUGTRACE, ISC_FALSE },
+	{ "record", ISC_MEM_DEBUGRECORD, ISC_FALSE },
+	{ "usage", ISC_MEM_DEBUGUSAGE, ISC_FALSE },
+	{ "size", ISC_MEM_DEBUGSIZE, ISC_FALSE },
+	{ "mctx", ISC_MEM_DEBUGCTX, ISC_FALSE },
+	{ NULL, 0, ISC_FALSE }
 }, mem_context_flags[] = {
-	{ "external", ISC_MEMFLAG_INTERNAL, true },
-	{ "fill", ISC_MEMFLAG_FILL, false },
-	{ "nofill", ISC_MEMFLAG_FILL, true },
-	{ NULL, 0, false }
+	{ "external", ISC_MEMFLAG_INTERNAL, ISC_TRUE },
+	{ "fill", ISC_MEMFLAG_FILL, ISC_FALSE },
+	{ "nofill", ISC_MEMFLAG_FILL, ISC_TRUE },
+	{ NULL, 0, ISC_FALSE }
 };

 static void
 set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
-	bool clear = false;
+	isc_boolean_t clear = ISC_FALSE;

 	for (;;) {
 		const struct flag_def *def;
@@ -427,7 +422,7 @@ set_flags(const char *arg, struct flag_def *defs, unsigned int *ret) {
 			if (arglen == (int)strlen(def->name) &&
 			    memcmp(arg, def->name, arglen) == 0) {
 				if (def->value == 0)
-					clear = true;
+					clear = ISC_TRUE;
 				if (def->negate)
 					*ret &= ~(def->value);
 				else
@@ -469,96 +464,12 @@ parse_fuzz_arg(void) {
 	}
 }

-static void
-parse_T_opt(char *option) {
-	const char *p;
-	/*
-	 * force the server to behave (or misbehave) in
-	 * specified ways for testing purposes.
-	 *
-	 * clienttest: make clients single shot with their
-	 * 	       own memory context.
-	 * delay=xxxx: delay client responses by xxxx ms to
-	 *	       simulate remote servers.
-	 * dscp=x:     check that dscp values are as
-	 * 	       expected and assert otherwise.
-	 */
-	if (!strcmp(option, "clienttest")) {
-		clienttest = true;
-	} else if (!strncmp(option, "delay=", 6)) {
-		delay = atoi(option + 6);
-	} else if (!strcmp(option, "dropedns")) {
-		dropedns = true;
-	} else if (!strncmp(option, "dscp=", 5)) {
-		isc_dscp_check_value = atoi(option + 5);
-	} else if (!strcmp(option, "fixedlocal")) {
-		fixedlocal = true;
-	} else if (!strcmp(option, "keepstderr")) {
-		named_g_keepstderr = true;
-	} else if (!strcmp(option, "noaa")) {
-		noaa = true;
-	} else if (!strcmp(option, "noedns")) {
-		noedns = true;
-	} else if (!strcmp(option, "nonearest")) {
-		nonearest = true;
-	} else if (!strcmp(option, "nosoa")) {
-		nosoa = true;
-	} else if (!strcmp(option, "nosyslog")) {
-		named_g_nosyslog = true;
-	} else if (!strcmp(option, "notcp")) {
-		notcp = true;
-	} else if (!strcmp(option, "maxudp512")) {
-		maxudp = 512;
-	} else if (!strcmp(option, "maxudp1460")) {
-		maxudp = 1460;
-	} else if (!strncmp(option, "maxudp=", 7)) {
-		maxudp = atoi(option + 7);
-	} else if (!strncmp(option, "mkeytimers=", 11)) {
-		p = strtok(option + 11, "/");
-		if (p == NULL) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		dns_zone_mkey_hour = atoi(p);
-		if (dns_zone_mkey_hour == 0) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-
-		p = strtok(NULL, "/");
-		if (p == NULL) {
-			dns_zone_mkey_day = (24 * dns_zone_mkey_hour);
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_day = atoi(p);
-		if (dns_zone_mkey_day < dns_zone_mkey_hour)
-			named_main_earlyfatal("bad mkeytimer");
-
-		p = strtok(NULL, "/");
-		if (p == NULL) {
-			dns_zone_mkey_month = (30 * dns_zone_mkey_day);
-			return;
-		}
-
-		dns_zone_mkey_month = atoi(p);
-		if (dns_zone_mkey_month < dns_zone_mkey_day) {
-			named_main_earlyfatal("bad mkeytimer");
-		}
-	} else if (!strcmp(option, "sigvalinsecs")) {
-		sigvalinsecs = true;
-	} else if (!strncmp(option, "tat=", 4)) {
-		named_g_tat_interval = atoi(option + 4);
-	} else {
-		fprintf(stderr, "unknown -T flag '%s\n", option);
-	}
-}
-
 static void
 parse_command_line(int argc, char *argv[]) {
 	int ch;
 	int port;
 	const char *p;
+	char *last;

 	save_command_line(argc, argv);

@@ -566,7 +477,7 @@ parse_command_line(int argc, char *argv[]) {
 	 * NAMED_MAIN_ARGS is defined in main.h, so that it can be used
 	 * both by named and by ntservice hooks.
 	 */
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
 					   NAMED_MAIN_ARGS)) != -1)
 	{
@@ -579,7 +490,7 @@ parse_command_line(int argc, char *argv[]) {
 				named_main_earlyfatal("IPv4 not supported "
 						      "by OS");
 			isc_net_disableipv6();
-			disable6 = true;
+			disable6 = ISC_TRUE;
 			break;
 		case '6':
 			if (disable6)
@@ -589,14 +500,14 @@ parse_command_line(int argc, char *argv[]) {
 				named_main_earlyfatal("IPv6 not supported "
 						      "by OS");
 			isc_net_disableipv4();
-			disable4 = true;
+			disable4 = ISC_TRUE;
 			break;
 		case 'A':
 			parse_fuzz_arg();
 			break;
 		case 'c':
 			named_g_conffile = isc_commandline_argument;
-			named_g_conffileset = true;
+			named_g_conffileset = ISC_TRUE;
 			break;
 		case 'd':
 			named_g_debuglevel = parse_int(isc_commandline_argument,
@@ -609,11 +520,11 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_engine = isc_commandline_argument;
 			break;
 		case 'f':
-			named_g_foreground = true;
+			named_g_foreground = ISC_TRUE;
 			break;
 		case 'g':
-			named_g_foreground = true;
-			named_g_logstderr = true;
+			named_g_foreground = ISC_TRUE;
+			named_g_logstderr = ISC_TRUE;
 			break;
 		case 'L':
 			named_g_logfile = isc_commandline_argument;
@@ -642,7 +553,7 @@ parse_command_line(int argc, char *argv[]) {
 			break;
 		case 's':
 			/* XXXRTH temporary syntax */
-			want_stats = true;
+			want_stats = ISC_TRUE;
 			break;
 		case 'S':
 			maxsocks = parse_int(isc_commandline_argument,
@@ -653,7 +564,95 @@ parse_command_line(int argc, char *argv[]) {
 			named_g_chrootdir = isc_commandline_argument;
 			break;
 		case 'T':	/* NOT DOCUMENTED */
-			parse_T_opt(isc_commandline_argument);
+			/*
+			 * force the server to behave (or misbehave) in
+			 * specified ways for testing purposes.
+			 *
+			 * clienttest: make clients single shot with their
+			 * 	       own memory context.
+			 * delay=xxxx: delay client responses by xxxx ms to
+			 *	       simulate remote servers.
+			 * dscp=x:     check that dscp values are as
+			 * 	       expected and assert otherwise.
+			 */
+			if (!strcmp(isc_commandline_argument, "clienttest"))
+				clienttest = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nosoa"))
+				nosoa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noaa"))
+				noaa = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp512"))
+				maxudp = 512;
+			else if (!strcmp(isc_commandline_argument,
+					 "maxudp1460"))
+				maxudp = 1460;
+			else if (!strcmp(isc_commandline_argument, "dropedns"))
+				dropedns = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "noedns"))
+				noedns = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument,
+					  "maxudp=", 7))
+				maxudp = atoi(isc_commandline_argument + 7);
+			else if (!strncmp(isc_commandline_argument,
+					  "delay=", 6))
+				delay = atoi(isc_commandline_argument + 6);
+			else if (!strcmp(isc_commandline_argument, "nosyslog"))
+				named_g_nosyslog = ISC_TRUE;
+			else if (!strcmp(isc_commandline_argument, "nonearest"))
+				nonearest = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "dscp=", 5))
+				isc_dscp_check_value =
+					   atoi(isc_commandline_argument + 5);
+			else if (!strncmp(isc_commandline_argument,
+					  "mkeytimers=", 11))
+			{
+				p = strtok_r(isc_commandline_argument + 11, "/", &last);
+				if (p == NULL)
+					named_main_earlyfatal("bad mkeytimer");
+				dns_zone_mkey_hour = atoi(p);
+				if (dns_zone_mkey_hour == 0)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_day =
+						(24 * dns_zone_mkey_hour);
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_day = atoi(p);
+				if (dns_zone_mkey_day < dns_zone_mkey_hour)
+					named_main_earlyfatal("bad mkeytimer");
+
+				p = strtok_r(NULL, "/", &last);
+				if (p == NULL) {
+					dns_zone_mkey_month =
+						(30 * dns_zone_mkey_day);
+					break;
+				}
+				dns_zone_mkey_month = atoi(p);
+				if (dns_zone_mkey_month < dns_zone_mkey_day)
+					named_main_earlyfatal("bad mkeytimer");
+			} else if (!strcmp(isc_commandline_argument, "notcp"))
+				notcp = ISC_TRUE;
+			else if (!strncmp(isc_commandline_argument, "tat=", 4))
+			{
+				named_g_tat_interval =
+					   atoi(isc_commandline_argument + 4);
+			} else if (!strcmp(isc_commandline_argument,
+					 "keepstderr"))
+			{
+				named_g_keepstderr = ISC_TRUE;
+			} else if (!strcmp(isc_commandline_argument,
+					   "fixedlocal"))
+			{
+				fixedlocal = ISC_TRUE;
+			} else {
+				fprintf(stderr, "unknown -T flag '%s\n",
+					isc_commandline_argument);
+			}
 			break;
 		case 'U':
 			named_g_udpdisp = parse_int(isc_commandline_argument,
@@ -694,7 +693,7 @@ parse_command_line(int argc, char *argv[]) {
 #ifdef __SUNPRO_C
 			printf("compiled by Solaris Studio %x\n", __SUNPRO_C);
 #endif
-#ifdef OPENSSL
+#if HAVE_OPENSSL
 			printf("compiled with OpenSSL version: %s\n",
 			       OPENSSL_VERSION_TEXT);
 #if !defined(LIBRESSL_VERSION_NUMBER) && \
@@ -735,7 +734,7 @@ parse_command_line(int argc, char *argv[]) {
 			/* Obsolete. No longer in use. Ignore. */
 			break;
 		case 'X':
-			named_g_forcelock = true;
+			named_g_forcelock = ISC_TRUE;
 			if (strcasecmp(isc_commandline_argument, "none") != 0)
 				named_g_defaultlockfile =
 					isc_commandline_argument;
@@ -845,23 +844,6 @@ create_managers(void) {
 			      ISC_LOG_INFO, "using up to %u sockets", socks);
 	}

-	result = isc_entropy_create(named_g_mctx, &named_g_entropy);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_entropy_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
-	result = isc_hash_create(named_g_mctx, named_g_entropy,
-				 DNS_NAME_MAXWIRE);
-	if (result != ISC_R_SUCCESS) {
-		UNEXPECTED_ERROR(__FILE__, __LINE__,
-				 "isc_hash_create() failed: %s",
-				 isc_result_totext(result));
-		return (ISC_R_UNEXPECTED);
-	}
-
 	return (ISC_R_SUCCESS);
 }

@@ -873,13 +855,6 @@ destroy_managers(void) {
 	isc_taskmgr_destroy(&named_g_taskmgr);
 	isc_timermgr_destroy(&named_g_timermgr);
 	isc_socketmgr_destroy(&named_g_socketmgr);
-
-	/*
-	 * isc_hash_destroy() cannot be called as long as a resolver may be
-	 * running.  Calling this after isc_taskmgr_destroy() ensures the
-	 * call is safe.
-	 */
-	isc_hash_destroy();
 }

 static void
@@ -911,60 +886,6 @@ dump_symboltable(void) {
 	}
 }

-#ifdef HAVE_LIBSECCOMP
-static void
-setup_seccomp() {
-	scmp_filter_ctx ctx;
-	unsigned int i;
-	int ret;
-
-	/* Make sure the lists are in sync */
-	INSIST((sizeof(scmp_syscalls) / sizeof(int)) ==
-	       (sizeof(scmp_syscall_names) / sizeof(const char *)));
-
-	ctx = seccomp_init(SCMP_ACT_KILL);
-	if (ctx == NULL) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-			      "libseccomp activation failed");
-		return;
-	}
-
-	for (i = 0 ; i < sizeof(scmp_syscalls)/sizeof(*(scmp_syscalls)); i++) {
-		ret = seccomp_rule_add(ctx, SCMP_ACT_ALLOW,
-				       scmp_syscalls[i], 0);
-		if (ret < 0)
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-				      "libseccomp rule failed: %s",
-				      scmp_syscall_names[i]);
-
-		else
-			isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-				      NAMED_LOGMODULE_MAIN, ISC_LOG_DEBUG(9),
-				      "added libseccomp rule: %s",
-				      scmp_syscall_names[i]);
-	}
-
-	ret = seccomp_load(ctx);
-	if (ret < 0) {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_WARNING,
-			      "libseccomp unable to load filter");
-	} else {
-		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-			      "libseccomp sandboxing active");
-	}
-
-	/*
-	 * Release filter in ctx. Filters already loaded are not
-	 * affected.
-	 */
-	seccomp_release(ctx);
-}
-#endif /* HAVE_LIBSECCOMP */
-
 static void
 setup(void) {
 	isc_result_t result;
@@ -1000,30 +921,6 @@ setup(void) {
 		isc_mem_free(named_g_mctx, instance);
 #endif /* HAVE_LIBSCF */

-#ifdef PATH_RANDOMDEV
-	/*
-	 * Initialize system's random device as fallback entropy source
-	 * if running chroot'ed.
-	 */
-	if (named_g_chrootdir != NULL) {
-		result = isc_entropy_create(named_g_mctx,
-					    &named_g_fallbackentropy);
-		if (result != ISC_R_SUCCESS)
-			named_main_earlyfatal("isc_entropy_create() failed: %s",
-					   isc_result_totext(result));
-
-		result = isc_entropy_createfilesource(named_g_fallbackentropy,
-						      PATH_RANDOMDEV);
-		if (result != ISC_R_SUCCESS) {
-			named_main_earlywarning("could not open pre-chroot "
-					     "entropy source %s: %s",
-					     PATH_RANDOMDEV,
-					     isc_result_totext(result));
-			isc_entropy_detach(&named_g_fallbackentropy);
-		}
-	}
-#endif
-
 #ifdef ISC_PLATFORM_USETHREADS
 	/*
 	 * Check for the number of cpu's before named_os_chroot().
@@ -1043,7 +940,7 @@ setup(void) {
 	 */
 	named_os_minprivs();

