Provide debugging information for the isc_random function

2018-05-23 21:37:47 +02:00
2730 changed files with 322585 additions and 86820 deletions
@@ -1,71 +0,0 @@
 ;;; Directory Local Variables
 ;;; For more information see (info "(emacs) Directory Variables")
 ((c-mode .
  ((eval .
 	 (set (make-local-variable 'directory-of-current-dir-locals-file)
 	      (file-name-directory (locate-dominating-file default-directory ".dir-locals.el"))
 	      )
 	 )
   (eval .
 	 (set (make-local-variable 'include-directories)
 	      (list
 	       ;; top directory
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "./"))
 	       ;; current directory
 	       (expand-file-name (concat default-directory "./"))
 	       ;; libisc
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/unix/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/pthreads/include"))
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isc/include"))
 	       ;; libdns
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/dns/include"))
 	       ;; libisccc
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isccc/include"))
 	       ;; libisccfg
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/isccfg/include"))
 	       ;; libns
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/ns/include"))
 	       ;; libirs
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/irs/include"))
 	       ;; libbind9
 	       (expand-file-name
 		(concat directory-of-current-dir-locals-file "lib/bind9/include"))
 	       (expand-file-name "/usr/local/opt/openssl@1.1/include")
 	       (expand-file-name "/usr/local/opt/libxml2/include/libxml2")
 	       (expand-file-name "/usr/local/include")
 	       )
 	      )
 	 )
   (eval setq flycheck-clang-include-path include-directories)
   (eval setq flycheck-cppcheck-include-path include-directories)
   (eval setq flycheck-clang-args
 	 (list
 	  "-include"
 	  (expand-file-name
 	   (concat directory-of-current-dir-locals-file "config.h"))
 	  )
 	 )
   )
  ))
@@ -1,2 +1,3 @@
 *.sln.in eol=crlf
-*.vcxproj.* eol=crlf
+*.vcxproj.in eol=crlf
 *.vcxproj.filters.in eol=crlf
@@ -1,58 +1,62 @@
-*-symtbl.c
+Makefile
-*.a
+config.log
-*.gcda
+config.h
-*.gcno
+config.cache
-*.la
+config.status
-*.lo
+libtool
 /isc-config.sh
 /configure.lineno
 autom4te.cache/
 *.o
-*.orig
+*.lo
 *.plist/ # ccc-analyzer store its results in .plist directories
 *.rej
 *.so
 *.a
 *.la
 *.gcno
 *.gcda
 *_test
-*~
+*-symtbl.c
 timestamp
 ans.run
 named.run
 named.memstats
 gen.dSYM/
 .ccache/
 .cproject
 .deps/
 .dirstamp
 .libs/
 unit/atf-src/atf-c++/atf-c++.pc
 unit/atf-src/atf-c/atf-c.pc
 unit/atf-src/atf-c/defs.h
 unit/atf-src/atf-c/detail/process_helpers
 unit/atf-src/atf-config/atf-config
 unit/atf-src/atf-report/atf-report
 unit/atf-src/atf-report/fail_helper
 unit/atf-src/atf-report/misc_helpers
 unit/atf-src/atf-report/pass_helper
 unit/atf-src/atf-run/atf-run
 unit/atf-src/atf-run/bad_metadata_helper
 unit/atf-src/atf-run/expect_helpers
 unit/atf-src/atf-run/misc_helpers
 unit/atf-src/atf-run/pass_helper
 unit/atf-src/atf-run/several_tcs_helper
 unit/atf-src/atf-run/zero_tcs_helper
 unit/atf-src/atf-sh/atf-check
 unit/atf-src/atf-sh/atf-sh
 unit/atf-src/atf-sh/misc_helpers
 unit/atf-src/atf-version/atf-version
 unit/atf-src/atf-version/revision.h
 unit/atf-src/atf-version/revision.h.stamp
 unit/atf-src/bconfig.h
 unit/atf-src/bootstrap/atconfig
 unit/atf-src/doc/atf.7
 unit/atf-src/stamp-h1
 unit/atf-src/test-programs/c_helpers
 unit/atf-src/test-programs/cpp_helpers
 unit/atf-src/test-programs/sh_helpers
 # ccc-analyzer store its results in .plist directories
 *.plist/
 *~
 .project
 .cproject
 .settings
 /aclocal.m4
 /ar-lib
 /autom4te.cache/
 /bind.keys.h
 /compile
 /config.cache
 /config.guess
 /config.h
 /config.h.in
 /config.log
 /config.status
 /config.sub
 /configure
 /configure.lineno
 /depcomp
 /install-sh
 /isc-config.sh
 /libltdl/*
 /libtool
 /ltmain.sh
 /m4/libtool.m4
 /m4/ltargz.m4
 /m4/ltdl.m4
 /m4/ltoptions.m4
 /m4/ltsugar.m4
 /m4/ltversion.m4
 /m4/lt~obsolete.m4
 /missing
 /py-compile
 /stamp-h1
 /test-driver
 Makefile
 ans.run
 gen.dSYM/
 kyua.log
 named.memstats
 named.run
 timestamp
@@ -1,478 +1,233 @@
 variables:
  # Not normally needed, but may be if some script uses `apt-get install`.
  DEBIAN_FRONTEND: noninteractive
  # Locale settings do not affect the build, but might affect tests.
  LC_ALL: C
-
+  DOCKER_DRIVER: overlay2
-  CI_REGISTRY_IMAGE: registry.gitlab.isc.org/isc-projects/images/bind9
+  CI_REGISTRY_IMAGE: oerdnj/bind9
  CCACHE_DIR: "/ccache"
  SOFTHSM2_CONF: "/var/tmp/softhsm2/softhsm2.conf"
 stages:
  - precheck
  - build
  - test
  - push
 ### Runner Tag Templates
 .linux-amd64: &linux_amd64
  tags:
    - linux
    - amd64
 .linux-i386: &linux_i386
  tags:
    - linux
    - i386
 ### Docker Image Templates
 # CentOS
 .centos-centos6-amd64: &centos_centos6_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos6-amd64"
  <<: *linux_amd64
 .centos-centos7-amd64: &centos_centos7_amd64_image
  image: "$CI_REGISTRY_IMAGE:centos-centos7-amd64"
  <<: *linux_amd64
 # Debian
 .debian-jessie-amd64: &debian_jessie_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-amd64"
-  <<: *linux_amd64
+  tags:
    - linux
    - docker
    - amd64
 .debian-jessie-i386: &debian_jessie_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-jessie-i386"
-  <<: *linux_i386
+  tags:
    - linux
    - docker
    - i386
 .debian-stretch-amd64: &debian_stretch_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-amd64"
-  <<: *linux_amd64
+  tags:
    - linux
    - docker
    - amd64
-.debian-stretch-i386: &debian_stretch_i386_image
+.debian-stretch-i386:: &debian_stretch_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-stretch-i386"
-  <<: *linux_i386
+  tags:
    - linux
    - docker
    - i386
 .debian-buster-amd64: &debian_buster_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-amd64"
  tags:
    - linux
    - docker
    - amd64
 .debian-buster-i386:: &debian_buster_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-buster-i386"
  tags:
    - linux
    - docker
    - i386
 .debian-sid-amd64: &debian_sid_amd64_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-amd64"
-  <<: *linux_amd64
+  tags:
    - linux
    - docker
    - amd64
 .debian-sid-i386: &debian_sid_i386_image
  image: "$CI_REGISTRY_IMAGE:debian-sid-i386"
-  <<: *linux_i386
+  tags:
    - linux
    - docker
    - i386
-# Fedora
+.ubuntu-trusty-amd64: &ubuntu_trusty_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-amd64"
  tags:
    - linux
    - docker
    - amd64
-.fedora-29-amd64: &fedora_29_amd64_image
+.ubuntu-trusty-i386: &ubuntu_trusty_i386_image
-  image: "$CI_REGISTRY_IMAGE:fedora-29-amd64"
+  image: "$CI_REGISTRY_IMAGE:ubuntu-trusty-i386"
-  <<: *linux_amd64
+  tags:
-
+    - linux
-# Ubuntu
+    - docker
    - i386
 .ubuntu-xenial-amd64: &ubuntu_xenial_amd64_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-amd64"
-  <<: *linux_amd64
+  tags:
    - linux
    - docker
    - amd64
 .ubuntu-xenial-i386: &ubuntu_xenial_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-xenial-i386"
-  <<: *linux_i386
+  tags:
-
+    - linux
-.ubuntu-bionic-amd64: &ubuntu_bionic_amd64_image
+    - docker
-  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-amd64"
+    - i386
  <<: *linux_amd64
 .ubuntu-bionic-i386: &ubuntu_bionic_i386_image
  image: "$CI_REGISTRY_IMAGE:ubuntu-bionic-i386"
  <<: *linux_i386
 ### Job Templates
 .default-triggering-rules: &default_triggering_rules
  only:
    - merge_requests
    - tags
    - web
 .precheck: &precheck_job
  <<: *default_triggering_rules
  <<: *debian_sid_amd64_image
  stage: precheck
 .build: &build_job
  <<: *default_triggering_rules
  stage: build
  before_script:
    - test -w "${CCACHE_DIR}" && export PATH="/usr/lib/ccache:${PATH}"
    - ./autogen.sh
  script:
-    - ./configure --enable-developer --with-libtool --disable-static --with-cmocka --prefix=$HOME/.local --without-make-clean $EXTRA_CONFIGURE || cat config.log
+    - ./configure --enable-developer --with-libtool --disable-static --with-atf=/usr/local --with-libidn2
-    - make -j${BUILD_PARALLEL_JOBS:-1} -k all V=1
+    - make -j${PARALLEL_JOBS_BUILD:-1} -k all V=1
    - test -z "${RUN_MAKE_INSTALL}" || make install
  artifacts:
    expire_in: '1 hour'
    untracked: true
    expire_in: "1 hour"
 .system_test: &system_test_job
  <<: *default_triggering_rules
  stage: test
  retry: 2
  before_script:
    - rm -rf .ccache
    - bash -x bin/tests/system/ifconfig.sh up
    - bash -x util/prepare-softhsm2.sh
  script:
    - ( cd bin/tests && make -j${TEST_PARALLEL_JOBS:-1} -k test V=1 )
    - test -s bin/tests/system/systests.output
  artifacts:
    untracked: true
-    expire_in: "1 week"
+    expire_in: '1 week'
    when: on_failure
 .unit_test: &unit_test_job
  <<: *default_triggering_rules
  stage: test
  before_script:
    - export KYUA_RESULT="$CI_PROJECT_DIR/kyua.results"
    - bash -x util/prepare-softhsm2.sh
  script:
    - make unit
  after_script:
    - kyua report-html --force --results-file kyua.results --results-filter "" --output kyua_html
  artifacts:
    paths:
-      - kyua.log
+    - atf.out
-      - kyua.results
+    - kyua.log
-      - kyua_html/
+    - kyua.results
-    expire_in: "1 week"
+    - kyua_html/
    expire_in: '1 week'
    when: on_failure
-### Job Definitions
+precheck:debian:sid:amd64:
-
+  <<: *debian_sid_amd64_image
-# Jobs in the precheck stage
+  stage: precheck
 misc:sid:amd64:
  <<: *precheck_job
  script:
    - sh util/check-ans-prereq.sh
    - sh util/checklibs.sh > checklibs.out
    - sh util/tabify-changes < CHANGES > CHANGES.tmp
    - diff -urNap CHANGES CHANGES.tmp
    - rm CHANGES.tmp
    - perl util/check-changes CHANGES
    - perl -w util/merge_copyrights
    - diff -urNap util/copyrights util/newcopyrights
    - rm util/newcopyrights
    - perl -w util/update_copyrights < util/copyrights
    - if test "$(git status --porcelain | grep -Ev '\?\?' | wc -l)" -gt "0"; then git status --short; exit 1; fi
    - xmllint --noout --nonet `git ls-files '*.xml' '*.docbook'`
    - xmllint --noout --nonet --html `git ls-files '*.html'`
    - sh util/check-win32util-configure
  artifacts:
    paths:
-      - util/newcopyrights
+    - util/newcopyrights
-      - checklibs.out
+    expire_in: '1 week'
    expire_in: "1 week"
    when: on_failure
-🐞:sid:amd64:
+#build:debian:jessie:amd64:
-  <<: *precheck_job
+#  <<: *debian_jessie_amd64_image
-  script: util/check-cocci
+#  <<: *build_job
 #
 #build:debian:jessie:i386:
 #  <<: *debian_jessie_i386_image
 #  <<: *build_job
 #
 #build:debian:stretch:amd64:
 #  <<: *debian_stretch_amd64_image
 #  <<: *build_job
 #
 #build:debian:buster:i386:
 #  <<: *debian_buster_i386_image
 #  <<: *build_job
 #
 #build:ubuntu:trusty:amd64:
 #  <<: *ubuntu_trusty_amd64_image
 #  <<: *build_job
 #
 #build:ubuntu:xenial:i386:
 #  <<: *ubuntu_xenial_i386_image
 #  <<: *build_job
-# Jobs for doc builds on Debian Sid (amd64)
+build:clang:debian:sid:amd64:
 docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: build
  script:
    - ./configure || cat config.log
    - make -C doc/misc docbook
    - make -C doc/arm Bv9ARM.html
  artifacts:
    paths:
      - doc/arm/
    expire_in: "1 month"
  only:
    - merge_requests
    - tags
    - web
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 push:docs:sid:amd64:
  <<: *debian_sid_amd64_image
  stage: push
  dependencies: []
  script:
    - curl -X POST -F token=$GITLAB_PAGES_DOCS_TRIGGER_TOKEN -F ref=master $GITLAB_PAGES_DOCS_TRIGGER_URL
  only:
    - master@isc-projects/bind9
    - /^v9_[1-9][0-9]$/@isc-projects/bind9
 # Jobs for regular GCC builds on CentOS 6 (amd64)
 gcc:centos6:amd64:
  variables:
-    CC: gcc
+    CC: clang-6.0
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2 --disable-warn-error"
  <<: *centos_centos6_amd64_image
  <<: *build_job
 system:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:centos6:amd64
 unit:gcc:centos6:amd64:
  <<: *centos_centos6_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos6:amd64
 # Jobs for regular GCC builds on CentOS 7 (amd64)
 gcc:centos7:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *centos_centos7_amd64_image
  <<: *build_job
 system:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:centos7:amd64
 unit:gcc:centos7:amd64:
  <<: *centos_centos7_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:centos7:amd64
 # Jobs for regular GCC builds on Debian 8 Jessie (amd64)
 gcc:jessie:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--without-cmocka --with-python"
  <<: *debian_jessie_amd64_image
  <<: *build_job
 system:gcc:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:jessie:amd64
 unit:gcc:jessie:amd64:
  <<: *debian_jessie_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:jessie:amd64
 # Jobs for regular GCC builds on Debian 9 Stretch (amd64)
 gcc:stretch:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_stretch_amd64_image
  <<: *build_job
 system:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:stretch:amd64
 unit:gcc:stretch:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:stretch:amd64
 # Jobs for regular GCC builds on Debian Sid (amd64)
 gcc:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
    RUN_MAKE_INSTALL: 1
  <<: *debian_sid_amd64_image
  <<: *build_job
 system:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:sid:amd64
 unit:gcc:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:amd64
 # Jobs for regular GCC builds on Debian Sid (i386)
 gcc:sid:i386:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2 --without-python"
  <<: *debian_sid_i386_image
  <<: *build_job
 system:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
    - gcc:sid:i386
 unit:gcc:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
    - gcc:sid:i386
 # Jobs for regular GCC builds on Fedora 29 (amd64)
 gcc:fedora29:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *fedora_29_amd64_image
  <<: *build_job
 system:gcc:fedora29:amd64:
  <<: *fedora_29_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:fedora29:amd64
 unit:gcc:fedora29:amd64:
  <<: *fedora_29_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:fedora29:amd64
 # Jobs for regular GCC builds on Ubuntu 16.04 Xenial Xerus (amd64)
 gcc:xenial:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *ubuntu_xenial_amd64_image
  <<: *build_job
 system:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:xenial:amd64
 unit:gcc:xenial:amd64:
  <<: *ubuntu_xenial_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:xenial:amd64
 # Jobs for regular GCC builds on Ubuntu 18.04 Bionic Beaver (amd64)
 gcc:bionic:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *ubuntu_bionic_amd64_image
  <<: *build_job
 system:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *system_test_job
  dependencies:
    - gcc:bionic:amd64
 unit:gcc:bionic:amd64:
  <<: *ubuntu_bionic_amd64_image
  <<: *unit_test_job
  dependencies:
    - gcc:bionic:amd64
 # Jobs for GCC builds with ASAN enabled on Debian Sid (amd64)
 asan:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g -fsanitize=address,undefined -DISC_MEM_USE_INTERNAL_MALLOC=0"
    LDFLAGS: "-fsanitize=address,undefined"
    EXTRA_CONFIGURE: "--with-libidn2"
  <<: *debian_sid_amd64_image
  <<: *build_job
 system:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
    - asan:sid:amd64
 unit:asan:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - asan:sid:amd64
 # Jobs for Clang builds on Debian Stretch (amd64)
 clang:stretch:amd64:
  variables:
    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    EXTRA_CONFIGURE: "--with-python=python3"
+  <<: *debian_sid_amd64_image
  <<: *debian_stretch_amd64_image
  <<: *build_job
-unit:clang:stretch:amd64:
+build:debian:sid:amd64:
  <<: *debian_stretch_amd64_image
  <<: *unit_test_job
  dependencies:
    - clang:stretch:amd64
 # Jobs for Clang builds on Debian Stretch (i386)
 clang:stretch:i386:
  variables:
    CC: clang
    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
    EXTRA_CONFIGURE: "--with-python=python2"
  <<: *debian_stretch_i386_image
  <<: *build_job
 # Jobs for PKCS#11-enabled GCC builds on Debian Sid (amd64)
 pkcs11:sid:amd64:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
    EXTRA_CONFIGURE: "--enable-native-pkcs11 --with-pkcs11=/usr/lib/softhsm/libsofthsm2.so"
  <<: *debian_sid_amd64_image
  <<: *build_job
-system:pkcs11:sid:amd64:
+build:clang:debian:sid:i386:
-  <<: *debian_sid_amd64_image
+  variables:
-  <<: *system_test_job
+    CC: clang-6.0
-  dependencies:
+    CFLAGS: "-Wall -Wextra -Wenum-conversion -O2 -g"
-    - pkcs11:sid:amd64
+  <<: *debian_sid_i386_image
  <<: *build_job
-unit:pkcs11:sid:amd64:
+build:debian:sid:i386:
  variables:
    CC: gcc
    CFLAGS: "-Wall -Wextra -O2 -g"
  <<: *debian_sid_i386_image
  <<: *build_job
 unittest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
-    - pkcs11:sid:amd64
+    - build:debian:sid:amd64
 unittest:clang:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *unit_test_job
  dependencies:
    - build:clang:debian:sid:amd64
 unittest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *unit_test_job
  dependencies:
    - build:debian:sid:i386
 systemtest:debian:sid:amd64:
  <<: *debian_sid_amd64_image
  <<: *system_test_job
  dependencies:
    - build:debian:sid:amd64
 systemtest:debian:sid:i386:
  <<: *debian_sid_i386_image
  <<: *system_test_job
  dependencies:
    - build:debian:sid:i386
@@ -9,10 +9,6 @@ email to [security-officer@isc.org](security-officer@isc.org).
 (Summarize the bug encountered concisely.)
 ### BIND version used
 (Paste the output of `named -V`.)
 ### Steps to reproduce
 (How one can reproduce the issue - this is very important.)
@@ -1,44 +0,0 @@
 ## Release Checklist
 - [ ] (Manager) Check for the presence of a milestone for the release:
    - If there is a milestone, are all the issues for the milestone resolved? (other than this checklist).
 - [ ] (Manager) Inform Support/Marketing of impending release (and give estimated release dates).
 - (SwEng) Prepare the sources for tarball generation:
   - [ ] Check perflab to ensure there has been no unexplained drop in performance for the version being released.
   - [ ] Ensure that there are no outstanding merge requests in the private repository (subscription version only).
   - [ ] Update API files for libraries with new version information.
   - [ ] Change software version and library versions in configure.in (new major release only).
   - [ ] Rebuild configure using autoconf on docs.isc.org.
   - [ ] Update CHANGES.
   - [ ] Update CHANGES.SE (subscription branch only).
   - [ ] Update "version".
   - [ ] Update "readme.md".
   - Check the release notes are correct:
     - [ ] Compare content with merge requests for the release.
     - [ ] Check formatting.
   - [ ] Build documentation on docs.isc.org.
   - [ ] Commit changes and make sure the gitlab-ci tests are passing.
   - [ ] Push the changes and tag ("alphatag" is an optional string such as "b1", "rc1" etc.). (```git tag -u <DEVELOPER_KEYID> -a -s -m "BIND 9.X.Y[alphatag]" v9_X_Y[alphatag]```)
   - [ ] If this is the first tag for a release (e.g. beta), create a release branch named `release_v9_X_Y` (this allows development to continue on the release branch whilst release engineering continues).
 - [ ] (SwEng) Run the "make release" Jenkins job to produce the tarballs and zips.
 - [ ] (SwEng) Ask QA to sanity check the tarball and zips (passing to them the number of the Jenkins job).
 - [ ] (QA) Sanity check the tarballs.
 - [ ] (QA) Request the signature on the tarballs.
 - [ ] (QA) Check signatures on tarballs.
 - [ ] (QA) Tell Support to handle notification of release.
 - [ ] (Manager) Inform Marketing of the release
 - [ ] (Manager) Update the internal [BIND release dates wiki page](https://wiki.isc.org/bin/view/Main/BindReleaseDates) when public announcement has been made.
 - [ ] (SwEng) Update DEB and RPM packages
 - [ ] (SwEng) Merge the automatically prepared `prep 9.X.Y` commit which updates `version` and documentation on the release branch into the relevant maintenance branch (`v9_X`)
 ## Support
 - [ ] Make tarballs and signatures available to download.
 - [ ] Write release email to bind9-announce.
 - [ ] Write email to bind9-users (if a major release).
 - [ ] Update tickets in case of waiting support customers.
 ## Marketing
 - [ ] Post short note to Twitter.
 - [ ] Update [Wikipedia entry for BIND](http://en.wikipedia.org/wiki/BIND).
 - [ ] Write blog article (if a major release).
@@ -0,0 +1,5 @@
 Content-Type: application/X-atf-atffile; version="1"
 prop: test-suite = bind9
 tp: lib
@@ -1,977 +1,5 @@
 5234.	[port]		arm: just use the compiler's default support for
 			yield. [GL #981]
 	--- 9.15.0 released ---
 5233.	[bug]		Negative trust anchors did not work with "forward only;"
 			to validating resolvers. [GL #997]
 5232.	[placeholder]
 5231.	[protocol]	Add support for displaying CLIENT-TAG and SERVER-TAG.
 			[GL #960]
 5230.	[protocol]	The SHA-1 hash algorithm is no longer used when
 			generating DS and CDS records. [GL #1015]
 5229.	[protocol]	Enforce known SSHFP fingerprint lengths. [GL #852]
 5228.	[func]		If trusted-keys and managed-keys were configured
 			simultaneously for the same name, the key could
 			not be be rolled automatically. This is now
 			a fatal configuration error. [GL #868]
 5227.	[placeholder]
 5226.	[placeholder]
 5225.	[func]		Allow dig to print out AAAA record fully expanded.
 			with +[no]expandaaaa. [GL #765]
 5224.	[bug]		Only test provide-ixfr on TCP streams. [GL #991]
 5223.	[bug]		Fixed a race in the filter-aaaa plugin accessing
 			the hash table. [GL #1005]
 5222.	[bug]		'delv -t ANY' could leak memory. [GL #983]
 5221.	[test]		Enable parallel execution of system tests on
 			Windows. [GL !4101]
 5220.	[cleanup]	Refactor the isc_stat structure to take advantage
 			of stdatomic. [GL !1493]
 5219.	[bug]		Fixed a race in the filter-aaaa plugin that could
 			trigger a crash when returning an instance object
 			to the memory pool. [GL #982]
 5218.	[bug]		Conditionally include <dlfcn.h>. [GL #995]
 5217.	[bug]		Restore key id calculation for RSAMD5. [GL #996]
 5216.	[bug]		Fetches-per-zone counter wasn't updated correctly
 			when doing qname minimization. [GL #992]
 5215.	[bug]		Change #5124 was incomplete; named could still
 			return FORMERR instead of SERVFAIL in some cases.
 			[GL #990]
 5214.	[bug]		win32: named now removes its lock file upon shutdown.
 			[GL #979]
 5213.	[bug]		win32: Eliminated a race which allowed named.exe running
 			as a service to be killed prematurely during shutdown.
 			[GL #978]
 5212.	[placeholder]
 5211.	[bug]		Allow out-of-zone additional data to be included
 			in authoritative responses if recursion is allowed
 			and "minimal-responses" is disabled.  This behavior
 			was inadvertently removed in change #4605. [GL #817]
 5210.	[bug]		When dnstap is enabled and recursion is not
 			available, incoming queries are now logged
 			as "auth". Previously, this depended on whether
 			recursion was requested by the client, not on
 			whether recursion was available. [GL #963]
 5209.	[bug]		When update-check-ksk is true, add_sigs was not
 			considering offline keys, leaving record sets signed
 			with the incorrect type key. [GL #763]
 5208.	[test]		Run valid rdata wire encodings through totext+fromtext
 			and tofmttext+fromtext methods to check these methods.
 			[GL #899]
 5207.	[test]		Check delv and dig TTL values. [GL #965]
 5206.	[bug]		Delv could print out bad TTLs. [GL #965]
 5205.	[bug]		Enforce that a DS hash exists. [GL #899]
 5204.	[test]		Check that dns_rdata_fromtext() produces a record that
 			will be accepted by dns_rdata_fromwire(). [GL #852]
 5203.	[bug]		Enforce whether key rdata exists or not in KEY,
 			DNSKEY, CDNSKEY and RKEY. [GL #899]
 5202.	[bug]		<dns/ecs.h> was missing ISC_LANG_ENDDECLS. [GL #976]
 5201.	[bug]		Fix a possible deadlock in RPZ update code. [GL #973]
 5200.	[security]	tcp-clients settings could be exceeded in some cases,
 			which could lead to exhaustion of file descriptors.
 			(CVE-2018-5743) [GL #615]
 5199.	[security]	In certain configurations, named could crash
 			if nxdomain-redirect was in use and a redirected
 			query resulted in an NXDOMAIN from the cache.
 			(CVE-2019-6467) [GL #880]
 5198.	[bug]		If a fetch context was being shut down and, at the same
 			time, we returned from qname minimization, an INSIST
 			could be hit. [GL #966]
 5197.	[bug]		dig could die in best effort mode on multiple SIG(0)
 			records. Similarly on multiple OPT and multiple TSIG
 			records. [GL #920]
 5196.	[bug]		make install failed with --with-dlopen=no. [GL #955]
 5195.	[bug]		"allow-update" and "allow-update-forwarding" were
 			treated as configuration errors if used at the
 			options or view level. [GL #913]
 5194.	[bug]		Enforce non empty ZOMEMD hash. [GL #899]
 5193.	[bug]		EID and NIMLOC failed to do multi-line output
 			correctly. [GL #899]
 5192.	[placeholder]
 5191.	[placeholder]
 5190.	[bug]		Ignore trust anchors using disabled algorithms.
 			[GL #806]
 5189.	[cleanup]	Remove revoked root DNSKEY from bind.keys. [GL #945]
 5188.	[func]		The "dnssec-enable" option is deprecated and no
 			longer has any effect; DNSSEC responses are
 			always enabled. [GL #866]
 5187.	[test]		Set time zone before running any tests in dnstap_test.
 			[GL #940]
 5186.	[cleanup]	More dnssec-keygen manual tidying. [GL !1678]
 5185.	[placeholder]
 5184.	[bug]		Missing unlocks in sdlz.c. [GL #936]
 5183.	[bug]		Reinitialize ECS data before reusing client
 			structures. [GL #881]
 5182.	[bug]		Fix a high-load race/crash in handling of
 			isc_socket_close() in resolver. [GL #834]
 5181.	[func]		Add a mechanism for a DLZ module to signal that
 			the view's allow-transfer ACL should be used to
 			determine whether transfers are allowed. [GL #803]
 5180.	[bug]		delv now honors the operating system's preferred
 			ephemeral port range. [GL #925]
 5179.	[cleanup]	Replace some vague type declarations with the more
 			specific dns_secalg_t and dns_dsdigest_t.
 			Thanks to Tony Finch. [GL !1498]
 5178.	[bug]		Handle EDQUOT (disk quota) and ENOSPC (disk full)
 			errors when writing files. [GL #902]
 5177.	[func]		Add the ability to specify in named.conf whether a
 			response-policy zone's SOA record should be added
 			to the additional section (add-soa yes/no). [GL #865]
 5176.	[tests]		Remove a dependency on libxml in statschannel system
 			test. [GL #926]
 5175.	[bug]		Fixed a problem with file input in dnssec-keymgr,
 			dnssec-coverage and dnssec-checkds when using
 			python3. [GL #882]
 5174.	[doc]		Tidy dnssec-keygen manual. [GL !1557]
 5173.	[bug]		Fixed a race in socket code that could occur when
 			accept, send, or recv were called from an event
 			loop but the socket had been closed by another
 			thread. [RT #874]
 5172.	[bug]		nsupdate now honors the operating system's preferred
 			ephemeral port range. [GL #905]
 5171.	[func]		named plugins are now installed into a separate
 			directory.  Supplying a filename (a string without path
 			separators) in a "plugin" configuration stanza now
 			causes named to look for that plugin in that directory.
 			[GL #878]
 5170.	[test]		Added --with-dlz-filesystem to feature-test. [GL !1587]
 5169.	[bug]		The presence of certain types in an otherwise
 			empty node could cause a crash while processing a
 			type ANY query. [GL #901]
 5168.	[bug]		Do not crash on shutdown when RPZ fails to load.  Also,
 			keep previous version of the database if RPZ fails to
 			load. [GL #813]
 5167.	[bug]		nxdomain-redirect could sometimes lookup the wrong
 			redirect name. [GL #892]
 5166.	[placeholder]
 5165.	[contrib]	Removed SDB drivers from contrib; they're obsolete.
 			[GL #428]
 5164.	[bug]		Correct errno to result translation in dlz filesystem
 			modules. [GL #884]
 5163.	[cleanup]	Out-of-tree builds failed --enable-dnstap. [GL #836]
 5162.	[cleanup]	Improve dnssec-keymgr manual. Thanks to Tony Finch.
 			[GL !1518]
 5161.	[bug]		Do not require the SEP bit to be set for mirror zone
 			trust anchors. [GL #873]
 5160.	[contrib]	Added DNAME support to the DLZ LDAP schema. Also
 			fixed a compilation bug affecting several DLZ
 			modules. [GL #872]
 5159.	[bug]		dnssec-coverage was incorrectly ignoring
 			names specified on the command line without
 			trailing dots. [GL !1478]
 5158.	[protocol]	Add support for AMTRELAY and ZONEMD. [GL #867]
 5157.	[bug]		Nslookup now errors out if there are extra command
 			line arguments. [GL #207]
 5156.	[doc]		Extended and refined the section of the ARM describing
 			mirror zones. [GL #774]
 5155.	[func]		"named -V" now outputs the default paths to
 			named.conf, rndc.conf, bind.keys, and other
 			files used or created by named and other tools, so
 			that the correct paths to these files can quickly be
 			determined regardless of the configure settings
 			used when BIND was built. [GL #859]
 5154.	[bug]		dig: process_opt could be called twice on the same
 			message leading to a assertion failure. [GL #860]
 5153.	[func]		Zone transfer statistics (size, number of records, and
 			number of messages) are now logged for outgoing
 			transfers as well as incoming ones. [GL #513]
 5152.	[func]		Improved logging of DNSSEC key events:
 			- Zone signing and DNSKEY maintenance events are
 			  now logged to the "dnssec" category
 			- Messages are now logged when DNSSEC keys are
 			  published, activated, inactivated, deleted,
 			  or revoked.