-	result = named_log_init((named_g_username != NULL));
+	result = named_log_init(ISC_TF(named_g_username != NULL));
 	if (result != ISC_R_SUCCESS)
 		named_main_earlyfatal("named_log_init() failed: %s",
 				   isc_result_totext(result));
@@ -1086,85 +983,6 @@ setup(void) {
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 		      "running as: %s%s",
 		      program_name, saved_command_line);
-#ifdef __clang__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by CLANG %s", __VERSION__);
-#else
-#if defined(__ICC) || defined(__INTEL_COMPILER)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by ICC %s", __VERSION__);
-#else
-#ifdef __GNUC__
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by GCC %s", __VERSION__);
-#endif
-#endif
-#endif
-#ifdef _MSC_VER
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by MSVC %d", _MSC_VER);
-#endif
-#ifdef __SUNPRO_C
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled by Solaris Studio %x", __SUNPRO_C);
-#endif
-#ifdef OPENSSL
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with OpenSSL version: %s",
-		      OPENSSL_VERSION_TEXT);
-#if !defined(LIBRESSL_VERSION_NUMBER) && \
-    OPENSSL_VERSION_NUMBER >= 0x10100000L /* 1.1.0 or higher */
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      OpenSSL_version(OPENSSL_VERSION));
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to OpenSSL version: %s",
-		      SSLeay_version(SSLEAY_VERSION));
-#endif /* OPENSSL_VERSION_NUMBER >= 0x10100000L */
-#endif
-#ifdef HAVE_LIBXML2
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libxml2 version: %s",
-		      LIBXML_DOTTED_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libxml2 version: %s", xmlParserVersion);
-#endif
-#if defined(HAVE_JSON) && defined(JSON_C_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with libjson-c version: %s", JSON_C_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to libjson-c version: %s", json_c_version());
-#endif
-#if defined(HAVE_ZLIB) && defined(ZLIB_VERSION)
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "compiled with zlib version: %s", ZLIB_VERSION);
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "linked to zlib version: %s", zlibVersion());
-#endif
-#ifdef ISC_PLATFORM_USETHREADS
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is enabled");
-#else
-	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
-		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
-		      "threads support is disabled");
-#endif

 	isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 		      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
@@ -1211,8 +1029,8 @@ setup(void) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
 			      "adjusted limit on open files from "
-			      "%" PRIu64 " to "
-			      "%" PRIu64,
+			      "%" ISC_PRINT_QUADFORMAT "u to "
+			      "%" ISC_PRINT_QUADFORMAT "u",
 			      old_openfiles, named_g_initopenfiles);
 	}

@@ -1279,33 +1097,27 @@ setup(void) {
 	 * Modify server context according to command line options
 	 */
 	if (clienttest)
-		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, true);
+		ns_server_setoption(sctx, NS_SERVER_CLIENTTEST, ISC_TRUE);
 	if (dropedns)
-		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, true);
+		ns_server_setoption(sctx, NS_SERVER_DROPEDNS, ISC_TRUE);
 	if (noedns)
-		ns_server_setoption(sctx, NS_SERVER_NOEDNS, true);
+		ns_server_setoption(sctx, NS_SERVER_NOEDNS, ISC_TRUE);
 	if (nosoa)
-		ns_server_setoption(sctx, NS_SERVER_NOSOA, true);
+		ns_server_setoption(sctx, NS_SERVER_NOSOA, ISC_TRUE);
 	if (noaa)
-		ns_server_setoption(sctx, NS_SERVER_NOAA, true);
+		ns_server_setoption(sctx, NS_SERVER_NOAA, ISC_TRUE);
 	if (nonearest)
-		ns_server_setoption(sctx, NS_SERVER_NONEAREST, true);
+		ns_server_setoption(sctx, NS_SERVER_NONEAREST, ISC_TRUE);
 	if (notcp)
-		ns_server_setoption(sctx, NS_SERVER_NOTCP, true);
+		ns_server_setoption(sctx, NS_SERVER_NOTCP, ISC_TRUE);
 	if (fixedlocal)
-		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, true);
+		ns_server_setoption(sctx, NS_SERVER_FIXEDLOCAL, ISC_TRUE);
 	if (disable4)
-		ns_server_setoption(sctx, NS_SERVER_DISABLE4, true);
+		ns_server_setoption(sctx, NS_SERVER_DISABLE4, ISC_TRUE);
 	if (disable6)
-		ns_server_setoption(sctx, NS_SERVER_DISABLE6, true);
-	if (sigvalinsecs)
-		ns_server_setoption(sctx, NS_SERVER_SIGVALINSECS, true);
+		ns_server_setoption(sctx, NS_SERVER_DISABLE6, ISC_TRUE);

 	named_g_server->sctx->delay = delay;
-
-#ifdef HAVE_LIBSECCOMP
-	setup_seccomp();
-#endif /* HAVE_LIBSECCOMP */
 }

 static void
@@ -1315,10 +1127,6 @@ cleanup(void) {
 	if (named_g_mapped != NULL)
 		dns_acl_detach(&named_g_mapped);

-	isc_entropy_detach(&named_g_entropy);
-	if (named_g_fallbackentropy != NULL)
-		isc_entropy_detach(&named_g_fallbackentropy);
-
 	named_server_destroy(&named_g_server);

 	named_builtin_deinit();
@@ -1471,7 +1279,7 @@ main(int argc, char *argv[]) {
 	dns_result_register();
 	dst_result_register();
 	isccc_result_register();
-#ifdef PKCS11CRYPTO
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif

@@ -10,12 +10,12 @@
 .\"     Title: named.conf
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2018-06-21
+.\"      Date: 2018-01-22
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "NAMED\&.CONF" "5" "2018\-06\-21" "ISC" "BIND9"
+.TH "NAMED\&.CONF" "5" "2018\-01\-22" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -199,7 +199,6 @@ options {
 	    ] [ dscp \fIinteger\fR ];
 	alt\-transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR |
 	    * ) ] [ dscp \fIinteger\fR ];
-	answer\-cookie \fIboolean\fR;
 	attach\-cache \fIstring\fR;
 	auth\-nxdomain \fIboolean\fR; // default changed
 	auto\-dnssec ( allow | maintain | off );
@@ -218,8 +217,9 @@ options {
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check\-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -307,7 +307,8 @@ options {
 	hostname ( \fIquoted_string\fR | none );
 	inline\-signing \fIboolean\fR;
 	interface\-interval \fIinteger\fR;
-	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
+	ixfr\-from\-differences ( primary | master | secondary | slave |
+	    \fIboolean\fR );
 	keep\-response\-order { \fIaddress_match_element\fR; \&.\&.\&. };
 	key\-directory \fIquoted_string\fR;
 	lame\-ttl \fIttlval\fR;
@@ -419,7 +420,6 @@ options {
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
-	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
 	secroots\-file \fIquoted_string\fR;
@@ -585,8 +585,9 @@ view \fIstring\fR [ \fIclass\fR ] {
 	check\-integrity \fIboolean\fR;
 	check\-mx ( fail | warn | ignore );
 	check\-mx\-cname ( fail | warn | ignore );
-	check\-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check\-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check\-sibling \fIboolean\fR;
 	check\-spf ( warn | ignore );
 	check\-srv\-cname ( fail | warn | ignore );
@@ -652,7 +653,8 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    | \fIipv6_address\fR ) [ port \fIinteger\fR ] [ dscp \fIinteger\fR ]; \&.\&.\&. };
 	glue\-cache \fIboolean\fR;
 	inline\-signing \fIboolean\fR;
-	ixfr\-from\-differences ( master | slave | \fIboolean\fR );
+	ixfr\-from\-differences ( primary | master | secondary | slave |
+	    \fIboolean\fR );
 	key \fIstring\fR {
 		algorithm \fIstring\fR;
 		secret \fIstring\fR;
@@ -753,7 +755,6 @@ view \fIstring\fR [ \fIclass\fR ] {
 	    dnsrps\-enable \fIboolean\fR ] [ dnsrps\-options { \fIunspecified\-text\fR
 	    } ];
 	root\-delegation\-only [ exclude { \fIquoted_string\fR; \&.\&.\&. } ];
-	root\-key\-sentinel \fIboolean\fR;
 	rrset\-order { [ class \fIstring\fR ] [ type \fIstring\fR ] [ name
 	    \fIquoted_string\fR ] \fIstring\fR \fIstring\fR; \&.\&.\&. };
 	send\-cookie \fIboolean\fR;
@@ -903,14 +904,15 @@ view \fIstring\fR [ \fIclass\fR ] {
 		transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port (
 		    \fIinteger\fR | * ) ] [ dscp \fIinteger\fR ];
 		try\-tcp\-refresh \fIboolean\fR;
-		type ( delegation\-only | forward | hint | master | redirect
-		    | slave | static\-stub | stub );
+		type ( primary | master | secondary | slave |
+		    delegation\-only | forward | hint | redirect |
+		    static\-stub | stub );
 		update\-check\-ksk \fIboolean\fR;
 		update\-policy ( local | { ( deny | grant ) \fIstring\fR (
-		    6to4\-self | external | krb5\-self | krb5\-selfsub |
-		    krb5\-subdomain | ms\-self | ms\-selfsub | ms\-subdomain |
-		    name | self | selfsub | selfwild | subdomain | tcp\-self
-		    | wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
+		    6to4\-self | external | krb5\-self | krb5\-subdomain |
+		    ms\-self | ms\-subdomain | name | self | selfsub |
+		    selfwild | subdomain | tcp\-self | wildcard | zonesub )
+		    [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
 		use\-alt\-transfer\-source \fIboolean\fR;
 		zero\-no\-soa\-ttl \fIboolean\fR;
 		zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -1008,14 +1010,13 @@ zone \fIstring\fR [ \fIclass\fR ] {
 	transfer\-source\-v6 ( \fIipv6_address\fR | * ) [ port ( \fIinteger\fR | * )
 	    ] [ dscp \fIinteger\fR ];
 	try\-tcp\-refresh \fIboolean\fR;
-	type ( delegation\-only | forward | hint | master | redirect | slave
-	    | static\-stub | stub );
+	type ( primary | master | secondary | slave | delegation\-only |
+	    forward | hint | redirect | static\-stub | stub );
 	update\-check\-ksk \fIboolean\fR;
 	update\-policy ( local | { ( deny | grant ) \fIstring\fR ( 6to4\-self |
-	    external | krb5\-self | krb5\-selfsub | krb5\-subdomain | ms\-self
-	    | ms\-selfsub | ms\-subdomain | name | self | selfsub | selfwild
-	    | subdomain | tcp\-self | wildcard | zonesub ) [ \fIstring\fR ]
-	    \fIrrtypelist\fR; \&.\&.\&. };
+	    external | krb5\-self | krb5\-subdomain | ms\-self | ms\-subdomain
+	    | name | self | selfsub | selfwild | subdomain | tcp\-self |
+	    wildcard | zonesub ) [ \fIstring\fR ] \fIrrtypelist\fR; \&.\&.\&. };
 	use\-alt\-transfer\-source \fIboolean\fR;
 	zero\-no\-soa\-ttl \fIboolean\fR;
 	zone\-statistics ( full | terse | none | \fIboolean\fR );
@@ -13,7 +13,7 @@

 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.named.conf">
  <info>
-    <date>2018-06-21</date>
+    <date>2018-01-22</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -192,7 +192,6 @@ options {
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	alt-transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> |
 	    * ) ] [ dscp <replaceable>integer</replaceable> ];
-	answer-cookie <replaceable>boolean</replaceable>;
 	attach-cache <replaceable>string</replaceable>;
 	auth-nxdomain <replaceable>boolean</replaceable>; // default changed
 	auto-dnssec ( allow | maintain | off );
@@ -211,8 +210,9 @@ options {
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -300,7 +300,8 @@ options {
 	hostname ( <replaceable>quoted_string</replaceable> | none );
 	inline-signing <replaceable>boolean</replaceable>;
 	interface-interval <replaceable>integer</replaceable>;
-	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
+	ixfr-from-differences ( primary | master | secondary | slave |
+	    <replaceable>boolean</replaceable> );
 	keep-response-order { <replaceable>address_match_element</replaceable>; ... };
 	key-directory <replaceable>quoted_string</replaceable>;
 	lame-ttl <replaceable>ttlval</replaceable>;
@@ -412,7 +413,6 @@ options {
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
-	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	secroots-file <replaceable>quoted_string</replaceable>;
@@ -562,8 +562,9 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	check-integrity <replaceable>boolean</replaceable>;
 	check-mx ( fail | warn | ignore );
 	check-mx-cname ( fail | warn | ignore );
-	check-names ( master | slave | response
-	    ) ( fail | warn | ignore );
+	check-names ( primary | master |
+	    secondary | slave | response ) (
+	    fail | warn | ignore );
 	check-sibling <replaceable>boolean</replaceable>;
 	check-spf ( warn | ignore );
 	check-srv-cname ( fail | warn | ignore );
@@ -629,7 +630,8 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    | <replaceable>ipv6_address</replaceable> ) [ port <replaceable>integer</replaceable> ] [ dscp <replaceable>integer</replaceable> ]; ... };
 	glue-cache <replaceable>boolean</replaceable>;
 	inline-signing <replaceable>boolean</replaceable>;
-	ixfr-from-differences ( master | slave | <replaceable>boolean</replaceable> );
+	ixfr-from-differences ( primary | master | secondary | slave |
+	    <replaceable>boolean</replaceable> );
 	key <replaceable>string</replaceable> {
 		algorithm <replaceable>string</replaceable>;
 		secret <replaceable>string</replaceable>;
@@ -730,7 +732,6 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	    dnsrps-enable <replaceable>boolean</replaceable> ] [ dnsrps-options { <replaceable>unspecified-text</replaceable>
 	    } ];
 	root-delegation-only [ exclude { <replaceable>quoted_string</replaceable>; ... } ];
-	root-key-sentinel <replaceable>boolean</replaceable>;
 	rrset-order { [ class <replaceable>string</replaceable> ] [ type <replaceable>string</replaceable> ] [ name
 	    <replaceable>quoted_string</replaceable> ] <replaceable>string</replaceable> <replaceable>string</replaceable>; ... };
 	send-cookie <replaceable>boolean</replaceable>;
@@ -880,14 +881,15 @@ view <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 		transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port (
 		    <replaceable>integer</replaceable> | * ) ] [ dscp <replaceable>integer</replaceable> ];
 		try-tcp-refresh <replaceable>boolean</replaceable>;
-		type ( delegation-only | forward | hint | master | redirect
-		    | slave | static-stub | stub );
+		type ( primary | master | secondary | slave |
+		    delegation-only | forward | hint | redirect |
+		    static-stub | stub );
 		update-check-ksk <replaceable>boolean</replaceable>;
 		update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> (
-		    6to4-self | external | krb5-self | krb5-selfsub |
-		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |
-		    name | self | selfsub | selfwild | subdomain | tcp-self
-		    | wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
+		    6to4-self | external | krb5-self | krb5-subdomain |
+		    ms-self | ms-subdomain | name | self | selfsub |
+		    selfwild | subdomain | tcp-self | wildcard | zonesub )
+		    [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
 		use-alt-transfer-source <replaceable>boolean</replaceable>;
 		zero-no-soa-ttl <replaceable>boolean</replaceable>;
 		zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -981,14 +983,13 @@ zone <replaceable>string</replaceable> [ <replaceable>class</replaceable> ] {
 	transfer-source-v6 ( <replaceable>ipv6_address</replaceable> | * ) [ port ( <replaceable>integer</replaceable> | * )
 	    ] [ dscp <replaceable>integer</replaceable> ];
 	try-tcp-refresh <replaceable>boolean</replaceable>;
-	type ( delegation-only | forward | hint | master | redirect | slave
-	    | static-stub | stub );
+	type ( primary | master | secondary | slave | delegation-only |
+	    forward | hint | redirect | static-stub | stub );
 	update-check-ksk <replaceable>boolean</replaceable>;
 	update-policy ( local | { ( deny | grant ) <replaceable>string</replaceable> ( 6to4-self |
-	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self
-	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild
-	    | subdomain | tcp-self | wildcard | zonesub ) [ <replaceable>string</replaceable> ]
-	    <replaceable>rrtypelist</replaceable>; ... };
+	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain
+	    | name | self | selfsub | selfwild | subdomain | tcp-self |
+	    wildcard | zonesub ) [ <replaceable>string</replaceable> ] <replaceable>rrtypelist</replaceable>; ... };
 	use-alt-transfer-source <replaceable>boolean</replaceable>;
 	zero-no-soa-ttl <replaceable>boolean</replaceable>;
 	zone-statistics ( full | terse | none | <replaceable>boolean</replaceable> );
@@ -180,7 +180,6 @@ options
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	alt-transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> |<br>
 	    * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
-	answer-cookie <em class="replaceable"><code>boolean</code></em>;<br>
 	attach-cache <em class="replaceable"><code>string</code></em>;<br>
 	auth-nxdomain <em class="replaceable"><code>boolean</code></em>; // default changed<br>
 	auto-dnssec ( allow | maintain | off );<br>
@@ -199,8 +198,9 @@ options
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( master | slave | response<br>
-	    ) ( fail | warn | ignore );<br>
+	check-names ( primary | master |<br>
+	    secondary | slave | response ) (<br>
+	    fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -288,7 +288,8 @@ options
 	hostname ( <em class="replaceable"><code>quoted_string</code></em> | none );<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
 	interface-interval <em class="replaceable"><code>integer</code></em>;<br>
-	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
+	ixfr-from-differences ( primary | master | secondary | slave |<br>
+	    <em class="replaceable"><code>boolean</code></em> );<br>
 	keep-response-order { <em class="replaceable"><code>address_match_element</code></em>; ... };<br>
 	key-directory <em class="replaceable"><code>quoted_string</code></em>;<br>
 	lame-ttl <em class="replaceable"><code>ttlval</code></em>;<br>
@@ -400,7 +401,6 @@ options
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
 	secroots-file <em class="replaceable"><code>quoted_string</code></em>;<br>
@@ -554,8 +554,9 @@ view
 	check-integrity <em class="replaceable"><code>boolean</code></em>;<br>
 	check-mx ( fail | warn | ignore );<br>
 	check-mx-cname ( fail | warn | ignore );<br>
-	check-names ( master | slave | response<br>
-	    ) ( fail | warn | ignore );<br>
+	check-names ( primary | master |<br>
+	    secondary | slave | response ) (<br>
+	    fail | warn | ignore );<br>
 	check-sibling <em class="replaceable"><code>boolean</code></em>;<br>
 	check-spf ( warn | ignore );<br>
 	check-srv-cname ( fail | warn | ignore );<br>
@@ -621,7 +622,8 @@ view
 	    | <em class="replaceable"><code>ipv6_address</code></em> ) [ port <em class="replaceable"><code>integer</code></em> ] [ dscp <em class="replaceable"><code>integer</code></em> ]; ... };<br>
 	glue-cache <em class="replaceable"><code>boolean</code></em>;<br>
 	inline-signing <em class="replaceable"><code>boolean</code></em>;<br>
-	ixfr-from-differences ( master | slave | <em class="replaceable"><code>boolean</code></em> );<br>
+	ixfr-from-differences ( primary | master | secondary | slave |<br>
+	    <em class="replaceable"><code>boolean</code></em> );<br>
 	key <em class="replaceable"><code>string</code></em> {<br>
 		algorithm <em class="replaceable"><code>string</code></em>;<br>
 		secret <em class="replaceable"><code>string</code></em>;<br>
@@ -722,7 +724,6 @@ view
 	    dnsrps-enable <em class="replaceable"><code>boolean</code></em> ] [ dnsrps-options { <em class="replaceable"><code>unspecified-text</code></em><br>
 	    } ];<br>
 	root-delegation-only [ exclude { <em class="replaceable"><code>quoted_string</code></em>; ... } ];<br>
-	root-key-sentinel <em class="replaceable"><code>boolean</code></em>;<br>
 	rrset-order { [ class <em class="replaceable"><code>string</code></em> ] [ type <em class="replaceable"><code>string</code></em> ] [ name<br>
 	    <em class="replaceable"><code>quoted_string</code></em> ] <em class="replaceable"><code>string</code></em> <em class="replaceable"><code>string</code></em>; ... };<br>
 	send-cookie <em class="replaceable"><code>boolean</code></em>;<br>
@@ -872,14 +873,15 @@ view
 		transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port (<br>
 		    <em class="replaceable"><code>integer</code></em> | * ) ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 		try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-		type ( delegation-only | forward | hint | master | redirect<br>
-		    | slave | static-stub | stub );<br>
+		type ( primary | master | secondary | slave |<br>
+		    delegation-only | forward | hint | redirect |<br>
+		    static-stub | stub );<br>
 		update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 		update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> (<br>
-		    6to4-self | external | krb5-self | krb5-selfsub |<br>
-		    krb5-subdomain | ms-self | ms-selfsub | ms-subdomain |<br>
-		    name | self | selfsub | selfwild | subdomain | tcp-self<br>
-		    | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+		    6to4-self | external | krb5-self | krb5-subdomain |<br>
+		    ms-self | ms-subdomain | name | self | selfsub |<br>
+		    selfwild | subdomain | tcp-self | wildcard | zonesub )<br>
+		    [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 		use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 		zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 		zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -974,14 +976,13 @@ zone
 	transfer-source-v6 ( <em class="replaceable"><code>ipv6_address</code></em> | * ) [ port ( <em class="replaceable"><code>integer</code></em> | * )<br>
 	    ] [ dscp <em class="replaceable"><code>integer</code></em> ];<br>
 	try-tcp-refresh <em class="replaceable"><code>boolean</code></em>;<br>
-	type ( delegation-only | forward | hint | master | redirect | slave<br>
-	    | static-stub | stub );<br>
+	type ( primary | master | secondary | slave | delegation-only |<br>
+	    forward | hint | redirect | static-stub | stub );<br>
 	update-check-ksk <em class="replaceable"><code>boolean</code></em>;<br>
 	update-policy ( local | { ( deny | grant ) <em class="replaceable"><code>string</code></em> ( 6to4-self |<br>
-	    external | krb5-self | krb5-selfsub | krb5-subdomain | ms-self<br>
-	    | ms-selfsub | ms-subdomain | name | self | selfsub | selfwild<br>
-	    | subdomain | tcp-self | wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ]<br>
-	    <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
+	    external | krb5-self | krb5-subdomain | ms-self | ms-subdomain<br>
+	    | name | self | selfsub | selfwild | subdomain | tcp-self |<br>
+	    wildcard | zonesub ) [ <em class="replaceable"><code>string</code></em> ] <em class="replaceable"><code>rrtypelist</code></em>; ... };<br>
 	use-alt-transfer-source <em class="replaceable"><code>boolean</code></em>;<br>
 	zero-no-soa-ttl <em class="replaceable"><code>boolean</code></em>;<br>
 	zone-statistics ( full | terse | none | <em class="replaceable"><code>boolean</code></em> );<br>
@@ -13,9 +13,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/buffer.h>
 #include <isc/httpd.h>
 #include <isc/json.h>
@@ -70,7 +67,7 @@ stats_dumparg {
 	void			*arg;		/* type dependent argument */
 	int			ncounters;	/* for general statistics */
 	int			*counterindices; /* for general statistics */
-	uint64_t		*countervalues;	 /* for general statistics */
+	isc_uint64_t		*countervalues;	 /* for general statistics */
 	isc_result_t		result;
 } stats_dumparg_t;

@@ -103,7 +100,7 @@ user_zonetype( dns_zone_t *zone ) {
 	};
 	const struct zt *tp;

-	if ((dns_zone_getoptions2(zone) & DNS_ZONEOPT2_AUTOEMPTY) != 0)
+	if ((dns_zone_getoptions(zone) & DNS_ZONEOPT_AUTOEMPTY) != 0)
 		return ("builtin");

 	view = dns_zone_getview(zone);
@@ -1051,7 +1048,7 @@ init_desc(void) {
 * Dump callback functions.
 */
 static void
-generalstat_dump(isc_statscounter_t counter, uint64_t val, void *arg) {
+generalstat_dump(isc_statscounter_t counter, isc_uint64_t val, void *arg) {
 	stats_dumparg_t *dumparg = arg;

 	REQUIRE(counter < dumparg->ncounters);
@@ -1061,10 +1058,10 @@ generalstat_dump(isc_statscounter_t counter, uint64_t val, void *arg) {
 static isc_result_t
 dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 	      const char *category, const char **desc, int ncounters,
-	      int *indices, uint64_t *values, int options)
+	      int *indices, isc_uint64_t *values, int options)
 {
 	int i, idx;
-	uint64_t value;
+	isc_uint64_t value;
 	stats_dumparg_t dumparg;
 	FILE *fp;
 #ifdef HAVE_LIBXML2
@@ -1109,7 +1106,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 		switch (dumparg.type) {
 		case isc_statsformat_file:
 			fp = arg;
-			fprintf(fp, "%20" PRIu64 " %s\n",
+			fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n",
 				value, desc[idx]);
 			break;
 		case isc_statsformat_xml:
@@ -1137,7 +1134,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 							       ISC_XMLCHAR
 							       "counter"));
 				TRY0(xmlTextWriterWriteFormatString(writer,
-					"%" PRIu64, value));
+					"%" ISC_PRINT_QUADFORMAT "u", value));

 				TRY0(xmlTextWriterEndElement(writer));
 				/* </counter> */
@@ -1154,7 +1151,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 								 ISC_XMLCHAR
 								 desc[idx]));
 				TRY0(xmlTextWriterWriteFormatString(writer,
-					"%" PRIu64, value));
+					"%" ISC_PRINT_QUADFORMAT "u", value));
 				TRY0(xmlTextWriterEndElement(writer));
 				/* counter */
 			}
@@ -1182,7 +1179,7 @@ dump_counters(isc_stats_t *stats, isc_statsformat_t type, void *arg,
 }

 static void
-rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
+rdtypestat_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 	char typebuf[64];
 	const char *typestr;
 	stats_dumparg_t *dumparg = arg;
@@ -1206,7 +1203,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 	switch (dumparg->type) {
 	case isc_statsformat_file:
 		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s\n", val, typestr);
+		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, typestr);
 		break;
 	case isc_statsformat_xml:
 #ifdef HAVE_LIBXML2
@@ -1218,7 +1215,7 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 						 ISC_XMLCHAR typestr));

 		TRY0(xmlTextWriterWriteFormatString(writer,
-					       "%" PRIu64,
+					       "%" ISC_PRINT_QUADFORMAT "u",
 					       val));

 		TRY0(xmlTextWriterEndElement(writer)); /* type */
@@ -1246,13 +1243,13 @@ rdtypestat_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 }

 static void
-rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
+rdatasetstats_dump(dns_rdatastatstype_t type, isc_uint64_t val, void *arg) {
 	stats_dumparg_t *dumparg = arg;
 	FILE *fp;
 	char typebuf[64];
 	const char *typestr;
-	bool nxrrset = false;
-	bool stale = false;
+	isc_boolean_t nxrrset = ISC_FALSE;
+	isc_boolean_t stale = ISC_FALSE;
 #ifdef HAVE_LIBXML2
 	xmlTextWriterPtr writer;
 	int xmlrc;
@@ -1276,16 +1273,16 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {

 	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_NXRRSET)
 	    != 0)
-		nxrrset = true;
+		nxrrset = ISC_TRUE;

 	if ((DNS_RDATASTATSTYPE_ATTR(type) & DNS_RDATASTATSTYPE_ATTR_STALE)
 	    != 0)
-		stale = true;
+		stale = ISC_TRUE;

 	switch (dumparg->type) {
 	case isc_statsformat_file:
 		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s%s%s\n", val,
+		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s%s%s\n", val,
 			stale ? "#" : "", nxrrset ? "!" : "", typestr);
 		break;
 	case isc_statsformat_xml:
@@ -1301,7 +1298,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {

 		TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "counter"));
 		TRY0(xmlTextWriterWriteFormatString(writer,
-					       "%" PRIu64,
+					       "%" ISC_PRINT_QUADFORMAT "u",
 					       val));
 		TRY0(xmlTextWriterEndElement(writer)); /* counter */

@@ -1332,7 +1329,7 @@ rdatasetstats_dump(dns_rdatastatstype_t type, uint64_t val, void *arg) {
 }

 static void
-opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
+opcodestat_dump(dns_opcode_t code, isc_uint64_t val, void *arg) {
 	FILE *fp;
 	isc_buffer_t b;
 	char codebuf[64];
@@ -1352,7 +1349,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 	switch (dumparg->type) {
 	case isc_statsformat_file:
 		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s\n", val, codebuf);
+		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, codebuf);
 		break;
 	case isc_statsformat_xml:
 #ifdef HAVE_LIBXML2
@@ -1361,7 +1358,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
 						 ISC_XMLCHAR codebuf ));
 		TRY0(xmlTextWriterWriteFormatString(writer,
-						"%" PRIu64,
+						"%" ISC_PRINT_QUADFORMAT "u",
 						val));
 		TRY0(xmlTextWriterEndElement(writer)); /* counter */
 #endif
@@ -1389,7 +1386,7 @@ opcodestat_dump(dns_opcode_t code, uint64_t val, void *arg) {
 }

 static void
-rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
+rcodestat_dump(dns_rcode_t code, isc_uint64_t val, void *arg) {
 	FILE *fp;
 	isc_buffer_t b;
 	char codebuf[64];
@@ -1409,7 +1406,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 	switch (dumparg->type) {
 	case isc_statsformat_file:
 		fp = dumparg->arg;
-		fprintf(fp, "%20" PRIu64 " %s\n", val, codebuf);
+		fprintf(fp, "%20" ISC_PRINT_QUADFORMAT "u %s\n", val, codebuf);
 		break;
 	case isc_statsformat_xml:
 #ifdef HAVE_LIBXML2
@@ -1418,7 +1415,7 @@ rcodestat_dump(dns_rcode_t code, uint64_t val, void *arg) {
 		TRY0(xmlTextWriterWriteAttribute(writer, ISC_XMLCHAR "name",
 						 ISC_XMLCHAR codebuf ));
 		TRY0(xmlTextWriterWriteFormatString(writer,
-						"%" PRIu64,
+						"%" ISC_PRINT_QUADFORMAT "u",
 						val));
 		TRY0(xmlTextWriterEndElement(writer)); /* counter */
 #endif
@@ -1463,7 +1460,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	isc_result_t result;
 	char buf[1024 + 32];	/* sufficiently large for zone name and class */
 	dns_rdataclass_t rdclass;
-	uint32_t serial;
+	isc_uint32_t serial;
 	xmlTextWriterPtr writer = arg;
 	dns_zonestat_level_t statlevel;
 	int xmlrc;
@@ -1497,7 +1494,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 	TRY0(xmlTextWriterEndElement(writer)); /* type */