 			[GL #714]
 5151.	[func]		Options that have been been marked as obsolete in
 			named.conf for a very long time are now fatal
 			configuration errors. [GL #358]
 5150.	[cleanup]	Remove the ability to compile BIND with assertions
 			disabled. [GL #735]
 5149.	[func]		"rndc dumpdb" now prints a line above a stale RRset
 			indicating how long the data will be retained in the
 			cache for emergency use. [GL #101]
 5148.	[bug]		named did not sign the TKEY response. [GL #821]
 5147.	[bug]		dnssec-keymgr: Add a five-minute margin to better
 			handle key events close to 'now'. [GL #848]
 5146.	[placeholder]
 5145.	[func]		Use atomics instead of locked variables for isc_quota
 			and isc_counter. [GL !1389]
 5144.	[bug]		dig now returns a non-zero exit code when a TCP
 			connection is prematurely closed by a peer more than
 			once for the same lookup.  [GL #820]
 5143.	[bug]		dnssec-keymgr and dnssec-coverage failed to find
 			key files for zone names ending in ".". [GL #560]
 5142.	[cleanup]	Removed "configure --disable-rpz-nsip" and
 			"--disable-rpz-nsdname" options. "nsip-enable"
 			and "nsdname-enable" both now default to yes,
 			regardless of compile-time settings. [GL #824]
 5141.	[security]	Zone transfer controls for writable DLZ zones were
 			not effective as the allowzonexfr method was not being
 			called for such zones. (CVE-2019-6465) [GL #790]
 5140.	[bug]		Don't immediately mark existing keys as inactive and
 			deleted when running dnssec-keymgr for the first
 			time. [GL #117]
 5139.	[bug]		If possible, don't use forwarders when priming.
 			This ensures we can get root server IP addresses
 			from priming query response glue, which may not
 			be present if the forwarding server is returning
 			minimal responses. [GL #752]
 5138.	[bug]		Under some circumstances named could hit an assertion
 			failure when doing qname minimization when using
 			forwarders. [GL #797]
 5137.	[func]		named now logs messages whenever a mirror zone becomes
 			usable or unusable for resolution purposes. [GL #818]
 5136.	[cleanup]	Check in named-checkconf that allow-update and
 			allow-update-forwarding are not set at the
 			view/options level; fix documentation. [GL #512]
 5135.	[port]		sparc: Use smt_pause() instead of pause. [GL #816]
 5134.	[bug]		win32: WSAStartup was not called before getservbyname
 			was called. [GL #590]
 5133.	[bug]		'rndc managed-keys' didn't handle class and view
 			correctly and failed to add new lines between each
 			view. [GL !1327]
 5132.	[bug]		Fix race condition in cleanup part of dns_dt_create().
 			[GL !1323]
 5131.	[cleanup]	Address Coverity warnings. [GL #801]
 5130.	[cleanup]	Remove support for l10n message catalogs. [GL #709]
 5129.	[contrib]	sdlz_helper.c:build_querylist was not properly
 			splitting the query string. [GL #798]
 5128.	[bug]		Refreshkeytime was not being updated for managed
 			keys zones. [GL #784]
 5127.	[bug]		rcode.c:maybe_numeric failed to handle NUL in text
 			regions. [GL #807]
 5126.	[bug]		Named incorrectly accepted empty base64 and hex encoded
 			fields when reading master files. [GL #807]
 5125.	[bug]		Allow for up to 100 records or 64k of data when caching
 			a negative response. [GL #804]
 5124.	[bug]		Named could incorrectly return FORMERR rather than
 			SERVFAIL. [GL #804]
 5123.	[bug]		dig could hang indefinitely after encountering an error
 			before creating a TCP socket. [GL #692]
 5122.	[bug]		In a "forward first;" configuration, a forwarder
 			timeout did not prevent that forwarder from being
 			queried again after falling back to full recursive
 			resolution. [GL #315]
 5121.	[contrib]	dlz_stub_driver.c fails to return ISC_R_NOTFOUND on none
 			matching zone names. [GL !1299]
 5120.	[placeholder]
 5119.	[placeholder]
 5118.	[security]	Named could crash if it is managing a key with
 			`managed-keys` and the authoritative zone is rolling
 			the key to an unsupported algorithm. (CVE-2018-5745)
 			[GL #780]
 5117.	[placeholder]
 5116.	[bug]		Named/named-checkconf triggered a assertion when
 			a mirror zone's name is bad. [GL #778]
 5115.	[bug]		Allow unsupported algorithms in zone when not used for
 			signing with dnssec-signzone. [GL #783]
 5114.	[func]		Include a 'reconfig/reload in progress' status line
 			in rndc status, use it in tests.
 5113.	[port]		Fixed a Windows build error.
 5112.	[bug]		Named/named-checkconf could dump core if there was
 			a missing masters clause and a bad notify clause.
 			[GL #779]
 5111.	[bug]		Occluded DNSKEY records could make it into the
 			delegating NSEC/NSEC3 bitmap. [GL #742]
 5110.	[security]	Named leaked memory if there were multiple Key Tag
 			EDNS options present. (CVE-2018-5744) [GL #772]
 5109.	[cleanup]	Remove support for RSAMD5 algorithm. [GL #628]
 	--- 9.13.5 released ---
 5108.	[bug]		Named could fail to determine bottom of zone when
 			removing out of date keys leading to invalid NSEC
 			and NSEC3 records being added to the zone. [GL #771]
 5107.	[bug]		'host -U' did not work. [GL #769]
 5106.	[experimental]	A new "plugin" mechanism has been added to allow
 			extension of query processing functionality through
 			the use of dynamically loadable libraries. A
 			"filter-aaaa.so" plugin has been implemented,
 			replacing the filter-aaaa feature that was formerly
 			implemented as a native part of BIND.
 			The "filter-aaaa", "filter-aaaa-on-v4" and
 			"filter-aaaa-on-v6" options can no longer be
 			configured using native named.conf syntax. However,
 			loading the filter-aaaa.so plugin and setting its
 			parameters provides identical functionality.
 			Note that the plugin API is a work in progress and
 			is likely to evolve as further plugins are
 			implemented. [GL #15]
 5105.	[bug]		Fix a race between process_fd and socketclose in
 			unix socket code. [GL #744]
 5104.	[cleanup]	Log clearer informational message when a catz zone
 			is overridden by a zone in named.conf.
 			Thanks to Tony Finch. [GL !1157]
 5103.	[bug]		Add missing design by contract tests to dns_catz*.
 			[GL #748]
 5102.	[bug]		dnssec-coverage failed to use the default TTL when
 			checking KSK deletion times leading to a exception.
 			[GL #585]
 5101.	[bug]		Fix default installation path for Python modules and
 			remove the dnspython dependency accidentally introduced
 			by change 4970. [GL #730]
 5100.	[func]		Pin resolver tasks to specific task queues. [GL !1117]
 5099.	[func]		Failed mutex and conditional creations are always
 			fatal. [GL #674]
 	--- 9.13.4 released ---
 5098.	[func]		Failed memory allocations are now fatal. [GL #674]
 5097.	[cleanup]	Remove embedded ATF unit testing framework
 			from BIND source distribution.  [GL !875]
 5096.	[func]		Use multiple event loops in socket code, and
 			make network threads CPU-affinitive.  This
 			significantly improves performance on large
 			systems. [GL #666]
 5095.	[test]		Converted all unit tests from ATF to CMocka;
 			removed the source code for the ATF libraries.
 			Build with "configure --with-cmocka" to enable
 			unit testing. [GL #620]
 5094.	[func]		Add 'dig -r' to disable reading of .digrc. [GL !970]
 5093.	[bug]		Log lame qname-minimization servers only if they're
 			really lame. [GL #671]
 5092.	[bug]		Address memory leak on SIGTERM in nsupdate when using
 			GSS-TSIG. [GL #558]
 5091.	[func]		Two new global and per-view options min-cache-ttl
 			and min-ncache-ttl [GL #613]
 5090.	[bug]		dig and mdig failed to properly pre-parse dash value
 			pairs when value was a separate argument and started
 			with a dash. [GL #584]
 5089.	[bug]		Restore localhost fallback in dig and host which is
 			used when no nameserver addresses present in
 			/etc/resolv.conf are usable due to the requested
 			address family restrictions. [GL #433]
 5088.	[bug]		dig/host/nslookup could crash when interrupted close to
 			a query timeout. [GL #599]
 5087.	[test]		Check that result tables are complete. [GL #676]
 5086.	[func]		Log of RPZ now includes the QTYPE and QCLASS. [GL #623]
 5085.	[bug]		win32: Restore looking up nameservers, search list,
 			etc. [GL #186]
 5084.	[placeholder]
 5083.	[func]		Add autoconf macro AX_POSIX_SHELL, so we
 			can use POSIX-compatible shell features
 			in the scripts.
 5082.	[bug]		Fixed a race that could cause a crash in
 			dig/host/nslookup. [GL #650]
 5081.	[func]		Use per-worker queues in task manager, make task
 			runners CPU-affine. [GL #659]
 5080.	[func]		Improvements to "rndc nta" user interface:
 			- catch and report invalid command line options
 			- when removing an NTA from all views, do not
 			  abort with an error if the NTA was not found
 			  in one of the views
 			- include the view name in "rndc nta -dump"
 			  output, for consistency with the add and remove
 			  actions
 			Thanks to Tony Finch. [GL !816]
 5079.	[func]		Disable IDN processing in dig and nslookup
 			when not on a tty. [GL #653]
 5078.	[cleanup]	Require python components to be explicitly disabled if
 			python is not available on unix platforms. [GL #601]
 5077.	[cleanup]	Remove ip6.int support (-i) from dig and mdig.
 			[GL !969]
 5076.	[bug]		"require-server-cookie" was not effective if
 			"rate-limit" was configured. [GL #617]
 5075.	[bug]		Refresh nameservers from cache when sending final
 			query in qname minimization. [GL #16]
 5074.	[cleanup]	Remove vector socket functions - isc_socket_recvv(),
 			isc_socket_sendtov(), isc_socket_sendtov2(),
 			isc_socket_sendv() - in order to simplify socket code.
 			[GL #645]
 5073.	[bug]		Destroy a task first when destroying rpzs and catzs.
 			[GL #84]
 5072.	[bug]		Add unit tests for isc_buffer_copyregion() and fix its
 			behavior for auto-reallocated buffers. [GL #644]
 5071.	[bug]		Comparison of NXT records was broken. [GL #631]
 5070.	[bug]		Record types which support a empty rdata field were
 			not handling the empty rdata field case. [GL #638]
 5069.	[bug]		Fix a hang on in RPZ when named is shutdown during RPZ
 			zone update. [GL !907]
 5068.	[bug]		Fix a race in RPZ with min-update-interval set to 0.
 			[GL #643]
 5067.	[bug]		Don't minimize qname when sending the query
 			to a forwarder. [GL #361]
 5066.	[cleanup]	Allow unquoted strings to be used as a zone names
 			in response-policy statements. [GL #641]
 5065.	[bug]		Only set IPV6_USE_MIN_MTU on IPv6. [GL #553]
 5064.	[test]		Initialize TZ environment variable before calling
 			dns_test_begin in dnstap_test. [GL #624]
 5063.	[test]		In statschannel test try a few times before failing
 			when checking if the compressed output is the same as
 			uncompressed. [GL !909]
 5062.	[func]		Use non-crypto-secure PRNG to generate nonces for
 			cookies. [GL !887]
 5061.	[protocol]	Add support for EID and NIMLOC. [GL #626]
 5060.	[bug]		GID, UID and UINFO could not be loaded using unknown
 			record format. [GL #627]
 5059.	[bug]		Display a per-view list of zones in the web interface.
 			[GL #427]
 5058.	[func]		Replace old message digest and hmac APIs with more
 			generic isc_md and isc_hmac APIs, and convert their
 			respective tests to cmocka. [GL #305]
 5057.	[protocol]	Add support for ATMA. [GL #619]
 5056.	[placeholder]
 5055.	[func]		A default list of primary servers for the root zone is
 			now built into named, allowing the "masters" statement
 			to be omitted when configuring an IANA root zone
 			mirror. [GL #564]
 5054.	[func]		Attempts to use mirror zones with recursion disabled
 			are now considered a configuration error. [GL #564]
 5053.	[func]		The only valid zone-level NOTIFY settings for mirror
 			zones are now "notify no;" and "notify explicit;".
 			[GL #564]
 5052.	[func]		Mirror zones are now configured using "type mirror;"
 			rather than "mirror yes;". [GL #564]
 5051.	[doc]		Documentation incorrectly stated that the
 			"server-addresses" static-stub zone option accepts
 			custom port numbers. [GL #582]
 5050.	[bug]		The libirs version of getaddrinfo() was unable to parse
 			scoped IPv6 addresses present in /etc/resolv.conf.
 			[GL #187]
 5049.	[cleanup]	QNAME minimization has been deeply refactored. [GL #16]
 5048.	[func]		Add configure option to enable and enforce FIPS mode
 			in BIND 9. [GL #506]
 5047.	[bug]		Messages logged for certain query processing failures
 			now include a more specific error description if it is
 			available. [GL #572]
 5046.	[bug]		named could crash during shutdown if an RPZ
 			reload was in progress. [RT #46210]
 5045.	[func]		Remove support for DNSSEC algorithms 3 (DSA)
 			and 6 (DSA-NSEC3-SHA1). [GL #22]
 5044.	[cleanup]	If "dnssec-enable" is no, then "dnssec-validation"
 			now also defaults to no.  [GL #388]
 5043.	[bug]		Fix creating and validating EdDSA signatures. [GL #579]
 5042.	[test]		Make the chained delegations in reclimit behave
 			like they would in a regular name server. [GL #578]
 5041.	[test]		The chain test contains a incomplete delegation.
 			[GL #568]
 5040.	[func]		Extended dnstap so that it can log UPDATE requests
 			and responses as separate message types. Thanks
 			to Greg Rabil. [GL #570]
 5039.	[bug]		Named could fail to preserve owner name case of new
 			RRset. [GL #420]
 5038.	[bug]		Chaosnet addresses were compared incorrectly.
 			[GL #562]
 5037.	[func]		"allow-recursion-on" and "allow-query-cache-on"
 			each now default to the other if only one of them
 			is set, in order to be more consistent with the way
 			"allow-recursion" and "allow-query-cache" work.
 			Also we now ensure that both query-cache ACLs are
 			checked when determining cache access. [GL #319]
 5036.	[cleanup]	Fixed a spacing/formatting error in some RPZ-related
 			error messages in the log. [GL !805]
 5035.	[test]		Fixed errors that prevented the DNSRPS subtests
 			from running in the rpz and rpzrecurse system
 			tests. [GL #503]
 5034.	[bug]		A race between threads could prevent zone maintenance
 			scheduled immediately after zone load from being
 			performed. [GL #542]
 5033.	[bug]		When adding NTAs to multiple views using "rndc nta",
 			the text returned via rndc was incorrectly terminated
 			after the first line, making it look as if only one
 			NTA had been added. Also, it was not possible to
 			differentiate between views with the same name but
 			different classes; this has been corrected with the
 			addition of a "-class" option. [GL #105]
 5032.	[func]		Add krb5-selfsub and ms-selfsub update policy rules.
 			[GL #511]
 5031.	[cleanup]	Various defines in platform.h has been either dropped
 			if always or never triggered on supported platforms
 			or replaced with config.h equivalents if the defines
 			didn't have any impact on public headers.  Workarounds
 			for LinuxThreads have been removed because NPTL is
 			available since Linux kernel 2.6.0.  [GL #525]
 5030.	[bug]		Align CMSG buffers to a 64-bit boundary, fixes crash
 			on architectures with strict alignment. [GL #521]
 	--- 9.13.3 released ---
 5029.	[func]		Workarounds for servers that misbehave when queried
 			with EDNS have been removed, because these broken
 			servers and the workarounds for their noncompliance
 			cause unnecessary delays, increase code complexity,
 			and prevent deployment of new DNS features. See
 			https://dnsflagday.net for further details. [GL #150]
 5028.	[bug]		Spread the initial RRSIG expiration times over the
 			entire working sig-validity-interval when signing a
 			zone in named to even out re-signing and transfer
 			loads. [GL #418]
 5027.	[func]		Set SO_SNDBUF size on sockets. [GL #74]
 5026.	[bug]		rndc reconfig should not touch already loaded zones.
 			[GL #276]
 5025.	[cleanup]	Remove isc_keyboard family of functions. [GL #178]
 5024.	[func]		Replace custom assembly for atomic operations with
 			atomic support from the compiler. The code will now use
 			C11 stdatomic, or __atomic, or __sync builtins with GCC
 			or Clang compilers, and Interlocked functions with MSVC.
 			[GL #10]
 5023.	[cleanup]	Remove wrappers that try to fix broken or incomplete
 			implementations of IPv6, pthreads and other core
 			functionality required and used by BIND. [GL #192]
 5022.	[doc]		Update ms-self, ms-subdomain, krb5-self, and
 			krb5-subdomain documentation. [GL !708]
 5021.	[bug]		dig returned a non-zero exit code when it received a
 			reply over TCP after a retry. [GL #487]
 5020.	[func]		RNG uses thread-local storage instead of locks, if
 			supported by platform. [GL #496]
 5019.	[cleanup]	A message is now logged when ixfr-from-differences is
 			set at zone level for an inline-signed zone. [GL #470]
 5018.	[bug]		Fix incorrect sizeof arguments in lib/isc/pk11.c.
 			[GL !588]
 5017.	[bug]		lib/isc/pk11.c failed to unlink the session before
 			releasing the lock which is unsafe. [GL !589]
 5016.	[bug]		Named could assert with overlapping filter-aaaa and
 			dns64 acls. [GL #445]
 5015.	[bug]		Reloading all zones caused zone maintenance to cease
 			for inline-signed zones. [GL #435]
 5014.	[bug]		Signatures loaded from the journal for the signed
 			version of an inline-signed zone were not scheduled for
 			refresh. [GL #482]
 5013.	[bug]		A referral response with a non-empty ANSWER section was
 			inadvertently being treated as an error. [GL #390]
 5012.	[bug]		Fix lock order reversal in pk11_initialize. [GL !590]
 5011.	[func]		Remove support for unthreaded named. [GL #478]
 5010.	[func]		New "validate-except" option specifies a list of
 			domains beneath which DNSSEC validation should not
 			be performed. [GL #237]
 5009.	[bug]		Upon an OpenSSL failure, the first error in the OpenSSL
 			error queue was not logged. [GL #476]
 5008.	[bug]		"rndc signing -nsec3param ..." requests were silently
 			ignored for zones which were not yet loaded or
 			transferred. [GL #468]
 5007.	[cleanup]	Replace custom ISC boolean and integer data types
 			with C99 stdint.h and stdbool.h types. [GL #9]
 5006.	[cleanup]	Code preparing a delegation response was extracted from
 			query_delegation() and query_zone_delegation() into a
 			separate function in order to decrease code
 			duplication. [GL #431]
 5005.	[bug]		dnssec-verify, and dnssec-signzone at the verification
 			step, failed on some validly signed zones. [GL #442]
 5004.	[bug]		'rndc reconfig' could cause inline zones to stop
 			re-signing. [GL #439]
 5003.	[bug]		dns_acl_isinsecure did not handle geoip elements.
 			[GL #406]
 5002.	[bug]		mdig: Handle malformed +ednsopt option, support 100
 			+ednsopt options per query rather than 100 total and
 			address memory leaks if +ednsopt was specified.
 			[GL #410]
 5001.	[bug]		Fix refcount errors on error paths. [GL !563]
 5000.	[bug]		named_server_servestale() could leave the server in
 			exclusive mode if an error occurred. [GL #441]
 4999.	[cleanup]	Remove custom printf implementation in lib/isc/print.c.
 			[GL #261]
 4998.	[test]		Make resolver and cacheclean tests more civilized.
 4997.	[security]	named could crash during recursive processing
 			of DNAME records when "deny-answer-aliases" was
 			in use. (CVE-2018-5740) [GL #387]
 4996.	[bug]		dig: Handle malformed +ednsopt option. [GL #403]
 4995.	[test]		Add tests for "tcp-self" update policy. [GL !282]
 4994.	[bug]		Trust anchor telemetry queries were not being sent
 			upstream for locally served zones. [GL #392]
 4993.	[cleanup]	Remove support for silently ignoring 'no-change' deltas
 			from BIND 8 when processing an IXFR stream. 'no-change'
 			deltas will now trigger a fallback to AXFR as the
 			recovery mechanism. [GL #369]
 4992.	[bug]		The wrong address was being logged for trust anchor
 			telemetry queries. [GL #379]
 4991.	[bug]		"rndc reconfig" was incorrectly handling zones whose
 			"mirror" setting was changed. [GL #381]
 4990.	[bug]		Prevent a possible NULL reference in pkcs11-keygen.
 			[GL #401]
 4989.	[cleanup]	IDN support in dig has been reworked.  IDNA2003
 			fallbacks were removed in the process. [GL #384]
 4988.	[bug]		Don't synthesize NXDOMAIN from NSEC for records under
 			a DNAME.
 	--- 9.13.2 released ---
 4987.	[cleanup]	dns_rdataslab_tordataset() and its related
 			dns_rdatasetmethods_t callbacks were removed as they
 			were not being used by anything in BIND. [GL #371]
 4986.	[func]		When built on Linux, BIND now requires the libcap
 			library to set process privileges, unless capability
 			support is explicitly overridden with "configure
 			--disable-linux-caps". [GL #321]
 4985.	[func]		Add a new slave zone option, "mirror", to enable
 			serving a non-authoritative copy of a zone that
 			is subject to DNSSEC validation before being
 			used.  For now, this option is only meant to
 			facilitate deployment of an RFC 7706-style local
 			copy of the root zone. [GL #33]
 4984.	[bug]		Improve handling of very large incremental
 			zone transfers to prevent journal corruption. [GL #339]
 4983.	[func]		Add the ability to not return a DNS COOKIE option
 			when one is present in the request (answer-cookie no;).
 			[GL #173]
 4982.	[cleanup]	Return FORMERR if the question section is empty
 			and no COOKIE option is present; this restores
 			older behavior except in the newly specified
 			COOKIE case. [GL #260]
 4981.	[bug]		Fix race in cmsg buffer usage in socket code.
 			[GL #180]
 4980.	[bug]		Named-checkconf failed to detect bad in-view targets.
 			[GL #288]
 4979.	[placeholder]
 4978.	[test]		Fix error handling and resolver configuration in the
 			"rpz" system test. [GL #312]
 4977.	[func]		When starting up, log the same details that
 			would be reported by 'named -V'. [GL #247]
 4976.	[bug]		Log the label with invalid prefix length correctly
 			when loading RPZ zones. [GL #254]
 4975.	[bug]		The server cookie computation for sha1 and sha256 did
 			not match the method described in RFC 7873. [GL #356]
 4974.	[bug]		Restore default rrset-order to random. [GL #336]
 4973.	[func]		verifyzone() and the functions it uses were moved to
 			libdns and refactored to prevent exit() from being
 			called upon failure.  A side effect of that is that
 			dnssec-signzone and dnssec-verify now check for memory
 			leaks upon shutdown. [GL #266]
 4972.	[func]		Declare the 'rdata' argument for dns_rdata_tostruct()
 			to be const. [GL #341]
 4971.	[bug]		dnssec-signzone and dnssec-verify did not treat records
 			below a DNAME as out-of-zone data. [GL #298]
 4970.	[func]		Add QNAME minimization option to resolver. [GL #16]
 4969.	[cleanup]	Refactor zone logging functions. [GL #269]
 	--- 9.13.1 released ---
 4968.	[bug]		If glue records are signed, attempt to validate them.
 			[GL #209]
 4967.	[cleanup]	Add "answer-cookie" to the parser, marked obsolete.
 4966.	[placeholder]
 4965.	[func]		Add support for marking options as deprecated.
 			[GL #322]
 4964.	[bug]		Reduce the probabilty of double signature when deleting
 			a DNSKEY by checking if the node is otherwise signed
 			by the algorithm of the key to be deleted. [GL #240]
 4963.	[test]		ifconfig.sh now uses "ip" instead of "ifconfig",
 			if available, to configure the test interfaces on
 			linux.  [GL #302]
 4962.	[cleanup]	Move 'named -T' processing to its own function.
 			[GL #316]
 4961.	[protocol]	Remove support for ECC-GOST (GOST R 34.11-94).
 			[GL #295]
 4960.	[security]	When recursion is enabled, but the "allow-recursion"
 			and "allow-query-cache" ACLs are not specified,
 			they should be limited to local networks,
 			but were inadvertently set to match the default
 			"allow-query", thus allowing remote queries.
 			(CVE-2018-5738) [GL #309]
 4959.	[func]		NSID logging (enabled by the "request-nsid" option)
 			now has its own "nsid" category, instead of using the
 			"resolver" category. [GL !332]
 4958.	[bug]		Remove redundant space from NSEC3 record. [GL #281]
 4957.	[func]		The default setting for "dnssec-validation" is now
 			"auto", which activates DNSSEC validation using the
 			IANA root key. (The default can be changed back to
 			"yes", which activates DNSSEC validation only when keys
 			are explicitly configured in named.conf, by building
 			BIND with "configure --disable-auto-validation".)
 			[GL #30]
 4956.	[func]		Change isc_random() to be just PRNG using xoshiro128**,
 			and add isc_nonce_buf() that uses CSPRNG. [GL #289]
 4955.	[cleanup]	Silence cppcheck warnings in lib/dns/master.c.
 			[GL #286]
 4954.	[func]		Messages about serving of stale answers are now
 			directed to the "serve-stale" logging category.
 			Also clarified serve-stale documentation. [GL !323]
 4953.	[bug]		Removed the option to build the red black tree
 			database without a hash table; the non-hashing
 			version was buggy and is not needed. [GL #184]
 4952.	[func]		Authoritative server support in named for the
 			EDNS CLIENT-SUBNET option (which was experimental
 			and not practical to deploy) has been removed.
 			The ECS option is still supported in dig and mdig
 			via the +subnet option, and can be parsed and logged
 			when received by named, but it is no longer used
 			for ACL processing. The "geoip-use-ecs" option
 			is now obsolete; a warning will be logged if it is
 			used in named.conf. "ecs" tags in an ACL definition
 			are also obsolete and will cause the configuration
 			to fail to load.  [GL #32]
 4951.	[protocol]	Add "HOME.ARPA" to list of built in empty zones as
 			per RFC 8375. [GL #273]
 	--- 9.13.0 released ---
 4950.	[bug]		ISC_SOCKEVENTATTR_TRUNC was not be set. [GL #238]
@@ -1635,8 +663,8 @@
 4760.	[func]		Add glue cache statistics counters. [RT #46028]
-4759.	[func]		Add logging channel "trust-anchor-telemetry" to
+4759.	[func]		Add logging channel "trust-anchor-telementry" to
-			record trust-anchor-telemetry in incoming requests.
+			record trust-anchor-telementry in incoming requests.
 			Both _ta-XXXX.<anchor>/NULL and EDNS KEY-TAG options
 			are logged.  [RT #46124]
@@ -1705,10 +733,10 @@
 			tests when running on terminals that support them.
 			[RT #45977]
-4744.	[bug]		Suppress trust-anchor-telemetry queries if
+4744.	[bug]		Suppress trust-anchor-telementry queries if
 			validation is disabled. [RT #46131]
-4743.	[func]		Exclude trust-anchor-telemetry queries from
+4743.	[func]		Exclude trust-anchor-telementry queries from
 			synth-from-dnssec processing. [RT #46123]
 4742.	[func]		Synthesis of responses from DNSSEC-verified records.
@@ -1,4 +1,4 @@
-Copyright (C) 1996-2019  Internet Systems Consortium, Inc. ("ISC")
+Copyright (C) 1996-2018  Internet Systems Consortium, Inc. ("ISC")
 This Source Code Form is subject to the terms of the Mozilla Public
 License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -1,79 +1,5 @@
 Functional enhancements from prior major releases of BIND 9
 BIND 9.14
 BIND 9.14 (a stable branch based on the 9.13 development branch) includes
 a number of changes from BIND 9.12 and earlier releases. New features
 include:
  * A new "plugin" mechanism has been added to allow query functionality
    to be extended using dynamically loadable libraries. The "filter-aaaa"
    feature has been removed from named and is now implemented as a
    plugin.
  * Socket and task code has been refactored to improve performance.
  * QNAME minimization, as described in RFC 7816, is now supported.
  * "Root key sentinel" support, enabling validating resolvers to indicate
    via a special query which trust anchors are configured for the root
    zone.
  * Secondary zones can now be configured as "mirror" zones; their
    contents are transferred in as with traditional slave zones, but are
    subject to DNSSEC validation and are not treated as authoritative data
    when answering. This makes it easier to configure a local copy of the
    root zone as described in RFC 7706.
  * The "validate-except" option allows configuration of domains below
    which DNSSEC validation should not be performed.
  * The default value of "dnssec-validation" is now "auto".
  * IDNA2008 is now supported when linking with libidn2.
  * "named -V" now outputs the default paths for files used by named and
    other tools.
 In addition, workarounds that were formerly in place to enable resolution
 of domains whose authoritative servers did not respond to EDNS queries
 have been removed. See https://dnsflagday.net for more details.
 Cryptographic support has been modernized. BIND now uses the best
 available pseudo-random number generator for the platform on which it's
 built. Very old versions of OpenSSL are no longer supported. Cryptography
 is now mandatory: building BIND without DNSSEC is no longer supported.
 Special code to support certain legacy operating systems has also been
 removed; see the file PLATFORMS.md for details of supported platforms. In
 addition to OpenSSL, BIND now requires support for IPv6, threads, and
 standard atomic operations provided by the C compiler.
 BIND 9.12
 BIND 9.12 includes a number of changes from BIND 9.11 and earlier
 releases. New features include:
  * named and related libraries have been substantially refactored for
    improved query performance -- particularly on delegation heavy zones
    -- and for improved readability, maintainability, and testability.
  * Code implementing the name server query processing logic has been
    moved into a new libns library, for easier testing and use in tools
    other than named.
  * Cached, validated NSEC and other records can now be used to synthesize
    NXDOMAIN responses.
  * The DNS Response Policy Service API (DNSRPS) is now supported.
  * Setting 'max-journal-size default' now limits the size of journal
    files to twice the size of the zone.
  * dnstap-read -x prints a hex dump of the wire format of each logged DNS
    message.
  * dnstap output files can now be configured to roll automatically when
    reaching a given size.
  * Log file timestamps can now also be formatted in ISO 8601 (local) or
    ISO 8601 (UTC) formats.
  * Logging channels and dnstap output files can now be configured to use
    a timestamp as the suffix when rolling to a new file.
  * 'named-checkconf -l' lists zones found in named.conf.
  * Added support for the EDNS Padding and Keepalive options.
  * 'new-zones-directory' option sets the location where the configuration
    data for zones added by rndc addzone is stored.
  * The default key algorithm in rndc-confgen is now hmac-sha256.
  * filter-aaaa-on-v4 and filter-aaaa-on-v6 options are now available by
    default without a configure option.
  * The obsolete isc-hmac-fixup command has been removed.
 BIND 9.11
 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
@@ -10,81 +10,6 @@
 -->
 ### Functional enhancements from prior major releases of BIND 9
 #### BIND 9.14
 BIND 9.14 (a stable branch based on the 9.13 development branch)
 includes a number of changes from BIND 9.12 and earlier releases.
 New features include:
 * A new "plugin" mechanism has been added to allow query functionality
  to be extended using dynamically loadable libraries. The "filter-aaaa"
  feature has been removed from named and is now implemented as a plugin.
 * Socket and task code has been refactored to improve performance.
 * QNAME minimization, as described in RFC 7816, is now supported.
 * "Root key sentinel" support, enabling validating resolvers to indicate
  via a special query which trust anchors are configured for the root zone.
 * Secondary zones can now be configured as "mirror" zones; their contents
  are transferred in as with traditional slave zones, but are subject to
  DNSSEC validation and are not treated as authoritative data when
  answering. This makes it easier to configure a local copy of the root
  zone as described in RFC 7706.
 * The "validate-except" option allows configuration of domains below which
  DNSSEC validation should not be performed.
 * The default value of "dnssec-validation" is now "auto".
 * IDNA2008 is now supported when linking with `libidn2`.
 * "named -V" now outputs the default paths for files used by named
  and other tools.
 In addition, workarounds that were formerly in place to enable resolution
 of domains whose authoritative servers did not respond to EDNS queries
 have been removed. See [https://dnsflagday.net](https://dnsflagday.net)
 for more details.
 Cryptographic support has been modernized. BIND now uses the
 best available pseudo-random number generator for the platform on which
 it's built. Very old versions of OpenSSL are no longer supported.
 Cryptography is now mandatory: building BIND without DNSSEC is no
 longer supported.
 Special code to support certain legacy operating systems has also
 been removed; see the file [PLATFORMS.md](PLATFORMS.md) for details
 of supported platforms. In addition to OpenSSL, BIND now requires
 support for IPv6, threads, and standard atomic operations provided
 by the C compiler.
 #### BIND 9.12
 BIND 9.12 includes a number of changes from BIND 9.11 and earlier releases.
 New features include:
 * `named` and related libraries have been substantially refactored for
  improved query performance -- particularly on delegation heavy zones --
  and for improved readability, maintainability, and testability.
 * Code implementing the name server query processing logic has been moved
  into a new `libns` library, for easier testing and use in tools other
  than `named`.