 	TRY0(xmlTextWriterStartElement(writer, ISC_XMLCHAR "serial"));
-	if (dns_zone_getserial2(zone, &serial) == ISC_R_SUCCESS)
+	if (dns_zone_getserial(zone, &serial) == ISC_R_SUCCESS)
 		TRY0(xmlTextWriterWriteFormatString(writer, "%u", serial));
 	else
 		TRY0(xmlTextWriterWriteString(writer, ISC_XMLCHAR "-"));
@@ -1507,8 +1504,8 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 		isc_stats_t *zonestats;
 		isc_stats_t *gluecachestats;
 		dns_stats_t *rcvquerystats;
-		uint64_t nsstat_values[ns_statscounter_max];
-		uint64_t gluecachestats_values[dns_gluecachestatscounter_max];
+		isc_uint64_t nsstat_values[ns_statscounter_max];
+		isc_uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

 		zonestats = dns_zone_getrequeststats(zone);
 		if (zonestats != NULL) {
@@ -1581,7 +1578,7 @@ zone_xmlrender(dns_zone_t *zone, void *arg) {
 }

 static isc_result_t
-generatexml(named_server_t *server, uint32_t flags,
+generatexml(named_server_t *server, isc_uint32_t flags,
 	    int *buflen, xmlChar **buf)
 {
 	char boottime[sizeof "yyyy-mm-ddThh:mm:ss.sssZ"];
@@ -1594,17 +1591,17 @@ generatexml(named_server_t *server, uint32_t flags,
 	dns_view_t *view;
 	stats_dumparg_t dumparg;
 	dns_stats_t *cacherrstats;
-	uint64_t nsstat_values[ns_statscounter_max];
-	uint64_t resstat_values[dns_resstatscounter_max];
-	uint64_t adbstat_values[dns_adbstats_max];
-	uint64_t zonestat_values[dns_zonestatscounter_max];
-	uint64_t sockstat_values[isc_sockstatscounter_max];
-	uint64_t udpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t udpoutsizestat_values[dns_sizecounter_out_max];
-	uint64_t tcpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t tcpoutsizestat_values[dns_sizecounter_out_max];
+	isc_uint64_t nsstat_values[ns_statscounter_max];
+	isc_uint64_t resstat_values[dns_resstatscounter_max];
+	isc_uint64_t adbstat_values[dns_adbstats_max];
+	isc_uint64_t zonestat_values[dns_zonestatscounter_max];
+	isc_uint64_t sockstat_values[isc_sockstatscounter_max];
+	isc_uint64_t udpinsizestat_values[dns_sizecounter_in_max];
+	isc_uint64_t udpoutsizestat_values[dns_sizecounter_out_max];
+	isc_uint64_t tcpinsizestat_values[dns_sizecounter_in_max];
+	isc_uint64_t tcpoutsizestat_values[dns_sizecounter_out_max];
 #ifdef HAVE_DNSTAP
-	uint64_t dnstapstat_values[dns_dnstapcounter_max];
+	isc_uint64_t dnstapstat_values[dns_dnstapcounter_max];
 #endif
 	isc_result_t result;

@@ -1918,8 +1915,8 @@ generatexml(named_server_t *server, uint32_t flags,
 		if ((flags & STATS_XML_ZONES) != 0) {
 			TRY0(xmlTextWriterStartElement(writer,
 						       ISC_XMLCHAR "zones"));
-			result = dns_zt_apply(view->zonetable, true,
-					      zone_xmlrender, writer);
+			result = dns_zt_apply(view->zonetable, ISC_TRUE,
+					      NULL, zone_xmlrender, writer);
 			if (result != ISC_R_SUCCESS)
 				goto error;
 			TRY0(xmlTextWriterEndElement(writer)); /* /zones */
@@ -2056,7 +2053,7 @@ wrap_xmlfree(isc_buffer_t *buffer, void *arg) {
 }

 static isc_result_t
-render_xml(uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
+render_xml(isc_uint32_t flags, const char *url, isc_httpdurl_t *urlinfo,
 	   const char *querystring, const char *headers, void *arg,
 	   unsigned int *retcode, const char **retmsg,
 	   const char **mimetype, isc_buffer_t *b,
@@ -2231,7 +2228,7 @@ wrap_jsonfree(isc_buffer_t *buffer, void *arg) {

 static json_object *
 addzone(char *name, char *classname, const char *ztype,
-	uint32_t serial, bool add_serial)
+	isc_uint32_t serial, isc_boolean_t add_serial)
 {
 	json_object *node = json_object_new_object();

@@ -2258,7 +2255,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	char *zone_name_only = NULL;
 	char *class_only = NULL;
 	dns_rdataclass_t rdclass;
-	uint32_t serial;
+	isc_uint32_t serial;
 	json_object *zonearray = (json_object *) arg;
 	json_object *zoneobj = NULL;
 	dns_zonestat_level_t statlevel;
@@ -2274,12 +2271,12 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 	dns_rdataclass_format(rdclass, classbuf, sizeof(classbuf));
 	class_only = classbuf;

-	if (dns_zone_getserial2(zone, &serial) != ISC_R_SUCCESS)
+	if (dns_zone_getserial(zone, &serial) != ISC_R_SUCCESS)
 		zoneobj = addzone(zone_name_only, class_only,
-				  user_zonetype(zone), 0, false);
+				  user_zonetype(zone), 0, ISC_FALSE);
 	else
 		zoneobj = addzone(zone_name_only, class_only,
-				  user_zonetype(zone), serial, true);
+				  user_zonetype(zone), serial, ISC_TRUE);

 	if (zoneobj == NULL)
 		return (ISC_R_NOMEMORY);
@@ -2288,8 +2285,8 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {
 		isc_stats_t *zonestats;
 		isc_stats_t *gluecachestats;
 		dns_stats_t *rcvquerystats;
-		uint64_t nsstat_values[ns_statscounter_max];
-		uint64_t gluecachestats_values[dns_gluecachestatscounter_max];
+		isc_uint64_t nsstat_values[ns_statscounter_max];
+		isc_uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

 		zonestats = dns_zone_getrequeststats(zone);
 		if (zonestats != NULL) {
@@ -2379,7 +2376,7 @@ zone_jsonrender(dns_zone_t *zone, void *arg) {

 static isc_result_t
 generatejson(named_server_t *server, size_t *msglen,
-	     const char **msg, json_object **rootp, uint32_t flags)
+	     const char **msg, json_object **rootp, isc_uint32_t flags)
 {
 	dns_view_t *view;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -2389,17 +2386,17 @@ generatejson(named_server_t *server, size_t *msglen,
 	json_object *tcpreq4 = NULL, *tcpresp4 = NULL;
 	json_object *udpreq6 = NULL, *udpresp6 = NULL;
 	json_object *tcpreq6 = NULL, *tcpresp6 = NULL;
-	uint64_t nsstat_values[ns_statscounter_max];
-	uint64_t resstat_values[dns_resstatscounter_max];
-	uint64_t adbstat_values[dns_adbstats_max];
-	uint64_t zonestat_values[dns_zonestatscounter_max];
-	uint64_t sockstat_values[isc_sockstatscounter_max];
-	uint64_t udpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t udpoutsizestat_values[dns_sizecounter_out_max];
-	uint64_t tcpinsizestat_values[dns_sizecounter_in_max];
-	uint64_t tcpoutsizestat_values[dns_sizecounter_out_max];
+	isc_uint64_t nsstat_values[ns_statscounter_max];
+	isc_uint64_t resstat_values[dns_resstatscounter_max];
+	isc_uint64_t adbstat_values[dns_adbstats_max];
+	isc_uint64_t zonestat_values[dns_zonestatscounter_max];
+	isc_uint64_t sockstat_values[isc_sockstatscounter_max];
+	isc_uint64_t udpinsizestat_values[dns_sizecounter_in_max];
+	isc_uint64_t udpoutsizestat_values[dns_sizecounter_out_max];
+	isc_uint64_t tcpinsizestat_values[dns_sizecounter_in_max];
+	isc_uint64_t tcpoutsizestat_values[dns_sizecounter_out_max];
 #ifdef HAVE_DNSTAP
-	uint64_t dnstapstat_values[dns_dnstapcounter_max];
+	isc_uint64_t dnstapstat_values[dns_dnstapcounter_max];
 #endif
 	stats_dumparg_t dumparg;
 	char boottime[sizeof "yyyy-mm-ddThh:mm:ss.sssZ"];
@@ -2612,8 +2609,10 @@ generatejson(named_server_t *server, size_t *msglen,
 			CHECKMEM(za);

 			if ((flags & STATS_JSON_ZONES) != 0) {
-				result = dns_zt_apply(view->zonetable, true,
-						      zone_jsonrender, za);
+				result = dns_zt_apply(view->zonetable,
+						      ISC_TRUE,
+						      NULL, zone_jsonrender,
+						      za);
 				if (result != ISC_R_SUCCESS) {
 					goto error;
 				}
@@ -2956,7 +2955,7 @@ generatejson(named_server_t *server, size_t *msglen,
 }

 static isc_result_t
-render_json(uint32_t flags,
+render_json(isc_uint32_t flags,
 	    const char *url, isc_httpdurl_t *urlinfo,
 	    const char *querystring, const char *headers,
 	    void *arg, unsigned int *retcode, const char **retmsg,
@@ -3107,6 +3106,7 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	   isc_httpdfree_t **freecb, void **freecb_args)
 {
 	isc_result_t result;
+	char *_headers = NULL;

 	UNUSED(url);
 	UNUSED(querystring);
@@ -3118,30 +3118,45 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,

 	if (urlinfo->isstatic) {
 		isc_time_t when;
-		char *p = strcasestr(headers, "If-Modified-Since: ");
+		char *line, *saveptr;
+		const char *if_modified_since = "If-Modified-Since: ";
+		_headers = strdup(headers);

-		if (p != NULL) {
-			time_t t1, t2;
-			p += strlen("If-Modified-Since: ");
-			result = isc_time_parsehttptimestamp(p, &when);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+		if (_headers == NULL) {
+			goto send;
+		}

-			result = isc_time_secondsastimet(&when, &t1);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+		saveptr = NULL;
+		for (line = strtok_r(_headers, "\n", &saveptr);
+		     line;
+		     line = strtok_r(NULL, "\n", &saveptr)) {
+			if (strncasecmp(line, if_modified_since,
+					strlen(if_modified_since)) == 0) {
+				time_t t1, t2;
+				line += strlen(if_modified_since);
+				result = isc_time_parsehttptimestamp(line, &when);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			result = isc_time_secondsastimet(&urlinfo->loadtime,
-							 &t2);
-			if (result != ISC_R_SUCCESS)
-				goto send;
+				result = isc_time_secondsastimet(&when, &t1);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			if (t1 < t2)
-				goto send;
+				result = isc_time_secondsastimet(&urlinfo->loadtime, &t2);
+				if (result != ISC_R_SUCCESS) {
+					goto send;
+				}

-			*retcode = 304;
-			*retmsg = "Not modified";
-			return (ISC_R_SUCCESS);
+				if (t1 < t2) {
+					goto send;
+				}
+
+				*retcode = 304;
+				*retmsg = "Not modified";
+				goto end;
+			}
 		}
 	}

@@ -3150,7 +3165,8 @@ render_xsl(const char *url, isc_httpdurl_t *urlinfo,
 	*retmsg = "OK";
 	isc_buffer_reinit(b, xslmsg, strlen(xslmsg));
 	isc_buffer_add(b, strlen(xslmsg));
-
+end:
+	free(_headers);
 	return (ISC_R_SUCCESS);
 }

@@ -3166,7 +3182,7 @@ shutdown_listener(named_statschannel_t *listener) {
 	isc_httpdmgr_shutdown(&listener->httpdmgr);
 }

-static bool
+static isc_boolean_t
 client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	named_statschannel_t *listener = arg;
 	dns_aclenv_t *env =
@@ -3180,11 +3196,11 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 	isc_netaddr_fromsockaddr(&netaddr, fromaddr);

 	LOCK(&listener->lock);
-	if (dns_acl_match(&netaddr, NULL, listener->acl, env,
+	if (dns_acl_match(&netaddr, NULL, NULL, 0, NULL, listener->acl, env,
 			  &match, NULL) == ISC_R_SUCCESS && match > 0)
 	{
 		UNLOCK(&listener->lock);
-		return (true);
+		return (ISC_TRUE);
 	}
 	UNLOCK(&listener->lock);

@@ -3193,7 +3209,7 @@ client_ok(const isc_sockaddr_t *fromaddr, void *arg) {
 		      NAMED_LOGMODULE_SERVER, ISC_LOG_WARNING,
 		      "rejected statistics connection from %s", socktext);

-	return (false);
+	return (ISC_FALSE);
 }

 static void
@@ -3265,7 +3281,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_socket_setname(sock, "statchannel", NULL);

 #ifndef ISC_ALLOW_MAPPED
-	isc_socket_ipv6only(sock, true);
+	isc_socket_ipv6only(sock, ISC_TRUE);
 #endif

 	result = isc_socket_bind(sock, addr, ISC_SOCKET_REUSEADDRESS);
@@ -3320,7 +3336,7 @@ add_listener(named_server_t *server, named_statschannel_t **listenerp,
 	isc_httpdmgr_addurl(listener->httpdmgr, "/json/v1/traffic",
 			    render_json_traffic, server);
 #endif
-	isc_httpdmgr_addurl2(listener->httpdmgr, "/bind9.xsl", true,
+	isc_httpdmgr_addurl2(listener->httpdmgr, "/bind9.xsl", ISC_TRUE,
 			     render_xsl, server);

 	*listenerp = listener;
@@ -3550,12 +3566,12 @@ named_stats_dump(named_server_t *server, FILE *fp) {
 	dns_view_t *view;
 	dns_zone_t *zone, *next;
 	stats_dumparg_t dumparg;
-	uint64_t nsstat_values[ns_statscounter_max];
-	uint64_t resstat_values[dns_resstatscounter_max];
-	uint64_t adbstat_values[dns_adbstats_max];
-	uint64_t zonestat_values[dns_zonestatscounter_max];
-	uint64_t sockstat_values[isc_sockstatscounter_max];
-	uint64_t gluecachestats_values[dns_gluecachestatscounter_max];
+	isc_uint64_t nsstat_values[ns_statscounter_max];
+	isc_uint64_t resstat_values[dns_resstatscounter_max];
+	isc_uint64_t adbstat_values[dns_adbstats_max];
+	isc_uint64_t zonestat_values[dns_zonestatscounter_max];
+	isc_uint64_t sockstat_values[isc_sockstatscounter_max];
+	isc_uint64_t gluecachestats_values[dns_gluecachestatscounter_max];

 	RUNTIME_CHECK(isc_once_do(&once, init_desc) == ISC_R_SUCCESS);