 * Cached, validated NSEC and other records can now be used to synthesize
  NXDOMAIN responses.
 * The DNS Response Policy Service API (DNSRPS) is now supported.
 * Setting `'max-journal-size default'` now limits the size of journal files
  to twice the size of the zone.
 * `dnstap-read -x` prints a hex dump of the wire format of each logged
  DNS message.
 * `dnstap` output files can now be configured to roll automatically when
  reaching a given size.
 * Log file timestamps can now also be formatted in ISO 8601 (local) or ISO
  8601 (UTC) formats.
 * Logging channels and `dnstap` output files can now be configured to use a
  timestamp as the suffix when rolling to a new file.
 * `'named-checkconf -l'` lists zones found in `named.conf`.
 * Added support for the EDNS Padding and Keepalive options.
 * 'new-zones-directory' option sets the location where the configuration
  data for zones added by rndc addzone is stored.
 * The default key algorithm in `rndc-confgen` is now hmac-sha256.
 * `filter-aaaa-on-v4` and `filter-aaaa-on-v6` options are now available
  by default without a configure option.
 * The obsolete `isc-hmac-fixup` command has been removed.
 #### BIND 9.11
 BIND 9.11.0 includes a number of changes from BIND 9.10 and earlier
@@ -14,7 +14,7 @@ top_builddir =  @top_builddir@
 VERSION=@BIND9_VERSION@
-SUBDIRS =	make lib fuzz bin doc
+SUBDIRS =	make unit lib bin doc
 TARGETS =
 PREREQS =	bind.keys.h
@@ -22,8 +22,7 @@ MANPAGES =	isc-config.sh.1
 HTMLPAGES =	isc-config.sh.html
-MANOBJS =	README HISTORY OPTIONS CONTRIBUTING PLATFORMS \
+MANOBJS =	README HISTORY OPTIONS CONTRIBUTING ${MANPAGES} ${HTMLPAGES}
 		${MANPAGES} ${HTMLPAGES}
@BIND9_MAKE_RULES@
@@ -90,7 +89,6 @@ force-test: test-force
 test-force:
 	status=0; \
 	(cd fuzz && ${MAKE} check) || status=1; \
 	(cd bin/tests && ${MAKE} ${MAKEDEFS} test) || status=1; \
 	(test -f ${top_builddir}/unit/unittest.sh && \
 		$(SHELL) ${top_builddir}/unit/unittest.sh) || status=1; \
@@ -116,11 +114,6 @@ CONTRIBUTING: CONTRIBUTING.md
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 PLATFORMS: PLATFORMS.md
 	${PANDOC} --email-obfuscation=none -s -t html PLATFORMS.md | \
 		${W3M} -dump -cols 75 -O ascii -T text/html | \
 		sed -e '$${/^$$/d;}' > $@
 unit::
 	sh ${top_builddir}/unit/unittest.sh
@@ -1,98 +0,0 @@
 Supported platforms
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C99-compliant C compiler, BSD-style sockets with
 RFC-compliant IPv6 support, POSIX-compliant threads, and the OpenSSL
 cryptography library. Atomic operations support from the compiler is
 needed, either in the form of builtin operations, C11 atomics or the
 Interlocked family of functions on Windows.
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
 offer support on a "best effort" basis for some.
 Regularly tested platforms
 As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
  * Debian 8, 9, 10
  * Ubuntu 16.04, 18.04
  * Fedora 28, 29
  * Red Hat Enterprise Linux / CentOS 6, 7
  * FreeBSD 11.x
  * OpenBSD 6.2, 6.3
 The amd64, i386, armhf and arm64 CPU architectures are all fully
 supported.
 Best effort
 The following are platforms on which BIND is known to build and run. ISC
 makes every effort to fix bugs on these platforms, but may be unable to do
 so quickly due to lack of hardware, less familiarity on the part of
 engineering staff, and other constraints. With the exception of Windows
 Server 2012 R2, none of these are tested regularly by ISC.
  * Windows Server 2012 R2, 2016 / x64
  * Windows 10 / x64
  * macOS 10.12+
  * Solaris 11
  * FreeBSD 10.x, 12.0+
  * OpenBSD 6.4+
  * NetBSD
  * Other Linux distributions still supported by their vendors, such as:
      + Ubuntu 14.04, 18.10+
      + Gentoo
      + Arch Linux
      + Alpine Linux
  * OpenWRT/LEDE 17.01+
  * Other CPU architectures (mips, mipsel, sparc, ...)
 Unsupported platforms
 These are platforms on which BIND 9.15 is known not to build or run:
  * Platforms without at least OpenSSL 1.0.2
  * Windows 10 / x86
  * Windows Server 2012 and older
  * Solaris 10 and older
  * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
  * Platforms that don't support atomic operations (via compiler or
    library)
  * Linux without NPTL (Native POSIX Thread Library)
 Platform quirks
 ARM
 If the compilation ends with following error:
 Error: selected processor does not support `yield' in ARM mode
 You will need to set -march compiler option to native, so the compiler
 recognizes yield assembler instruction. The proper way to set -march=
 native would be to put it into CFLAGS, e.g. run ./configure like this:
 CFLAGS="-march=native -Os -g" ./configure plus your usual options.
 If that doesn't work, you can enforce the minimum CPU and FPU (taken from
 Debian armhf documentation):
  * The lowest worthwhile CPU implementation is Armv7-A, therefore the
    recommended build option is -march=armv7-a.
  * FPU should be set at VFPv3-D16 as they represent the minimum
    specification of the processors to support here, therefore the
    recommended build option is -mfpu=vfpv3-d16.
 The configure command should look like this:
 CFLAGS="-march=armv7-a -mfpu=vfpv3-d16 -Os -g" ./configure
 NetBSD 6 i386
 The i386 build of NetBSD requires the libatomic library, available from
 the gcc5-libs package. Because this library is in a non-standard path, its
 location must be specified in the configure command line:
 LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
@@ -1,83 +0,0 @@
 <!--
 - Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 -
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
 - file, You can obtain one at http://mozilla.org/MPL/2.0/.
 -
 - See the COPYRIGHT file distributed with this work for additional
 - information regarding copyright ownership.
 -->
 ## Supported platforms
 In general, this version of BIND will build and run on any POSIX-compliant
 system with a C99-compliant C compiler, BSD-style sockets with RFC-compliant
 IPv6 support, POSIX-compliant threads, and the OpenSSL cryptography library.
 Atomic operations support from the compiler is needed, either in the form of
 builtin operations, C11 atomics or the Interlocked family of functions on
 Windows.
 ISC regularly tests BIND on many operating systems and architectures, but
 lacks the resources to test all of them. Consequently, ISC is only able to
 offer support on a "best effort" basis for some.
 ### Regularly tested platforms
 As of Feb 2019, BIND 9.15 is fully supported and regularly tested on the
 following systems:
 * Debian 8, 9, 10
 * Ubuntu 16.04, 18.04
 * Fedora 28, 29
 * Red Hat Enterprise Linux / CentOS 6, 7
 * FreeBSD 11.x
 * OpenBSD 6.2, 6.3
 The amd64, i386, armhf and arm64 CPU architectures are all fully supported.
 ### Best effort
 The following are platforms on which BIND is known to build and run.
 ISC makes every effort to fix bugs on these platforms, but may be unable to
 do so quickly due to lack of hardware, less familiarity on the part of
 engineering staff, and other constraints. With the exception of Windows
 Server 2012 R2, none of these are tested regularly by ISC.
 * Windows Server 2012 R2, 2016 / x64
 * Windows 10 / x64
 * macOS 10.12+
 * Solaris 11
 * FreeBSD 10.x, 12.0+
 * OpenBSD 6.4+
 * NetBSD
 * Other Linux distributions still supported by their vendors, such as:
    * Ubuntu 14.04, 18.10+
    * Gentoo
    * Arch Linux
    * Alpine Linux
 * OpenWRT/LEDE 17.01+
 * Other CPU architectures (mips, mipsel, sparc, ...)
 ## Unsupported platforms
 These are platforms on which BIND 9.15 is known *not* to build or run:
 * Platforms without at least OpenSSL 1.0.2
 * Windows 10 / x86
 * Windows Server 2012 and older
 * Solaris 10 and older
 * Platforms that don't support IPv6 Advanced Socket API (RFC 3542)
 * Platforms that don't support atomic operations (via compiler or library)
 * Linux without NPTL (Native POSIX Thread Library)
 ## Platform quirks
 ### NetBSD 6 i386
 The i386 build of NetBSD requires the `libatomic` library, available from
 the `gcc5-libs` package.  Because this library is in a non-standard path,
 its location must be specified in the `configure` command line:
 ```
 LDFLAGS="-L/usr/pkg/gcc5/i486--netbsdelf/lib/ -Wl,-R/usr/pkg/gcc5/i486--netbsdelf/lib/" ./configure
 ```
@@ -5,15 +5,14 @@ Contents
 1. Introduction
 2. Reporting bugs and getting help
 3. Contributing to BIND
- 4. BIND 9.15 features
+ 4. BIND 9.13 features
 5. Building BIND
 6. macOS
- 7. Dependencies
+ 7. Compile-time options
- 8. Compile-time options
+ 8. Automated testing
- 9. Automated testing
+ 9. Documentation
-10. Documentation
+10. Change log
-11. Change log
+11. Acknowledgments
 12. Acknowledgments
 Introduction
@@ -32,9 +31,9 @@ administrative tools, including the dig and delv DNS lookup tools,
 nsupdate for dynamic DNS zone updates, rndc for remote name server
 administration, and more.
-BIND 9 began as a complete re-write of the BIND architecture that was used
+BIND 9 is a complete re-write of the BIND architecture that was used in
-in versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a
+versions 4 and 8. Internet Systems Consortium (https://www.isc.org), a 501
-501(c)(3) public benefit corporation dedicated to providing software and
+(c)(3) public benefit corporation dedicated to providing software and
 services in support of the Internet infrastructure, developed BIND 9 and
 is responsible for its ongoing maintenance and improvement. BIND is open
 source software licenced under the terms of the Mozilla Public License,
@@ -49,8 +48,6 @@ the file CHANGES. See below for details on the CHANGES file format.
 For up-to-date release notes and errata, see http://www.isc.org/software/
 bind9/releasenotes
 For information about supported platforms, see PLATFORMS.
 Reporting bugs and getting help
 To report non-security-sensitive bugs or request new features, you may
@@ -100,25 +97,21 @@ If you prefer, you may also submit code by opening a GitLab Issue and
 including your patch as an attachment, preferably generated by git
 format-patch.
-BIND 9.15 features
+BIND 9.13 features
-BIND 9.15 is the newest development branch of BIND 9. It includes a number
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
-of changes from BIND 9.14 and earlier releases.
+number of changes from BIND 9.12 and earlier releases. New features
 include:
  * TBD
 Building BIND
-Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
+BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-basic POSIX support, and a 64-bit integer type. Successful builds have
+support, and a 64-bit integer type. Successful builds have been observed
-been observed on many versions of Linux and UNIX, including RedHat,
+on many versions of Linux and UNIX, including RedHat, Fedora, Debian,
-Fedora, Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS
+Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris,
-X, Solaris, HP-UX, and OpenWRT.
+HP-UX, AIX, SCO OpenServer, and OpenWRT.
 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires the
 libcap library to set process privileges, though this requirement can be
 overridden by disabling capability support at compile time. See
 Compile-time options below for details on other libraries that may be
 required to support optional features.
 BIND is also available for Windows 2008 and higher. See win32utils/
 readme1st.txt for details on building for Windows systems.
@@ -162,28 +155,38 @@ if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and
 other tools so that they can be easily found.
 Dependencies
 Portions of BIND that are written in Python, including dnssec-keymgr,
 dnssec-coverage, dnssec-checkds, and some of the system tests, require the
 'argparse' and 'ply' modules to be available. 'argparse' is a standard
 module as of Python 2.7 and Python 3.2. 'ply' is available from https://
 pypi.python.org/pypi/ply.
 Compile-time options
 To see a full list of configuration options, run configure --help.
 On most platforms, BIND 9 is built with multithreading support, allowing
 it to take advantage of multiple CPUs. You can configure this by
 specifying --enable-threads or --disable-threads on the configure command
 line. The default is to enable threads, except on some older operating
 systems on which threads are known to have had problems in the past.
 (Note: Prior to BIND 9.10, the default was to disable threads on Linux
 systems; this has now been reversed. On Linux systems, the threaded build
 is known to change BIND's behavior with respect to file permissions; it
 may be necessary to specify a user with the -u option when running named.)
 To build shared libraries, specify --with-libtool on the configure command
 line.
 Certain compiled-in constants and default settings can be increased to
 values better suited to large servers with abundant memory resources (e.g,
 64-bit servers with 12G or more of memory) by specifying --with-tuning=
 large on the configure command line. This can improve performance on big
 servers, but will consume more memory and may degrade performance on
 smaller systems.
 For the server to support DNSSEC, you need to build it with crypto
 support. To use OpenSSL, you should have OpenSSL 1.0.2e or newer
 installed. If the OpenSSL library is installed in a nonstandard location,
-specify the prefix using --with-openssl=<PREFIX> on the configure command
+specify the prefix using "--with-openssl=<PREFIX>" on the configure
-line. To use a PKCS#11 hardware service module for cryptographic
+command line. To use a PKCS#11 hardware service module for cryptographic
 operations, specify the path to the PKCS#11 provider library using
--with-pkcs11=<PREFIX>, and configure BIND with --enable-native-pkcs11.
+"--with-pkcs11=<PREFIX>", and configure BIND with
 "--enable-native-pkcs11".
 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2 http://xmlsoft.org or json-c https://
@@ -196,29 +199,23 @@ specify the prefix using --with-zlib=/prefix.
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in
-a nonstandard location, specify the prefix using with-lmdb=/prefix.
+a nonstandard location, specify the prefix using "with-lmdb=/prefix".
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
--with-geoip. If the library is installed in a nonstandard location,
+"--with-geoip". If the library is installed in a nonstandard location, use
-specify the prefix using --with-geoip=/prefix.
+specify the prefix using "--with-geoip=/prefix".
 For DNSTAP packet logging, you must have installed libfstrm https://
 github.com/farsightsec/fstrm and libprotobuf-c https://
 developers.google.com/protocol-buffers, and BIND must be configured with
--enable-dnstap.
+"--enable-dnstap".
-Certain compiled-in constants and default settings can be increased to
+Portions of BIND that are written in Python, including dnssec-keymgr,
-values better suited to large servers with abundant memory resources (e.g,
+dnssec-coverage, dnssec-checkds, and some of the system tests, require the
-64-bit servers with 12G or more of memory) by specifying --with-tuning=
+'argparse' and 'ply' modules to be available. 'argparse' is a standard
-large on the configure command line. This can improve performance on big
+module as of Python 2.7 and Python 3.2. 'ply' is available from https://
-servers, but will consume more memory and may degrade performance on
+pypi.python.org/pypi/ply.
 smaller systems.
 On Linux, process capabilities are managed in user space using the libcap
 library, which can be installed on most Linux systems via the libcap-dev
 or libcap-devel module. Process capability support can also be disabled by
 configuring with --disable-linux-caps.
 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB. This can be done by using
@@ -229,9 +226,9 @@ specifying --enable-fixed-rrset or --disable-fixed-rrset on the configure
 command line. By default, fixed rrset-order is disabled to reduce memory
 footprint.
-The --enable-querytrace option causes named to log every step of
+If your operating system has integrated support for IPv6, it will be used
-processing every query. This should only be enabled when debugging,
+automatically. If you have installed KAME IPv6 separately, use --with-kame
-because it has a significant negative impact on query performance.
+[=PATH] to specify its location.
 make install will install named and the various BIND 9 libraries. By
 default, installation is into /usr/local, but this can be changed with the
@@ -258,10 +255,8 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
-Unit tests are implemented using the CMocka unit testing framework. To
+Unit tests are implemented using Automated Testing Framework (ATF). To run
-build them, use configure --with-cmocka. Execution of tests is done by the
+them, use configure --with-atf, then run make test or make unit.
 Kyua test execution engine; if the kyua command is available, then unit
 tests can be run via make test or make unit.
 Documentation
@@ -15,10 +15,9 @@
 1. [Introduction](#intro)
 1. [Reporting bugs and getting help](#help)
 1. [Contributing to BIND](#contrib)
-1. [BIND 9.15 features](#features)
+1. [BIND 9.13 features](#features)
 1. [Building BIND](#build)
 1. [macOS](#macos)
 1. [Dependencies](#dependencies)
 1. [Compile-time options](#opts)
 1. [Automated testing](#testing)
 1. [Documentation](#doc)
@@ -42,8 +41,8 @@ administrative tools, including the `dig` and `delv` DNS lookup tools,
 `nsupdate` for dynamic DNS zone updates, `rndc` for remote name server
 administration, and more.
-BIND 9 began as a complete re-write of the BIND architecture that was
+BIND 9 is a complete re-write of the BIND architecture that was used in
-used in versions 4 and 8.  Internet Systems Consortium
+versions 4 and 8.  Internet Systems Consortium
 ([https://www.isc.org](https://www.isc.org)), a 501(c)(3) public benefit
 corporation dedicated to providing software and services in support of the
 Internet infrastructure, developed BIND 9 and is responsible for its
@@ -60,8 +59,6 @@ CHANGES file format.
 For up-to-date release notes and errata, see
 [http://www.isc.org/software/bind9/releasenotes](http://www.isc.org/software/bind9/releasenotes)
 For information about supported platforms, see [PLATFORMS](PLATFORMS.md).
 ### <a name="help"/> Reporting bugs and getting help
 To report non-security-sensitive bugs or request new features, you may
@@ -117,25 +114,21 @@ If you prefer, you may also submit code by opening a
 including your patch as an attachment, preferably generated by
 `git format-patch`.
-### <a name="features"/> BIND 9.15 features
+### <a name="features"/> BIND 9.13 features
-BIND 9.15 is the newest development branch of BIND 9. It includes a
+BIND 9.13.0 is the newest development branch of BIND 9. It includes a
-number of changes from BIND 9.14 and earlier releases.
+number of changes from BIND 9.12 and earlier releases.  New features
 include:
 * TBD
 ### <a name="build"/> Building BIND
-Minimally, BIND requires a UNIX or Linux system with an ANSI C compiler,
+BIND requires a UNIX or Linux system with an ANSI C compiler, basic POSIX
-basic POSIX support, and a 64-bit integer type. Successful builds have been
+support, and a 64-bit integer type. Successful builds have been observed on
-observed on many versions of Linux and UNIX, including RedHat, Fedora,
+many versions of Linux and UNIX, including RedHat, Fedora, Debian, Ubuntu,
-Debian, Ubuntu, SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X,
+SuSE, Slackware, FreeBSD, NetBSD, OpenBSD, Mac OS X, Solaris, HP-UX, AIX,
-Solaris, HP-UX, and OpenWRT.
+SCO OpenServer, and OpenWRT. 
 BIND requires a cryptography provider library such as OpenSSL or a
 hardware service module supporting PKCS#11. On Linux, BIND requires
 the `libcap` library to set process privileges, though this requirement
 can be overridden by disabling capability support at compile time.
 See [Compile-time options](#opts) below for details on other libraries
 that may be required to support optional features.
 BIND is also available for Windows 2008 and higher.  See
 `win32utils/readme1st.txt` for details on building for Windows
@@ -173,28 +166,38 @@ or if you have Xcode already installed you can run "xcode-select --install".
 This will add /usr/include to the system and install the compiler and other
 tools so that they can be easily found.
 ### <a name="dependencies"/> Dependencies
 Portions of BIND that are written in Python, including
 `dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
 system tests, require the 'argparse' and 'ply' modules to be available.
 'argparse' is a standard module as of Python 2.7 and Python 3.2.
 'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
 #### <a name="opts"/> Compile-time options
 To see a full list of configuration options, run `configure --help`.
 On most platforms, BIND 9 is built with multithreading support, allowing it
 to take advantage of multiple CPUs.  You can configure this by specifying
 `--enable-threads` or `--disable-threads` on the `configure` command line.
 The default is to enable threads, except on some older operating systems on
 which threads are known to have had problems in the past.  (Note: Prior to
 BIND 9.10, the default was to disable threads on Linux systems; this has
 now been reversed.  On Linux systems, the threaded build is known to change
 BIND's behavior with respect to file permissions; it may be necessary to
 specify a user with the -u option when running `named`.)
 To build shared libraries, specify `--with-libtool` on the `configure`
 command line.
 Certain compiled-in constants and default settings can be increased to
 values better suited to large servers with abundant memory resources (e.g,
 64-bit servers with 12G or more of memory) by specifying
 `--with-tuning=large` on the `configure` command line. This can improve
 performance on big servers, but will consume more memory and may degrade
 performance on smaller systems.
 For the server to support DNSSEC, you need to build it with crypto support.
 To use OpenSSL, you should have OpenSSL 1.0.2e or newer installed.  If the
 OpenSSL library is installed in a nonstandard location, specify the prefix
-using `--with-openssl=<PREFIX>` on the configure command line. To use a
+using "--with-openssl=&lt;PREFIX&gt;" on the configure command line. To use a
 PKCS#11 hardware service module for cryptographic operations, specify the
-path to the PKCS#11 provider library using `--with-pkcs11=<PREFIX>`, and
+path to the PKCS#11 provider library using "--with-pkcs11=&lt;PREFIX&gt;", and
-configure BIND with `--enable-native-pkcs11`.
+configure BIND with "--enable-native-pkcs11".
 To support the HTTP statistics channel, the server must be linked with at
 least one of the following: libxml2
@@ -209,30 +212,24 @@ specify the prefix using `--with-zlib=/prefix`.
 To support storing configuration data for runtime-added zones in an LMDB
 database, the server must be linked with liblmdb. If this is installed in a
-nonstandard location, specify the prefix using `with-lmdb=/prefix`.
+nonstandard location, specify the prefix using "with-lmdb=/prefix".
 To support GeoIP location-based ACLs, the server must be linked with
 libGeoIP. This is not turned on by default; BIND must be configured with
-`--with-geoip`. If the library is installed in a nonstandard location,
+"--with-geoip". If the library is installed in a nonstandard location, use
-specify the prefix using `--with-geoip=/prefix`.
+specify the prefix using "--with-geoip=/prefix".
 For DNSTAP packet logging, you must have installed libfstrm
 [https://github.com/farsightsec/fstrm](https://github.com/farsightsec/fstrm)
 and libprotobuf-c
 [https://developers.google.com/protocol-buffers](https://developers.google.com/protocol-buffers),
-and BIND must be configured with `--enable-dnstap`.
+and BIND must be configured with "--enable-dnstap".
-Certain compiled-in constants and default settings can be increased to
+Portions of BIND that are written in Python, including
-values better suited to large servers with abundant memory resources (e.g,
+`dnssec-keymgr`, `dnssec-coverage`, `dnssec-checkds`, and some of the
-64-bit servers with 12G or more of memory) by specifying
+system tests, require the 'argparse' and 'ply' modules to be available.
-`--with-tuning=large` on the `configure` command line. This can improve
+'argparse' is a standard module as of Python 2.7 and Python 3.2.
-performance on big servers, but will consume more memory and may degrade
+'ply' is available from [https://pypi.python.org/pypi/ply](https://pypi.python.org/pypi/ply).
 performance on smaller systems.
 On Linux, process capabilities are managed in user space using
 the `libcap` library, which can be installed on most Linux systems via
 the `libcap-dev` or `libcap-devel` module. Process capability support can
 also be disabled by configuring with `--disable-linux-caps`.
 On some platforms it is necessary to explicitly request large file support
 to handle files bigger than 2GB.  This can be done by using
@@ -243,9 +240,9 @@ specifying `--enable-fixed-rrset` or `--disable-fixed-rrset` on the
 configure command line.  By default, fixed rrset-order is disabled to
 reduce memory footprint.
-The `--enable-querytrace` option causes `named` to log every step of
+If your operating system has integrated support for IPv6, it will be used
-processing every query. This should only be enabled when debugging, because
+automatically.  If you have installed KAME IPv6 separately, use
-it has a significant negative impact on query performance.
+`--with-kame[=PATH]` to specify its location.
 `make install` will install `named` and the various BIND 9 libraries.  By
 default, installation is into /usr/local, but this can be changed with the
@@ -272,10 +269,9 @@ and will be skipped if these are not available. Some tests require Python
 and the 'dnspython' module and will be skipped if these are not available.
 See bin/tests/system/README for further details.
-Unit tests are implemented using the CMocka unit testing framework.
+Unit tests are implemented using Automated Testing Framework (ATF).
-To build them, use `configure --with-cmocka`. Execution of tests is done
+To run them, use `configure --with-atf`, then run `make test` or
-by the Kyua test execution engine; if the `kyua` command is available,
+`make unit`.
 then unit tests can be run via `make test` or `make unit`.
 ### <a name="doc"/> Documentation
@@ -0,0 +1,137 @@
 /*
 * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/.
 *
 * See the COPYRIGHT file distributed with this work for additional
 * information regarding copyright ownership.
 */
 /*! \file */
 /***
 *** This file is not to be included by any public header files, because
 *** it does not get installed.
 ***/
@TOP@
 /** define on DEC OSF to enable 4.4BSD style sa_len support */
 #undef _SOCKADDR_LEN
 /** define if your system needs pthread_init() before using pthreads */
 #undef NEED_PTHREAD_INIT
 /** define if your system has sigwait() */
 #undef HAVE_SIGWAIT
 /** define if sigwait() is the UnixWare flavor */
 #undef HAVE_UNIXWARE_SIGWAIT
 /** define on Solaris to get sigwait() to work using pthreads semantics */
 #undef _POSIX_PTHREAD_SEMANTICS
 /** define if LinuxThreads is in use */
 #undef HAVE_LINUXTHREADS
 /** define if sysconf() is available */
 #undef HAVE_SYSCONF
 /** define if sysctlbyname() is available */
 #undef HAVE_SYSCTLBYNAME
 /** define if catgets() is available */
 #undef HAVE_CATGETS
 /** define if getifaddrs() exists */
 #undef HAVE_GETIFADDRS
 /** define if you have the NET_RT_IFLIST sysctl variable and sys/sysctl.h */
 #undef HAVE_IFLIST_SYSCTL
 /** define if tzset() is available */
 #undef HAVE_TZSET
 /** define if struct addrinfo exists */
 #undef HAVE_ADDRINFO
 /** define if getaddrinfo() exists */
 #undef HAVE_GETADDRINFO
 /** define if gai_strerror() exists */
 #undef HAVE_GAISTRERROR
 /**
 * define if pthread_setconcurrency() should be called to tell the
 * OS how many threads we might want to run.
 */
 #undef CALL_PTHREAD_SETCONCURRENCY
 /** define if IPv6 is not disabled */
 #undef WANT_IPV6
 /** define if flockfile() is available */
 #undef HAVE_FLOCKFILE
 /** define if getc_unlocked() is available */
 #undef HAVE_GETCUNLOCKED
 /** Shut up warnings about sputaux in stdio.h on BSD/OS pre-4.1 */
 #undef SHUTUP_SPUTAUX
 #ifdef SHUTUP_SPUTAUX
 struct __sFILE;
 extern __inline int __sputaux(int _c, struct __sFILE *_p);
 #endif
 /** Shut up warnings about missing sigwait prototype on BSD/OS 4.0* */
 #undef SHUTUP_SIGWAIT
 #ifdef SHUTUP_SIGWAIT
 int sigwait(const unsigned int *set, int *sig);
 #endif
 /** Shut up warnings from gcc -Wcast-qual on BSD/OS 4.1. */
 #undef SHUTUP_STDARG_CAST
 #if defined(SHUTUP_STDARG_CAST) && defined(__GNUC__)
 #include <stdarg.h>		/** Grr.  Must be included *every time*. */
 /**
 * The silly continuation line is to keep configure from
 * commenting out the #undef.
 */
 #undef \
 	va_start
 #define	va_start(ap, last) \
 	do { \
 		union { const void *konst; long *var; } _u; \
 		_u.konst = &(last); \
 		ap = (va_list)(_u.var + __va_words(__typeof(last))); \
 	} while (0)
 #endif /** SHUTUP_STDARG_CAST && __GNUC__ */
 /** define if the system has a random number generating device */
 #undef PATH_RANDOMDEV
 /** define if pthread_attr_getstacksize() is available */
 #undef HAVE_PTHREAD_ATTR_GETSTACKSIZE
 /** define if pthread_attr_setstacksize() is available */
 #undef HAVE_PTHREAD_ATTR_SETSTACKSIZE
 /** define if you have strerror in the C library. */
 #undef HAVE_STRERROR
 /* Define if OpenSSL includes DSA support */
 #undef HAVE_OPENSSL_DSA
 /* Define if you have getpassphrase in the C library. */
 #undef HAVE_GETPASSPHRASE
 /* Define to the length type used by the socket API (socklen_t, size_t, int). */
 #undef ISC_SOCKADDR_LEN_T
 /* Define if threads need PTHREAD_SCOPE_SYSTEM */
 #undef NEED_PTHREAD_SCOPE_SYSTEM
 /* Define to 1 if you have the uname library function. */
 #undef HAVE_UNAME
@@ -1,298 +1,17 @@
-# generated automatically by aclocal 1.16.1 -*- Autoconf -*-
+sinclude(libtool.m4/libtool.m4)dnl
 sinclude(libtool.m4/ltoptions.m4)dnl
 sinclude(libtool.m4/ltsugar.m4)dnl
 sinclude(libtool.m4/ltversion.m4)dnl
 sinclude(libtool.m4/lt~obsolete.m4)dnl
-# Copyright (C) 1996-2018 Free Software Foundation, Inc.
+m4_divert_text(HELP_CANON, [[
  NOTE: If PREFIX is not set, then the default values for --sysconfdir
  and --localstatedir are /etc and /var, respectively.]])
 m4_divert_text(HELP_END, [[
 Professional support for BIND is provided by Internet Systems Consortium,
 Inc.  Information about paid support and training options is available at
 https://www.isc.org/support.
-# This file is free software; the Free Software Foundation
+Help can also often be found on the BIND Users mailing list
-# gives unlimited permission to copy and/or distribute it,
+(https://lists.isc.org/mailman/listinfo/bind-users) or in the #bind
-# with or without modifications, as long as this notice is preserved.
+channel of the Freenode IRC service.]])
 # This program is distributed in the hope that it will be useful,
 # but WITHOUT ANY WARRANTY, to the extent permitted by law; without
 # even the implied warranty of MERCHANTABILITY or FITNESS FOR A
 # PARTICULAR PURPOSE.
 m4_ifndef([AC_CONFIG_MACRO_DIRS], [m4_defun([_AM_CONFIG_MACRO_DIRS], [])m4_defun([AC_CONFIG_MACRO_DIRS], [_AM_CONFIG_MACRO_DIRS($@)])])
 # pkg.m4 - Macros to locate and utilise pkg-config.   -*- Autoconf -*-
 # serial 12 (pkg-config-0.29.2)
 dnl Copyright © 2004 Scott James Remnant <scott@netsplit.com>.
 dnl Copyright © 2012-2015 Dan Nicholson <dbn.lists@gmail.com>
 dnl
 dnl This program is free software; you can redistribute it and/or modify
 dnl it under the terms of the GNU General Public License as published by
 dnl the Free Software Foundation; either version 2 of the License, or
 dnl (at your option) any later version.
 dnl
 dnl This program is distributed in the hope that it will be useful, but
 dnl WITHOUT ANY WARRANTY; without even the implied warranty of
 dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
 dnl General Public License for more details.
 dnl
 dnl You should have received a copy of the GNU General Public License
 dnl along with this program; if not, write to the Free Software
 dnl Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
 dnl 02111-1307, USA.
 dnl
 dnl As a special exception to the GNU General Public License, if you
 dnl distribute this file as part of a program that contains a
 dnl configuration script generated by Autoconf, you may include it under
 dnl the same distribution terms that you use for the rest of that
 dnl program.
 dnl PKG_PREREQ(MIN-VERSION)
 dnl -----------------------
 dnl Since: 0.29
 dnl
 dnl Verify that the version of the pkg-config macros are at least
 dnl MIN-VERSION. Unlike PKG_PROG_PKG_CONFIG, which checks the user's
 dnl installed version of pkg-config, this checks the developer's version
 dnl of pkg.m4 when generating configure.
 dnl
 dnl To ensure that this macro is defined, also add:
 dnl m4_ifndef([PKG_PREREQ],
 dnl     [m4_fatal([must install pkg-config 0.29 or later before running autoconf/autogen])])
 dnl
 dnl See the "Since" comment for each macro you use to see what version
 dnl of the macros you require.
 m4_defun([PKG_PREREQ],
 [m4_define([PKG_MACROS_VERSION], [0.29.2])
 m4_if(m4_version_compare(PKG_MACROS_VERSION, [$1]), -1,
    [m4_fatal([pkg.m4 version $1 or higher is required but ]PKG_MACROS_VERSION[ found])])
 ])dnl PKG_PREREQ
 dnl PKG_PROG_PKG_CONFIG([MIN-VERSION])
 dnl ----------------------------------
 dnl Since: 0.16
 dnl
 dnl Search for the pkg-config tool and set the PKG_CONFIG variable to
 dnl first found in the path. Checks that the version of pkg-config found
 dnl is at least MIN-VERSION. If MIN-VERSION is not specified, 0.9.0 is
 dnl used since that's the first version where most current features of
 dnl pkg-config existed.
 AC_DEFUN([PKG_PROG_PKG_CONFIG],
 [m4_pattern_forbid([^_?PKG_[A-Z_]+$])
 m4_pattern_allow([^PKG_CONFIG(_(PATH|LIBDIR|SYSROOT_DIR|ALLOW_SYSTEM_(CFLAGS|LIBS)))?$])
 m4_pattern_allow([^PKG_CONFIG_(DISABLE_UNINSTALLED|TOP_BUILD_DIR|DEBUG_SPEW)$])
 AC_ARG_VAR([PKG_CONFIG], [path to pkg-config utility])
 AC_ARG_VAR([PKG_CONFIG_PATH], [directories to add to pkg-config's search path])
 AC_ARG_VAR([PKG_CONFIG_LIBDIR], [path overriding pkg-config's built-in search path])
 if test "x$ac_cv_env_PKG_CONFIG_set" != "xset"; then
 	AC_PATH_TOOL([PKG_CONFIG], [pkg-config])
 fi
 if test -n "$PKG_CONFIG"; then
 	_pkg_min_version=m4_default([$1], [0.9.0])
 	AC_MSG_CHECKING([pkg-config is at least version $_pkg_min_version])
 	if $PKG_CONFIG --atleast-pkgconfig-version $_pkg_min_version; then
 		AC_MSG_RESULT([yes])
 	else
 		AC_MSG_RESULT([no])
 		PKG_CONFIG=""
 	fi
 fi[]dnl
 ])dnl PKG_PROG_PKG_CONFIG
 dnl PKG_CHECK_EXISTS(MODULES, [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
 dnl -------------------------------------------------------------------
 dnl Since: 0.18
 dnl
 dnl Check to see whether a particular set of modules exists. Similar to
 dnl PKG_CHECK_MODULES(), but does not set variables or print errors.
 dnl
 dnl Please remember that m4 expands AC_REQUIRE([PKG_PROG_PKG_CONFIG])
 dnl only at the first occurence in configure.ac, so if the first place
 dnl it's called might be skipped (such as if it is within an "if", you
 dnl have to call PKG_CHECK_EXISTS manually
 AC_DEFUN([PKG_CHECK_EXISTS],
 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
 if test -n "$PKG_CONFIG" && \
    AC_RUN_LOG([$PKG_CONFIG --exists --print-errors "$1"]); then
  m4_default([$2], [:])
 m4_ifvaln([$3], [else
  $3])dnl
 fi])
 dnl _PKG_CONFIG([VARIABLE], [COMMAND], [MODULES])
 dnl ---------------------------------------------
 dnl Internal wrapper calling pkg-config via PKG_CONFIG and setting
 dnl pkg_failed based on the result.
 m4_define([_PKG_CONFIG],
 [if test -n "$$1"; then
    pkg_cv_[]$1="$$1"
 elif test -n "$PKG_CONFIG"; then
    PKG_CHECK_EXISTS([$3],
                     [pkg_cv_[]$1=`$PKG_CONFIG --[]$2 "$3" 2>/dev/null`
 		      test "x$?" != "x0" && pkg_failed=yes ],
 		     [pkg_failed=yes])
 else
    pkg_failed=untried
 fi[]dnl
 ])dnl _PKG_CONFIG
 dnl _PKG_SHORT_ERRORS_SUPPORTED
 dnl ---------------------------
 dnl Internal check to see if pkg-config supports short errors.
 AC_DEFUN([_PKG_SHORT_ERRORS_SUPPORTED],
 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])
 if $PKG_CONFIG --atleast-pkgconfig-version 0.20; then
        _pkg_short_errors_supported=yes
 else
        _pkg_short_errors_supported=no
 fi[]dnl
 ])dnl _PKG_SHORT_ERRORS_SUPPORTED
 dnl PKG_CHECK_MODULES(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
 dnl   [ACTION-IF-NOT-FOUND])
 dnl --------------------------------------------------------------
 dnl Since: 0.4.0
 dnl
 dnl Note that if there is a possibility the first call to
 dnl PKG_CHECK_MODULES might not happen, you should be sure to include an
 dnl explicit call to PKG_PROG_PKG_CONFIG in your configure.ac
 AC_DEFUN([PKG_CHECK_MODULES],
 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
 AC_ARG_VAR([$1][_CFLAGS], [C compiler flags for $1, overriding pkg-config])dnl
 AC_ARG_VAR([$1][_LIBS], [linker flags for $1, overriding pkg-config])dnl
 pkg_failed=no
 AC_MSG_CHECKING([for $2])
 _PKG_CONFIG([$1][_CFLAGS], [cflags], [$2])
 _PKG_CONFIG([$1][_LIBS], [libs], [$2])
 m4_define([_PKG_TEXT], [Alternatively, you may set the environment variables $1[]_CFLAGS
 and $1[]_LIBS to avoid the need to call pkg-config.
 See the pkg-config man page for more details.])
 if test $pkg_failed = yes; then
        AC_MSG_RESULT([no])
        _PKG_SHORT_ERRORS_SUPPORTED
        if test $_pkg_short_errors_supported = yes; then
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --short-errors --print-errors --cflags --libs "$2" 2>&1`
        else
 	        $1[]_PKG_ERRORS=`$PKG_CONFIG --print-errors --cflags --libs "$2" 2>&1`
        fi
 	# Put the nasty error message in config.log where it belongs
 	echo "$$1[]_PKG_ERRORS" >&AS_MESSAGE_LOG_FD
 	m4_default([$4], [AC_MSG_ERROR(
 [Package requirements ($2) were not met:
 $$1_PKG_ERRORS
 Consider adjusting the PKG_CONFIG_PATH environment variable if you
 installed software in a non-standard prefix.
 _PKG_TEXT])[]dnl
        ])
 elif test $pkg_failed = untried; then
        AC_MSG_RESULT([no])
 	m4_default([$4], [AC_MSG_FAILURE(
 [The pkg-config script could not be found or is too old.  Make sure it
 is in your PATH or set the PKG_CONFIG environment variable to the full
 path to pkg-config.
 _PKG_TEXT
 To get pkg-config, see <http://pkg-config.freedesktop.org/>.])[]dnl
        ])
 else
 	$1[]_CFLAGS=$pkg_cv_[]$1[]_CFLAGS
 	$1[]_LIBS=$pkg_cv_[]$1[]_LIBS
        AC_MSG_RESULT([yes])
 	$3
 fi[]dnl
 ])dnl PKG_CHECK_MODULES
 dnl PKG_CHECK_MODULES_STATIC(VARIABLE-PREFIX, MODULES, [ACTION-IF-FOUND],
 dnl   [ACTION-IF-NOT-FOUND])
 dnl ---------------------------------------------------------------------
 dnl Since: 0.29
 dnl
 dnl Checks for existence of MODULES and gathers its build flags with
 dnl static libraries enabled. Sets VARIABLE-PREFIX_CFLAGS from --cflags
 dnl and VARIABLE-PREFIX_LIBS from --libs.
 dnl
 dnl Note that if there is a possibility the first call to
 dnl PKG_CHECK_MODULES_STATIC might not happen, you should be sure to
 dnl include an explicit call to PKG_PROG_PKG_CONFIG in your
 dnl configure.ac.
 AC_DEFUN([PKG_CHECK_MODULES_STATIC],
 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
 _save_PKG_CONFIG=$PKG_CONFIG
 PKG_CONFIG="$PKG_CONFIG --static"
 PKG_CHECK_MODULES($@)
 PKG_CONFIG=$_save_PKG_CONFIG[]dnl
 ])dnl PKG_CHECK_MODULES_STATIC
 dnl PKG_INSTALLDIR([DIRECTORY])
 dnl -------------------------
 dnl Since: 0.27
 dnl
 dnl Substitutes the variable pkgconfigdir as the location where a module
 dnl should install pkg-config .pc files. By default the directory is
 dnl $libdir/pkgconfig, but the default can be changed by passing
 dnl DIRECTORY. The user can override through the --with-pkgconfigdir
 dnl parameter.
 AC_DEFUN([PKG_INSTALLDIR],
 [m4_pushdef([pkg_default], [m4_default([$1], ['${libdir}/pkgconfig'])])
 m4_pushdef([pkg_description],
    [pkg-config installation directory @<:@]pkg_default[@:>@])
 AC_ARG_WITH([pkgconfigdir],
    [AS_HELP_STRING([--with-pkgconfigdir], pkg_description)],,
    [with_pkgconfigdir=]pkg_default)
 AC_SUBST([pkgconfigdir], [$with_pkgconfigdir])
 m4_popdef([pkg_default])
 m4_popdef([pkg_description])
 ])dnl PKG_INSTALLDIR
 dnl PKG_NOARCH_INSTALLDIR([DIRECTORY])
 dnl --------------------------------
 dnl Since: 0.27
 dnl
 dnl Substitutes the variable noarch_pkgconfigdir as the location where a
 dnl module should install arch-independent pkg-config .pc files. By
 dnl default the directory is $datadir/pkgconfig, but the default can be
 dnl changed by passing DIRECTORY. The user can override through the
 dnl --with-noarch-pkgconfigdir parameter.
 AC_DEFUN([PKG_NOARCH_INSTALLDIR],
 [m4_pushdef([pkg_default], [m4_default([$1], ['${datadir}/pkgconfig'])])
 m4_pushdef([pkg_description],
    [pkg-config arch-independent installation directory @<:@]pkg_default[@:>@])
 AC_ARG_WITH([noarch-pkgconfigdir],
    [AS_HELP_STRING([--with-noarch-pkgconfigdir], pkg_description)],,
    [with_noarch_pkgconfigdir=]pkg_default)
 AC_SUBST([noarch_pkgconfigdir], [$with_noarch_pkgconfigdir])
 m4_popdef([pkg_default])
 m4_popdef([pkg_description])
 ])dnl PKG_NOARCH_INSTALLDIR
 dnl PKG_CHECK_VAR(VARIABLE, MODULE, CONFIG-VARIABLE,
 dnl [ACTION-IF-FOUND], [ACTION-IF-NOT-FOUND])
 dnl -------------------------------------------
 dnl Since: 0.28
 dnl
 dnl Retrieves the value of the pkg-config variable for the given module.
 AC_DEFUN([PKG_CHECK_VAR],
 [AC_REQUIRE([PKG_PROG_PKG_CONFIG])dnl
 AC_ARG_VAR([$1], [value of $3 for $2, overriding pkg-config])dnl
 _PKG_CONFIG([$1], [variable="][$3]["], [$2])
 AS_VAR_COPY([$1], [pkg_cv_][$1])
 AS_VAR_IF([$1], [""], [$5], [$4])dnl
 ])dnl PKG_CHECK_VAR
 m4_include([m4/ax_check_openssl.m4])
 m4_include([m4/ax_posix_shell.m4])
 m4_include([m4/ax_pthread.m4])
 m4_include([m4/libtool.m4])
 m4_include([m4/ltoptions.m4])
 m4_include([m4/ltsugar.m4])
 m4_include([m4/ltversion.m4])
 m4_include([m4/lt~obsolete.m4])
@@ -10,4 +10,4 @@
 # information regarding copyright ownership.
 # Run this script after modifying configure.in to generate configure
-autoreconf -f -i
+autoreconf -i
@@ -12,7 +12,7 @@ VPATH =		@srcdir@
 top_srcdir =	@top_srcdir@
 SUBDIRS =	named rndc dig delv dnssec tools nsupdate check confgen \
-		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ plugins tests
+		@NZD_TOOLS@ @PYTHON_TOOLS@ @PKCS11_TOOLS@ tests
 TARGETS =
@BIND9_MAKE_RULES@
@@ -16,15 +16,15 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@
 CINCLUDES =	${NS_INCLUDES} ${BIND9_INCLUDES} ${DNS_INCLUDES} ${ISCCFG_INCLUDES} \
-		${ISC_INCLUDES} @OPENSSL_INCLUDES@
+		${ISC_INCLUDES} @DST_OPENSSL_INC@
 CDEFINES = 	-DNAMED_CONFFILE=\"${sysconfdir}/named.conf\"
 CWARNINGS =
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
 NSLIBS =	../../lib/ns/libns.@A@
@@ -66,7 +66,7 @@ named-checkzone.@O@: named-checkzone.c
 named-checkconf@EXEEXT@: named-checkconf.@O@ check-tool.@O@ ${ISCDEPLIBS} \
 		${NSDEPENDLIBS} ${DNSDEPLIBS} ${ISCCFGDEPLIBS} ${BIND9DEPLIBS}
 	export BASEOBJS="named-checkconf.@O@ check-tool.@O@"; \
-	export LIBS0="${BIND9LIBS} ${NSLIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
+	export LIBS0="${NSLIBS} ${BIND9LIBS} ${ISCCFGLIBS} ${DNSLIBS}"; \
 	${FINALBUILDCMD}
 named-checkzone@EXEEXT@: named-checkzone.@O@ check-tool.@O@ ${ISCDEPLIBS} \
@@ -88,12 +88,12 @@ install:: named-checkconf@EXEEXT@ named-checkzone@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkconf@EXEEXT@ ${DESTDIR}${sbindir}
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} named-checkzone@EXEEXT@ ${DESTDIR}${sbindir}
 	(cd ${DESTDIR}${sbindir}; rm -f named-compilezone@EXEEXT@; ${LINK_PROGRAM} named-checkzone@EXEEXT@ named-compilezone@EXEEXT@)
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
 	(cd ${DESTDIR}${mandir}/man8; rm -f named-compilezone.8; ${LINK_PROGRAM} named-checkzone.8 named-compilezone.8)
 uninstall::
 	rm -f ${DESTDIR}${mandir}/man8/named-compilezone.8
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
 	rm -f ${DESTDIR}${sbindir}/named-compilezone@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkconf@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/named-checkzone@EXEEXT@
@@ -12,9 +12,9 @@
 /*! \file */
-#include <stdbool.h>
+#include <config.h>
 #include <stdio.h>
 #include <inttypes.h>
 #ifdef _WIN32
 #include <Winsock2.h>
@@ -60,6 +60,14 @@
 #define CHECK_LOCAL 1
 #endif
 #ifdef HAVE_ADDRINFO
 #ifdef HAVE_GETADDRINFO
 #ifdef HAVE_GAISTRERROR
 #define USE_GETADDRINFO
 #endif
 #endif
 #endif
 #define CHECK(r) \
 	do { \
 		result = (r); \
@@ -80,15 +88,15 @@ static const char *dbtype[] = { "rbt" };
 int debug = 0;
 const char *journal = NULL;
-bool nomerge = true;
+isc_boolean_t nomerge = ISC_TRUE;
 #if CHECK_LOCAL
-bool docheckmx = true;
+isc_boolean_t docheckmx = ISC_TRUE;
-bool dochecksrv = true;
+isc_boolean_t dochecksrv = ISC_TRUE;
-bool docheckns = true;
+isc_boolean_t docheckns = ISC_TRUE;
 #else
-bool docheckmx = false;
+isc_boolean_t docheckmx = ISC_FALSE;
-bool dochecksrv = false;
+isc_boolean_t dochecksrv = ISC_FALSE;
-bool docheckns = false;
+isc_boolean_t docheckns = ISC_FALSE;
 #endif
 dns_zoneopt_t zone_options = DNS_ZONEOPT_CHECKNS |
 			     DNS_ZONEOPT_CHECKMX |
@@ -134,7 +142,7 @@ add(char *key, int value) {
 	if (symtab == NULL) {
 		result = isc_symtab_create(sym_mctx, 100, freekey, sym_mctx,
-					   false, &symtab);
+					   ISC_FALSE, &symtab);
 		if (result != ISC_R_SUCCESS)
 			return;
 	}
@@ -150,31 +158,32 @@ add(char *key, int value) {
 		isc_mem_free(sym_mctx, key);
 }
-static bool
+static isc_boolean_t
 logged(char *key, int value) {
 	isc_result_t result;
 	if (symtab == NULL)
-		return (false);
+		return (ISC_FALSE);
 	result = isc_symtab_lookup(symtab, key, value, NULL);
 	if (result == ISC_R_SUCCESS)
-		return (true);
+		return (ISC_TRUE);
-	return (false);
+	return (ISC_FALSE);
 }
-static bool
+static isc_boolean_t
 checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	dns_rdataset_t *a, dns_rdataset_t *aaaa)
 {
 #ifdef USE_GETADDRINFO
 	dns_rdataset_t *rdataset;
 	dns_rdata_t rdata = DNS_RDATA_INIT;
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	char addrbuf[sizeof("xxxx:xxxx:xxxx:xxxx:xxxx:xxxx:123.123.123.123")];
-	bool answer = true;
+	isc_boolean_t answer = ISC_TRUE;
-	bool match;
+	isc_boolean_t match;
 	const char *type;
 	void *ptr = NULL;
 	int result;
@@ -223,7 +232,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     ownerbuf, namebuf,
 				     cur->ai_canonname);
 			/* XXX950 make fatal for 9.5.0 */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 			add(namebuf, ERR_IS_CNAME);
 		}
 		break;
@@ -239,7 +248,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0 */
-		return (true);
+		return (ISC_TRUE);
 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -248,7 +257,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 				     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}
 	/*
@@ -259,13 +268,13 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	result = dns_rdataset_first(a);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(a, &rdata);
-		match = false;
+		match = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET)
 				continue;
 			ptr = &((struct sockaddr_in *)(cur->ai_addr))->sin_addr;
 			if (memcmp(ptr, rdata.data, rdata.length) == 0) {
-				match = true;
+				match = ISC_TRUE;
 				break;
 			}
 		}
@@ -277,7 +286,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					       addrbuf, sizeof(addrbuf)));
 			add(namebuf, ERR_EXTRA_A);
 			/* XXX950 make fatal for 9.5.0 */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 		}
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(a);
@@ -289,13 +298,13 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	result = dns_rdataset_first(aaaa);
 	while (result == ISC_R_SUCCESS) {
 		dns_rdataset_current(aaaa, &rdata);
-		match = false;
+		match = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			if (cur->ai_family != AF_INET6)
 				continue;
 			ptr = &((struct sockaddr_in6 *)(cur->ai_addr))->sin6_addr;
 			if (memcmp(ptr, rdata.data, rdata.length) == 0) {
-				match = true;
+				match = ISC_TRUE;
 				break;
 			}
 		}
@@ -307,7 +316,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					       addrbuf, sizeof(addrbuf)));
 			add(namebuf, ERR_EXTRA_AAAA);
 			/* XXX950 make fatal for 9.5.0. */
-			/* answer = false; */
+			/* answer = ISC_FALSE; */
 		}
 		dns_rdata_reset(&rdata);
 		result = dns_rdataset_next(aaaa);
@@ -318,7 +327,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	 * Check that all addresses appear in the glue.
 	 */
 	if (!logged(namebuf, ERR_MISSING_GLUE)) {
-		bool missing_glue = false;
+		isc_boolean_t missing_glue = ISC_FALSE;
 		for (cur = ai; cur != NULL; cur = cur->ai_next) {
 			switch (cur->ai_family) {
 			case AF_INET:
@@ -334,7 +343,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			default:
 				 continue;
 			}
-			match = false;
+			match = ISC_FALSE;
 			if (dns_rdataset_isassociated(rdataset))
 				result = dns_rdataset_first(rdataset);
 			else
@@ -342,7 +351,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 			while (result == ISC_R_SUCCESS && !match) {
 				dns_rdataset_current(rdataset, &rdata);
 				if (memcmp(ptr, rdata.data, rdata.length) == 0)
-					match = true;
+					match = ISC_TRUE;
 				dns_rdata_reset(&rdata);
 				result = dns_rdataset_next(rdataset);
 			}
@@ -353,8 +362,8 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 					     inet_ntop(cur->ai_family, ptr,
 						       addrbuf, sizeof(addrbuf)));
 				/* XXX950 make fatal for 9.5.0. */
-				/* answer = false; */
+				/* answer = ISC_FALSE; */
-				missing_glue = true;
+				missing_glue = ISC_TRUE;
 			}
 		}
 		if (missing_glue)
@@ -362,16 +371,20 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	}
 	freeaddrinfo(ai);
 	return (answer);
 #else
 	return (ISC_TRUE);
 #endif
 }
-static bool
+static isc_boolean_t
 checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
 	int level = ISC_LOG_ERROR;
-	bool answer = true;
+	isc_boolean_t answer = ISC_TRUE;
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_CANONNAME;
@@ -415,7 +428,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 					add(namebuf, ERR_IS_MXCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
-					answer = false;
+					answer = ISC_FALSE;
 			}
 		}
 		freeaddrinfo(ai);
@@ -433,7 +446,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return (ISC_TRUE);
 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -442,18 +455,22 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}
 #else
 	return (ISC_TRUE);
 #endif
 }
-static bool
+static isc_boolean_t
 checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 #ifdef USE_GETADDRINFO
 	struct addrinfo hints, *ai, *cur;
 	char namebuf[DNS_NAME_FORMATSIZE + 1];
 	char ownerbuf[DNS_NAME_FORMATSIZE];
 	int result;
 	int level = ISC_LOG_ERROR;
-	bool answer = true;
+	isc_boolean_t answer = ISC_TRUE;
 	memset(&hints, 0, sizeof(hints));
 	hints.ai_flags = AI_CANONNAME;
@@ -496,7 +513,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 					add(namebuf, ERR_IS_SRVCNAME);
 				}
 				if (level == ISC_LOG_ERROR)
-					answer = false;
+					answer = ISC_FALSE;
 			}
 		}
 		freeaddrinfo(ai);
@@ -514,7 +531,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 			add(namebuf, ERR_NO_ADDRESSES);
 		}
 		/* XXX950 make fatal for 9.5.0. */
-		return (true);
+		return (ISC_TRUE);
 	default:
 		if (!logged(namebuf, ERR_LOOKUP_FAILURE)) {
@@ -523,8 +540,11 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 				     namebuf, gai_strerror(result));
 			add(namebuf, ERR_LOOKUP_FAILURE);
 		}
-		return (true);
+		return (ISC_TRUE);
 	}
 #else
 	return (ISC_TRUE);
 #endif
 }
 isc_result_t
@@ -630,7 +650,7 @@ check_ttls(dns_zone_t *zone, dns_ttl_t maxttl) {
 	if (dbiter != NULL)
 		dns_dbiterator_destroy(&dbiter);
 	if (version != NULL)
-		dns_db_closeversion(db, &version, false);
+		dns_db_closeversion(db, &version, ISC_FALSE);
 	if (db != NULL)
 		dns_db_detach(&db);
@@ -677,7 +697,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	CHECK(dns_rdataclass_fromtext(&rdclass, &region));
 	dns_zone_setclass(zone, rdclass);
-	dns_zone_setoption(zone, zone_options, true);
+	dns_zone_setoption(zone, zone_options, ISC_TRUE);
 	dns_zone_setoption(zone, DNS_ZONEOPT_NOMERGE, nomerge);
 	dns_zone_setmaxttl(zone, maxttl);
@@ -689,7 +709,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 	if (dochecksrv)
 		dns_zone_setchecksrv(zone, checksrv);
-	CHECK(dns_zone_load(zone, false));
+	CHECK(dns_zone_load(zone));
 	/*
 	 * When loading map files we can't catch oversize TTLs during
@@ -714,7 +734,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 isc_result_t
 dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	  dns_masterformat_t fileformat, const dns_master_style_t *style,
-	  const uint32_t rawversion)
+	  const isc_uint32_t rawversion)
 {
 	isc_result_t result;
 	FILE *output = stdout;
@@ -769,3 +789,4 @@ DestroySockets(void) {
 	WSACleanup();
 }
 #endif
@@ -15,9 +15,6 @@
 /*! \file */
 #include <inttypes.h>
 #include <stdbool.h>
 #include <isc/lang.h>
 #include <isc/stdio.h>
 #include <isc/types.h>
@@ -39,7 +36,7 @@ load_zone(isc_mem_t *mctx, const char *zonename, const char *filename,
 isc_result_t
 dump_zone(const char *zonename, dns_zone_t *zone, const char *filename,
 	  dns_masterformat_t fileformat, const dns_master_style_t *style,
-	  const uint32_t rawversion);
+	  const isc_uint32_t rawversion);
 #ifdef _WIN32
 void InitSockets(void);
@@ -48,10 +45,10 @@ void DestroySockets(void);
 extern int debug;
 extern const char *journal;
-extern bool nomerge;
+extern isc_boolean_t nomerge;
-extern bool docheckmx;
+extern isc_boolean_t docheckmx;
-extern bool docheckns;
+extern isc_boolean_t docheckns;
-extern bool dochecksrv;
+extern isc_boolean_t dochecksrv;
 extern dns_zoneopt_t zone_options;
 ISC_LANG_ENDDECLS
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -39,7 +39,7 @@
 named-checkconf \- named configuration file syntax checking tool
 .SH "SYNOPSIS"
 .HP \w'\fBnamed\-checkconf\fR\ 'u
-\fBnamed\-checkconf\fR [\fB\-chjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
+\fBnamed\-checkconf\fR [\fB\-hjlvz\fR] [\fB\-p\fR\ [\fB\-x\fR\ ]] [\fB\-t\ \fR\fB\fIdirectory\fR\fR] {filename}
 .SH "DESCRIPTION"
 .PP
 \fBnamed\-checkconf\fR
@@ -79,13 +79,6 @@ When loading a zonefile read the journal if it exists\&.
 List all the configured zones\&. Each line of output contains the zone name, class (e\&.g\&. IN), view, and type (e\&.g\&. master or slave)\&.
 .RE
 .PP
 \-c
 .RS 4
 Check "core" configuration only\&. This suppresses the loading of plugin modules, and causes all parameters to
 \fBplugin\fR
 statements to be ignored\&.
 .RE
 .PP
 \-p
 .RS 4
 Print out the
@@ -143,5 +136,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -12,8 +12,9 @@
 /*! \file */
 #include <config.h>
 #include <errno.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>
@@ -44,8 +45,6 @@
 static const char *program = "named-checkconf";
 static bool loadplugins = true;
 isc_log_t *logc = NULL;
 #define CHECK(r)\
@@ -61,7 +60,7 @@ usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(void) {
-	fprintf(stderr, "usage: %s [-chjlvz] [-p [-x]] [-t directory] "
+	fprintf(stderr, "usage: %s [-hjlvz] [-p [-x]] [-t directory] "
 		"[named.conf]\n", program);
 	exit(1);
 }
@@ -92,18 +91,18 @@ directory_callback(const char *clausename, const cfg_obj_t *obj, void *arg) {
 	return (ISC_R_SUCCESS);
 }
-static bool
+static isc_boolean_t
 get_maps(const cfg_obj_t **maps, const char *name, const cfg_obj_t **obj) {
 	int i;
 	for (i = 0;; i++) {
 		if (maps[i] == NULL)
-			return (false);
+			return (ISC_FALSE);
 		if (cfg_map_get(maps[i], name, obj) == ISC_R_SUCCESS)
-			return (true);
+			return (ISC_TRUE);
 	}
 }
-static bool
+static isc_boolean_t
 get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *checknames;
@@ -114,14 +113,14 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 	for (i = 0;; i++) {
 		if (maps[i] == NULL)
-			return (false);
+			return (ISC_FALSE);
 		checknames = NULL;
 		result = cfg_map_get(maps[i], "check-names", &checknames);
 		if (result != ISC_R_SUCCESS)
 			continue;
 		if (checknames != NULL && !cfg_obj_islist(checknames)) {
 			*obj = checknames;
-			return (true);
+			return (ISC_TRUE);
 		}
 		for (element = cfg_list_first(checknames);
 		     element != NULL;
@@ -136,7 +135,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 				continue;
 			}
 			*obj = cfg_tuple_get(value, "mode");
-			return (true);
+			return (ISC_TRUE);
 		}
 	}
 }
@@ -169,7 +168,7 @@ configure_hint(const char *zfile, const char *zclass, isc_mem_t *mctx) {
 static isc_result_t
 configure_zone(const char *vclass, const char *view,
 	       const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
-	       const cfg_obj_t *config, isc_mem_t *mctx, bool list)
+	       const cfg_obj_t *config, isc_mem_t *mctx, isc_boolean_t list)
 {
 	int i = 0;
 	isc_result_t result;
@@ -282,10 +281,8 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -302,10 +299,8 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -331,10 +326,8 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -351,10 +344,8 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -374,10 +365,8 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -393,10 +382,8 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else {
+		} else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -406,16 +393,14 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0) {
+		if (strcasecmp(masterformatstr, "text") == 0)
 			masterformat = dns_masterformat_text;
-		} else if (strcasecmp(masterformatstr, "raw") == 0) {
+		else if (strcasecmp(masterformatstr, "raw") == 0)
 			masterformat = dns_masterformat_raw;
-		} else if (strcasecmp(masterformatstr, "map") == 0) {
+		else if (strcasecmp(masterformatstr, "map") == 0)
 			masterformat = dns_masterformat_map;
-		} else {
+		else
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 	}
 	obj = NULL;
@@ -435,7 +420,7 @@ configure_zone(const char *vclass, const char *view,
 /*% configure a view */
 static isc_result_t
 configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
-	       const cfg_obj_t *vconfig, isc_mem_t *mctx, bool list)
+	       const cfg_obj_t *vconfig, isc_mem_t *mctx, isc_boolean_t list)
 {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *voptions;
@@ -484,7 +469,7 @@ config_getclass(const cfg_obj_t *classobj, dns_rdataclass_t defclass,
 /*% load zones from the configuration */
 static isc_result_t
 load_zones_fromconfig(const cfg_obj_t *config, isc_mem_t *mctx,
-		      bool list_zones)
+		      isc_boolean_t list_zones)
 {
 	const cfg_listelt_t *element;
 	const cfg_obj_t *views;
@@ -552,17 +537,17 @@ main(int argc, char **argv) {
 	isc_mem_t *mctx = NULL;
 	isc_result_t result;
 	int exit_status = 0;
-	bool load_zones = false;
+	isc_boolean_t load_zones = ISC_FALSE;
-	bool list_zones = false;
+	isc_boolean_t list_zones = ISC_FALSE;
-	bool print = false;
+	isc_boolean_t print = ISC_FALSE;
 	unsigned int flags = 0;
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	/*
 	 * Process memory debugging argument first.
 	 */
-#define CMDLINE_FLAGS "cdhjlm:t:pvxz"
+#define CMDLINE_FLAGS "dhjlm:t:pvxz"
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
 		switch (c) {
 		case 'm':
@@ -581,26 +566,22 @@ main(int argc, char **argv) {
 			break;
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;
 	RUNTIME_CHECK(isc_mem_create(0, 0, &mctx) == ISC_R_SUCCESS);
 	while ((c = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != EOF) {
 		switch (c) {
 		case 'c':
 			loadplugins = false;
 			break;
 		case 'd':
 			debug++;
 			break;
 		case 'j':
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;
 		case 'l':
-			list_zones = true;
+			list_zones = ISC_TRUE;
 			break;
 		case 'm':
@@ -616,7 +597,7 @@ main(int argc, char **argv) {
 			break;
 		case 'p':
-			print = true;
+			print = ISC_TRUE;
 			break;
 		case 'v':
@@ -628,10 +609,10 @@ main(int argc, char **argv) {
 			break;
 		case 'z':
-			load_zones = true;
+			load_zones = ISC_TRUE;
-			docheckmx = false;
+			docheckmx = ISC_FALSE;
-			docheckns = false;
+			docheckns = ISC_FALSE;
-			dochecksrv = false;
+			dochecksrv = ISC_FALSE;
 			break;
 		case '?':
@@ -681,10 +662,9 @@ main(int argc, char **argv) {
 	    ISC_R_SUCCESS)
 		exit(1);
-	result = bind9_check_namedconf(config, loadplugins, logc, mctx);
+	result = bind9_check_namedconf(config, logc, mctx);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		exit_status = 1;
 	}
 	if (result == ISC_R_SUCCESS && (load_zones || list_zones)) {
 		result = load_zones_fromconfig(config, mctx, list_zones);
@@ -40,7 +40,6 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -53,7 +52,7 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>named-checkconf</command>
-      <arg choice="opt" rep="norepeat"><option>-chjlvz</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-hjlvz</option></arg>
      <arg choice="opt" rep="norepeat"><option>-p</option>
 	<arg choice="opt" rep="norepeat"><option>-x</option>
      </arg></arg>
@@ -115,17 +114,6 @@
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-c</term>
        <listitem>
          <para>
 	    Check "core" configuration only. This suppresses the loading
 	    of plugin modules, and causes all parameters to
 	    <command>plugin</command> statements to be ignored.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
        <term>-p</term>
        <listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007, 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,7 +33,7 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">named-checkconf</code> 
-       [<code class="option">-chjlvz</code>]
+       [<code class="option">-hjlvz</code>]
       [<code class="option">-p</code>
 	 [<code class="option">-x</code>
      ]]
@@ -88,14 +88,6 @@
            (e.g. master or slave).