@@ -14,8 +14,6 @@

 #include <config.h>

-#include <inttypes.h>
-
 #include <isc/buffer.h>
 #include <isc/string.h>		/* Required for HP/UX (and others?) */
 #include <isc/mem.h>
@@ -47,19 +45,19 @@

 isc_result_t
 named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
-			 isc_entropy_t *ectx, dns_tkeyctx_t **tctxp)
+			 dns_tkeyctx_t **tctxp)
 {
 	isc_result_t result;
 	dns_tkeyctx_t *tctx = NULL;
 	const char *s;
-	uint32_t n;
+	isc_uint32_t n;
 	dns_fixedname_t fname;
 	dns_name_t *name;
 	isc_buffer_t b;
 	const cfg_obj_t *obj;
 	int type;

-	result = dns_tkeyctx_create(mctx, ectx, &tctx);
+	result = dns_tkeyctx_create(mctx, &tctx);
 	if (result != ISC_R_SUCCESS)
 		return (result);

@@ -103,7 +101,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 		isc_buffer_add(&b, strlen(s));
 		name = dns_fixedname_initname(&fname);
 		RETERR(dns_name_fromtext(name, &b, dns_rootname, 0, NULL));
-		RETERR(dst_gssapi_acquirecred(name, false, &tctx->gsscred));
+		RETERR(dst_gssapi_acquirecred(name, ISC_FALSE, &tctx->gsscred));
 	}

 	obj = NULL;
@@ -14,8 +14,6 @@

 #include <config.h>

-#include <inttypes.h>
-
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/mem.h>
@@ -45,7 +43,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,
 	int secretlen = 0;
 	isc_result_t ret;
 	isc_stdtime_t now;
-	uint16_t bits;
+	isc_uint16_t bits;

 	for (element = cfg_list_first(list);
 	     element != NULL;
@@ -111,7 +109,7 @@ add_initial_keys(const cfg_obj_t *list, dns_tsig_keyring_t *ring,

 		isc_stdtime_get(&now);
 		ret = dns_tsigkey_create(&keyname, alg, secret, secretlen,
-					 false, NULL, now, now,
+					 ISC_FALSE, NULL, now, now,
 					 mctx, ring, &tsigkey);
 		isc_mem_put(mctx, secret, secretalloc);
 		secret = NULL;
@@ -17,7 +17,7 @@ CINCLUDES =	-I${srcdir}/include -I${srcdir}/../include \
 		${ISCCFG_INCLUDES} ${ISCCC_INCLUDES} \
 		${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@

-CDEFINES =	@CRYPTO@
+CDEFINES =
 CWARNINGS =

 OBJS =		os.@O@ dlz_dlopen_driver.@O@
@@ -13,10 +13,8 @@
 #include <config.h>

 #include <stdio.h>
-#include <inttypes.h>
-#include <stdbool.h>
-#include <stdlib.h>
 #include <string.h>
+#include <stdlib.h>
 #include <dlfcn.h>

 #include <dns/log.h>
@@ -45,7 +43,7 @@ typedef struct dlopen_data {
 	unsigned int flags;
 	isc_mutex_t lock;
 	int version;
-	bool in_configure;
+	isc_boolean_t in_configure;

 	dlz_dlopen_version_t *dlz_version;
 	dlz_dlopen_create_t *dlz_create;
@@ -68,14 +66,14 @@ typedef struct dlopen_data {
 #define MAYBE_LOCK(cd) \
 	do { \
 		if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
-		    cd->in_configure == false) \
+		    cd->in_configure == ISC_FALSE) \
 			LOCK(&cd->lock); \
 	} while (0)

 #define MAYBE_UNLOCK(cd) \
 	do { \
 		if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
-		    cd->in_configure == false) \
+		    cd->in_configure == ISC_FALSE) \
 			UNLOCK(&cd->lock); \
 	} while (0)

@@ -195,7 +193,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 * Load a symbol from the library
 */
 static void *
-dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
+dl_load_symbol(dlopen_data_t *cd, const char *symbol, isc_boolean_t mandatory) {
 	void *ptr = dlsym(cd->dl_handle, symbol);
 	if (ptr == NULL && mandatory) {
 		dlopen_log(ISC_LOG_ERROR,
@@ -283,13 +281,13 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	/* Find the symbols */
 	cd->dlz_version = (dlz_dlopen_version_t *)
-		dl_load_symbol(cd, "dlz_version", true);
+		dl_load_symbol(cd, "dlz_version", ISC_TRUE);
 	cd->dlz_create = (dlz_dlopen_create_t *)
-		dl_load_symbol(cd, "dlz_create", true);
+		dl_load_symbol(cd, "dlz_create", ISC_TRUE);
 	cd->dlz_lookup = (dlz_dlopen_lookup_t *)
-		dl_load_symbol(cd, "dlz_lookup", true);
+		dl_load_symbol(cd, "dlz_lookup", ISC_TRUE);
 	cd->dlz_findzonedb = (dlz_dlopen_findzonedb_t *)
-		dl_load_symbol(cd, "dlz_findzonedb", true);
+		dl_load_symbol(cd, "dlz_findzonedb", ISC_TRUE);

 	if (cd->dlz_create == NULL ||
 	    cd->dlz_version == NULL ||
@@ -302,29 +300,29 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	}

 	cd->dlz_allowzonexfr = (dlz_dlopen_allowzonexfr_t *)
-		dl_load_symbol(cd, "dlz_allowzonexfr", false);
+		dl_load_symbol(cd, "dlz_allowzonexfr", ISC_FALSE);
 	cd->dlz_allnodes = (dlz_dlopen_allnodes_t *)
 		dl_load_symbol(cd, "dlz_allnodes",
-			       (cd->dlz_allowzonexfr != NULL));
+			       ISC_TF(cd->dlz_allowzonexfr != NULL));
 	cd->dlz_authority = (dlz_dlopen_authority_t *)
-		dl_load_symbol(cd, "dlz_authority", false);
+		dl_load_symbol(cd, "dlz_authority", ISC_FALSE);
 	cd->dlz_newversion = (dlz_dlopen_newversion_t *)
-		dl_load_symbol(cd, "dlz_newversion", false);
+		dl_load_symbol(cd, "dlz_newversion", ISC_FALSE);
 	cd->dlz_closeversion = (dlz_dlopen_closeversion_t *)
 		dl_load_symbol(cd, "dlz_closeversion",
-			       (cd->dlz_newversion != NULL));
+			       ISC_TF(cd->dlz_newversion != NULL));
 	cd->dlz_configure = (dlz_dlopen_configure_t *)
-		dl_load_symbol(cd, "dlz_configure", false);
+		dl_load_symbol(cd, "dlz_configure", ISC_FALSE);
 	cd->dlz_ssumatch = (dlz_dlopen_ssumatch_t *)
-		dl_load_symbol(cd, "dlz_ssumatch", false);
+		dl_load_symbol(cd, "dlz_ssumatch", ISC_FALSE);
 	cd->dlz_addrdataset = (dlz_dlopen_addrdataset_t *)
-		dl_load_symbol(cd, "dlz_addrdataset", false);
+		dl_load_symbol(cd, "dlz_addrdataset", ISC_FALSE);
 	cd->dlz_subrdataset = (dlz_dlopen_subrdataset_t *)
-		dl_load_symbol(cd, "dlz_subrdataset", false);
+		dl_load_symbol(cd, "dlz_subrdataset", ISC_FALSE);
 	cd->dlz_delrdataset = (dlz_dlopen_delrdataset_t *)
-		dl_load_symbol(cd, "dlz_delrdataset", false);
+		dl_load_symbol(cd, "dlz_delrdataset", ISC_FALSE);
 	cd->dlz_destroy = (dlz_dlopen_destroy_t *)
-		dl_load_symbol(cd, "dlz_destroy", false);
+		dl_load_symbol(cd, "dlz_destroy", ISC_FALSE);

 	/* Check the version of the API is the same */
 	cd->version = cd->dlz_version(&cd->flags);
@@ -437,7 +435,7 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 * Called to end a transaction
 */
 static void
-dlopen_dlz_closeversion(const char *zone, bool commit,
+dlopen_dlz_closeversion(const char *zone, isc_boolean_t commit,
 			void *driverarg, void *dbdata, void **versionp)
 {
 	dlopen_data_t *cd = (dlopen_data_t *) dbdata;
@@ -470,9 +468,9 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
 		return (ISC_R_SUCCESS);

 	MAYBE_LOCK(cd);
-	cd->in_configure = true;
+	cd->in_configure = ISC_TRUE;
 	result = cd->dlz_configure(view, dlzdb, cd->dbdata);
-	cd->in_configure = false;
+	cd->in_configure = ISC_FALSE;
 	MAYBE_UNLOCK(cd);

 	return (result);
@@ -482,18 +480,18 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
 /*
 * Check for authority to change a name.
 */
-static bool
+static isc_boolean_t
 dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
-		    const char *type, const char *key, uint32_t keydatalen,
+		    const char *type, const char *key, isc_uint32_t keydatalen,
 		    unsigned char *keydata, void *driverarg, void *dbdata)
 {
 	dlopen_data_t *cd = (dlopen_data_t *) dbdata;
-	bool ret;
+	isc_boolean_t ret;

 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL)
-		return (false);
+		return (ISC_FALSE);

 	MAYBE_LOCK(cd);
 	ret = cd->dlz_ssumatch(signer, name, tcpaddr, type, key, keydatalen,
@@ -15,7 +15,6 @@
 /*! \file */

 #include <pwd.h>
-#include <stdbool.h>

 #include <isc/types.h>

@@ -50,12 +49,12 @@ void
 named_os_minprivs(void);

 FILE *
-named_os_openfile(const char *filename, mode_t mode, bool switch_user);
+named_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user);

 void
-named_os_writepidfile(const char *filename, bool first_time);
+named_os_writepidfile(const char *filename, isc_boolean_t first_time);

-bool
+isc_boolean_t
 named_os_issingleton(const char *filename);

 void
@@ -13,7 +13,6 @@

 #include <config.h>
 #include <stdarg.h>
-#include <stdbool.h>

 #include <sys/types.h>	/* dev_t FreeBSD 2.1 */
 #include <sys/stat.h>
@@ -108,13 +107,13 @@ static pid_t mainpid = 0;
 #endif

 static struct passwd *runas_pw = NULL;
-static bool done_setuid = false;
+static isc_boolean_t done_setuid = ISC_FALSE;
 static int dfd[2] = { -1, -1 };

 #ifdef HAVE_LINUX_CAPABILITY_H

-static bool non_root = false;
-static bool non_root_caps = false;
+static isc_boolean_t non_root = ISC_FALSE;
+static isc_boolean_t non_root_caps = ISC_FALSE;

 #ifdef HAVE_SYS_CAPABILITY_H
 #include <sys/capability.h>
@@ -232,47 +231,18 @@ linux_setcaps(cap_t caps) {
 		cap_free(curcaps); \
 	} while (0)
 #else
-#define SET_CAP(flag) \
-	do { \
-		if (curcaps & (1 << (flag))) { \
-			caps |= (1 << (flag)); \
-		} \
-	} while (0)
+#define SET_CAP(flag) do { caps |= (1 << (flag)); } while (0)
 #define INIT_CAP do { caps = 0; } while (0)
 #endif /* HAVE_LIBCAP */

-#ifndef HAVE_LIBCAP
-/*%
- * Store the bitmask representing the permitted capability set in 'capsp'.  To
- * match libcap-enabled behavior, capget() syscall errors are not reported,
- * they just cause 'capsp' to be set to 0, which effectively prevents any
- * capability from being subsequently requested.
- */
-static void
-linux_getpermittedcaps(cap_t *capsp) {
-	struct __user_cap_header_struct caphead;
-	struct __user_cap_data_struct curcaps;
-
-	memset(&caphead, 0, sizeof(caphead));
-	caphead.version = _LINUX_CAPABILITY_VERSION;
-	caphead.pid = 0;
-	memset(&curcaps, 0, sizeof(curcaps));
-	syscall(SYS_capget, &caphead, &curcaps);
-
-	*capsp = curcaps.permitted;
-}
-#endif /* HAVE_LIBCAP */
-
 static void
 linux_initialprivs(void) {
-	cap_t curcaps;
 	cap_t caps;
 #ifdef HAVE_LIBCAP
+	cap_t curcaps;
 	cap_value_t capval;
 	char strbuf[ISC_STRERRORSIZE];
 	int err;
-#else
-	linux_getpermittedcaps(&curcaps);
 #endif

 	/*%
@@ -337,14 +307,12 @@ linux_initialprivs(void) {

 static void
 linux_minprivs(void) {
-	cap_t curcaps;
 	cap_t caps;
 #ifdef HAVE_LIBCAP
+	cap_t curcaps;
 	cap_value_t capval;
 	char strbuf[ISC_STRERRORSIZE];
 	int err;
-#else
-	linux_getpermittedcaps(&curcaps);
 #endif

 	INIT_CAP;
@@ -389,9 +357,9 @@ linux_keepcaps(void) {
 			named_main_earlyfatal("prctl() failed: %s", strbuf);
 		}
 	} else {
-		non_root_caps = true;
+		non_root_caps = ISC_TRUE;
 		if (getuid() != 0)
-			non_root = true;
+			non_root = ISC_TRUE;
 	}
 }
 #endif
@@ -528,16 +496,16 @@ named_os_closedevnull(void) {
 	}
 }

-static bool
+static isc_boolean_t
 all_digits(const char *s) {
 	if (*s == '\0')
-		return (false);
+		return (ISC_FALSE);
 	while (*s != '\0') {
 		if (!isdigit((*s)&0xff))
-			return (false);
+			return (ISC_FALSE);
 		s++;
 	}
-	return (true);
+	return (ISC_TRUE);
 }

 void
@@ -596,7 +564,7 @@ named_os_changeuser(void) {
 	if (runas_pw == NULL || done_setuid)
 		return;

-	done_setuid = true;
+	done_setuid = ISC_TRUE;

 #ifdef HAVE_LINUXTHREADS
 #ifdef HAVE_LINUX_CAPABILITY_H
@@ -678,7 +646,7 @@ named_os_minprivs(void) {
 }

 static int
-safe_open(const char *filename, mode_t mode, bool append) {
+safe_open(const char *filename, mode_t mode, isc_boolean_t append) {
 	int fd;
 	struct stat sb;

@@ -835,7 +803,7 @@ setperms(uid_t uid, gid_t gid) {
 }

 FILE *
-named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
+named_os_openfile(const char *filename, mode_t mode, isc_boolean_t switch_user) {
 	char strbuf[ISC_STRERRORSIZE], *f;
 	FILE *fp;
 	int fd;
@@ -863,7 +831,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 		/* Set UID/GID to the one we'll be running with eventually */
 		setperms(runas_pw->pw_uid, runas_pw->pw_gid);

-		fd = safe_open(filename, mode, false);
+		fd = safe_open(filename, mode, ISC_FALSE);