          </p>
        </dd>
 <dt><span class="term">-c</span></dt>
 <dd>
          <p>
 	    Check "core" configuration only. This suppresses the loading
 	    of plugin modules, and causes all parameters to
 	    <span class="command"><strong>plugin</strong></span> statements to be ignored.
          </p>
        </dd>
 <dt><span class="term">-p</span></dt>
 <dd>
          <p>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -325,5 +325,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -12,9 +12,9 @@
 /*! \file */
-#include <stdbool.h>
+#include <config.h>
 #include <stdlib.h>
 #include <inttypes.h>
 #include <isc/app.h>
 #include <isc/commandline.h>
@@ -106,10 +106,10 @@ main(int argc, char **argv) {
 	dns_masterformat_t inputformat = dns_masterformat_text;
 	dns_masterformat_t outputformat = dns_masterformat_text;
 	dns_masterrawheader_t header;
-	uint32_t rawversion = 1, serialnum = 0;
+	isc_uint32_t rawversion = 1, serialnum = 0;
 	dns_ttl_t maxttl = 0;
-	bool snset = false;
+	isc_boolean_t snset = ISC_FALSE;
-	bool logdump = false;
+	isc_boolean_t logdump = ISC_FALSE;
 	FILE *errout = stdout;
 	char *endp;
@@ -137,14 +137,12 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
-	if (PROGCMP("named-checkzone")) {
+	if (PROGCMP("named-checkzone"))
 		progmode = progmode_check;
-	} else if (PROGCMP("named-compilezone")) {
+	else if (PROGCMP("named-compilezone"))
 		progmode = progmode_compile;
-	} else {
+	else
 		INSIST(0);
 		ISC_UNREACHABLE();
 	}
 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
@@ -161,7 +159,7 @@ main(int argc, char **argv) {
 #define ARGCMP(X) (strcmp(isc_commandline_argument, X) == 0)
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	while ((c = isc_commandline_parse(argc, argv,
 			       "c:df:hi:jJ:k:L:l:m:n:qr:s:t:o:vw:DF:M:S:T:W:"))
@@ -179,33 +177,33 @@ main(int argc, char **argv) {
 			if (ARGCMP("full")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY |
 						DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = true;
+				docheckmx = ISC_TRUE;
-				docheckns = true;
+				docheckns = ISC_TRUE;
-				dochecksrv = true;
+				dochecksrv = ISC_TRUE;
 			} else if (ARGCMP("full-sibling")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = true;
+				docheckmx = ISC_TRUE;
-				docheckns = true;
+				docheckns = ISC_TRUE;
-				dochecksrv = true;
+				dochecksrv = ISC_TRUE;
 			} else if (ARGCMP("local")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options |= DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
+				docheckmx = ISC_FALSE;
-				docheckns = false;
+				docheckns = ISC_FALSE;
-				dochecksrv = false;
+				dochecksrv = ISC_FALSE;
 			} else if (ARGCMP("local-sibling")) {
 				zone_options |= DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
+				docheckmx = ISC_FALSE;
-				docheckns = false;
+				docheckns = ISC_FALSE;
-				dochecksrv = false;
+				dochecksrv = ISC_FALSE;
 			} else if (ARGCMP("none")) {
 				zone_options &= ~DNS_ZONEOPT_CHECKINTEGRITY;
 				zone_options &= ~DNS_ZONEOPT_CHECKSIBLING;
-				docheckmx = false;
+				docheckmx = ISC_FALSE;
-				docheckns = false;
+				docheckns = ISC_FALSE;
-				dochecksrv = false;
+				dochecksrv = ISC_FALSE;
 			} else {
 				fprintf(stderr, "invalid argument to -i: %s\n",
 					isc_commandline_argument);
@@ -222,12 +220,12 @@ main(int argc, char **argv) {
 			break;
 		case 'j':
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;
 		case 'J':
 			journal = isc_commandline_argument;
-			nomerge = false;
+			nomerge = ISC_FALSE;
 			break;
 		case 'k':
@@ -248,7 +246,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
-			snset = true;
+			snset = ISC_TRUE;
 			endp = NULL;
 			serialnum = strtol(isc_commandline_argument, &endp, 0);
 			if (*endp != '\0') {
@@ -507,7 +505,7 @@ main(int argc, char **argv) {
 	     strcmp(output_filename, "/dev/fd/1") == 0 ||
 	     strcmp(output_filename, "/dev/stdout") == 0)) {
 		errout = stderr;
-		logdump = false;
+		logdump = ISC_FALSE;
 	}
 	if (isc_commandline_index + 2 != argc)
@@ -43,7 +43,6 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004-2007, 2009-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -55,14 +55,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -71,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -82,7 +81,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -90,7 +89,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -101,7 +99,7 @@
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
  </ItemDefinitionGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -58,14 +58,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -81,7 +80,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -89,7 +88,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\ns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -55,14 +55,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(ProjectName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -71,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -88,7 +87,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -96,7 +95,6 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -107,7 +105,7 @@ copy /Y named-checkzone.ilk named-compilezone.ilk
      <OptimizeReferences>true</OptimizeReferences>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);..\..\..\lib\ns\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>checktool.lib;libisc.lib;libdns.lib;libisccfg.lib;libbind9.lib;libns.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
    </Link>
    <PostBuildEvent>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -27,8 +27,8 @@ CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 ISCCCLIBS =	../../lib/isccc/libisccc.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -144,5 +144,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -17,15 +17,17 @@
 * and the corresponding key and update-policy statements in named.conf.
 */
-#include <stdarg.h>
+#include <config.h>
-#include <stdbool.h>
+
 #include <stdlib.h>
 #include <stdarg.h>
 #include <isc/assertions.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>
@@ -34,7 +36,7 @@
 #include <isc/time.h>
 #include <isc/util.h>
-#if USE_PKCS11
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif
@@ -54,7 +56,7 @@
 static char program[256];
 const char *progname;
 static enum { progmode_keygen, progmode_confgen} progmode;
-bool verbose = false; /* needed by util.c but not used here */
+isc_boolean_t verbose = ISC_FALSE; /* needed by util.c but not used here */
 ISC_PLATFORM_NORETURN_PRE static void
 usage(int status) ISC_PLATFORM_NORETURN_POST;
@@ -85,8 +87,8 @@ Usage:\n\
 int
 main(int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
-	bool show_final_mem = false;
+	isc_boolean_t show_final_mem = ISC_FALSE;
-	bool quiet = false;
+	isc_boolean_t quiet = ISC_FALSE;
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
@@ -100,7 +102,7 @@ main(int argc, char **argv) {
 	int len = 0;
 	int ch;
-#if USE_PKCS11
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
@@ -122,15 +124,13 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
-		quiet = true;
+		quiet = ISC_TRUE;
-	} else if (PROGCMP("ddns-confgen")) {
+	} else if (PROGCMP("ddns-confgen"))
 		progmode = progmode_confgen;
-	} else {
+	else
 		INSIST(0);
 		ISC_UNREACHABLE();
 	}
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
 					   "a:hk:Mmr:qs:y:z:")) != -1) {
@@ -155,11 +155,11 @@ main(int argc, char **argv) {
 			isc_mem_debugging = ISC_MEM_DEBUGTRACE;
 			break;
 		case 'm':
-			show_final_mem = true;
+			show_final_mem = ISC_TRUE;
 			break;
 		case 'q':
 			if (progmode == progmode_confgen)
-				quiet = true;
+				quiet = ISC_TRUE;
 			else
 				usage(1);
 			break;
@@ -37,7 +37,6 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2009, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2009, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -12,12 +12,15 @@
 /*! \file */
 #include <config.h>
 #include <stdlib.h>
 #include <stdarg.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/result.h>
@@ -40,8 +43,10 @@
 const char *
 alg_totext(dns_secalg_t alg) {
 	switch (alg) {
 #ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
 		return "hmac-md5";
 #endif
 	    case DST_ALG_HMACSHA1:
 		return "hmac-sha1";
 	    case DST_ALG_HMACSHA224:
@@ -66,8 +71,10 @@ alg_fromtext(const char *name) {
 	if (strncasecmp(p, "hmac-", 5) == 0)
 		p = &name[5];
 #ifndef PK11_MD5_DISABLE
 	if (strcasecmp(p, "md5") == 0)
 		return DST_ALG_HMACMD5;
 #endif
 	if (strcasecmp(p, "sha1") == 0)
 		return DST_ALG_HMACSHA1;
 	if (strcasecmp(p, "sha224") == 0)
@@ -117,7 +124,9 @@ generate_key(isc_mem_t *mctx, dns_secalg_t alg, int keysize,
 	dst_key_t *key = NULL;
 	switch (alg) {
 #ifndef PK11_MD5_DISABLE
 	    case DST_ALG_HMACMD5:
 #endif
 	    case DST_ALG_HMACSHA1:
 	    case DST_ALG_HMACSHA224:
 	    case DST_ALG_HMACSHA256:
@@ -189,3 +198,4 @@ write_key_file(const char *keyfile, const char *user,
 		fatal("fclose(%s) failed\n", keyfile);
 	fprintf(stderr, "wrote key file \"%s\"\n", keyfile);
 }
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -206,5 +206,5 @@ BIND 9 Administrator Reference Manual\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -20,15 +20,17 @@
 * controls statement altogether.
 */
-#include <stdarg.h>
+#include <config.h>
-#include <stdbool.h>
+
 #include <stdlib.h>
 #include <stdarg.h>
 #include <isc/assertions.h>
 #include <isc/base64.h>
 #include <isc/buffer.h>
 #include <isc/commandline.h>
 #include <isc/file.h>
 #include <isc/keyboard.h>
 #include <isc/mem.h>
 #include <isc/net.h>
 #include <isc/print.h>
@@ -55,7 +57,7 @@
 static char program[256];
 const char *progname;
-bool verbose = false;
+isc_boolean_t verbose = ISC_FALSE;
 const char *keyfile, *keydef;
@@ -85,7 +87,7 @@ Usage:\n\
 int
 main(int argc, char **argv) {
-	bool show_final_mem = false;
+	isc_boolean_t show_final_mem = ISC_FALSE;
 	isc_buffer_t key_txtbuffer;
 	char key_txtsecret[256];
 	isc_mem_t *mctx = NULL;
@@ -102,7 +104,7 @@ main(int argc, char **argv) {
 	struct in6_addr addr6_dummy;
 	char *chrootdir = NULL;
 	char *user = NULL;
-	bool keyonly = false;
+	isc_boolean_t keyonly = ISC_FALSE;
 	int len;
 	keydef = keyfile = RNDC_KEYFILE;
@@ -117,14 +119,14 @@ main(int argc, char **argv) {
 	serveraddr = DEFAULT_SERVER;
 	port = DEFAULT_PORT;
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 	while ((ch = isc_commandline_parse(argc, argv,
 					   "aA:b:c:hk:Mmp:r:s:t:u:Vy")) != -1)
 	{
 		switch (ch) {
 		case 'a':
-			keyonly = true;
+			keyonly = ISC_TRUE;
 			break;
 		case 'A':
 			algname = isc_commandline_argument;
@@ -151,7 +153,7 @@ main(int argc, char **argv) {
 			break;
 		case 'm':
-			show_final_mem = true;
+			show_final_mem = ISC_TRUE;
 			break;
 		case 'p':
 			port = strtol(isc_commandline_argument, &p, 10);
@@ -175,7 +177,7 @@ main(int argc, char **argv) {
 			user = isc_commandline_argument;
 			break;
 		case 'V':
-			verbose = true;
+			verbose = ISC_TRUE;
 			break;
 		case '?':
 			if (isc_commandline_option != '?') {
@@ -44,7 +44,6 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2001, 2003-2005, 2007, 2009, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -12,6 +12,8 @@
 /*! \file */
 #include <config.h>
 #include <confgen/os.h>
 #include <fcntl.h>
@@ -12,16 +12,18 @@
 /*! \file */
 #include <config.h>
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <isc/boolean.h>
 #include <isc/print.h>
 #include "util.h"
-extern bool verbose;
+extern isc_boolean_t verbose;
 extern const char *progname;
 void
@@ -60,7 +60,6 @@
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -85,7 +84,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -62,7 +62,6 @@
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -71,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -96,7 +95,6 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -108,7 +106,7 @@ copy /Y ddns-confgen.ilk tsig-keygen.ilk
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
    <PostBuildEvent>
      <Command>cd ..\..\..\Build\$(Configuration)
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -9,6 +9,9 @@
 * information regarding copyright ownership.
 */
 #include <config.h>
 #include <confgen/os.h>
 #include <fcntl.h>
@@ -62,7 +62,6 @@
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -71,7 +70,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -90,7 +89,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\dns\include;..\..\..\lib\isccc\include;..\..\..\lib\isccfg\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -102,7 +100,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\isccc\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>confgentool.lib;libisc.lib;libdns.lib;libisccfg.lib;libisccc.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -16,7 +16,7 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @DST_OPENSSL_INC@
 CDEFINES =	-DVERSION=\"${VERSION}\" \
 		-DSYSCONFDIR=\"${sysconfdir}\"
@@ -24,8 +24,8 @@ CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -437,5 +437,5 @@ RFC5155\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -9,6 +9,7 @@
 * information regarding copyright ownership.
 */
 #include <config.h>
 #include <bind.keys.h>
 #ifndef WIN32
@@ -23,9 +24,7 @@
 #include <netdb.h>
 #endif
 #include <stdbool.h>
 #include <stdio.h>
 #include <inttypes.h>
 #include <stdlib.h>
 #include <string.h>
 #include <unistd.h>
@@ -95,40 +94,40 @@ static const char *port = "53";
 static isc_sockaddr_t *srcaddr4 = NULL, *srcaddr6 = NULL;
 static isc_sockaddr_t a4, a6;
 static char *curqname = NULL, *qname = NULL;
-static bool classset = false;
+static isc_boolean_t classset = ISC_FALSE;
 static dns_rdatatype_t qtype = dns_rdatatype_none;
-static bool typeset = false;
+static isc_boolean_t typeset = ISC_FALSE;
 static unsigned int styleflags = 0;
-static uint32_t splitwidth = 0xffffffff;
+static isc_uint32_t splitwidth = 0xffffffff;
-static bool
+static isc_boolean_t
-	showcomments = true,
+	showcomments = ISC_TRUE,
-	showdnssec = true,
+	showdnssec = ISC_TRUE,
-	showtrust = true,
+	showtrust = ISC_TRUE,
-	rrcomments = true,
+	rrcomments = ISC_TRUE,
-	noclass = false,
+	noclass = ISC_FALSE,
-	nocrypto = false,
+	nocrypto = ISC_FALSE,
-	nottl = false,
+	nottl = ISC_FALSE,
-	multiline = false,
+	multiline = ISC_FALSE,
-	short_form = false,
+	short_form = ISC_FALSE,
-	print_unknown_format = false;
+	print_unknown_format = ISC_FALSE;
-static bool
+static isc_boolean_t
-	resolve_trace = false,
+	resolve_trace = ISC_FALSE,
-	validator_trace = false,
+	validator_trace = ISC_FALSE,
-	message_trace = false;
+	message_trace = ISC_FALSE;
-static bool
+static isc_boolean_t
-	use_ipv4 = true,
+	use_ipv4 = ISC_TRUE,
-	use_ipv6 = true;
+	use_ipv6 = ISC_TRUE;
-static bool
+static isc_boolean_t
-	cdflag = false,
+	cdflag = ISC_FALSE,
-	no_sigs = false,
+	no_sigs = ISC_FALSE,
-	root_validation = true,
+	root_validation = ISC_TRUE,
-	dlv_validation = true;
+	dlv_validation = ISC_TRUE;
-static bool use_tcp = false;
+static isc_boolean_t use_tcp = ISC_FALSE;
 static char *anchorfile = NULL;
 static char *trust_anchor = NULL;
@@ -145,10 +144,10 @@ static char anchortext[] = MANAGED_KEYS;
 * Static function prototypes
 */
 static isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict);
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict);
 static isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);
 static void
@@ -409,7 +408,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 {
 	isc_result_t result = ISC_R_SUCCESS;
 	static dns_trust_t trust;
-	static bool first = true;
+	static isc_boolean_t first = ISC_TRUE;
 	isc_buffer_t target;
 	isc_region_t r;
 	char *t = NULL;
@@ -431,7 +430,7 @@ printdata(dns_rdataset_t *rdataset, dns_name_t *owner,
 			putchar('\n');
 		print_status(rdataset);
 		trust = rdataset->trust;
-		first = false;
+		first = ISC_FALSE;
 	}
 	do {
@@ -567,7 +566,7 @@ convert_name(dns_fixedname_t *fn, dns_name_t **name, const char *text) {
 static isc_result_t
 key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_rdata_dnskey_t keystruct;
-	uint32_t flags, proto, alg;
+	isc_uint32_t flags, proto, alg;
 	const char *keystr, *keynamestr;
 	unsigned char keydata[4096];
 	isc_buffer_t keydatabuf;
@@ -577,7 +576,7 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	dns_fixedname_t fkeyname;
 	dns_name_t *keyname;
 	isc_result_t result;
-	bool match_root = false, match_dlv = false;
+	isc_boolean_t match_root = ISC_FALSE, match_dlv = ISC_FALSE;
 	keynamestr = cfg_obj_asstring(cfg_tuple_get(key, "name"));
 	CHECK(convert_name(&fkeyname, &keyname, keynamestr));
@@ -622,9 +621,9 @@ key_fromconfig(const cfg_obj_t *key, dns_client_t *client) {
 	if (alg > 0xff)
 		CHECK(ISC_R_RANGE);
-	keystruct.flags = (uint16_t)flags;
+	keystruct.flags = (isc_uint16_t)flags;
-	keystruct.protocol = (uint8_t)proto;
+	keystruct.protocol = (isc_uint8_t)proto;
-	keystruct.algorithm = (uint8_t)alg;
+	keystruct.algorithm = (isc_uint8_t)alg;
 	isc_buffer_init(&keydatabuf, keydata, sizeof(keydata));
 	isc_buffer_init(&rrdatabuf, rrdata, sizeof(rrdata));
@@ -742,8 +741,8 @@ setup_dnsseckeys(dns_client_t *client) {
 		isc_buffer_init(&b, anchortext, sizeof(anchortext) - 1);
 		isc_buffer_add(&b, sizeof(anchortext) - 1);
-		result = cfg_parse_buffer(parser, &b, NULL, 0,
+		result = cfg_parse_buffer(parser, &b, &cfg_type_bindkeys,
-					  &cfg_type_bindkeys, 0, &bindkeys);
+					  &bindkeys);
 		if (result != ISC_R_SUCCESS)
 			fatal("Unable to parse built-in keys");
 	}
@@ -764,14 +763,7 @@ setup_dnsseckeys(dns_client_t *client) {
 	if (dlv_validation)
 		dns_client_setdlv(client, dns_rdataclass_in, dlv_anchor);
 cleanup:
 	if (bindkeys != NULL) {
 		cfg_obj_destroy(parser, &bindkeys);
 	}
 	if (parser != NULL) {
 		cfg_parser_destroy(&parser);
 	}
 	if (result != ISC_R_SUCCESS)
 		delv_log(ISC_LOG_ERROR, "setup_dnsseckeys: %s",
 			  isc_result_totext(result));
@@ -786,7 +778,7 @@ addserver(dns_client_t *client) {
 	struct in6_addr in6;
 	isc_sockaddr_t *sa;
 	isc_sockaddrlist_t servers;
-	uint32_t destport;
+	isc_uint32_t destport;
 	isc_result_t result;
 	dns_name_t *name = NULL;
@@ -877,7 +869,7 @@ findserver(dns_client_t *client) {
 	irs_resconf_t *resconf = NULL;
 	isc_sockaddrlist_t *nameservers;
 	isc_sockaddr_t *sa, *next;
-	uint32_t destport;
+	isc_uint32_t destport;
 	result = parse_uint(&destport, port, 0xffff, "port");
 	if (result != ISC_R_SUCCESS)
@@ -952,9 +944,9 @@ cleanup:
 }
 static isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = isc_parse_uint32(&n, value, 10);
 	if (result == ISC_R_SUCCESS && n > max)
 		result = ISC_R_RANGE;
@@ -971,7 +963,7 @@ static void
 plus_option(char *option) {
 	isc_result_t result;
 	char *cmd, *value, *last = NULL;
-	bool state = true;
+	isc_boolean_t state = ISC_TRUE;
 	INSIST(option != NULL);
@@ -982,7 +974,7 @@ plus_option(char *option) {
 	}
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
-		state = false;
+		state = ISC_FALSE;
 	}
 	value = strtok_r(NULL, "\0", &last);
@@ -1009,7 +1001,7 @@ plus_option(char *option) {
 			break;
 		case 'l': /* class */
 			FULLCHECK("class");
-			noclass = !state;
+			noclass = ISC_TF(!state);
 			break;
 		case 'o': /* comments */
 			FULLCHECK("comments");
@@ -1017,7 +1009,7 @@ plus_option(char *option) {
 			break;
 		case 'r': /* crypto */
 			FULLCHECK("crypto");
-			nocrypto = !state;
+			nocrypto = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1090,10 +1082,10 @@ plus_option(char *option) {
 			FULLCHECK("short");
 			short_form = state;
 			if (short_form) {
-				multiline = false;
+				multiline = ISC_FALSE;
-				showcomments = false;
+				showcomments = ISC_FALSE;
-				showtrust = false;
+				showtrust = ISC_FALSE;
-				showdnssec = false;
+				showdnssec = ISC_FALSE;
 			}
 			break;
 		case 'p': /* split */
@@ -1145,7 +1137,7 @@ plus_option(char *option) {
 			break;
 		case 't': /* ttl */
 			FULLCHECK("ttl");
-			nottl = !state;
+			nottl = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1173,13 +1165,11 @@ plus_option(char *option) {
 * options: "46a:b:c:d:himp:q:t:vx:";
 */
 static const char *single_dash_opts = "46himv";
-static const char *dash_opts = "46abcdhimpqtvx";
+static isc_boolean_t
-
+dash_option(char *option, char *next, isc_boolean_t *open_type_class) {
 static bool
 dash_option(char *option, char *next, bool *open_type_class) {
 	char opt, *value;
 	isc_result_t result;
-	bool value_from_next;
+	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -1187,7 +1177,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 	struct in_addr in4;
 	struct in6_addr in6;
 	in_port_t srcport;
-	uint32_t num;
+	isc_uint32_t num;
 	char *hash;
 	while (strpbrk(option, single_dash_opts) == &option[0]) {
@@ -1203,7 +1193,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				fatal("IPv4 networking not available");
 			if (use_ipv6) {
 				isc_net_disableipv6();
-				use_ipv6 = false;
+				use_ipv6 = ISC_FALSE;
 			}
 			break;
 		case '6':
@@ -1211,7 +1201,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 				fatal("IPv6 networking not available");
 			if (use_ipv4) {
 				isc_net_disableipv4();
-				use_ipv4 = false;
+				use_ipv4 = ISC_FALSE;
 			}
 			break;
 		case 'h':
@@ -1219,9 +1209,9 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			exit(0);
 			/* NOTREACHED */
 		case 'i':
-			no_sigs = true;
+			no_sigs = ISC_TRUE;
-			dlv_validation = false;
+			dlv_validation = ISC_FALSE;
-			root_validation = false;
+			root_validation = ISC_FALSE;
 			break;
 		case 'm':
 			/* handled in preparse_args() */
@@ -1232,19 +1222,18 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
 			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
 		else
-			return (false);
+			return (ISC_FALSE);
 	}
 	opt = option[0];
 	if (strlen(option) > 1U) {
-		value_from_next = false;
+		value_from_next = ISC_FALSE;
 		value = &option[1];
 	} else {
-		value_from_next = true;
+		value_from_next = ISC_TRUE;
 		value = next;
 	}
 	if (value == NULL)
@@ -1290,13 +1279,13 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		if (classset)
 			warn("extra query class");
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = strlen(value);
 		result = dns_rdataclass_fromtext(&rdclass,
 						 (isc_textregion_t *)&tr);
 		if (result == ISC_R_SUCCESS)
-			classset = true;
+			classset = ISC_TRUE;
 		else if (rdclass != dns_rdataclass_in)
 			warn("ignoring non-IN query class");
 		else
@@ -1321,7 +1310,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			fatal("out of memory");
 		return (value_from_next);
 	case 't':
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = strlen(value);
 		result = dns_rdatatype_fromtext(&rdtype,
@@ -1333,13 +1322,13 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			    rdtype == dns_rdatatype_axfr)
 				fatal("Transfer not supported");
 			qtype = rdtype;
-			typeset = true;
+			typeset = ISC_TRUE;
 		} else
 			warn("ignoring invalid type");
 		return (value_from_next);
 	case 'x':
 		result = get_reverse(textname, sizeof(textname), value,
-				     false);
+				     ISC_FALSE);
 		if (result == ISC_R_SUCCESS) {
 			if (curqname != NULL) {
 				isc_mem_free(mctx, curqname);
@@ -1351,7 +1340,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			if (typeset)
 				warn("extra query type");
 			qtype = dns_rdatatype_ptr;
-			typeset = true;
+			typeset = ISC_TRUE;
 		} else {
 			fprintf(stderr, "Invalid IP address %s\n", value);
 			exit(1);
@@ -1363,7 +1352,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 		usage();
 	}
 	/* NOTREACHED */
-	return (false);
+	return (ISC_FALSE);
 }
 /*
@@ -1372,14 +1361,12 @@ dash_option(char *option, char *next, bool *open_type_class) {
 */
 static void
 preparse_args(int argc, char **argv) {
-	bool ipv4only = false, ipv6only = false;
+	isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 	char *option;
 	for (argc--, argv++; argc > 0; argc--, argv++) {
-		if (argv[0][0] != '-') {
+		if (argv[0][0] != '-')
 			continue;
 		}
 		option = &argv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
@@ -1391,38 +1378,17 @@ preparse_args(int argc, char **argv) {
 				if (ipv6only) {
 					fatal("only one of -4 and -6 allowed");
 				}
-				ipv4only = true;
+				ipv4only = ISC_TRUE;
 				break;
 			case '6':
 				if (ipv4only) {
 					fatal("only one of -4 and -6 allowed");
 				}
-				ipv6only = true;
+				ipv6only = ISC_TRUE;
 				break;
 			}
 			option = &option[1];
 		}
 		if (strlen(option) == 0U) {
 			continue;
 		}
 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
 		    strlen(option) > 1U)
 		{
 			/* Error or value in option. */
 			continue;
 		}
 		/* Dash value is next argument so we need to skip it. */
 		argc--;
 		argv++;
 		/* Handle missing argument */
 		if (argc == 0) {
 			break;
 		}
 	}
 }
@@ -1438,7 +1404,7 @@ parse_args(int argc, char **argv) {
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	bool open_type_class = true;
+	isc_boolean_t open_type_class = ISC_TRUE;
 	for (; argc > 0; argc--, argv++) {
 		if (argv[0][0] == '@') {
@@ -1477,7 +1443,7 @@ parse_args(int argc, char **argv) {
 					    rdtype == dns_rdatatype_axfr)
 						fatal("Transfer not supported");
 					qtype = rdtype;
-					typeset = true;
+					typeset = ISC_TRUE;
 					continue;
 				}
 				result = dns_rdataclass_fromtext(&rdclass,
@@ -1546,7 +1512,7 @@ reverse_octets(const char *in, char **p, char *end) {
 }
 static isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict) {
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t strict) {
 	int r;
 	isc_result_t result;
 	isc_netaddr_t addr;
@@ -39,7 +39,6 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -53,15 +53,14 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
+      <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -69,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -80,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -88,8 +87,7 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
-      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
+      <AdditionalIncludeDirectories>..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@GEOIP_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\win32\include;..\..\..\lib\dns\include;..\..\..\lib\irs\win32\include;..\..\..\lib\irs\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
    <Link>
@@ -100,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>libisc.lib;libdns.lib;libisccfg.lib;libirs.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -19,7 +19,7 @@ READLINE_LIB = @READLINE_LIB@
 CINCLUDES =	-I${srcdir}/include ${DNS_INCLUDES} \
 		${BIND9_INCLUDES} ${ISC_INCLUDES} \
-		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @OPENSSL_INCLUDES@
+		${IRS_INCLUDES} ${ISCCFG_INCLUDES} @LIBIDN2_CFLAGS@ @DST_OPENSSL_INC@
 CDEFINES =	-DVERSION=\"${VERSION}\"
 CWARNINGS =
@@ -27,8 +27,8 @@ CWARNINGS =
 ISCCFGLIBS =	../../lib/isccfg/libisccfg.@A@
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
 BIND9LIBS =	../../lib/bind9/libbind9.@A@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 IRSLIBS =	../../lib/irs/libirs.@A@
 ISCCFGDEPLIBS =	../../lib/isccfg/libisccfg.@A@
@@ -64,8 +64,6 @@ MANOBJS =	${MANPAGES} ${HTMLPAGES}
@BIND9_MAKE_RULES@
 LDFLAGS =	@LDFLAGS@ @LIBIDN2_LDFLAGS@
 dig@EXEEXT@: dig.@O@ dighost.@O@ ${UOBJS} ${DEPLIBS}
 	export BASEOBJS="dig.@O@ dighost.@O@ ${UOBJS}"; \
 	export LIBS0="${DNSLIBS} ${IRSLIBS}"; \
@@ -101,12 +99,12 @@ install:: dig@EXEEXT@ host@EXEEXT@ nslookup@EXEEXT@ installdirs
 	${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} \
 		nslookup@EXEEXT@ ${DESTDIR}${bindir}
 	for m in ${MANPAGES}; do \
-		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1 || exit 1; \
+		${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man1; \
-	done
+		done
 uninstall::
 	for m in ${MANPAGES}; do \
-		rm -f ${DESTDIR}${mandir}/man1/$$m || exit 1; \
+		rm -f ${DESTDIR}${mandir}/man1/$$m ; \
 	done
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/nslookup@EXEEXT@
 	${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${bindir}/host@EXEEXT@
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -74,9 +74,7 @@ will perform an NS query for "\&." (the root)\&.
 It is possible to set per\-user defaults for
 \fBdig\fR
 via
-${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&. The
+${HOME}/\&.digrc\&. This file is read and any options in it are applied before the command line arguments\&.
 \fB\-r\fR
 option disables this feature, for scripts that need predictable behaviour\&.
 .PP
 The IN and CH class names overlap with the IN and CH top level domain names\&. Either use the
 \fB\-t\fR
@@ -176,6 +174,11 @@ reads a list of lookup requests to process from the given
 using the command\-line interface\&.
 .RE
 .PP
 \-i
 .RS 4
 Do reverse IPv6 lookups using the obsolete RFC 1886 IP6\&.INT domain, which is no longer in use\&. Obsolete bit string label queries (RFC 2874) are not attempted\&.
 .RE
 .PP
 \-k \fIkeyfile\fR
 .RS 4
 Sign queries using TSIG using a key read from the given file\&. Key files can be generated using
@@ -205,12 +208,6 @@ The domain name to query\&. This is useful to distinguish the
 from other arguments\&.
 .RE
 .PP
 \-r
 .RS 4
 Do not read options from
 ${HOME}/\&.digrc\&. This is useful for scripts that need predictable behaviour\&.
 .RE
 .PP
 \-t \fItype\fR
 .RS 4
 The resource record type to query\&. It can be any valid query type\&. If it is a resource record type supported in BIND 9, it can be given by the type mnemonic (such as "NS" or "AAAA")\&. The default query type is "A", unless the
@@ -249,7 +246,9 @@ arguments\&.
 \fBdig\fR
 automatically performs a lookup for a name like
 94\&.2\&.0\&.192\&.in\-addr\&.arpa
-and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain\&.
+and sets the query type and class to PTR and IN respectively\&. IPv6 addresses are looked up using nibble format under the IP6\&.ARPA domain (but see also the
 \fB\-i\fR
 option)\&.
 .RE
 .PP
 \-y \fI[hmac:]\fR\fIkeyname:secret\fR
@@ -450,11 +449,6 @@ clears the EDNS options to be sent\&.
 Send an EDNS Expire option\&.
 .RE
 .PP
 \fB+[no]expandaaaa\fR
 .RS 4
 When printing AAAA record print all zero nibbles rather than the default RFC 5952 preferred presentation format\&.
 .RE
 .PP
 \fB+[no]fail\fR
 .RS 4
 Do not try the next server if you receive a SERVFAIL\&. The default is to not try the next server which is the reverse of normal stub resolver behavior\&.
@@ -474,16 +468,12 @@ option is enabled\&. If short form answers are requested, the default is not to
 .PP
 \fB+[no]idnin\fR
 .RS 4
-Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+Process [do not process] IDN domain names on input\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to process IDN input\&.
 .sp
 The default is to process IDN input when standard output is a tty\&. The IDN processing on input is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]idnout\fR
 .RS 4
-Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&.
+Convert [do not convert] puny code on output\&. This requires IDN SUPPORT to have been enabled at compile time\&. The default is to convert output\&.
 .sp
 The default is to process puny code on output when standard output is a tty\&. The puny code processing on output is disabled when dig output is redirected to files, pipes, and other non\-tty file descriptors\&.
 .RE
 .PP
 \fB+[no]ignore\fR
@@ -805,10 +795,7 @@ has been built with IDN (internationalized domain name) support, it can accept a
 appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, use parameters
 \fI+noidnin\fR
 and
-\fI+noidnout\fR
+\fI+noidnout\fR\&.
 or define the
 \fBIDN_DISABLE\fR
 environment variable\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -829,5 +816,5 @@ There are probably too many query options\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -11,8 +11,7 @@
 /*! \file */
-#include <inttypes.h>
+#include <config.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <time.h>
 #include <ctype.h>
@@ -62,10 +61,10 @@ static int addresscount = 0;
 static char domainopt[DNS_NAME_MAXTEXT];
 static char hexcookie[81];
-static bool short_form = false, printcmd = true,
+static isc_boolean_t short_form = ISC_FALSE, printcmd = ISC_TRUE,
-	plusquest = false, pluscomm = false,
+	ip6_int = ISC_FALSE, plusquest = ISC_FALSE, pluscomm = ISC_FALSE,
-	ipv4only = false, ipv6only = false, digrc = true;
+	ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
-static uint32_t splitwidth = 0xffffffff;
+static isc_uint32_t splitwidth = 0xffffffff;
 /*% opcode text */
 static const char * const opcodetext[] = {
@@ -151,11 +150,11 @@ help(void) {
 "                 -b address[#port]   (bind to source address/port)\n"
 "                 -c class            (specify query class)\n"
 "                 -f filename         (batch mode)\n"
 "                 -i                  (use IP6.INT for IPv6 reverse lookups)\n"
 "                 -k keyfile          (specify tsig key file)\n"
 "                 -m                  (enable memory usage debugging)\n"
 "                 -p port             (specify port number)\n"
 "                 -q name             (specify query name)\n"
 "                 -r                  (do not read ~/.digrc)\n"
 "                 -t type             (specify query type)\n"
 "                 -u                  (display times in usec instead of msec)\n"
 "                 -x dot-notation     (shortcut for reverse lookups)\n"
@@ -187,15 +186,12 @@ help(void) {
 "                 +[no]ednsnegotiation (Set EDNS version negotiation)\n"
 "                 +ednsopt=###[:value] (Send specified EDNS option)\n"
 "                 +noednsopt          (Clear list of +ednsopt options)\n"
 "                 +[no]expandaaaa     (Expand AAAA records)\n"
 "                 +[no]expire         (Request time to expire)\n"
 "                 +[no]fail           (Don't try next server on SERVFAIL)\n"
 "                 +[no]header-only    (Send query without a question section)\n"
 "                 +[no]identify       (ID responders in short answers)\n"
-#ifdef HAVE_LIBIDN2
+"                 +[no]idnin          (Parse IDN names)\n"
-"                 +[no]idnin          (Parse IDN names [default=on on tty])\n"
+"                 +[no]idnout         (Convert IDN response)\n"
 "                 +[no]idnout         (Convert IDN response [default=on on tty])\n"
 #endif
 "                 +[no]ignore         (Don't revert to TCP for TC responses.)\n"
 "                 +[no]keepalive      (Request EDNS TCP keepalive)\n"
 "                 +[no]keepopen       (Keep the TCP socket open between queries)\n"
@@ -244,7 +240,7 @@ help(void) {
 */
 static void
 received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
-	uint64_t diff;
+	isc_uint64_t diff;
 	time_t tnow;
 	struct tm tmnow;
 #ifdef WIN32
@@ -264,7 +260,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 			printf(";; Query time: %ld msec\n", (long) diff / 1000);
 		printf(";; SERVER: %s(%s)\n", fromtext, query->servname);
 		time(&tnow);
-#if !defined(WIN32)
+#if defined(ISC_PLATFORM_USETHREADS) && !defined(WIN32)
 		(void)localtime_r(&tnow, &tmnow);
 #else
 		tmnow  = *localtime(&tnow);
@@ -285,7 +281,7 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 #endif
 		if (query->lookup->doing_xfr) {
 			printf(";; XFR size: %u records (messages %u, "
-			       "bytes %" PRIu64 ")\n",
+			       "bytes %" ISC_PRINT_QUADFORMAT "u)\n",
 			       query->rr_count, query->msg_count,
 			       query->byte_count);
 		} else {
@@ -303,18 +299,18 @@ received(unsigned int bytes, isc_sockaddr_t *from, dig_query_t *query) {
 	} else if (query->lookup->identify && !short_form) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		if (query->lookup->use_usec)
-			printf(";; Received %" PRIu64 " bytes "
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld us\n\n",
 			       query->lookup->doing_xfr
 				 ? query->byte_count
-				 : (uint64_t)bytes,
+				 : (isc_uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff);
 		else
-			printf(";; Received %" PRIu64 " bytes "
+			printf(";; Received %" ISC_PRINT_QUADFORMAT "u bytes "
 			       "from %s(%s) in %ld ms\n\n",
 			       query->lookup->doing_xfr
 				 ?  query->byte_count
-				 : (uint64_t)bytes,
+				 : (isc_uint64_t)bytes,
 			       fromtext, query->userarg, (long) diff / 1000);
 	}
 }
@@ -336,7 +332,7 @@ trying(char *frm, dig_lookup_t *lookup) {
 static isc_result_t
 say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 	isc_result_t result;
-	uint64_t diff;
+	isc_uint64_t diff;
 	char store[sizeof(" in 18446744073709551616 us.")];
 	unsigned int styleflags = 0;
@@ -364,11 +360,10 @@ say_message(dns_rdata_t *rdata, dig_query_t *query, isc_buffer_t *buf) {
 		diff = isc_time_microdiff(&query->time_recv, &query->time_sent);
 		ADD_STRING(buf, " from server ");
 		ADD_STRING(buf, query->servname);
-		if (query->lookup->use_usec) {
+		if (query->lookup->use_usec)
-			snprintf(store, sizeof(store), " in %" PRIu64 " us.", diff);
+			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u us.", diff);
-		} else {
+		else
-			snprintf(store, sizeof(store), " in %" PRIu64 " ms.", diff / 1000);
+			snprintf(store, sizeof(store), " in %" ISC_PLATFORM_QUADFORMAT "u ms.", diff / 1000);
 		}
 		ADD_STRING(buf, store);
 	}
 	ADD_STRING(buf, "\n");
@@ -426,7 +421,7 @@ short_answer(dns_message_t *msg, dns_messagetextflag_t flags,
 	return (ISC_R_SUCCESS);
 }
-static bool
+static isc_boolean_t
 isdotlocal(dns_message_t *msg) {
 	isc_result_t result;
 	static unsigned char local_ndata[] = { "\005local\0" };
@@ -441,16 +436,16 @@ isdotlocal(dns_message_t *msg) {
 		dns_name_t *name = NULL;
 		dns_message_currentname(msg, DNS_SECTION_QUESTION, &name);
 		if (dns_name_issubdomain(name, &local))
-			return (true);
+			return (ISC_TRUE);
 	}
-	return (false);
+	return (ISC_FALSE);
 }
 /*
 * Callback from dighost.c to print the reply from a server
 */
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	isc_result_t result;
 	dns_messagetextflag_t flags;
 	isc_buffer_t *buf = NULL;
@@ -474,8 +469,6 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		styleflags |= DNS_STYLEFLAG_NO_CLASS;
 	if (query->lookup->nocrypto)
 		styleflags |= DNS_STYLEFLAG_NOCRYPTO;
 	if (query->lookup->expandaaaa)
 		styleflags |= DNS_STYLEFLAG_EXPANDAAAA;
 	if (query->lookup->multiline) {
 		styleflags |= DNS_STYLEFLAG_OMIT_OWNER;
 		styleflags |= DNS_STYLEFLAG_OMIT_CLASS;
@@ -696,7 +689,7 @@ cleanup:
 static void
 printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 	int i;
-	static bool first = true;
+	static isc_boolean_t first = ISC_TRUE;
 	char append[MXNAME];
 	if (printcmd) {
@@ -723,7 +716,7 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 				 ";; global options:%s%s\n",
 				 short_form ? " +short" : "",
 				 printcmd ? " +cmd" : "");
-			first = false;
+			first = ISC_FALSE;
 			strlcat(lookup->cmdline, append,
 				sizeof(lookup->cmdline));
 		}
@@ -738,13 +731,13 @@ printgreeting(int argc, char **argv, dig_lookup_t *lookup) {
 */
 static void
-plus_option(char *option, bool is_batchfile,
+plus_option(char *option, isc_boolean_t is_batchfile,
 	    dig_lookup_t *lookup)
 {
 	isc_result_t result;
 	char *cmd, *value, *last = NULL, *code, *extra;
-	uint32_t num;
+	isc_uint32_t num;
-	bool state = true;
+	isc_boolean_t state = ISC_TRUE;
 	size_t n;
 	INSIST(option != NULL);
@@ -755,7 +748,7 @@ plus_option(char *option, bool is_batchfile,
 	}
 	if (strncasecmp(cmd, "no", 2)==0) {
 		cmd += 2;
-		state = false;
+		state = ISC_FALSE;
 	}
 	/* parse the rest of the string */
 	value = strtok_r(NULL, "", &last);
@@ -862,7 +855,7 @@ plus_option(char *option, bool is_batchfile,
 		case 'l': /* class */
 			/* keep +cl for backwards compatibility */
 			FULLCHECK2("cl", "class");
-			lookup->noclass = !state;
+			lookup->noclass = ISC_TF(!state);
 			break;
 		case 'm': /* cmd */
 			FULLCHECK("cmd");
@@ -898,7 +891,7 @@ plus_option(char *option, bool is_batchfile,
 			break;
 		case 'r':
 			FULLCHECK("crypto");
-			lookup->nocrypto = !state;
+			lookup->nocrypto = ISC_TF(!state);
 			break;
 		default:
 			goto invalid_option;
@@ -1008,20 +1001,14 @@ plus_option(char *option, bool is_batchfile,
 							lookup->ednsoptscnt = 0;
 							break;
 						}
-						code = NULL;
+						if (value == NULL) {
 						if (value != NULL) {
 							code = strtok_r(value,
 									":",
 									&last);
 						}
 						if (code == NULL) {
 							warn("ednsopt no "
 							     "code point "
 							     "specified");
 							goto exit_or_usage;
 						}
-						extra = strtok_r(NULL, "\0",
+						code = strtok_r(value, ":", &last);
-								 &last);
+						extra = strtok_r(NULL, "\0", &last);
 						save_opt(lookup, code, extra);
 						break;
 					default:
@@ -1037,24 +1024,8 @@ plus_option(char *option, bool is_batchfile,
 			}
 			break;
 		case 'x':
-			switch (cmd[2]) {
+			FULLCHECK("expire");
-			case 'p':
+			lookup->expire = state;
 				switch(cmd[3]) {
 				case 'a':
 					FULLCHECK("expandaaaa");
 					lookup->expandaaaa = state;
 					break;
 				case 'i':
 					FULLCHECK("expire");
 					lookup->expire = state;
 					break;
 				default:
 					goto invalid_option;
 				}
 				break;
 			default:
 				goto invalid_option;
 			}
 			break;
 		default:
 			goto invalid_option;
@@ -1080,7 +1051,7 @@ plus_option(char *option, bool is_batchfile,
 				switch (cmd[3]) {
 				case 'i':
 					FULLCHECK("idnin");
-#ifndef HAVE_LIBIDN2
+#ifndef WITH_IDN_SUPPORT
 					fprintf(stderr, ";; IDN input support"
 						" not enabled\n");
 #else
@@ -1089,7 +1060,7 @@ plus_option(char *option, bool is_batchfile,
 				break;
 				case 'o':
 					FULLCHECK("idnout");
-#ifndef HAVE_LIBIDN2
+#ifndef WITH_IDN_OUT_SUPPORT
 					fprintf(stderr, ";; IDN output support"
 						" not enabled\n");
 #else
@@ -1185,17 +1156,17 @@ plus_option(char *option, bool is_batchfile,
 				FULLCHECK("nssearch");
 				lookup->ns_search_only = state;
 				if (state) {
-					lookup->trace_root = true;
+					lookup->trace_root = ISC_TRUE;
-					lookup->recurse = true;
+					lookup->recurse = ISC_TRUE;
-					lookup->identify = true;
+					lookup->identify = ISC_TRUE;
-					lookup->stats = false;
+					lookup->stats = ISC_FALSE;
-					lookup->comments = false;
+					lookup->comments = ISC_FALSE;
-					lookup->section_additional = false;
+					lookup->section_additional = ISC_FALSE;
-					lookup->section_authority = false;
+					lookup->section_authority = ISC_FALSE;
-					lookup->section_question = false;
+					lookup->section_question = ISC_FALSE;
 					lookup->rdtype = dns_rdatatype_ns;
-					lookup->rdtypeset = true;
+					lookup->rdtypeset = ISC_TRUE;
-					short_form = true;
+					short_form = ISC_TRUE;
 					lookup->rrcomments = 0;
 				}
 				break;
@@ -1253,7 +1224,7 @@ plus_option(char *option, bool is_batchfile,
 			warn("Couldn't parse padding");
 			goto exit_or_usage;
 		}
-		lookup->padding = (uint16_t)num;
+		lookup->padding = (isc_uint16_t)num;
 		break;
 	case 'q':
 		switch (cmd[1]) {
@@ -1329,13 +1300,13 @@ plus_option(char *option, bool is_batchfile,
 				FULLCHECK("short");
 				short_form = state;
 				if (state) {
-					printcmd = false;
+					printcmd = ISC_FALSE;
-					lookup->section_additional = false;
+					lookup->section_additional = ISC_FALSE;
-					lookup->section_answer = true;
+					lookup->section_answer = ISC_TRUE;
-					lookup->section_authority = false;
+					lookup->section_authority = ISC_FALSE;
-					lookup->section_question = false;
+					lookup->section_question = ISC_FALSE;
-					lookup->comments = false;
+					lookup->comments = ISC_FALSE;
-					lookup->stats = false;
+					lookup->stats = ISC_FALSE;
 					lookup->rrcomments = -1;
 				}
 				break;
@@ -1429,7 +1400,7 @@ plus_option(char *option, bool is_batchfile,
 				FULLCHECK("tcp");
 				if (!is_batchfile) {
 					lookup->tcp_mode = state;
-					lookup->tcp_mode_set = true;
+					lookup->tcp_mode_set = ISC_TRUE;
 				}
 				break;
 			default:
@@ -1462,17 +1433,17 @@ plus_option(char *option, bool is_batchfile,
 				lookup->trace = state;
 				lookup->trace_root = state;
 				if (state) {
-					lookup->recurse = false;
+					lookup->recurse = ISC_FALSE;
-					lookup->identify = true;
+					lookup->identify = ISC_TRUE;
-					lookup->comments = false;
+					lookup->comments = ISC_FALSE;
 					lookup->rrcomments = 0;
-					lookup->stats = false;
+					lookup->stats = ISC_FALSE;
-					lookup->section_additional = false;
+					lookup->section_additional = ISC_FALSE;
-					lookup->section_authority = true;
+					lookup->section_authority = ISC_TRUE;
-					lookup->section_question = false;
+					lookup->section_question = ISC_FALSE;
-					lookup->dnssec = true;
+					lookup->dnssec = ISC_TRUE;
-					lookup->sendcookie = true;
+					lookup->sendcookie = ISC_TRUE;
-					usesearch = false;
+					usesearch = ISC_FALSE;
 				}
 				break;
 			case 'i': /* tries */
@@ -1506,12 +1477,12 @@ plus_option(char *option, bool is_batchfile,
 				case 0:
 				case 'i': /* ttlid */
 					FULLCHECK2("ttl", "ttlid");
-					lookup->nottl = !state;
+					lookup->nottl = ISC_TF(!state);
 					break;
 				case 'u': /* ttlunits */
 					FULLCHECK("ttlunits");
-					lookup->nottl = false;
+					lookup->nottl = ISC_FALSE;
-					lookup->ttlunits = state;
+					lookup->ttlunits = ISC_TF(state);
 					break;
 				default:
 					goto invalid_option;
@@ -1533,7 +1504,7 @@ plus_option(char *option, bool is_batchfile,
 		FULLCHECK("vc");
 		if (!is_batchfile) {
 			lookup->tcp_mode = state;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode_set = ISC_TRUE;
 		}
 		break;
 	case 'z': /* zflag */
@@ -1559,19 +1530,19 @@ plus_option(char *option, bool is_batchfile,
 }
 /*%
- * #true returned if value was used
+ * #ISC_TRUE returned if value was used
 */
-static const char *single_dash_opts = "46dhimnruv";
+static const char *single_dash_opts = "46dhimnuv";
-static const char *dash_opts = "46bcdfhikmnpqrtvyx";
+static const char *dash_opts = "46bcdfhikmnptvyx";
-static bool
+static isc_boolean_t
 dash_option(char *option, char *next, dig_lookup_t **lookup,
-	    bool *open_type_class, bool *need_clone,
+	    isc_boolean_t *open_type_class, isc_boolean_t *need_clone,
-	    bool config_only, int argc, char **argv,
+	    isc_boolean_t config_only, int argc, char **argv,
-	    bool *firstarg)
+	    isc_boolean_t *firstarg)
 {
 	char opt, *value, *ptr, *ptr2, *ptr3, *last;
 	isc_result_t result;
-	bool value_from_next;
+	isc_boolean_t value_from_next;
 	isc_textregion_t tr;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
@@ -1580,7 +1551,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 	struct in6_addr in6;
 	in_port_t srcport;
 	char *hash, *cmd;
-	uint32_t num;
+	isc_uint32_t num;
 	while (strpbrk(option, single_dash_opts) == &option[0]) {
 		/*
@@ -1593,21 +1564,21 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case '4':
 			if (have_ipv4) {
 				isc_net_disableipv6();
-				have_ipv6 = false;
+				have_ipv6 = ISC_FALSE;
 			} else {
 				fatal("can't find IPv4 networking");
 				/* NOTREACHED */
-				return (false);
+				return (ISC_FALSE);
 			}
 			break;
 		case '6':
 			if (have_ipv6) {
 				isc_net_disableipv4();
-				have_ipv4 = false;
+				have_ipv4 = ISC_FALSE;
 			} else {
 				fatal("can't find IPv6 networking");
 				/* NOTREACHED */
-				return (false);
+				return (ISC_FALSE);
 			}
 			break;
 		case 'd':
@@ -1615,17 +1586,17 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			if (ptr != &option[1]) {
 				cmd = option;
 				FULLCHECK("debug");
-				debugging = true;
+				debugging = ISC_TRUE;
-				return (false);
+				return (ISC_FALSE);
 			} else
-				debugging = true;
+				debugging = ISC_TRUE;
 			break;
 		case 'h':
 			help();
 			exit(0);
 			break;
 		case 'i':
-			/* deprecated */
+			ip6_int = ISC_TRUE;
 			break;
 		case 'm': /* memdebug */
 			/* memdebug is handled in preparse_args() */
@@ -1633,12 +1604,8 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		case 'n':
 			/* deprecated */
 			break;
 		case 'r':
 			debug("digrc (late)");
 			digrc = false;
 			break;
 		case 'u':
-			(*lookup)->use_usec = true;
+			(*lookup)->use_usec = ISC_TRUE;
 			break;
 		case 'v':
 			version();
@@ -1648,14 +1615,14 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (strlen(option) > 1U)
 			option = &option[1];
 		else
-			return (false);
+			return (ISC_FALSE);
 	}
 	opt = option[0];
 	if (strlen(option) > 1U) {
-		value_from_next = false;
+		value_from_next = ISC_FALSE;
 		value = &option[1];
 	} else {
-		value_from_next = true;
+		value_from_next = ISC_TRUE;
 		value = next;
 	}
 	if (value == NULL)
@@ -1685,20 +1652,20 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		}
 		if (hash != NULL)
 			*hash = '#';
-		specified_source = true;
+		specified_source = ISC_TRUE;
 		return (value_from_next);
 	case 'c':
 		if ((*lookup)->rdclassset) {
 			fprintf(stderr, ";; Warning, extra class option\n");
 		}
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		tr.base = value;
 		tr.length = (unsigned int) strlen(value);
 		result = dns_rdataclass_fromtext(&rdclass,
 						 (isc_textregion_t *)&tr);
 		if (result == ISC_R_SUCCESS) {
 			(*lookup)->rdclass = rdclass;
-			(*lookup)->rdclassset = true;
+			(*lookup)->rdclassset = ISC_TRUE;
 		} else
 			fprintf(stderr, ";; Warning, ignoring "
 				"invalid class %s\n",
@@ -1720,23 +1687,23 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		if (!config_only) {
 			if (*need_clone)
 				(*lookup) = clone_lookup(default_lookup,
-							 true);
+							 ISC_TRUE);
-			*need_clone = true;
+			*need_clone = ISC_TRUE;
 			strlcpy((*lookup)->textname, value,
 				sizeof((*lookup)->textname));
-			(*lookup)->trace_root = ((*lookup)->trace  ||
+			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
-						 (*lookup)->ns_search_only);
+						     (*lookup)->ns_search_only);
-			(*lookup)->new_search = true;
+			(*lookup)->new_search = ISC_TRUE;
 			if (*firstarg) {
 				printgreeting(argc, argv, *lookup);
-				*firstarg = false;
+				*firstarg = ISC_FALSE;
 			}
 			ISC_LIST_APPEND(lookup_list, (*lookup), link);
 			debug("looking up %s", (*lookup)->textname);
 		}
 		return (value_from_next);
 	case 't':
-		*open_type_class = false;
+		*open_type_class = ISC_FALSE;
 		if (strncasecmp(value, "ixfr=", 5) == 0) {
 			rdtype = dns_rdatatype_ixfr;
 			result = ISC_R_SUCCESS;
@@ -1756,9 +1723,9 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 						"extra type option\n");
 			}
 			if (rdtype == dns_rdatatype_ixfr) {
-				uint32_t serial;
+				isc_uint32_t serial;
 				(*lookup)->rdtype = dns_rdatatype_ixfr;
-				(*lookup)->rdtypeset = true;
+				(*lookup)->rdtypeset = ISC_TRUE;
 				result = parse_uint(&serial, &value[5],
 					   MAXSERIAL, "serial number");
 				if (result != ISC_R_SUCCESS)
@@ -1767,19 +1734,19 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 				(*lookup)->section_question = plusquest;
 				(*lookup)->comments = pluscomm;
 				if (!(*lookup)->tcp_mode_set)
-					(*lookup)->tcp_mode = true;
+					(*lookup)->tcp_mode = ISC_TRUE;
 			} else {
 				(*lookup)->rdtype = rdtype;
 				if (!config_only)
-					(*lookup)->rdtypeset = true;
+					(*lookup)->rdtypeset = ISC_TRUE;
 				if (rdtype == dns_rdatatype_axfr) {
 					(*lookup)->section_question = plusquest;
 					(*lookup)->comments = pluscomm;
 				} else if (rdtype == dns_rdatatype_any) {
 					if (!(*lookup)->tcp_mode_set)
-						(*lookup)->tcp_mode = true;
+						(*lookup)->tcp_mode = ISC_TRUE;
 				}
-				(*lookup)->ixfr_serial = false;
+				(*lookup)->ixfr_serial = ISC_FALSE;
 			}
 		} else
 			fprintf(stderr, ";; Warning, ignoring "
@@ -1798,7 +1765,11 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 			ptr = ptr2;
 			ptr2 = ptr3;
 		} else  {
 #ifndef PK11_MD5_DISABLE
 			hmacname = DNS_TSIG_HMACMD5_NAME;
 #else
 			hmacname = DNS_TSIG_HMACSHA256_NAME;
 #endif
 			digestbits = 0;
 		}
 		/* XXXONDREJ: FIXME */
@@ -1807,23 +1778,24 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		return (value_from_next);
 	case 'x':
 		if (*need_clone)
-			*lookup = clone_lookup(default_lookup, true);
+			*lookup = clone_lookup(default_lookup, ISC_TRUE);
-		*need_clone = true;
+		*need_clone = ISC_TRUE;
 		if (get_reverse(textname, sizeof(textname), value,
-				false) == ISC_R_SUCCESS) {
+				ip6_int, ISC_FALSE) == ISC_R_SUCCESS) {
 			strlcpy((*lookup)->textname, textname,
 				sizeof((*lookup)->textname));
 			debug("looking up %s", (*lookup)->textname);
-			(*lookup)->trace_root = ((*lookup)->trace  ||
+			(*lookup)->trace_root = ISC_TF((*lookup)->trace  ||
-						 (*lookup)->ns_search_only);
+						(*lookup)->ns_search_only);
 			(*lookup)->ip6_int = ip6_int;
 			if (!(*lookup)->rdtypeset)
 				(*lookup)->rdtype = dns_rdatatype_ptr;
 			if (!(*lookup)->rdclassset)
 				(*lookup)->rdclass = dns_rdataclass_in;
-			(*lookup)->new_search = true;
+			(*lookup)->new_search = ISC_TRUE;
 			if (*firstarg) {
 				printgreeting(argc, argv, *lookup);
-				*firstarg = false;
+				*firstarg = ISC_FALSE;
 			}
 			ISC_LIST_APPEND(lookup_list, *lookup, link);
 		} else {
@@ -1837,7 +1809,7 @@ dash_option(char *option, char *next, dig_lookup_t **lookup,
 		usage();
 	}
 	/* NOTREACHED */
-	return (false);
+	return (ISC_FALSE);
 }
 /*%
@@ -1863,50 +1835,24 @@ preparse_args(int argc, char **argv) {
 		option = &rv[0][1];
 		while (strpbrk(option, single_dash_opts) == &option[0]) {
 			switch (option[0]) {
 			case 'd':
 				/* For debugging early startup */
 				debugging = true;
 				break;
 			case 'm':
-				memdebugging = true;
+				memdebugging = ISC_TRUE;
 				isc_mem_debugging = ISC_MEM_DEBUGTRACE |
 					ISC_MEM_DEBUGRECORD;
 				break;
 			case 'r':
 				/*
 				 * Must be done early, because ~/.digrc
 				 * is read before command line parsing
 				 */
 				debug("digrc (early)");
 				digrc = false;
 				break;
 			case '4':
 				if (ipv6only)
 					fatal("only one of -4 and -6 allowed");
-				ipv4only = true;
+				ipv4only = ISC_TRUE;
 				break;
 			case '6':
 				if (ipv4only)
 					fatal("only one of -4 and -6 allowed");
-				ipv6only = true;
+				ipv6only = ISC_TRUE;
 				break;
 			}
 			option = &option[1];
 		}
 		if (strlen(option) == 0U) {
 			continue;
 		}
 		/* Look for dash value option. */
 		if (strpbrk(option, dash_opts) != &option[0] ||
 		    strlen(option) > 1U) {
 			/* Error or value in option. */
 			continue;
 		}
 		/* Dash value is next argument so we need to skip it. */
 		rc--, rv++;
 		/* Handle missing argument */
 		if (rc == 0)
 			break;
 	}
 }
@@ -1927,16 +1873,16 @@ split_batchline(char *batchline, char **bargv, int len, const char *msg) {
 }
 static void
-parse_args(bool is_batchfile, bool config_only,
+parse_args(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 	   int argc, char **argv)
 {
 	isc_result_t result;
 	isc_textregion_t tr;
-	bool firstarg = true;
+	isc_boolean_t firstarg = ISC_TRUE;
 	dig_lookup_t *lookup = NULL;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	bool open_type_class = true;
+	isc_boolean_t open_type_class = ISC_TRUE;
 	char batchline[MXNAME];
 	int bargc;
 	char *bargv[64];
@@ -1946,7 +1892,7 @@ parse_args(bool is_batchfile, bool config_only,
 	char *homedir;
 	char rcfile[PATH_MAX];
 #endif
-	bool need_clone = true;
+	isc_boolean_t need_clone = ISC_TRUE;
 	/*
 	 * The semantics for parsing the args is a bit complex; if
@@ -1963,9 +1909,9 @@ parse_args(bool is_batchfile, bool config_only,
 	if (!is_batchfile) {
 		debug("making new lookup");
 		default_lookup = make_empty_lookup();
-		default_lookup->adflag = true;
+		default_lookup->adflag = ISC_TRUE;
 		default_lookup->edns = 0;
-		default_lookup->sendcookie = true;
+		default_lookup->sendcookie = ISC_TRUE;
 #ifndef NOPOSIX
 		/*
@@ -1973,9 +1919,8 @@ parse_args(bool is_batchfile, bool config_only,
 		 */
 		INSIST(batchfp == NULL);
 		homedir = getenv("HOME");
-		if (homedir != NULL && digrc) {
+		if (homedir != NULL) {
 			unsigned int n;
 			debug("digrc (open)");
 			n = snprintf(rcfile, sizeof(rcfile), "%s/.digrc",
 				     homedir);
 			if (n < sizeof(rcfile)) {
@@ -1988,10 +1933,10 @@ parse_args(bool is_batchfile, bool config_only,
 			{
 				debug("config line %s", batchline);
 				bargc = split_batchline(batchline, bargv, 62,
-							".digrc argv");
+						        ".digrc argv");
 				bargv[0] = argv[0];
 				argv0 = argv[0];
-				parse_args(true, true,
+				parse_args(ISC_TRUE, ISC_TRUE,
 					   bargc, (char **)bargv);
 			}
 			fclose(batchfp);
@@ -2001,8 +1946,8 @@ parse_args(bool is_batchfile, bool config_only,
 	if (is_batchfile && !config_only) {
 		/* Processing '-f batchfile'. */
-		lookup = clone_lookup(default_lookup, true);
+		lookup = clone_lookup(default_lookup, ISC_TRUE);
-		need_clone = false;
+		need_clone = ISC_FALSE;
 	} else {
 		lookup = default_lookup;
 	}
@@ -2085,10 +2030,10 @@ parse_args(bool is_batchfile, bool config_only,
 							"extra type option\n");
 					}
 					if (rdtype == dns_rdatatype_ixfr) {
-						uint32_t serial;
+						isc_uint32_t serial;
 						lookup->rdtype =
 							dns_rdatatype_ixfr;
-						lookup->rdtypeset = true;
+						lookup->rdtypeset = ISC_TRUE;
 						result = parse_uint(&serial,
 								    &rv[0][5],
 								    MAXSERIAL,
@@ -2101,10 +2046,10 @@ parse_args(bool is_batchfile, bool config_only,
 							plusquest;
 						lookup->comments = pluscomm;
 						if (!lookup->tcp_mode_set)
-							lookup->tcp_mode = true;
+							lookup->tcp_mode = ISC_TRUE;
 					} else {
 						lookup->rdtype = rdtype;
-						lookup->rdtypeset = true;
+						lookup->rdtypeset = ISC_TRUE;
 						if (rdtype ==
 						    dns_rdatatype_axfr) {
 						    lookup->section_question =
@@ -2114,8 +2059,8 @@ parse_args(bool is_batchfile, bool config_only,
 						if (rdtype ==
 						    dns_rdatatype_any &&
 						    !lookup->tcp_mode_set)
-							lookup->tcp_mode = true;
+							lookup->tcp_mode = ISC_TRUE;
-						lookup->ixfr_serial = false;
+						lookup->ixfr_serial = ISC_FALSE;
 					}
 					continue;
 				}
@@ -2127,7 +2072,7 @@ parse_args(bool is_batchfile, bool config_only,
 							"extra class option\n");
 					}
 					lookup->rdclass = rdclass;
-					lookup->rdclassset = true;
+					lookup->rdclassset = ISC_TRUE;
 					continue;
 				}
 			}
@@ -2135,16 +2080,16 @@ parse_args(bool is_batchfile, bool config_only,
 			if (!config_only) {
 				if (need_clone)
 					lookup = clone_lookup(default_lookup,
-								      true);
+								      ISC_TRUE);
-				need_clone = true;
+				need_clone = ISC_TRUE;
 				strlcpy(lookup->textname, rv[0],
 					sizeof(lookup->textname));
-				lookup->trace_root = (lookup->trace ||
+				lookup->trace_root = ISC_TF(lookup->trace  ||
-						      lookup->ns_search_only);
+						     lookup->ns_search_only);
-				lookup->new_search = true;
+				lookup->new_search = ISC_TRUE;
 				if (firstarg) {
 					printgreeting(argc, argv, lookup);
-					firstarg = false;
+					firstarg = ISC_FALSE;
 				}
 				ISC_LIST_APPEND(lookup_list, lookup, link);
 				debug("looking up %s", lookup->textname);
@@ -2180,7 +2125,7 @@ parse_args(bool is_batchfile, bool config_only,
 						"batch argv");
 			bargv[0] = argv[0];
 			argv0 = argv[0];
-			parse_args(true, false, bargc, (char **)bargv);
+			parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 			return;
 		}
 		return;
@@ -2190,17 +2135,17 @@ parse_args(bool is_batchfile, bool config_only,
 	 */
 	if ((lookup_list.head == NULL) && !config_only) {
 		if (need_clone)
-			lookup = clone_lookup(default_lookup, true);
+			lookup = clone_lookup(default_lookup, ISC_TRUE);
-		need_clone = true;
+		need_clone = ISC_TRUE;
-		lookup->trace_root = (lookup->trace ||
+		lookup->trace_root = ISC_TF(lookup->trace ||
-				      lookup->ns_search_only);
+					    lookup->ns_search_only);
-		lookup->new_search = true;
+		lookup->new_search = ISC_TRUE;
 		strlcpy(lookup->textname, ".", sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ns;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 		if (firstarg) {
 			printgreeting(argc, argv, lookup);
-			firstarg = false;
+			firstarg = ISC_FALSE;
 		}
 		ISC_LIST_APPEND(lookup_list, lookup, link);
 	}
@@ -2237,7 +2182,7 @@ query_finished(void) {
 		debug("batch line %s", batchline);
 		bargc = split_batchline(batchline, bargv, 14, "batch argv");
 		bargv[0] = argv0;
-		parse_args(true, false, bargc, (char **)bargv);
+		parse_args(ISC_TRUE, ISC_FALSE, bargc, (char **)bargv);
 		start_lookup();
 	} else {
 		batchname = NULL;
@@ -2274,7 +2219,7 @@ void dig_setup(int argc, char **argv)
 	setup_system(ipv4only, ipv6only);
 }
-void dig_query_setup(bool is_batchfile, bool config_only,
+void dig_query_setup(isc_boolean_t is_batchfile, isc_boolean_t config_only,
 		int argc, char **argv)
 {
 	debug("dig_query_setup");
@@ -2286,7 +2231,7 @@ void dig_query_setup(bool is_batchfile, bool config_only,
 		setup_text_key();
 	if (domainopt[0] != '\0') {
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	}
 }
@@ -2323,7 +2268,7 @@ int
 main(int argc, char **argv) {
 	dig_setup(argc, argv);
-	dig_query_setup(false, false, argc, argv);
+	dig_query_setup(ISC_FALSE, ISC_FALSE, argc, argv);
 	dig_startup();
 	dig_shutdown();
@@ -52,7 +52,6 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -132,10 +131,9 @@
    <para>
      It is possible to set per-user defaults for <command>dig</command> via
-      <filename>${HOME}/.digrc</filename>. This file is read and any
+      <filename>${HOME}/.digrc</filename>.  This file is read and
-      options in it are applied before the command line arguments.