 #ifndef HAVE_LINUXTHREADS
 		/* Restore UID/GID to root */
@@ -872,7 +840,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {

 		if (fd == -1) {
 #ifndef HAVE_LINUXTHREADS
-			fd = safe_open(filename, mode, false);
+			fd = safe_open(filename, mode, ISC_FALSE);
 			if (fd != -1) {
 				named_main_earlywarning("Required root "
 							"permissions to open "
@@ -893,7 +861,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 #endif /* HAVE_LINUXTHREADS */
 		}
 	} else {
-		fd = safe_open(filename, mode, false);
+		fd = safe_open(filename, mode, ISC_FALSE);
 	}

 	if (fd < 0) {
@@ -914,7 +882,7 @@ named_os_openfile(const char *filename, mode_t mode, bool switch_user) {
 }

 void
-named_os_writepidfile(const char *filename, bool first_time) {
+named_os_writepidfile(const char *filename, isc_boolean_t first_time) {
 	FILE *fh;
 	pid_t pid;
 	char strbuf[ISC_STRERRORSIZE];
@@ -964,16 +932,16 @@ named_os_writepidfile(const char *filename, bool first_time) {
 	(void)fclose(fh);
 }

-bool
+isc_boolean_t
 named_os_issingleton(const char *filename) {
 	char strbuf[ISC_STRERRORSIZE];
 	struct flock lock;

 	if (singletonfd != -1)
-		return (true);
+		return (ISC_TRUE);

 	if (strcasecmp(filename, "none") == 0)
-		return (true);
+		return (ISC_TRUE);

 	/*
 	 * Make the containing directory if it doesn't exist.
@@ -989,7 +957,7 @@ named_os_issingleton(const char *filename) {
 			named_main_earlywarning("couldn't create '%s'",
 						filename);
 			cleanup_lockfile();
-			return (false);
+			return (ISC_FALSE);
 		}
 	}

@@ -1001,7 +969,7 @@ named_os_issingleton(const char *filename) {
 			   S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
 	if (singletonfd == -1) {
 		cleanup_lockfile();
-		return (false);
+		return (ISC_FALSE);
 	}

 	memset(&lock, 0, sizeof(lock));
@@ -1014,10 +982,10 @@ named_os_issingleton(const char *filename) {
 	if (fcntl(singletonfd, F_SETLK, &lock) == -1) {
 		close(singletonfd);
 		singletonfd = -1;
-		return (false);
+		return (ISC_FALSE);
 	}

-	return (true);
+	return (ISC_TRUE);
 }

 void
@@ -1035,36 +1003,24 @@ named_os_gethostname(char *buf, size_t len) {
 	return ((n == 0) ? ISC_R_SUCCESS : ISC_R_FAILURE);
 }

-static char *
-next_token(char **stringp, const char *delim) {
-	char *res;
-
-	do {
-		res = strsep(stringp, delim);
-		if (res == NULL)
-			break;
-	} while (*res == '\0');
-	return (res);
-}
-
 void
 named_os_shutdownmsg(char *command, isc_buffer_t *text) {
-	char *input, *ptr;
+	char *last, *ptr;
 	pid_t pid;

-	input = command;

 	/* Skip the command name. */
-	ptr = next_token(&input, " \t");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(command, " \t", &last)) == NULL) {
 		return;
+	}

-	ptr = next_token(&input, " \t");
-	if (ptr == NULL)
+	if ((ptr = strtok_r(NULL, " \t", &last)) == NULL) {
 		return;
+	}

-	if (strcmp(ptr, "-p") != 0)
+	if (strcmp(ptr, "-p") != 0) {
 		return;
+	}

 #ifdef HAVE_LINUXTHREADS
 	pid = mainpid;
@@ -12,13 +12,11 @@

 #include <config.h>

-#include <stdbool.h>
 #include <windows.h>

 #include <stdio.h>
-#include <inttypes.h>
-#include <stdlib.h>
 #include <string.h>
+#include <stdlib.h>

 #include <dns/log.h>
 #include <dns/result.h>
@@ -46,7 +44,7 @@ typedef struct dlopen_data {
 	unsigned int flags;
 	isc_mutex_t lock;
 	int version;
-	bool in_configure;
+	isc_boolean_t in_configure;

 	dlz_dlopen_version_t *dlz_version;
 	dlz_dlopen_create_t *dlz_create;
@@ -69,14 +67,14 @@ typedef struct dlopen_data {
 #define MAYBE_LOCK(cd) \
 	do { \
 		if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
-		    cd->in_configure == false) \
+		    cd->in_configure == ISC_FALSE) \
 			LOCK(&cd->lock); \
 	} while (0)

 #define MAYBE_UNLOCK(cd) \
 	do { \
 		if ((cd->flags & DNS_SDLZFLAG_THREADSAFE) == 0 && \
-		    cd->in_configure == false) \
+		    cd->in_configure == ISC_FALSE) \
 			UNLOCK(&cd->lock); \
 	} while (0)

@@ -196,7 +194,7 @@ dlopen_dlz_lookup(const char *zone, const char *name, void *driverarg,
 * Load a symbol from the library
 */
 static void *
-dl_load_symbol(dlopen_data_t *cd, const char *symbol, bool mandatory) {
+dl_load_symbol(dlopen_data_t *cd, const char *symbol, isc_boolean_t mandatory) {
 	void *ptr = GetProcAddress(cd->dl_handle, symbol);
 	if (ptr == NULL && mandatory) {
 		dlopen_log(ISC_LOG_ERROR,
@@ -216,7 +214,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	dlopen_data_t *cd;
 	isc_mem_t *mctx = NULL;
 	isc_result_t result = ISC_R_FAILURE;
-	bool triedload = false;
+	isc_boolean_t triedload = ISC_FALSE;

 	UNUSED(driverarg);

@@ -250,7 +248,7 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 		goto failed;
 	}

-	triedload = true;
+	triedload = ISC_TRUE;

 	/* Initialize the lock */
 	result = isc_mutex_init(&cd->lock);
@@ -271,13 +269,13 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],

 	/* Find the symbols */
 	cd->dlz_version = (dlz_dlopen_version_t *)
-		dl_load_symbol(cd, "dlz_version", true);
+		dl_load_symbol(cd, "dlz_version", ISC_TRUE);
 	cd->dlz_create = (dlz_dlopen_create_t *)
-		dl_load_symbol(cd, "dlz_create", true);
+		dl_load_symbol(cd, "dlz_create", ISC_TRUE);
 	cd->dlz_lookup = (dlz_dlopen_lookup_t *)
-		dl_load_symbol(cd, "dlz_lookup", true);
+		dl_load_symbol(cd, "dlz_lookup", ISC_TRUE);
 	cd->dlz_findzonedb = (dlz_dlopen_findzonedb_t *)
-		dl_load_symbol(cd, "dlz_findzonedb", true);
+		dl_load_symbol(cd, "dlz_findzonedb", ISC_TRUE);

 	if (cd->dlz_create == NULL ||
 	    cd->dlz_version == NULL ||
@@ -290,27 +288,27 @@ dlopen_dlz_create(const char *dlzname, unsigned int argc, char *argv[],
 	}

 	cd->dlz_allowzonexfr = (dlz_dlopen_allowzonexfr_t *)
-		dl_load_symbol(cd, "dlz_allowzonexfr", false);
+		dl_load_symbol(cd, "dlz_allowzonexfr", ISC_FALSE);
 	cd->dlz_allnodes = (dlz_dlopen_allnodes_t *)
 		dl_load_symbol(cd, "dlz_allnodes",
-			       (cd->dlz_allowzonexfr != NULL));
+			       ISC_TF(cd->dlz_allowzonexfr != NULL));
 	cd->dlz_authority = (dlz_dlopen_authority_t *)
-		dl_load_symbol(cd, "dlz_authority", false);
+		dl_load_symbol(cd, "dlz_authority", ISC_FALSE);
 	cd->dlz_newversion = (dlz_dlopen_newversion_t *)
-		dl_load_symbol(cd, "dlz_newversion", false);
+		dl_load_symbol(cd, "dlz_newversion", ISC_FALSE);
 	cd->dlz_closeversion = (dlz_dlopen_closeversion_t *)
 		dl_load_symbol(cd, "dlz_closeversion",
-			       (cd->dlz_newversion != NULL));
+			       ISC_TF(cd->dlz_newversion != NULL));
 	cd->dlz_configure = (dlz_dlopen_configure_t *)
-		dl_load_symbol(cd, "dlz_configure", false);
+		dl_load_symbol(cd, "dlz_configure", ISC_FALSE);
 	cd->dlz_ssumatch = (dlz_dlopen_ssumatch_t *)
-		dl_load_symbol(cd, "dlz_ssumatch", false);
+		dl_load_symbol(cd, "dlz_ssumatch", ISC_FALSE);
 	cd->dlz_addrdataset = (dlz_dlopen_addrdataset_t *)
-		dl_load_symbol(cd, "dlz_addrdataset", false);
+		dl_load_symbol(cd, "dlz_addrdataset", ISC_FALSE);
 	cd->dlz_subrdataset = (dlz_dlopen_subrdataset_t *)
-		dl_load_symbol(cd, "dlz_subrdataset", false);
+		dl_load_symbol(cd, "dlz_subrdataset", ISC_FALSE);
 	cd->dlz_delrdataset = (dlz_dlopen_delrdataset_t *)
-		dl_load_symbol(cd, "dlz_delrdataset", false);
+		dl_load_symbol(cd, "dlz_delrdataset", ISC_FALSE);

 	/* Check the version of the API is the same */
 	cd->version = cd->dlz_version(&cd->flags);
@@ -422,7 +420,7 @@ dlopen_dlz_newversion(const char *zone, void *driverarg, void *dbdata,
 * Called to end a transaction
 */
 static void
-dlopen_dlz_closeversion(const char *zone, bool commit,
+dlopen_dlz_closeversion(const char *zone, isc_boolean_t commit,
 			void *driverarg, void *dbdata, void **versionp)
 {
 	dlopen_data_t *cd = (dlopen_data_t *) dbdata;
@@ -455,9 +453,9 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
 		return (ISC_R_SUCCESS);

 	MAYBE_LOCK(cd);
-	cd->in_configure = true;
+	cd->in_configure = ISC_TRUE;
 	result = cd->dlz_configure(view, dlzdb, cd->dbdata);
-	cd->in_configure = false;
+	cd->in_configure = ISC_FALSE;
 	MAYBE_UNLOCK(cd);

 	return (result);
@@ -467,18 +465,18 @@ dlopen_dlz_configure(dns_view_t *view, dns_dlzdb_t *dlzdb,
 /*
 * Check for authority to change a name
 */
-static bool
+static isc_boolean_t
 dlopen_dlz_ssumatch(const char *signer, const char *name, const char *tcpaddr,
-		    const char *type, const char *key, uint32_t keydatalen,
+		    const char *type, const char *key, isc_uint32_t keydatalen,
 		    unsigned char *keydata, void *driverarg, void *dbdata)
 {
 	dlopen_data_t *cd = (dlopen_data_t *) dbdata;
-	bool ret;
+	isc_boolean_t ret;

 	UNUSED(driverarg);

 	if (cd->dlz_ssumatch == NULL)
-		return (false);
+		return (ISC_FALSE);

 	MAYBE_LOCK(cd);
 	ret = cd->dlz_ssumatch(signer, name, tcpaddr, type, key, keydatalen,
@@ -12,8 +12,6 @@
 #ifndef NAMED_OS_H
 #define NAMED_OS_H 1

-#include <stdbool.h>
-
 #include <isc/types.h>

 void
@@ -47,12 +45,12 @@ void
 named_os_minprivs(void);

 FILE *
-named_os_openfile(const char *filename, int mode, bool switch_user);
+named_os_openfile(const char *filename, int mode, isc_boolean_t switch_user);

 void
-named_os_writepidfile(const char *filename, bool first_time);
+named_os_writepidfile(const char *filename, isc_boolean_t first_time);

-bool
+isc_boolean_t
 named_os_issingleton(const char *filename);

 void
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup>
    <Filter Include="Source Files">
@@ -99,9 +99,6 @@
    <ClInclude Include="..\include\named\main.h">
      <Filter>Header Files</Filter>
    </ClInclude>
-    <ClInclude Include="..\include\named\seccomp.h">
-      <Filter>Header Files</Filter>
-    </ClInclude>
    <ClInclude Include="..\include\named\server.h">
      <Filter>Header Files</Filter>
    </ClInclude>
@@ -1,4 +1,4 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
 <Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
  <ItemGroup Label="ProjectConfigurations">
    <ProjectConfiguration Include="Debug|@PLATFORM@">
@@ -132,7 +132,6 @@
    <ClInclude Include="..\include\named\log.h" />
    <ClInclude Include="..\include\named\logconf.h" />
    <ClInclude Include="..\include\named\main.h" />
-    <ClInclude Include="..\include\named\seccomp.h" />
    <ClInclude Include="..\include\named\server.h" />
    <ClInclude Include="..\include\named\statschannel.h" />
    <ClInclude Include="..\include\named\tkeyconf.h" />
@@ -80,7 +80,7 @@ ServiceControl(DWORD dwCtrlCode) {

 	case SERVICE_CONTROL_SHUTDOWN:
 	case SERVICE_CONTROL_STOP:
-		named_server_flushonshutdown(named_g_server, true);
+		named_server_flushonshutdown(named_g_server, ISC_TRUE);
 		isc_app_shutdown();
 		UpdateSCM(SERVICE_STOPPED);
 		break;
@@ -131,7 +131,7 @@ int main(int argc, char *argv[])
 	int rc, ch;

 	/* Command line users should put -f in the options. */
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
 					   NAMED_MAIN_ARGS)) != -1)
 	{
@@ -146,7 +146,7 @@ int main(int argc, char *argv[])
 			break;
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;

 	if (foreground) {
 		/* run in console window */
@@ -11,7 +11,6 @@

 #include <config.h>
 #include <stdarg.h>
-#include <stdbool.h>

 #include <sys/types.h>
 #include <sys/stat.h>
@@ -177,7 +176,7 @@ named_os_minprivs(void) {
 }

 static int
-safe_open(const char *filename, int mode, bool append) {
+safe_open(const char *filename, int mode, isc_boolean_t append) {
 	int fd;
 	struct stat sb;

@@ -223,13 +222,13 @@ cleanup_lockfile(void) {
 }

 FILE *
-named_os_openfile(const char *filename, int mode, bool switch_user) {
+named_os_openfile(const char *filename, int mode, isc_boolean_t switch_user) {
 	char strbuf[ISC_STRERRORSIZE];
 	FILE *fp;
 	int fd;

 	UNUSED(switch_user);
-	fd = safe_open(filename, mode, false);
+	fd = safe_open(filename, mode, ISC_FALSE);
 	if (fd < 0) {
 		isc__strerror(errno, strbuf, sizeof(strbuf));
 		named_main_earlywarning("could not open file '%s': %s",
@@ -249,7 +248,7 @@ named_os_openfile(const char *filename, int mode, bool switch_user) {
 }

 void
-named_os_writepidfile(const char *filename, bool first_time) {
+named_os_writepidfile(const char *filename, isc_boolean_t first_time) {
 	FILE *pidlockfile;
 	pid_t pid;
 	char strbuf[ISC_STRERRORSIZE];
@@ -275,7 +274,7 @@ named_os_writepidfile(const char *filename, bool first_time) {

 	pidlockfile = named_os_openfile(filename,
 					S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH,
-					false);
+					ISC_FALSE);
 	if (pidlockfile == NULL) {
 		free(pidfile);
 		pidfile = NULL;
@@ -299,16 +298,16 @@ named_os_writepidfile(const char *filename, bool first_time) {
 	(void)fclose(pidlockfile);
 }