+      any options in it
-      The <option>-r</option> option disables this feature, for
+      are applied before the command line arguments.
      scripts that need predictable behaviour.
    </para>
    <para>
@@ -273,6 +271,17 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-i</term>
 	<listitem>
 	  <para>
 	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
 	    domain, which is no longer in use. Obsolete bit string
 	    label queries (RFC 2874) are not attempted.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-k <replaceable class="parameter">keyfile</replaceable></term>
 	<listitem>
@@ -325,16 +334,6 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-r</term>
 	<listitem>
 	  <para>
 	    Do not read options from <filename>${HOME}/.digrc</filename>.
 	    This is useful for scripts that need predictable behaviour.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-t <replaceable class="parameter">type</replaceable></term>
 	<listitem>
@@ -395,7 +394,8 @@
 	    <literal>94.2.0.192.in-addr.arpa</literal> and sets the
 	    query type and class to PTR and IN respectively. IPv6
 	    addresses are looked up using nibble format under the
-	    IP6.ARPA domain.
+	    IP6.ARPA domain (but see also the <option>-i</option>
 	    option).
 	  </para>
 	</listitem>
      </varlistentry>
@@ -747,16 +747,6 @@
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 	  <term><option>+[no]expandaaaa</option></term>
 	  <listitem>
 	    <para>
 	      When printing AAAA record print all zero nibbles rather
 	      than the default RFC 5952 preferred presentation format.
 	    </para>
 	  </listitem>
 	</varlistentry>
 	<varlistentry>
 	  <term><option>+[no]fail</option></term>
 	  <listitem>
@@ -799,13 +789,7 @@
 	    <para>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
+	      compile time.  The default is to process IDN input.
 	    </para>
 	    <para>
 	      The default is to process IDN input when standard output
 	      is a tty.  The IDN processing on input is disabled when
 	      dig output is redirected to files, pipes, and other
 	      non-tty file descriptors.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -816,13 +800,7 @@
 	    <para>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
+	      compile time.  The default is to convert output.
 	    </para>
 	    <para>
 	      The default is to process puny code on output when
 	      standard output is a tty.  The puny code processing on
 	      output is disabled when dig output is redirected to
 	      files, pipes, and other non-tty file descriptors.
 	    </para>
 	  </listitem>
 	</varlistentry>
@@ -1352,9 +1330,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      reply from the server.
      If you'd like to turn off the IDN support for some reason, use
      parameters <parameter>+noidnin</parameter> and
-      <parameter>+noidnout</parameter> or define
+      <parameter>+noidnout</parameter>.
      the <envar>IDN_DISABLE</envar> environment variable.
    </para>
  </refsection>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2011, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2011, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -106,10 +106,9 @@
    <p>
      It is possible to set per-user defaults for <span class="command"><strong>dig</strong></span> via
-      <code class="filename">${HOME}/.digrc</code>. This file is read and any
+      <code class="filename">${HOME}/.digrc</code>.  This file is read and
-      options in it are applied before the command line arguments.
+      any options in it
-      The <code class="option">-r</code> option disables this feature, for
+      are applied before the command line arguments.
      scripts that need predictable behaviour.
    </p>
    <p>
@@ -228,6 +227,14 @@
 	    <span class="command"><strong>dig</strong></span> using the command-line interface.
 	  </p>
 	</dd>
 <dt><span class="term">-i</span></dt>
 <dd>
 	  <p>
 	    Do reverse IPv6 lookups using the obsolete RFC 1886 IP6.INT
 	    domain, which is no longer in use. Obsolete bit string
 	    label queries (RFC 2874) are not attempted.
 	  </p>
 	</dd>
 <dt><span class="term">-k <em class="replaceable"><code>keyfile</code></em></span></dt>
 <dd>
 	  <p>
@@ -267,13 +274,6 @@
 	    the <em class="parameter"><code>name</code></em> from other arguments.
 	  </p>
 	</dd>
 <dt><span class="term">-r</span></dt>
 <dd>
 	  <p>
 	    Do not read options from <code class="filename">${HOME}/.digrc</code>.
 	    This is useful for scripts that need predictable behaviour.
 	  </p>
 	</dd>
 <dt><span class="term">-t <em class="replaceable"><code>type</code></em></span></dt>
 <dd>
 	  <p>
@@ -324,7 +324,8 @@
 	    <code class="literal">94.2.0.192.in-addr.arpa</code> and sets the
 	    query type and class to PTR and IN respectively. IPv6
 	    addresses are looked up using nibble format under the
-	    IP6.ARPA domain.
+	    IP6.ARPA domain (but see also the <code class="option">-i</code>
 	    option).
 	  </p>
 	</dd>
 <dt><span class="term">-y <em class="replaceable"><code>[<span class="optional">hmac:</span>]keyname:secret</code></em></span></dt>
@@ -598,13 +599,6 @@
 	      Send an EDNS Expire option.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]expandaaaa</code></span></dt>
 <dd>
 	    <p>
 	      When printing AAAA record print all zero nibbles rather
 	      than the default RFC 5952 preferred presentation format.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]fail</code></span></dt>
 <dd>
 	    <p>
@@ -637,13 +631,7 @@
 	    <p>
 	      Process [do not process] IDN domain names on input.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
+	      compile time.  The default is to process IDN input.
 	    </p>
 	    <p>
 	      The default is to process IDN input when standard output
 	      is a tty.  The IDN processing on input is disabled when
 	      dig output is redirected to files, pipes, and other
 	      non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]idnout</code></span></dt>
@@ -651,13 +639,7 @@
 	    <p>
 	      Convert [do not convert] puny code on output.
 	      This requires IDN SUPPORT to have been enabled at
-	      compile time.
+	      compile time.  The default is to convert output.
 	    </p>
 	    <p>
 	      The default is to process puny code on output when
 	      standard output is a tty.  The puny code processing on
 	      output is disabled when dig output is redirected to
 	      files, pipes, and other non-tty file descriptors.
 	    </p>
 	  </dd>
 <dt><span class="term"><code class="option">+[no]ignore</code></span></dt>
@@ -1079,9 +1061,7 @@ dig +qr www.isc.org any -x 127.0.0.1 isc.org ns +noqr
      reply from the server.
      If you'd like to turn off the IDN support for some reason, use
      parameters <em class="parameter"><code>+noidnin</code></em> and
-      <em class="parameter"><code>+noidnout</code></em> or define
+      <em class="parameter"><code>+noidnout</code></em>.
      the <code class="envar">IDN_DISABLE</code> environment variable.
    </p>
  </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -112,6 +112,11 @@ Print debugging traces\&. Equivalent to the
 verbose option\&.
 .RE
 .PP
 \-i
 .RS 4
 Obsolete\&. Use the IP6\&.INT domain for reverse lookups of IPv6 addresses as defined in RFC1886 and deprecated in RFC4159\&. The default is to use IP6\&.ARPA as specified in RFC3596\&.
 .RE
 .PP
 \-l
 .RS 4
 List zone: The
@@ -252,7 +257,7 @@ If
 \fBhost\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBhost\fR
-appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
+appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, defines the
 \fBIDN_DISABLE\fR
 environment variable\&. The IDN support is disabled if the variable is set when
 \fBhost\fR
@@ -269,5 +274,5 @@ runs\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -11,8 +11,7 @@
 /*! \file */
-#include <inttypes.h>
+#include <config.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <limits.h>
@@ -27,6 +26,7 @@
 #include <isc/string.h>
 #include <isc/util.h>
 #include <isc/task.h>
 #include <isc/stdlib.h>
 #include <dns/byaddr.h>
 #include <dns/fixedname.h>
@@ -40,14 +40,14 @@
 #include <dig/dig.h>
-static bool short_form = true, listed_server = false;
+static isc_boolean_t short_form = ISC_TRUE, listed_server = ISC_FALSE;
-static bool default_lookups = true;
+static isc_boolean_t default_lookups = ISC_TRUE;
 static int seen_error = -1;
-static bool list_addresses = true;
+static isc_boolean_t list_addresses = ISC_TRUE;
-static bool list_almost_all = false;
+static isc_boolean_t list_almost_all = ISC_FALSE;
 static dns_rdatatype_t list_type = dns_rdatatype_a;
-static bool printed_server = false;
+static isc_boolean_t printed_server = ISC_FALSE;
-static bool ipv4only = false, ipv6only = false;
+static isc_boolean_t ipv4only = ISC_FALSE, ipv6only = ISC_FALSE;
 static const char *opcodetext[] = {
 	"QUERY",
@@ -141,6 +141,7 @@ show_usage(void) {
 "       -c specifies query class for non-IN data\n"
 "       -C compares SOA records on authoritative nameservers\n"
 "       -d is equivalent to -v\n"
 "       -i IP6.INT reverse lookups\n"
 "       -l lists all hosts in a domain, using AXFR\n"
 "       -m set memory debugging flag (trace|record|usage)\n"
 "       -N changes the number of dots allowed before root lookup is done\n"
@@ -149,7 +150,6 @@ show_usage(void) {
 "       -s a SERVFAIL response should stop query\n"
 "       -t specifies the query type\n"
 "       -T enables TCP/IP mode\n"
 "       -U enables UDP mode\n"
 "       -v enables verbose output\n"
 "       -V print version number and exit\n"
 "       -w specifies to wait forever for a reply\n"
@@ -224,7 +224,7 @@ say_message(dns_name_t *name, const char *msg, dns_rdata_t *rdata,
 static isc_result_t
 printsection(dns_message_t *msg, dns_section_t sectionid,
-	     const char *section_name, bool headers,
+	     const char *section_name, isc_boolean_t headers,
 	     dig_query_t *query)
 {
 	dns_name_t *name, *print_name;
@@ -235,13 +235,13 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 	isc_region_t r;
 	dns_name_t empty_name;
 	char tbuf[4096];
-	bool first;
+	isc_boolean_t first;
-	bool no_rdata;
+	isc_boolean_t no_rdata;
 	if (sectionid == DNS_SECTION_QUESTION)
-		no_rdata = true;
+		no_rdata = ISC_TRUE;
 	else
-		no_rdata = false;
+		no_rdata = ISC_FALSE;
 	if (headers)
 		printf(";; %s SECTION:\n", section_name);
@@ -259,7 +259,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 		dns_message_currentname(msg, sectionid, &name);
 		isc_buffer_init(&target, tbuf, sizeof(tbuf));
-		first = true;
+		first = ISC_TRUE;
 		print_name = name;
 		for (rdataset = ISC_LIST_HEAD(name->list);
@@ -283,7 +283,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 			if (!short_form) {
 				result = dns_rdataset_totext(rdataset,
 							     print_name,
-							     false,
+							     ISC_FALSE,
 							     no_rdata,
 							     &target);
 				if (result != ISC_R_SUCCESS)
@@ -291,7 +291,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 #ifdef USEINITALWS
 				if (first) {
 					print_name = &empty_name;
-					first = false;
+					first = ISC_FALSE;
 				}
 #else
 				UNUSED(first); /* Shut up compiler. */
@@ -350,7 +350,7 @@ printsection(dns_message_t *msg, dns_section_t sectionid,
 static isc_result_t
 printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,
 	   const dns_name_t *owner, const char *set_name,
-	   bool headers)
+	   isc_boolean_t headers)
 {
 	isc_buffer_t target;
 	isc_result_t result;
@@ -363,7 +363,7 @@ printrdata(dns_message_t *msg, dns_rdataset_t *rdataset,
 	isc_buffer_init(&target, tbuf, sizeof(tbuf));
-	result = dns_rdataset_totext(rdataset, owner, false, false,
+	result = dns_rdataset_totext(rdataset, owner, ISC_FALSE, ISC_FALSE,
 				     &target);
 	if (result != ISC_R_SUCCESS)
 		return (result);
@@ -400,8 +400,8 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
-	bool did_flag = false;
+	isc_boolean_t did_flag = ISC_FALSE;
 	dns_rdataset_t *opt, *tsig = NULL;
 	const dns_name_t *tsigname;
 	isc_result_t result = ISC_R_SUCCESS;
@@ -424,7 +424,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 				    sizeof(sockstr));
 		printf("Address: %s\n", sockstr);
 		printf("Aliases: \n\n");
-		printed_server = true;
+		printed_server = ISC_TRUE;
 	}
 	if (msg->rcode != 0) {
@@ -456,22 +456,22 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_aaaa;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
 		}
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_mx;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -485,31 +485,31 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		printf(";; flags: ");
 		if ((msg->flags & DNS_MESSAGEFLAG_QR) != 0) {
 			printf("qr");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_AA) != 0) {
 			printf("%saa", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_TC) != 0) {
 			printf("%stc", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_RD) != 0) {
 			printf("%srd", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_RA) != 0) {
 			printf("%sra", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_AD) != 0) {
 			printf("%sad", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 		}
 		if ((msg->flags & DNS_MESSAGEFLAG_CD) != 0) {
 			printf("%scd", did_flag ? " " : "");
-			did_flag = true;
+			did_flag = ISC_TRUE;
 			POST(did_flag);
 		}
 		printf("; QUERY: %u, ANSWER: %u, "
@@ -532,7 +532,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_QUESTION, "QUESTION",
-				      true, query);
+				      ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -540,7 +540,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		if (!short_form)
 			printf("\n");
 		result = printsection(msg, DNS_SECTION_ANSWER, "ANSWER",
-				      !short_form, query);
+				      ISC_TF(!short_form), query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -549,7 +549,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_AUTHORITY, "AUTHORITY",
-				      true, query);
+				      ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -557,14 +557,14 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	    !short_form) {
 		printf("\n");
 		result = printsection(msg, DNS_SECTION_ADDITIONAL,
-				      "ADDITIONAL", true, query);
+				      "ADDITIONAL", ISC_TRUE, query);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
 	if ((tsig != NULL) && !short_form) {
 		printf("\n");
 		result = printrdata(msg, tsig, tsigname,
-				    "PSEUDOSECTION TSIG", true);
+				    "PSEUDOSECTION TSIG", ISC_TRUE);
 		if (result != ISC_R_SUCCESS)
 			return (result);
 	}
@@ -599,7 +599,7 @@ pre_parse_args(int argc, char **argv) {
 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'm':
-			memdebugging = true;
+			memdebugging = ISC_TRUE;
 			if (strcasecmp("trace", isc_commandline_argument) == 0)
 				isc_mem_debugging |= ISC_MEM_DEBUGTRACE;
 			else if (strcasecmp("record",
@@ -613,50 +613,49 @@ pre_parse_args(int argc, char **argv) {
 		case '4':
 			if (ipv6only)
 				fatal("only one of -4 and -6 allowed");
-			ipv4only = true;
+			ipv4only = ISC_TRUE;
 			break;
 		case '6':
 			if (ipv4only)
 				fatal("only one of -4 and -6 allowed");
-			ipv6only = true;
+			ipv6only = ISC_TRUE;
 			break;
 		case 'a': break;
 		case 'A': break;
 		case 'c': break;
 		case 'C': break;
 		case 'd': break;
 		case 'D':
 			if (debugging)
 				debugtiming = true;
 			debugging = true;
 			break;
 		case 'i': break;
 		case 'l': break;
 		case 'n': break;
 		case 'N': break;
 		case 'r': break;
 		case 'R': break;
 		case 's': break;
 		case 't': break;
 		case 'T': break;
 		case 'U': break;
 		case 'v': break;
 		case 'V':
 			  version();
 			  exit(0);
 			  break;
 		case 'w': break;
 		case 'C': break;
 		case 'D':
 			if (debugging)
 				debugtiming = ISC_TRUE;
 			debugging = ISC_TRUE;
 			break;
 		case 'N': break;
 		case 'R': break;
 		case 'T': break;
 		case 'W': break;
 		default:
 			show_usage();
 		}
 	}
-	isc_commandline_reset = true;
+	isc_commandline_reset = ISC_TRUE;
 	isc_commandline_index = 1;
 }
 static void
-parse_args(bool is_batchfile, int argc, char **argv) {
+parse_args(isc_boolean_t is_batchfile, int argc, char **argv) {
 	char hostname[MXNAME];
 	dig_lookup_t *lookup;
 	int c;
@@ -665,30 +664,30 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	isc_result_t result = ISC_R_SUCCESS;
 	dns_rdatatype_t rdtype;
 	dns_rdataclass_t rdclass;
-	uint32_t serial = 0;
+	isc_uint32_t serial = 0;
 	UNUSED(is_batchfile);
 	lookup = make_empty_lookup();
-	lookup->servfail_stops = false;
+	lookup->servfail_stops = ISC_FALSE;
-	lookup->comments = false;
+	lookup->comments = ISC_FALSE;
 	short_form = !verbose;
 	while ((c = isc_commandline_parse(argc, argv, optstring)) != -1) {
 		switch (c) {
 		case 'l':
-			lookup->tcp_mode = true;
+			lookup->tcp_mode = ISC_TRUE;
 			lookup->rdtype = dns_rdatatype_axfr;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			fatalexit = 3;
 			break;
 		case 'v':
 		case 'd':
-			short_form = false;
+			short_form = ISC_FALSE;
 			break;
 		case 'r':
-			lookup->recurse = false;
+			lookup->recurse = ISC_FALSE;
 			break;
 		case 't':
 			if (strncasecmp(isc_commandline_argument,
@@ -713,23 +712,23 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = rdtype;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			if (rdtype == dns_rdatatype_axfr) {
 				/* -l -t any -v */
 				list_type = dns_rdatatype_any;
-				short_form = false;
+				short_form = ISC_FALSE;
-				lookup->tcp_mode = true;
+				lookup->tcp_mode = ISC_TRUE;
 			} else if (rdtype == dns_rdatatype_ixfr) {
 				lookup->ixfr_serial = serial;
-				lookup->tcp_mode = true;
+				lookup->tcp_mode = ISC_TRUE;
 				list_type = rdtype;
 			} else if (rdtype == dns_rdatatype_any) {
 				if (!lookup->tcp_mode_set)
-					lookup->tcp_mode = true;
+					lookup->tcp_mode = ISC_TRUE;
 			} else
 				list_type = rdtype;
-			list_addresses = false;
+			list_addresses = ISC_FALSE;
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'c':
 			tr.base = isc_commandline_argument;
@@ -743,25 +742,25 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				      isc_commandline_argument);
 			} else {
 				lookup->rdclass = rdclass;
-				lookup->rdclassset = true;
+				lookup->rdclassset = ISC_TRUE;
 			}
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'A':
-			list_almost_all = true;
+			list_almost_all = ISC_TRUE;
 			/* FALL THROUGH */
 		case 'a':
 			if (!lookup->rdtypeset ||
 			    lookup->rdtype != dns_rdatatype_axfr)
 				lookup->rdtype = dns_rdatatype_any;
 			list_type = dns_rdatatype_any;
-			list_addresses = false;
+			list_addresses = ISC_FALSE;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
-			short_form = false;
+			short_form = ISC_FALSE;
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'i':
-			/* deprecated */
+			lookup->ip6_int = ISC_TRUE;
 			break;
 		case 'n':
 			/* deprecated */
@@ -787,23 +786,23 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 				tries = 2;
 			break;
 		case 'T':
-			lookup->tcp_mode = true;
+			lookup->tcp_mode = ISC_TRUE;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode_set = ISC_TRUE;
 			break;
 		case 'U':
-			lookup->tcp_mode = false;
+			lookup->tcp_mode = ISC_FALSE;
-			lookup->tcp_mode_set = true;
+			lookup->tcp_mode_set = ISC_TRUE;
 			break;
 		case 'C':
 			debug("showing all SOAs");
 			lookup->rdtype = dns_rdatatype_ns;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->rdclass = dns_rdataclass_in;
-			lookup->rdclassset = true;
+			lookup->rdclassset = ISC_TRUE;
-			lookup->ns_search_only = true;
+			lookup->ns_search_only = ISC_TRUE;
-			lookup->trace_root = true;
+			lookup->trace_root = ISC_TRUE;
-			lookup->identify_previous_line = true;
+			lookup->identify_previous_line = ISC_TRUE;
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 			break;
 		case 'N':
 			debug("setting NDOTS to %s",
@@ -820,7 +819,7 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 			/* Handled by pre_parse_args(). */
 			break;
 		case 's':
-			lookup->servfail_stops = true;
+			lookup->servfail_stops = ISC_TRUE;
 			break;
 		}
 	}
@@ -835,22 +834,22 @@ parse_args(bool is_batchfile, int argc, char **argv) {
 	if (argc > isc_commandline_index + 1) {
 		set_nameserver(argv[isc_commandline_index+1]);
 		debug("server is %s", argv[isc_commandline_index+1]);
-		listed_server = true;
+		listed_server = ISC_TRUE;
 	} else
-		check_ra = true;
+		check_ra = ISC_TRUE;
-	lookup->pending = false;
+	lookup->pending = ISC_FALSE;
-	if (get_reverse(store, sizeof(store), hostname, true)
+	if (get_reverse(store, sizeof(store), hostname,
-	    == ISC_R_SUCCESS) {
+			lookup->ip6_int, ISC_TRUE) == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
-		default_lookups = false;
+		default_lookups = ISC_FALSE;
 	} else {
 		strlcpy(lookup->textname, hostname, sizeof(lookup->textname));
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	}
-	lookup->new_search = true;
+	lookup->new_search = ISC_TRUE;
 	ISC_LIST_APPEND(lookup_list, lookup, link);
 }
@@ -879,7 +878,7 @@ main(int argc, char **argv) {
 	check_result(result, "isc_app_start");
 	setup_libs();
 	setup_system(ipv4only, ipv6only);
-	parse_args(false, argc, argv);
+	parse_args(ISC_FALSE, argc, argv);
 	if (keyfile[0] != 0)
 		setup_file_key();
 	else if (keysecret[0] != 0)
@@ -47,7 +47,6 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -180,6 +179,18 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-i</term>
 	<listitem>
 	  <para>
 	    Obsolete.
 	    Use the IP6.INT domain for reverse lookups of IPv6
 	    addresses as defined in RFC1886 and deprecated in RFC4159.
 	    The default is to use IP6.ARPA as specified in RFC3596.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-l</term>
 	<listitem>
@@ -378,7 +389,7 @@
      <command>host</command> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, define
+      If you'd like to turn off the IDN support for some reason, defines
      the <envar>IDN_DISABLE</envar> environment variable.
      The IDN support is disabled if the variable is set when
      <command>host</command> runs.
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2000-2002, 2004, 2005, 2007-2009, 2014-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -138,6 +138,15 @@
 	    Equivalent to the <code class="option">-v</code> verbose option.
 	  </p>
 	</dd>
 <dt><span class="term">-i</span></dt>
 <dd>
 	  <p>
 	    Obsolete.
 	    Use the IP6.INT domain for reverse lookups of IPv6
 	    addresses as defined in RFC1886 and deprecated in RFC4159.
 	    The default is to use IP6.ARPA as specified in RFC3596.
 	  </p>
 	</dd>
 <dt><span class="term">-l</span></dt>
 <dd>
 	  <p>
@@ -302,7 +311,7 @@
      <span class="command"><strong>host</strong></span> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
-      If you'd like to turn off the IDN support for some reason, define
+      If you'd like to turn off the IDN support for some reason, defines
      the <code class="envar">IDN_DISABLE</code> environment variable.
      The IDN support is disabled if the variable is set when
      <span class="command"><strong>host</strong></span> runs.
@@ -14,19 +14,16 @@
 /*! \file */
 #include <inttypes.h>
 #include <stdbool.h>
 #include <dns/rdatalist.h>
 #include <dst/dst.h>
 #include <isc/boolean.h>
 #include <isc/buffer.h>
 #include <isc/bufferlist.h>
 #include <isc/formatcheck.h>
 #include <isc/lang.h>
 #include <isc/list.h>
 #include <isc/magic.h>
 #include <isc/mem.h>
 #include <isc/print.h>
 #include <isc/sockaddr.h>
@@ -82,14 +79,9 @@ typedef struct dig_server dig_server_t;
 typedef ISC_LIST(dig_server_t) dig_serverlist_t;
 typedef struct dig_searchlist dig_searchlist_t;
 #define DIG_QUERY_MAGIC		ISC_MAGIC('D','i','g','q')
 #define DIG_VALID_QUERY(x)	ISC_MAGIC_VALID((x), DIG_QUERY_MAGIC)
 /*% The dig_lookup structure */
 struct dig_lookup {
-	bool
+	isc_boolean_t
 		pending, /*%< Pending a successful answer */
 		waiting_connect,
 		doing_xfr,
@@ -109,6 +101,7 @@ struct dig_lookup {
 		trace_root, /*% initial query for either +trace or +nssearch */
 		tcp_mode,
 		tcp_mode_set,
 		ip6_int,
 		comments,
 		stats,
 		section_question,
@@ -140,15 +133,14 @@ struct dig_lookup {
 		ttlunits,
 		idnin,
 		idnout,
 		expandaaaa,
 		qr;
 	char textname[MXNAME]; /*% Name we're going to be looking up */
 	char cmdline[MXNAME];
 	dns_rdatatype_t rdtype;
 	dns_rdatatype_t qrdtype;
 	dns_rdataclass_t rdclass;
-	bool rdtypeset;
+	isc_boolean_t rdtypeset;
-	bool rdclassset;
+	isc_boolean_t rdclassset;
 	char name_space[BUFSIZE];
 	char oname_space[BUFSIZE];
 	isc_buffer_t namebuf;
@@ -166,17 +158,17 @@ struct dig_lookup {
 	dig_serverlist_t my_server_list;
 	dig_searchlist_t *origin;
 	dig_query_t *xfr_q;
-	uint32_t retries;
+	isc_uint32_t retries;
 	int nsfound;
-	uint16_t udpsize;
+	isc_uint16_t udpsize;
-	int16_t edns;
+	isc_int16_t edns;
-	int16_t padding;
+	isc_int16_t padding;
-	uint32_t ixfr_serial;
+	isc_uint32_t ixfr_serial;
 	isc_buffer_t rdatabuf;
 	char rdatastore[MXNAME];
 	dst_context_t *tsigctx;
 	isc_buffer_t *querysig;
-	uint32_t msgcounter;
+	isc_uint32_t msgcounter;
 	dns_fixedname_t fdomain;
 	isc_sockaddr_t *ecs_addr;
 	char *cookie;
@@ -191,9 +183,8 @@ struct dig_lookup {
 /*% The dig_query structure */
 struct dig_query {
 	unsigned int magic;
 	dig_lookup_t *lookup;
-	bool waiting_connect,
+	isc_boolean_t waiting_connect,
 		pending_free,
 		waiting_senddone,
 		first_pass,
@@ -203,26 +194,30 @@ struct dig_query {
 		recv_made,
 		warn_id,
 		timedout;
-	uint32_t first_rr_serial;
+	isc_uint32_t first_rr_serial;
-	uint32_t second_rr_serial;
+	isc_uint32_t second_rr_serial;
-	uint32_t msg_count;
+	isc_uint32_t msg_count;
-	uint32_t rr_count;
+	isc_uint32_t rr_count;
-	bool ixfr_axfr;
+	isc_boolean_t ixfr_axfr;
 	char *servname;
 	char *userarg;
 	isc_bufferlist_t sendlist,
 		recvlist,
 		lengthlist;
 	isc_buffer_t recvbuf,
 		lengthbuf,
-		tmpsendbuf,
+		slbuf;
-		sendbuf;
+	char *recvspace,
-	char *recvspace, *tmpsendspace,
+		lengthspace[4],
-		lengthspace[4];
+		slspace[4];
 	isc_socket_t *sock;
 	ISC_LINK(dig_query_t) link;
 	ISC_LINK(dig_query_t) clink;
 	isc_sockaddr_t sockaddr;
 	isc_time_t time_sent;
 	isc_time_t time_recv;
-	uint64_t byte_count;
+	isc_uint64_t byte_count;
 	isc_buffer_t sendbuf;
 	isc_timer_t *timer;
 };
@@ -249,7 +244,7 @@ extern dig_serverlist_t server_list;
 extern dig_searchlistlist_t search_list;
 extern unsigned int extrabytes;
-extern bool check_ra, have_ipv4, have_ipv6, specified_source,
+extern isc_boolean_t check_ra, have_ipv4, have_ipv6, specified_source,
 	usesearch, showsearch;
 extern in_port_t port;
 extern unsigned int timeout;
@@ -265,17 +260,17 @@ extern char keysecret[MXNAME];
 extern const dns_name_t *hmacname;
 extern unsigned int digestbits;
 extern dns_tsigkey_t *tsigkey;
-extern bool validated;
+extern isc_boolean_t validated;
 extern isc_taskmgr_t *taskmgr;
 extern isc_task_t *global_task;
-extern bool free_now;
+extern isc_boolean_t free_now;
-extern bool debugging, debugtiming, memdebugging;
+extern isc_boolean_t debugging, debugtiming, memdebugging;
-extern bool keep_open;
+extern isc_boolean_t keep_open;
 extern char *progname;
 extern int tries;
 extern int fatalexit;
-extern bool verbose;
+extern isc_boolean_t verbose;
 /*
 * Routines in dighost.c.
@@ -287,7 +282,8 @@ int
 getaddresses(dig_lookup_t *lookup, const char *host, isc_result_t *resultp);
 isc_result_t
-get_reverse(char *reverse, size_t len, char *value, bool strict);
+get_reverse(char *reverse, size_t len, char *value, isc_boolean_t ip6_int,
 	    isc_boolean_t strict);
 ISC_PLATFORM_NORETURN_PRE void
 fatal(const char *format, ...)