-bool
+isc_boolean_t
 named_os_issingleton(const char *filename) {
 	char strbuf[ISC_STRERRORSIZE];
 	OVERLAPPED o;

 	if (lockfilefd != -1)
-		return (true);
+		return (ISC_TRUE);

 	if (strcasecmp(filename, "none") == 0)
-		return (true);
+		return (ISC_TRUE);

 	lockfile = strdup(filename);
 	if (lockfile == NULL) {
@@ -325,7 +324,7 @@ named_os_issingleton(const char *filename) {
 			  S_IRUSR|S_IWUSR|S_IRGRP|S_IROTH);
 	if (lockfilefd == -1) {
 		cleanup_lockfile();
-		return (false);
+		return (ISC_FALSE);
 	}

 	memset(&o, 0, sizeof(o));
@@ -334,10 +333,10 @@ named_os_issingleton(const char *filename) {
 			LOCKFILE_EXCLUSIVE_LOCK | LOCKFILE_FAIL_IMMEDIATELY,
 			0, 0, 1, &o)) {
 		cleanup_lockfile();
-		return (false);
+		return (ISC_FALSE);
 	}

-	return (true);
+	return (ISC_TRUE);
 }


@@ -11,9 +11,6 @@

 #include <config.h>

-#include <inttypes.h>
-#include <stdbool.h>
-
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/mem.h>
@@ -191,7 +188,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	const cfg_listelt_t *element, *element2;
 	dns_ssutable_t *table = NULL;
 	isc_mem_t *mctx = dns_zone_getmctx(zone);
-	bool autoddns = false;
+	isc_boolean_t autoddns = ISC_FALSE;
 	isc_result_t result;

 	(void)cfg_map_get(zconfig, "update-policy", &updatepolicy);
@@ -203,7 +200,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 	if (cfg_obj_isstring(updatepolicy) &&
 	    strcmp("local", cfg_obj_asstring(updatepolicy)) == 0) {
-		autoddns = true;
+		autoddns = ISC_TRUE;
 		updatepolicy = NULL;
 	}

@@ -222,8 +219,8 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		const cfg_obj_t *dname = cfg_tuple_get(stmt, "name");
 		const cfg_obj_t *typelist = cfg_tuple_get(stmt, "types");
 		const char *str;
-		bool grant = false;
-		bool usezone = false;
+		isc_boolean_t grant = ISC_FALSE;
+		isc_boolean_t usezone = ISC_FALSE;
 		unsigned int mtype = dns_ssumatchtype_name;
 		dns_fixedname_t fname, fident;
 		isc_buffer_t b;
@@ -232,16 +229,16 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,

 		str = cfg_obj_asstring(mode);
 		if (strcasecmp(str, "grant") == 0)
-			grant = true;
+			grant = ISC_TRUE;
 		else if (strcasecmp(str, "deny") == 0)
-			grant = false;
+			grant = ISC_FALSE;
 		else
 			INSIST(0);

 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
 		if (mtype == dns_ssumatchtype_subdomain) {
-			usezone = true;
+			usezone = ISC_TRUE;
 		}

 		dns_fixedname_init(&fident);
@@ -350,7 +347,7 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 			goto cleanup;
 		}

-		result = dns_ssutable_addrule(table, true,
+		result = dns_ssutable_addrule(table, ISC_TRUE,
 					      named_g_server->session_keyname,
 					      dns_ssumatchtype_local,
 					      dns_zone_getorigin(zone),
@@ -628,7 +625,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		goto cleanup;
 	dns_name_init(&apexname, NULL);
 	dns_name_clone(dns_zone_getorigin(zone), &apexname);
-	result = dns_db_findnode(db, &apexname, false, &apexnode);
+	result = dns_db_findnode(db, &apexname, ISC_FALSE, &apexnode);
 	if (result != ISC_R_SUCCESS)
 		goto cleanup;

@@ -671,7 +668,7 @@ configure_staticstub(const cfg_obj_t *zconfig, dns_zone_t *zone,
 	if (apexnode != NULL)
 		dns_db_detachnode(db, &apexnode);
 	if (dbversion != NULL)
-		dns_db_closeversion(db, &dbversion, true);
+		dns_db_closeversion(db, &dbversion, ISC_TRUE);
 	if (db != NULL)
 		dns_db_detach(&db);
 	for (i = 0; rdatalists[i] != NULL; i++) {
@@ -772,7 +769,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 * We run this unlocked as both the view list and the interface list
 * are updated when the appropriate task has exclusivity.
 */
-static bool
+static isc_boolean_t
 isself(dns_view_t *myview, dns_tsigkey_t *mykey,
       const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *dstaddr,
       dns_rdataclass_t rdclass, void *arg)
@@ -786,10 +783,10 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 	isc_netaddr_t netdst;

 	if (interfacemgr == NULL)
-		return (true);
+		return (ISC_TRUE);

 	if (!ns_interfacemgr_listeningon(interfacemgr, dstaddr))
-		return (false);
+		return (ISC_FALSE);

 	isc_netaddr_fromsockaddr(&netsrc, srcaddr);
 	isc_netaddr_fromsockaddr(&netdst, dstaddr);
@@ -805,7 +802,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 			continue;

 		if (mykey != NULL) {
-			bool match;
+			isc_boolean_t match;
 			isc_result_t result;

 			result = dns_view_gettsig(view, &mykey->name, &key);
@@ -824,7 +821,7 @@ isself(dns_view_t *myview, dns_tsigkey_t *mykey,
 				    view->matchdestinations, env))
 			break;
 	}
-	return (view == myview);
+	return (ISC_TF(view == myview));
 }


@@ -845,7 +842,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const char *filename = NULL;
 	const char *dupcheck;
 	dns_notifytype_t notifytype = dns_notifytype_yes;
-	uint32_t count;
+	isc_uint32_t count;
 	unsigned int dbargc;
 	char **dbargv;
 	static char default_dbtype[] = "rbt";
@@ -855,13 +852,13 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	dns_dialuptype_t dialup = dns_dialuptype_no;
 	dns_zonetype_t ztype;
 	int i;
-	int32_t journal_size;
-	bool multi;
-	bool alt;
+	isc_int32_t journal_size;
+	isc_boolean_t multi;
+	isc_boolean_t alt;
 	dns_view_t *view;
-	bool check = false, fail = false;
-	bool warn = false, ignore = false;
-	bool ixfrdiff;
+	isc_boolean_t check = ISC_FALSE, fail = ISC_FALSE;
+	isc_boolean_t warn = ISC_FALSE, ignore = ISC_FALSE;
+	isc_boolean_t ixfrdiff;
 	dns_masterformat_t masterformat;
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
@@ -1051,21 +1048,21 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		size_t signedlen = strlen(filename) + sizeof(SIGNED);
 		char *signedname;

-		RETERR(dns_zone_setfile3(raw, filename,
-					 masterformat, masterstyle));
+		RETERR(dns_zone_setfile(raw, filename,
+					masterformat, masterstyle));
 		signedname = isc_mem_get(mctx, signedlen);
 		if (signedname == NULL)
 			return (ISC_R_NOMEMORY);

 		(void)snprintf(signedname, signedlen, "%s" SIGNED, filename);
-		result = dns_zone_setfile3(zone, signedname,
-					   dns_masterformat_raw, NULL);
+		result = dns_zone_setfile(zone, signedname,
+					  dns_masterformat_raw, NULL);
 		isc_mem_put(mctx, signedname, signedlen);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	} else
-		RETERR(dns_zone_setfile3(zone, filename,
-					 masterformat, masterstyle));
+		RETERR(dns_zone_setfile(zone, filename,
+					masterformat, masterstyle));

 	obj = NULL;
 	result = cfg_map_get(zoptions, "journal", &obj);
@@ -1274,12 +1271,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				cfg_obj_log(obj, named_g_lctx,
 					    ISC_LOG_ERROR,
 					    "'max-journal-size "
-					    "%" PRId64 "' "
+					    "%" ISC_PRINT_QUADFORMAT "d' "
 					    "is too large",
 					    value);
 				RETERR(ISC_R_RANGE);
 			}
-			journal_size = (uint32_t)value;
+			journal_size = (isc_uint32_t)value;
 		}
 		if (raw != NULL)
 			dns_zone_setjournalsize(raw, journal_size);
@@ -1288,21 +1285,30 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		obj = NULL;
 		result = named_config_get(maps, "ixfr-from-differences", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
-		if (cfg_obj_isboolean(obj))
+		if (cfg_obj_isboolean(obj)) {
 			ixfrdiff = cfg_obj_asboolean(obj);
-		else if (!strcasecmp(cfg_obj_asstring(obj), "master") &&
-			 ztype == dns_zone_master)
-			ixfrdiff = true;
-		else if (!strcasecmp(cfg_obj_asstring(obj), "slave") &&
-			ztype == dns_zone_slave)
-			ixfrdiff = true;
-		else
-			ixfrdiff = false;
+		} else if ((strcasecmp(cfg_obj_asstring(obj),
+				       "primary") == 0 ||
+			   strcasecmp(cfg_obj_asstring(obj),
+				       "master") == 0) &&
+			   ztype == dns_zone_master)
+		{
+			ixfrdiff = ISC_TRUE;
+		} else if ((strcasecmp(cfg_obj_asstring(obj),
+				       "secondary") == 0 ||
+			   strcasecmp(cfg_obj_asstring(obj),
+				       "slave") == 0) &&
+			   ztype == dns_zone_slave)
+		{
+			ixfrdiff = ISC_TRUE;
+		} else {
+			ixfrdiff = ISC_FALSE;
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_IXFRFROMDIFFS,
-					   true);
+					   ISC_TRUE);
 			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
-					   false);
+					   ISC_TRUE);
 		} else
 			dns_zone_setoption(zone, DNS_ZONEOPT_IXFRFROMDIFFS,
 					   ixfrdiff);
@@ -1320,12 +1326,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		checknames(ztype, maps, &obj);
 		INSIST(obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
-			fail = false;
-			check = true;
+			fail = ISC_FALSE;
+			check = ISC_TRUE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
-			fail = check = true;
+			fail = check = ISC_TRUE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
-			fail = check = false;
+			fail = check = ISC_FALSE;
 		} else
 			INSIST(0);
 		if (raw != NULL) {
@@ -1334,9 +1340,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMESFAIL,
 					   fail);
 			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES,
-					   false);
+					   ISC_FALSE);
 			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMESFAIL,
-					   false);
+					   ISC_FALSE);
 		} else {
 			dns_zone_setoption(zone, DNS_ZONEOPT_CHECKNAMES,
 					   check);
@@ -1359,9 +1365,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "check-spf", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
-			check = true;
+			check = ISC_TRUE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
-			check = false;
+			check = ISC_FALSE;
 		} else
 			INSIST(0);
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
@@ -1398,12 +1404,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				cfg_obj_log(obj, named_g_lctx,
 					    ISC_LOG_ERROR,
 					    "'max-journal-size "
-					    "%" PRId64 "' "
+					    "%" ISC_PRINT_QUADFORMAT "d' "
 					    "is too large",
 					    value);
 				RETERR(ISC_R_RANGE);
 			}
-			journal_size = (uint32_t)value;
+			journal_size = (isc_uint32_t)value;
 		}
 		dns_zone_setjournalsize(zone, journal_size);
 	}
@@ -1432,36 +1438,37 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	}

 	if (ztype == dns_zone_master || raw != NULL) {
-		const cfg_obj_t *validity, *resign;
-		bool allow = false, maint = false;
-		bool sigvalinsecs;
+		isc_boolean_t allow = ISC_FALSE, maint = ISC_FALSE;
+
+		obj = NULL;
+		result = named_config_get(maps, "dnskey-sig-validity", &obj);
+		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		seconds = cfg_obj_asuint32(obj) * 86400;
+		dns_zone_setkeyvalidityinterval(zone, seconds);

 		obj = NULL;
 		result = named_config_get(maps, "sig-validity-interval", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
+		{
+			const cfg_obj_t *validity, *resign;

-		sigvalinsecs = ns_server_getoption(named_g_server->sctx,
-						   NS_SERVER_SIGVALINSECS);
-		validity = cfg_tuple_get(obj, "validity");
-		seconds = cfg_obj_asuint32(validity);
-		if (!sigvalinsecs) {
-			seconds *= 86400;
-		}
-		dns_zone_setsigvalidityinterval(zone, seconds);
+			validity = cfg_tuple_get(obj, "validity");
+			seconds = cfg_obj_asuint32(validity) * 86400;
+			dns_zone_setsigvalidityinterval(zone, seconds);

-		resign = cfg_tuple_get(obj, "re-sign");
-		if (cfg_obj_isvoid(resign)) {
-			seconds /= 4;
-		} else if (!sigvalinsecs) {
-			if (seconds > 7 * 86400) {
-				seconds = cfg_obj_asuint32(resign) * 86400;
+			resign = cfg_tuple_get(obj, "re-sign");
+			if (cfg_obj_isvoid(resign)) {
+				seconds /= 4;
 			} else {
-				seconds = cfg_obj_asuint32(resign) * 3600;
+				if (seconds > 7 * 86400)
+					seconds = cfg_obj_asuint32(resign) *
+							86400;
+				else
+					seconds = cfg_obj_asuint32(resign) *
+							3600;
 			}
-		} else {
-			seconds = cfg_obj_asuint32(resign);
+			dns_zone_setsigresigninginterval(zone, seconds);
 		}
-		dns_zone_setsigresigninginterval(zone, seconds);

 		obj = NULL;
 		result = named_config_get(maps, "key-directory", &obj);
@@ -1509,9 +1516,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
 			if (strcasecmp(arg, "allow") == 0)
-				allow = true;
+				allow = ISC_TRUE;
 			else if (strcasecmp(arg, "maintain") == 0)
-				allow = maint = true;
+				allow = maint = ISC_TRUE;
 			else if (strcasecmp(arg, "off") == 0)
 				;
 			else
@@ -1537,7 +1544,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		if (result == ISC_R_SUCCESS)
 			check = cfg_obj_asboolean(obj);
 		else
-			check = false;
+			check = ISC_FALSE;
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKWILDCARD, check);

 		/*
@@ -1562,12 +1569,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,

 		}
 		if (strcasecmp(dupcheck, "warn") == 0) {
-			fail = false;
-			check = true;
+			fail = ISC_FALSE;
+			check = ISC_TRUE;
 		} else if (strcasecmp(dupcheck, "fail") == 0) {
-			fail = check = true;
+			fail = check = ISC_TRUE;
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
-			fail = check = false;
+			fail = check = ISC_FALSE;
 		} else
 			INSIST(0);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
@@ -1577,12 +1584,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "check-mx", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
-			fail = false;
-			check = true;
+			fail = ISC_FALSE;
+			check = ISC_TRUE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
-			fail = check = true;
+			fail = check = ISC_TRUE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
-			fail = check = false;
+			fail = check = ISC_FALSE;
 		} else
 			INSIST(0);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
@@ -1601,7 +1608,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKINTEGRITY,
 					   cfg_obj_asboolean(obj));
 		} else {
-			check = false;
+			check = ISC_FALSE;
 			result = named_config_get(nodefault, "check-integrity",
 					       &obj);
 			if (result == ISC_R_SUCCESS)
@@ -1614,12 +1621,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "check-mx-cname", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
-			warn = true;
-			ignore = false;
+			warn = ISC_TRUE;
+			ignore = ISC_FALSE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
-			warn = ignore = false;
+			warn = ignore = ISC_FALSE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
-			warn = ignore = true;
+			warn = ignore = ISC_TRUE;
 		} else
 			INSIST(0);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
@@ -1629,12 +1636,12 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = named_config_get(maps, "check-srv-cname", &obj);
 		INSIST(result == ISC_R_SUCCESS && obj != NULL);
 		if (strcasecmp(cfg_obj_asstring(obj), "warn") == 0) {
-			warn = true;
-			ignore = false;
+			warn = ISC_TRUE;
+			ignore = ISC_FALSE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "fail") == 0) {
-			warn = ignore = false;
+			warn = ignore = ISC_FALSE;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
-			warn = ignore = true;
+			warn = ignore = ISC_TRUE;
 		} else
 			INSIST(0);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
@@ -1654,7 +1661,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			const char *arg = cfg_obj_asstring(obj);
 			if (strcasecmp(arg, "no-resign") == 0)
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
-						   true);
+						   ISC_TRUE);
 			else if (strcasecmp(arg, "maintain") == 0)
 				;
 			else
@@ -1702,7 +1709,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			result = dns_zone_setmasters(mayberaw, NULL, 0);
 		RETERR(result);

-		multi = false;
+		multi = ISC_FALSE;
 		if (count > 1) {
 			obj = NULL;
 			result = named_config_get(maps, "multi-master", &obj);
@@ -1794,9 +1801,9 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			 */
 			view = dns_zone_getview(zone);
 			if (view != NULL && strcmp(view->name, "_default") == 0)
-				alt = true;
+				alt = ISC_TRUE;
 			else
-				alt = false;
+				alt = ISC_FALSE;
 		} else
 			alt = cfg_obj_asboolean(obj);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_USEALTXFRSRC, alt);
@@ -1843,14 +1850,14 @@ named_zone_configure_writeable_dlz(dns_dlzdb_t *dlzdatabase,
 	return (result);
 }

-bool
+isc_boolean_t
 named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	const cfg_obj_t *zoptions = NULL;
 	const cfg_obj_t *obj = NULL;
 	const char *cfilename;
 	const char *zfilename;
 	dns_zone_t *raw = NULL;
-	bool has_raw;
+	isc_boolean_t has_raw;
 	dns_zonetype_t ztype;

 	zoptions = cfg_tuple_get(zconfig, "options");
@@ -1862,7 +1869,7 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	if (zonetype_fromconfig(zoptions) == dns_zone_staticstub) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: staticstub");
-		return (false);
+		return (ISC_FALSE);
 	}

 	/* If there's a raw zone, use that for filename and type comparison */
@@ -1871,11 +1878,11 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 		zfilename = dns_zone_getfile(raw);
 		ztype = dns_zone_gettype(raw);
 		dns_zone_detach(&raw);
-		has_raw = true;
+		has_raw = ISC_TRUE;
 	} else {
 		zfilename = dns_zone_getfile(zone);
 		ztype = dns_zone_gettype(zone);
-		has_raw = false;
+		has_raw = ISC_FALSE;
 	}

 	obj = NULL;
@@ -1883,17 +1890,17 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	if ((obj == NULL || !cfg_obj_asboolean(obj)) && has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was inline-signing");
-		return (false);
+		return (ISC_FALSE);
 	} else if ((obj != NULL && cfg_obj_asboolean(obj)) && !has_raw) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: old zone was not inline-signing");
-		return (false);
+		return (ISC_FALSE);
 	}

 	if (zonetype_fromconfig(zoptions) != ztype) {
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: type mismatch");
-		return (false);
+		return (ISC_FALSE);
 	}

 	obj = NULL;
@@ -1908,8 +1915,8 @@ named_zone_reusable(dns_zone_t *zone, const cfg_obj_t *zconfig) {
 	{
 		dns_zone_log(zone, ISC_LOG_DEBUG(1),
 			     "not reusable: filename mismatch");
-		return (false);
+		return (ISC_FALSE);
 	}

-	return (true);
+	return (ISC_TRUE);
 }
@@ -23,7 +23,7 @@ CINCLUDES =	${DNS_INCLUDES} ${BIND9_INCLUDES} ${ISC_INCLUDES} \
 		${ISCCFG_INCLUDES} ${IRS_INCLUDES} ${DST_GSSAPI_INC} \
 		@DST_OPENSSL_INC@

-CDEFINES =	-DVERSION=\"${VERSION}\" @CRYPTO@ @USE_GSSAPI@
+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_GSSAPI@
 CWARNINGS =

 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
@@ -39,7 +39,7 @@
 nsupdate \- Dynamic DNS update utility
 .SH "SYNOPSIS"
 .HP \w'\fBnsupdate\fR\ 'u
-\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-i\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-R\ \fR\fB\fIrandomdev\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [filename]
+\fBnsupdate\fR [\fB\-d\fR] [\fB\-D\fR] [\fB\-i\fR] [\fB\-L\ \fR\fB\fIlevel\fR\fR] [[\fB\-g\fR] | [\fB\-o\fR] | [\fB\-l\fR] | [\fB\-y\ \fR\fB\fI[hmac:]\fR\fIkeyname:secret\fR\fR] | [\fB\-k\ \fR\fB\fIkeyfile\fR\fR]] [\fB\-t\ \fR\fB\fItimeout\fR\fR] [\fB\-u\ \fR\fB\fIudptimeout\fR\fR] [\fB\-r\ \fR\fB\fIudpretries\fR\fR] [\fB\-v\fR] [\fB\-T\fR] [\fB\-P\fR] [\fB\-V\fR] [[\fB\-4\fR] | [\fB\-6\fR]] [filename]
 .SH "DESCRIPTION"
 .PP
 \fBnsupdate\fR
@@ -160,17 +160,6 @@ option\&.
 The number of UDP retries\&. The default is 3\&. If zero, only one update request will be made\&.
 .RE
 .PP
-\-R \fIrandomdev\fR
-.RS 4
-Where to obtain randomness\&. If the operating system does not provide a
-/dev/random
-or equivalent device, the default source of randomness is keyboard input\&.
-randomdev
-specifies the name of a character device or file containing random data to be used instead of the default\&. The special value
-keyboard
-indicates that keyboard input should be used\&. This option may be specified multiple times\&.
-.RE
-.PP
 \-t \fItimeout\fR
 .RS 4
 The maximum time an update request can take before it is aborted\&. The default is 300 seconds\&. Zero can be used to disable the timeout\&.
@@ -70,7 +70,6 @@
      <arg choice="opt" rep="norepeat"><option>-t <replaceable class="parameter">timeout</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-u <replaceable class="parameter">udptimeout</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-r <replaceable class="parameter">udpretries</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-R <replaceable class="parameter">randomdev</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-v</option></arg>
      <arg choice="opt" rep="norepeat"><option>-T</option></arg>
      <arg choice="opt" rep="norepeat"><option>-P</option></arg>
@@ -269,22 +268,6 @@
 	</listitem>
      </varlistentry>

-      <varlistentry>
-	<term>-R <replaceable class="parameter">randomdev</replaceable></term>
-	<listitem>
-	<para>
-	  Where to obtain randomness. If the operating system
-	  does not provide a <filename>/dev/random</filename> or
-	  equivalent device, the default source of randomness is keyboard
-	  input.  <filename>randomdev</filename> specifies the name of
-	  a character device or file containing random data to be used
-	  instead of the default.  The special value
-	  <filename>keyboard</filename> indicates that keyboard input
-	  should be used.  This option may be specified multiple times.
-	</para>
-	</listitem>
-      </varlistentry>
-
      <varlistentry>
 	<term>-t <replaceable class="parameter">timeout</replaceable></term>
 	<listitem>
@@ -46,7 +46,6 @@
       [<code class="option">-t <em class="replaceable"><code>timeout</code></em></code>]
       [<code class="option">-u <em class="replaceable"><code>udptimeout</code></em></code>]
       [<code class="option">-r <em class="replaceable"><code>udpretries</code></em></code>]
-       [<code class="option">-R <em class="replaceable"><code>randomdev</code></em></code>]
       [<code class="option">-v</code>]
       [<code class="option">-T</code>]
       [<code class="option">-P</code>]
@@ -214,19 +213,6 @@
 	    one update request will be made.
 	  </p>
 	</dd>
-<dt><span class="term">-R <em class="replaceable"><code>randomdev</code></em></span></dt>
-<dd>
-	<p>
-	  Where to obtain randomness. If the operating system
-	  does not provide a <code class="filename">/dev/random</code> or
-	  equivalent device, the default source of randomness is keyboard
-	  input.  <code class="filename">randomdev</code> specifies the name of
-	  a character device or file containing random data to be used
-	  instead of the default.  The special value
-	  <code class="filename">keyboard</code> indicates that keyboard input
-	  should be used.  This option may be specified multiple times.
-	</p>
-	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>timeout</code></em></span></dt>
 <dd>
 	  <p>
@@ -152,8 +152,8 @@ main(int argc, char *argv[]) {
 	if (pin == NULL)
 		pin = getpassphrase("Enter Pin: ");

-	result = pk11_get_session(&pctx, OP_ANY, false, true,
-				  true, (const char *) pin, slot);
+	result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_TRUE,
+				  ISC_TRUE, (const char *) pin, slot);
 	if (result == PK11_R_NORANDOMSERVICE ||
 	    result == PK11_R_NODIGESTSERVICE ||
 	    result == PK11_R_NOAESSERVICE) {
@@ -565,8 +565,8 @@ main(int argc, char *argv[]) {
 	if (pin == NULL)
 		pin = getpassphrase("Enter Pin: ");

-	result = pk11_get_session(&pctx, op_type, false, true,
-				  true, (const char *) pin, slot);
+	result = pk11_get_session(&pctx, op_type, ISC_FALSE, ISC_TRUE,
+				  ISC_TRUE, (const char *) pin, slot);
 	if (result == PK11_R_NORANDOMSERVICE ||
 	    result == PK11_R_NODIGESTSERVICE ||
 	    result == PK11_R_NOAESSERVICE) {
@@ -657,18 +657,8 @@ main(int argc, char *argv[]) {
 	}

 	/* Allocate space for parameter attributes */
-	for (i = 0; i < param_attrcnt; i++) {
-		param_template[i].pValue = NULL;
-	}
-
-	for (i = 0; i < param_attrcnt; i++) {
+	for (i = 0; i < param_attrcnt; i++)
 		param_template[i].pValue = malloc(param_template[i].ulValueLen);
-		if (param_template[i].pValue == NULL) {
-			fprintf(stderr, "malloc failed\n");
-			error = 1;
-			goto exit_params;
-		}
-	}

 	rv = pkcs_C_GetAttributeValue(hSession, domainparams,
 				 dsa_param_template, DSA_PARAM_ATTRS);
@@ -723,13 +713,9 @@ main(int argc, char *argv[]) {
 	
 exit_params:
 	/* Free parameter attributes */
-	if (keyclass == key_dsa || keyclass == key_dh) {
-		for (i = 0; i < param_attrcnt; i++) {
-			if (param_template[i].pValue != NULL) {
-				free(param_template[i].pValue);
-			}
-		}
-	}
+	if (keyclass == key_dsa || keyclass == key_dh)
+		for (i = 0; i < param_attrcnt; i++)
+			free(param_template[i].pValue);

 exit_domain:
 	/* Destroy domain parameters */
@@ -40,7 +40,6 @@

 #include <config.h>

-#include <stdbool.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <fcntl.h>
@@ -72,7 +71,7 @@ main(int argc, char *argv[]) {
 	char *lib_name = NULL;
 	char *label = NULL;
 	char *pin = NULL;
-	bool error = false, logon = true, all = false;
+	isc_boolean_t error = ISC_FALSE, logon = ISC_TRUE, all = ISC_FALSE;
 	unsigned int i = 0, id = 0;
 	int c, errflg = 0;
 	CK_ULONG ulObjectCount;
@@ -83,7 +82,7 @@ main(int argc, char *argv[]) {
 	while ((c = isc_commandline_parse(argc, argv, ":m:s:i:l:p:P")) != -1) {
 		switch (c) {
 		case 'P':
-			logon = false;
+			logon = ISC_FALSE;
 			break;
 		case 'm':
 			lib_name = isc_commandline_argument;
@@ -122,7 +121,7 @@ main(int argc, char *argv[]) {
 	}

 	if (!id && (label == NULL))
-		all = true;
+		all = ISC_TRUE;

 	if (slot)
 		printf("slot %lu\n", slot);
@@ -147,7 +146,7 @@ main(int argc, char *argv[]) {
 	if (logon && pin == NULL)
 		pin = getpassphrase("Enter Pin: ");

-	result = pk11_get_session(&pctx, OP_ANY, false, false,
+	result = pk11_get_session(&pctx, OP_ANY, ISC_FALSE, ISC_FALSE,
 				  logon, pin, slot);
 	if (result == PK11_R_NORANDOMSERVICE ||
 	    result == PK11_R_NODIGESTSERVICE ||
@@ -46,7 +46,7 @@ main(int argc, char *argv[]) {
 			lib_name = isc_commandline_argument;
 			break;
 		case 'v':
-			pk11_verbose_init = true;
+			pk11_verbose_init = ISC_TRUE;
 			break;
 		case ':':
 			fprintf(stderr, "Option -%c requires an operand\n",
@@ -78,8 +78,8 @@ main(int argc, char *argv[]) {
 	if (lib_name != NULL)
 		pk11_set_lib_name(lib_name);

-	result = pk11_get_session(&pctx, OP_ANY, true, false,
-				  false, NULL, 0);
+	result = pk11_get_session(&pctx, OP_ANY, ISC_TRUE, ISC_FALSE,
+				  ISC_FALSE, NULL, 0);
 	if (result == PK11_R_NORANDOMSERVICE ||
 	    result == PK11_R_NODIGESTSERVICE ||
 	    result == PK11_R_NOAESSERVICE) {
@@ -39,7 +39,7 @@
 dnssec-keymgr \- Ensures correct DNSKEY coverage for a zone based on a defined policy
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-keymgr\fR\ 'u
-\fBdnssec\-keymgr\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-c\ \fR\fB\fIfile\fR\fR] [\fB\-f\fR] [\fB\-k\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-z\fR] [\fB\-g\ \fR\fB\fIpath\fR\fR] [\fB\-r\ \fR\fB\fIpath\fR\fR] [\fB\-s\ \fR\fB\fIpath\fR\fR] [zone...]
+\fBdnssec\-keymgr\fR [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-c\ \fR\fB\fIfile\fR\fR] [\fB\-f\fR] [\fB\-k\fR] [\fB\-q\fR] [\fB\-v\fR] [\fB\-z\fR] [\fB\-g\ \fR\fB\fIpath\fR\fR] [\fB\-s\ \fR\fB\fIpath\fR\fR] [zone...]
 .SH "DESCRIPTION"
 .PP
 \fBdnssec\-keymgr\fR
@@ -123,15 +123,6 @@ and
 \fBdnssec\-settime\fR\&.
 .RE
 .PP
-\-r \fIrandomdev\fR
-.RS 4
-Specifies a path to a file containing random data\&. This is passed to the
-\fBdnssec\-keygen\fR
-binary using its
-\fB\-r\fR
-option\&.
-.RE
-.PP
 \-s \fIsettime\-path\fR
 .RS 4
 Specifies a path to a
--- a/Show More
+++ b/Show More