@@ -306,7 +302,7 @@ debug(const char *format, ...) ISC_FORMAT_PRINTF(1, 2);
 void
 check_result(isc_result_t result, const char *msg);
-bool
+isc_boolean_t
 setup_lookup(dig_lookup_t *lookup);
 void
@@ -328,14 +324,14 @@ void
 setup_libs(void);
 void
-setup_system(bool ipv4only, bool ipv6only);
+setup_system(isc_boolean_t ipv4only, isc_boolean_t ipv6only);
 isc_result_t
-parse_uint(uint32_t *uip, const char *value, uint32_t max,
+parse_uint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);
 isc_result_t
-parse_xint(uint32_t *uip, const char *value, uint32_t max,
+parse_xint(isc_uint32_t *uip, const char *value, isc_uint32_t max,
 	   const char *desc);
 isc_result_t
@@ -345,13 +341,13 @@ void
 parse_hmac(const char *hmacstr);
 dig_lookup_t *
-requeue_lookup(dig_lookup_t *lookold, bool servers);
+requeue_lookup(dig_lookup_t *lookold, isc_boolean_t servers);
 dig_lookup_t *
 make_empty_lookup(void);
 dig_lookup_t *
-clone_lookup(dig_lookup_t *lookold, bool servers);
+clone_lookup(dig_lookup_t *lookold, isc_boolean_t servers);
 dig_server_t *
 make_server(const char *servname, const char *userarg);
@@ -380,7 +376,7 @@ set_search_domain(char *domain);
 * then assigned to the appropriate function pointer
 */
 extern isc_result_t
-(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, bool headers);
+(*dighost_printmessage)(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers);
 /*%<
 * Print the final result of the lookup.
 */
@@ -422,7 +418,7 @@ dig_setup(int argc, char **argv);
 * Call to supply new parameters for the next lookup
 */
 void
-dig_query_setup(bool, bool, int argc, char **argv);
+dig_query_setup(isc_boolean_t, isc_boolean_t, int argc, char **argv);
 /*%<
 * set the main application event cycle running
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -277,17 +277,6 @@ Try the next nameserver if a nameserver responds with SERVFAIL or a referral (no
 .PP
 \fBnslookup\fR
 returns with an exit status of 1 if any query failed, and 0 otherwise\&.
 .SH "IDN SUPPORT"
 .PP
 If
 \fBnslookup\fR
 has been built with IDN (internationalized domain name) support, it can accept and display non\-ASCII domain names\&.
 \fBnslookup\fR
 appropriately converts character encoding of domain name before sending a request to DNS server or displaying a reply from the server\&. If you\*(Aqd like to turn off the IDN support for some reason, define the
 \fBIDN_DISABLE\fR
 environment variable\&. The IDN support is disabled if the variable is set when
 \fBnslookup\fR
 runs or when the standard output is not a tty\&.
 .SH "FILES"
 .PP
 /etc/resolv\&.conf
@@ -301,5 +290,5 @@ runs or when the standard output is not a tty\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -9,8 +9,8 @@
 * information regarding copyright ownership.
 */
-#include <inttypes.h>
+#include <config.h>
-#include <stdbool.h>
+
 #include <stdlib.h>
 #include <unistd.h>
@@ -53,18 +53,18 @@
 #endif
 #endif
-static bool short_form = true,
+static isc_boolean_t short_form = ISC_TRUE,
-	tcpmode = false, tcpmode_set = false,
+	tcpmode = ISC_FALSE, tcpmode_set = ISC_FALSE,
-	identify = false, stats = true,
+	identify = ISC_FALSE, stats = ISC_TRUE,
-	comments = true, section_question = true,
+	comments = ISC_TRUE, section_question = ISC_TRUE,
-	section_answer = true, section_authority = true,
+	section_answer = ISC_TRUE, section_authority = ISC_TRUE,
-	section_additional = true, recurse = true,
+	section_additional = ISC_TRUE, recurse = ISC_TRUE,
-	aaonly = false, nofail = true,
+	aaonly = ISC_FALSE, nofail = ISC_TRUE,
-	default_lookups = true, a_noanswer = false;
+	default_lookups = ISC_TRUE, a_noanswer = ISC_FALSE;
-static bool interactive;
+static isc_boolean_t interactive;
-static bool in_use = false;
+static isc_boolean_t in_use = ISC_FALSE;
 static char defclass[MXRD] = "IN";
 static char deftype[MXRD] = "A";
 static isc_event_t *global_event = NULL;
@@ -213,7 +213,7 @@ printrdata(dns_rdata_t *rdata) {
 	isc_result_t result;
 	isc_buffer_t *b = NULL;
 	unsigned int size = 1024;
-	bool done = false;
+	isc_boolean_t done = ISC_FALSE;
 	if (rdata->type < N_KNOWN_RRTYPES)
 		printf("%s", rtypetext[rdata->type]);
@@ -228,7 +228,7 @@ printrdata(dns_rdata_t *rdata) {
 		if (result == ISC_R_SUCCESS) {
 			printf("%.*s\n", (int)isc_buffer_usedlength(b),
 			       (char *)isc_buffer_base(b));
-			done = true;
+			done = ISC_TRUE;
 		} else if (result != ISC_R_NOSPACE)
 			check_result(result, "dns_rdata_totext");
 		isc_buffer_free(&b);
@@ -237,7 +237,7 @@ printrdata(dns_rdata_t *rdata) {
 }
 static isc_result_t
-printsection(dig_query_t *query, dns_message_t *msg, bool headers,
+printsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	     dns_section_t section) {
 	isc_result_t result, loopresult;
 	dns_name_t *name;
@@ -304,7 +304,7 @@ printsection(dig_query_t *query, dns_message_t *msg, bool headers,
 }
 static isc_result_t
-detailsection(dig_query_t *query, dns_message_t *msg, bool headers,
+detailsection(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers,
 	     dns_section_t section) {
 	isc_result_t result, loopresult;
 	dns_name_t *name;
@@ -429,7 +429,7 @@ chase_cnamechain(dns_message_t *msg, dns_name_t *qname) {
 }
 static isc_result_t
-printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
+printmessage(dig_query_t *query, dns_message_t *msg, isc_boolean_t headers) {
 	char servtext[ISC_SOCKADDR_FORMATSIZE];
 	/* I've we've gotten this far, we've reached a server. */
@@ -448,10 +448,10 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 	if (!short_form) {
 		puts("------------");
 		/*		detailheader(query, msg);*/
-		detailsection(query, msg, true, DNS_SECTION_QUESTION);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_QUESTION);
-		detailsection(query, msg, true, DNS_SECTION_ANSWER);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ANSWER);
-		detailsection(query, msg, true, DNS_SECTION_AUTHORITY);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_AUTHORITY);
-		detailsection(query, msg, true, DNS_SECTION_ADDITIONAL);
+		detailsection(query, msg, ISC_TRUE, DNS_SECTION_ADDITIONAL);
 		puts("------------");
 	}
@@ -479,12 +479,12 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		dns_name_copy(query->lookup->name, name, NULL);
 		chase_cnamechain(msg, name);
 		dns_name_format(name, namestr, sizeof(namestr));
-		lookup = clone_lookup(query->lookup, false);
+		lookup = clone_lookup(query->lookup, ISC_FALSE);
 		if (lookup != NULL) {
 			strlcpy(lookup->textname, namestr,
 				sizeof(lookup->textname));
 			lookup->rdtype = dns_rdatatype_aaaa;
-			lookup->rdtypeset = true;
+			lookup->rdtypeset = ISC_TRUE;
 			lookup->origin = NULL;
 			lookup->retries = tries;
 			ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -498,7 +498,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 		printsection(query, msg, headers, DNS_SECTION_ANSWER);
 	else {
 		if (default_lookups && query->lookup->rdtype == dns_rdatatype_a)
-			a_noanswer = true;
+			a_noanswer = ISC_TRUE;
 		else if (!default_lookups ||
 			 (query->lookup->rdtype == dns_rdatatype_aaaa &&
@@ -520,7 +520,7 @@ printmessage(dig_query_t *query, dns_message_t *msg, bool headers) {
 }
 static void
-show_settings(bool full, bool serv_only) {
+show_settings(isc_boolean_t full, isc_boolean_t serv_only) {
 	dig_server_t *srv;
 	isc_sockaddr_t sockaddr;
 	dig_searchlist_t *listent;
@@ -565,7 +565,7 @@ show_settings(bool full, bool serv_only) {
 	printf("\n");
 }
-static bool
+static isc_boolean_t
 testtype(char *typetext) {
 	isc_result_t result;
 	isc_textregion_t tr;
@@ -575,14 +575,14 @@ testtype(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdatatype_fromtext(&rdtype, &tr);
 	if (result == ISC_R_SUCCESS)
-		return (true);
+		return (ISC_TRUE);
 	else {
 		printf("unknown query type: %s\n", typetext);
-		return (false);
+		return (ISC_FALSE);
 	}
 }
-static bool
+static isc_boolean_t
 testclass(char *typetext) {
 	isc_result_t result;
 	isc_textregion_t tr;
@@ -592,24 +592,24 @@ testclass(char *typetext) {
 	tr.length = strlen(typetext);
 	result = dns_rdataclass_fromtext(&rdclass, &tr);
 	if (result == ISC_R_SUCCESS)
-		return (true);
+		return (ISC_TRUE);
 	else {
 		printf("unknown query class: %s\n", typetext);
-		return (false);
+		return (ISC_FALSE);
 	}
 }
 static void
 set_port(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, 65535, "port");
 	if (result == ISC_R_SUCCESS)
-		port = (uint16_t) n;
+		port = (isc_uint16_t) n;
 }
 static void
 set_timeout(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, UINT_MAX, "timeout");
 	if (result == ISC_R_SUCCESS)
 		timeout = n;
@@ -617,7 +617,7 @@ set_timeout(const char *value) {
 static void
 set_tries(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, INT_MAX, "tries");
 	if (result == ISC_R_SUCCESS)
 		tries = n;
@@ -625,7 +625,7 @@ set_tries(const char *value) {
 static void
 set_ndots(const char *value) {
-	uint32_t n;
+	isc_uint32_t n;
 	isc_result_t result = parse_uint(&n, value, 128, "ndots");
 	if (result == ISC_R_SUCCESS)
 		ndots = n;
@@ -644,7 +644,7 @@ setoption(char *opt) {
 	((l >= N) && (l < sizeof(A)) && (strncasecmp(opt, A, l) == 0))
 	if (CHECKOPT("all", 3)) {
-		show_settings(true, false);
+		show_settings(ISC_TRUE, ISC_FALSE);
 	} else if (strncasecmp(opt, "class=", 6) == 0) {
 		if (testclass(&opt[6]))
 			strlcpy(defclass, &opt[6], sizeof(defclass));
@@ -654,41 +654,41 @@ setoption(char *opt) {
 	} else if (strncasecmp(opt, "type=", 5) == 0) {
 		if (testtype(&opt[5])) {
 			strlcpy(deftype, &opt[5], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "ty=", 3) == 0) {
 		if (testtype(&opt[3])) {
 			strlcpy(deftype, &opt[3], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "querytype=", 10) == 0) {
 		if (testtype(&opt[10])) {
 			strlcpy(deftype, &opt[10], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "query=", 6) == 0) {
 		if (testtype(&opt[6])) {
 			strlcpy(deftype, &opt[6], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "qu=", 3) == 0) {
 		if (testtype(&opt[3])) {
 			strlcpy(deftype, &opt[3], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "q=", 2) == 0) {
 		if (testtype(&opt[2])) {
 			strlcpy(deftype, &opt[2], sizeof(deftype));
-			default_lookups = false;
+			default_lookups = ISC_FALSE;
 		}
 	} else if (strncasecmp(opt, "domain=", 7) == 0) {
 		strlcpy(domainopt, &opt[7], sizeof(domainopt));
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "do=", 3) == 0) {
 		strlcpy(domainopt, &opt[3], sizeof(domainopt));
 		set_search_domain(domainopt);
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (strncasecmp(opt, "port=", 5) == 0) {
 		set_port(&opt[5]);
 	} else if (strncasecmp(opt, "po=", 3) == 0) {
@@ -698,43 +698,43 @@ setoption(char *opt) {
 	} else if (strncasecmp(opt, "t=", 2) == 0) {
 		set_timeout(&opt[2]);
 	} else if (CHECKOPT("recurse", 3)) {
-		recurse = true;
+		recurse = ISC_TRUE;
 	} else if (CHECKOPT("norecurse", 5)) {
-		recurse = false;
+		recurse = ISC_FALSE;
 	} else if (strncasecmp(opt, "retry=", 6) == 0) {
 		set_tries(&opt[6]);
 	} else if (strncasecmp(opt, "ret=", 4) == 0) {
 		set_tries(&opt[4]);
 	} else if (CHECKOPT("defname", 3)) {
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (CHECKOPT("nodefname", 5)) {
-		usesearch = false;
+		usesearch = ISC_FALSE;
 	} else if (CHECKOPT("vc", 2)) {
-		tcpmode = true;
+		tcpmode = ISC_TRUE;
-		tcpmode_set = true;
+		tcpmode_set = ISC_TRUE;
 	} else if (CHECKOPT("novc", 4)) {
-		tcpmode = false;
+		tcpmode = ISC_FALSE;
-		tcpmode_set = true;
+		tcpmode_set = ISC_TRUE;
 	} else if (CHECKOPT("debug", 3)) {
-		short_form = false;
+		short_form = ISC_FALSE;
-		showsearch = true;
+		showsearch = ISC_TRUE;
 	} else if (CHECKOPT("nodebug", 5)) {
-		short_form = true;
+		short_form = ISC_TRUE;
-		showsearch = false;
+		showsearch = ISC_FALSE;
 	} else if (CHECKOPT("d2", 2)) {
-		debugging = true;
+		debugging = ISC_TRUE;
 	} else if (CHECKOPT("nod2", 4)) {
-		debugging = false;
+		debugging = ISC_FALSE;
 	} else if (CHECKOPT("search", 3)) {
-		usesearch = true;
+		usesearch = ISC_TRUE;
 	} else if (CHECKOPT("nosearch", 5)) {
-		usesearch = false;
+		usesearch = ISC_FALSE;
 	} else if (CHECKOPT("sil", 3)) {
-		/* deprecation_msg = false; */
+		/* deprecation_msg = ISC_FALSE; */
 	} else if (CHECKOPT("fail", 3)) {
-		nofail=false;
+		nofail=ISC_FALSE;
 	} else if (CHECKOPT("nofail", 5)) {
-		nofail=true;
+		nofail=ISC_TRUE;
 	} else if (strncasecmp(opt, "ndots=", 6) == 0) {
 		set_ndots(&opt[6]);
 	} else {
@@ -753,7 +753,7 @@ addlookup(char *opt) {
 	debug("addlookup()");
-	a_noanswer = false;
+	a_noanswer = ISC_FALSE;
 	tr.base = deftype;
 	tr.length = strlen(deftype);
@@ -770,21 +770,21 @@ addlookup(char *opt) {
 		rdclass = dns_rdataclass_in;
 	}
 	lookup = make_empty_lookup();
-	if (get_reverse(store, sizeof(store), opt, true)
+	if (get_reverse(store, sizeof(store), opt, lookup->ip6_int, ISC_TRUE)
 	    == ISC_R_SUCCESS) {
 		strlcpy(lookup->textname, store, sizeof(lookup->textname));
 		lookup->rdtype = dns_rdatatype_ptr;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 	} else {
 		strlcpy(lookup->textname, opt, sizeof(lookup->textname));
 		lookup->rdtype = rdtype;
-		lookup->rdtypeset = true;
+		lookup->rdtypeset = ISC_TRUE;
 	}
 	lookup->rdclass = rdclass;
-	lookup->rdclassset = true;
+	lookup->rdclassset = ISC_TRUE;
-	lookup->trace = false;
+	lookup->trace = ISC_FALSE;
 	lookup->trace_root = lookup->trace;
-	lookup->ns_search_only = false;
+	lookup->ns_search_only = ISC_FALSE;
 	lookup->identify = identify;
 	lookup->recurse = recurse;
 	lookup->aaonly = aaonly;
@@ -792,7 +792,7 @@ addlookup(char *opt) {
 	lookup->udpsize = 0;
 	lookup->comments = comments;
 	if (lookup->rdtype == dns_rdatatype_any && !tcpmode_set)
-		lookup->tcp_mode = true;
+		lookup->tcp_mode = ISC_TRUE;
 	else
 		lookup->tcp_mode = tcpmode;
 	lookup->stats = stats;
@@ -800,9 +800,9 @@ addlookup(char *opt) {
 	lookup->section_answer = section_answer;
 	lookup->section_authority = section_authority;
 	lookup->section_additional = section_additional;
-	lookup->new_search = true;
+	lookup->new_search = ISC_TRUE;
 	if (nofail)
-		lookup->servfail_stops = false;
+		lookup->servfail_stops = ISC_FALSE;
 	ISC_LIST_INIT(lookup->q);
 	ISC_LINK_INIT(lookup, link);
 	ISC_LIST_APPEND(lookup_list, lookup, link);
@@ -826,11 +826,11 @@ do_next_command(char *input) {
 		 (strcasecmp(ptr, "lserver") == 0)) {
 		isc_app_block();
 		set_nameserver(arg);
-		check_ra = false;
+		check_ra = ISC_FALSE;
 		isc_app_unblock();
-		show_settings(true, true);
+		show_settings(ISC_TRUE, ISC_TRUE);
 	} else if (strcasecmp(ptr, "exit") == 0) {
-		in_use = false;
+		in_use = ISC_FALSE;
 	} else if (strcasecmp(ptr, "help") == 0 ||
 		   strcasecmp(ptr, "?") == 0) {
 		printf("The '%s' command is not yet implemented.\n", ptr);
@@ -867,7 +867,7 @@ get_next_command(void) {
 		ptr = fgets(buf, COMMSIZE, stdin);
 	isc_app_unblock();
 	if (ptr == NULL) {
-		in_use = false;
+		in_use = ISC_FALSE;
 	} else
 		do_next_command(ptr);
 #ifdef HAVE_READLINE
@@ -877,29 +877,12 @@ get_next_command(void) {
 	isc_mem_free(mctx, buf);
 }
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(void) {
    fprintf(stderr, "Usage:\n");
    fprintf(stderr,
 "   nslookup [-opt ...]             # interactive mode using default server\n");
    fprintf(stderr,
 "   nslookup [-opt ...] - server    # interactive mode using 'server'\n");
    fprintf(stderr,
 "   nslookup [-opt ...] host        # just look up 'host' using default server\n");
    fprintf(stderr,
 "   nslookup [-opt ...] host server # just look up 'host' using 'server'\n");
    exit(1);
 }
 static void
 parse_args(int argc, char **argv) {
-	bool have_lookup = false;
+	isc_boolean_t have_lookup = ISC_FALSE;
-	usesearch = true;
+	usesearch = ISC_TRUE;
-	for (argc--, argv++; argc > 0 && argv[0] != NULL; argc--, argv++) {
+	for (argc--, argv++; argc > 0; argc--, argv++) {
 		debug("main parsing %s", argv[0]);
 		if (argv[0][0] == '-') {
 			if (strncasecmp(argv[0], "-ver", 4) == 0) {
@@ -908,18 +891,15 @@ parse_args(int argc, char **argv) {
 			} else if (argv[0][1] != 0) {
 				setoption(&argv[0][1]);
 			} else
-				have_lookup = true;
+				have_lookup = ISC_TRUE;
 		} else {
 			if (!have_lookup) {
-				have_lookup = true;
+				have_lookup = ISC_TRUE;
-				in_use = true;
+				in_use = ISC_TRUE;
 				addlookup(argv[0]);
 			} else {
 				if (argv[1] != NULL) {
 					usage();
 				}
 				set_nameserver(argv[0]);
-				check_ra = false;
+				check_ra = ISC_FALSE;
 			}
 		}
 	}
@@ -941,6 +921,12 @@ flush_lookup_list(void) {
 						  ISC_SOCKCANCEL_ALL);
 				isc_socket_detach(&q->sock);
 			}
 			if (ISC_LINK_LINKED(&q->recvbuf, link))
 				ISC_LIST_DEQUEUE(q->recvlist, &q->recvbuf,
 						 link);
 			if (ISC_LINK_LINKED(&q->lengthbuf, link))
 				ISC_LIST_DEQUEUE(q->lengthlist, &q->lengthbuf,
 						 link);
 			isc_buffer_invalidate(&q->recvbuf);
 			isc_buffer_invalidate(&q->lengthbuf);
 			qp = q;
@@ -984,13 +970,13 @@ int
 main(int argc, char **argv) {
 	isc_result_t result;
-	interactive = isatty(0);
+	interactive = ISC_TF(isatty(0));
 	ISC_LIST_INIT(lookup_list);
 	ISC_LIST_INIT(server_list);
 	ISC_LIST_INIT(search_list);
-	check_ra = true;
+	check_ra = ISC_TRUE;
 	/* setup dighost callbacks */
 	dighost_printmessage = printmessage;
@@ -1004,7 +990,7 @@ main(int argc, char **argv) {
 	setup_libs();
 	progname = argv[0];
-	setup_system(false, false);
+	setup_system(ISC_FALSE, ISC_FALSE);
 	parse_args(argc, argv);
 	if (keyfile[0] != 0)
 		setup_file_key();
@@ -1018,7 +1004,7 @@ main(int argc, char **argv) {
 	else
 		result = isc_app_onrun(mctx, global_task, getinput, NULL);
 	check_result(result, "isc_app_onrun");
-	in_use = !in_use;
+	in_use = ISC_TF(!in_use);
 	(void)isc_app_run();
@@ -71,7 +71,6 @@
      <year>2016</year>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -479,22 +478,6 @@ nslookup -query=hinfo  -timeout=10
    </para>
  </refsection>
  <refsection><info><title>IDN SUPPORT</title></info>
    <para>
      If <command>nslookup</command> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
      <command>nslookup</command> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
      If you'd like to turn off the IDN support for some reason, define
      the <envar>IDN_DISABLE</envar> environment variable.
      The IDN support is disabled if the variable is set when
      <command>nslookup</command> runs or when the standard output is not
      a tty.
    </para>
  </refsection>
  <refsection><info><title>FILES</title></info>
    <para><filename>/etc/resolv.conf</filename>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2004-2007, 2010, 2013-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2004-2007, 2010, 2013-2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -362,31 +362,14 @@ nslookup -query=hinfo  -timeout=10
  </div>
  <div class="refsection">
-<a name="id-1.11"></a><h2>IDN SUPPORT</h2>
+<a name="id-1.11"></a><h2>FILES</h2>
    <p>
      If <span class="command"><strong>nslookup</strong></span> has been built with IDN (internationalized
      domain name) support, it can accept and display non-ASCII domain names.
      <span class="command"><strong>nslookup</strong></span> appropriately converts character encoding of
      domain name before sending a request to DNS server or displaying a
      reply from the server.
      If you'd like to turn off the IDN support for some reason, define
      the <code class="envar">IDN_DISABLE</code> environment variable.
      The IDN support is disabled if the variable is set when
      <span class="command"><strong>nslookup</strong></span> runs or when the standard output is not
      a tty.
    </p>
  </div>
  <div class="refsection">
 <a name="id-1.12"></a><h2>FILES</h2>
    <p><code class="filename">/etc/resolv.conf</code>
    </p>
  </div>
  <div class="refsection">
-<a name="id-1.13"></a><h2>SEE ALSO</h2>
+<a name="id-1.12"></a><h2>SEE ALSO</h2>
    <p><span class="citerefentry">
        <span class="refentrytitle">dig</span>(1)
@@ -53,14 +53,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -69,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -80,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -88,7 +87,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -100,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;@IDN_LIB@ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -53,14 +53,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -78,7 +77,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -86,7 +85,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\include;..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -53,14 +53,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -69,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -80,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -88,7 +87,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@IDN_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -100,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>$(Configuration);..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>dighost.lib;@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -53,14 +53,13 @@
      </PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <PrecompiledHeaderOutputFile>.\$(Configuration)\$(TargetName).pch</PrecompiledHeaderOutputFile>
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <BrowseInformation>true</BrowseInformation>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -69,7 +68,7 @@
      <GenerateDebugInformation>true</GenerateDebugInformation>
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIBD@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|@PLATFORM@'">
@@ -80,7 +79,7 @@
      <Optimization>MaxSpeed</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
      <IntrinsicFunctions>@INTRINSIC@</IntrinsicFunctions>
-      <PreprocessorDefinitions>WIN32;USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;@CRYPTO@USE_READLINE_STATIC;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <InlineFunctionExpansion>OnlyExplicitInline</InlineFunctionExpansion>
      <WholeProgramOptimization>false</WholeProgramOptimization>
      <StringPooling>true</StringPooling>
@@ -88,7 +87,6 @@
      <AssemblerListingLocation>.\$(Configuration)\</AssemblerListingLocation>
      <ObjectFileName>.\$(Configuration)\</ObjectFileName>
      <ProgramDataBaseFileName>$(OutDir)$(TargetName).pdb</ProgramDataBaseFileName>
      <ForcedIncludeFiles>..\..\..\config.h</ForcedIncludeFiles>
      <AdditionalIncludeDirectories>.\;..\include;..\..\..\;@LIBXML2_INC@@OPENSSL_INC@@READLINE_INC@..\..\..\lib\isc\win32;..\..\..\lib\isc\win32\include;..\..\..\lib\isc\include;..\..\..\lib\isccfg\include;..\..\..\lib\irs\include;..\..\..\lib\irs\win32\include;..\..\..\lib\dns\include;..\..\..\lib\bind9\include;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
      <CompileAs>CompileAsC</CompileAs>
    </ClCompile>
@@ -100,7 +98,7 @@
      <OutputFile>..\..\..\Build\$(Configuration)\$(TargetName)$(TargetExt)</OutputFile>
      <LinkTimeCodeGeneration>Default</LinkTimeCodeGeneration>
      <AdditionalLibraryDirectories>..\..\..\lib\isc\win32\$(Configuration);..\..\..\lib\isccfg\win32\$(Configuration);..\..\..\lib\irs\win32\$(Configuration);..\..\..\lib\dns\win32\$(Configuration);..\..\..\lib\bind9\win32\$(Configuration);%(AdditionalLibraryDirectories)</AdditionalLibraryDirectories>
-      <AdditionalDependencies>@OPENSSL_LIB@@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <AdditionalDependencies>@READLINE_LIB@@IDN_LIB@libisc.lib;libisccfg.lib;libirs.lib;libdns.lib;libbind9.lib;ws2_32.lib;%(AdditionalDependencies)</AdditionalDependencies>
    </Link>
  </ItemDefinitionGroup>
  <ItemGroup>
@@ -1,3 +1,3 @@
-<?xml version="1.0" encoding="utf-8"?>
+<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
 </Project>
@@ -15,14 +15,15 @@ VERSION=@BIND9_VERSION@
@BIND9_MAKE_INCLUDES@
-CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @OPENSSL_INCLUDES@
+CINCLUDES =	${DNS_INCLUDES} ${ISC_INCLUDES} @DST_OPENSSL_INC@
-CDEFINES =	-DVERSION=\"${VERSION}\"
+CDEFINES =	-DVERSION=\"${VERSION}\" @USE_PKCS11@ @PKCS11_ENGINE@ \
 		-DPK11_LIB_LOCATION=\"@PKCS11_PROVIDER@\"
 CWARNINGS =
 DNSLIBS =	../../lib/dns/libdns.@A@ @DNS_CRYPTO_LIBS@
-ISCLIBS =	../../lib/isc/libisc.@A@ @OPENSSL_LIBS@
+ISCLIBS =	../../lib/isc/libisc.@A@ @ISC_OPENSSL_LIBS@
-ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @OPENSSL_LIBS@
+ISCNOSYMLIBS =	../../lib/isc/libisc-nosymtbl.@A@ @ISC_OPENSSL_LIBS@
 DNSDEPLIBS =	../../lib/dns/libdns.@A@
 ISCDEPLIBS =	../../lib/isc/libisc.@A@
@@ -115,12 +116,12 @@ installdirs:
 	$(SHELL) ${top_srcdir}/mkinstalldirs ${DESTDIR}${mandir}/man8
 install:: ${TARGETS} installdirs
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir} || exit 1; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_INSTALL} ${INSTALL_PROGRAM} $$t ${DESTDIR}${sbindir}; done
-	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8 || exit 1; done
+	for m in ${MANPAGES}; do ${INSTALL_DATA} ${srcdir}/$$m ${DESTDIR}${mandir}/man8; done
 uninstall::
-	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m || exit 1; done
+	for m in ${MANPAGES}; do rm -f ${DESTDIR}${mandir}/man8/$$m ; done
-	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t || exit 1; done
+	for t in ${TARGETS}; do ${LIBTOOL_MODE_UNINSTALL} rm -f ${DESTDIR}${sbindir}/$$t ; done
 clean distclean::
 	rm -f ${TARGETS}
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -102,7 +102,7 @@ Specify a digest algorithm to use when converting CDNSKEY records to DS records\
 .sp
 The
 \fIalgorithm\fR
-must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&.
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST, or SHA\-384 (SHA384)\&. These values are case insensitive\&. If no algorithm is specified, the default is SHA\-256\&.
 .RE
 .PP
 \-c \fIclass\fR
@@ -293,5 +293,5 @@ RFC 7344\&.
 .RE
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -16,9 +16,9 @@
 /*! \file */
 #include <config.h>
 #include <errno.h>
 #include <inttypes.h>
 #include <stdbool.h>
 #include <stdlib.h>
 #include <isc/buffer.h>
@@ -53,13 +53,18 @@
 #include <dst/dst.h>
-#if USE_PKCS11
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif
 #include "dnssectool.h"
 #ifndef PATH_MAX
 #define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 const char *program = "dnssec-cds";
 int verbose;
 /*
 * Infrastructure
@@ -75,6 +80,12 @@ static dns_fixedname_t fixed;
 static dns_name_t *name = NULL;
 static dns_rdataclass_t rdclass = dns_rdataclass_in;
 /*
 * List of digest types used by ds_from_cdnskey(), filled in by add_dtype()
 * from -a arguments. The size of the array is an arbitrary limit.
 */
 static isc_uint8_t dtype[8];
 static const char *startstr  = NULL;	/* from which we derive notbefore */
 static isc_stdtime_t notbefore = 0;	/* restrict sig inception times */
 static dns_rdata_rrsig_t oldestsig;	/* for recording inception time */
@@ -116,7 +127,7 @@ static int nkey; /* number of child zone DNSKEY records */
 typedef struct keyinfo {
 	dns_rdata_t rdata;
 	dst_key_t *dst;
-	dns_secalg_t algo;
+	isc_uint8_t algo;
 	dns_keytag_t tag;
 } keyinfo_t;
@@ -150,8 +161,8 @@ verbose_time(int level, const char *msg, isc_stdtime_t time) {
 	if (verbose < 3) {
 		vbprintf(level, "%s %s\n", msg, timestr);
 	} else {
-		vbprintf(level, "%s %s (%" PRIu32 ")\n",
+		vbprintf(level, "%s %s (%lld)\n",
-			 msg, timestr, time);
+			 msg, timestr, (long long)time);
 	}
 }
@@ -247,7 +258,7 @@ load_db(const char *filename, dns_db_t **dbp, dns_dbnode_t **nodep) {
 		      isc_result_totext(result));
 	}
-	result = dns_db_findnode(*dbp, name, false, nodep);
+	result = dns_db_findnode(*dbp, name, ISC_FALSE, nodep);
 	if (result != ISC_R_SUCCESS) {
 		fatal("can't find %s node in %s", namestr, filename);
 	}
@@ -301,7 +312,7 @@ get_dsset_name(char *filename, size_t size,
 		}
 		isc_buffer_putstr(&buf, prefix);
-		result = dns_name_tofilenametext(name, false, &buf);
+		result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
 		check_result(result, "dns_name_tofilenametext()");
 		if (isc_buffer_availablelength(&buf) == 0) {
 			fatal("%s: pathname too long", path);
@@ -389,7 +400,7 @@ formatset(dns_rdataset_t *rdataset) {
 static void
 write_parent_set(const char *path, const char *inplace,
-		 bool nsupdate, dns_rdataset_t *rdataset)
+		 isc_boolean_t nsupdate, dns_rdataset_t *rdataset)
 {
 	isc_result_t result;
 	isc_buffer_t *buf = NULL;
@@ -456,7 +467,7 @@ typedef enum { LOOSE, TIGHT } strictness_t;
 /*
 * Find out if any (C)DS record matches a particular (C)DNSKEY.
 */
-static bool
+static isc_boolean_t
 match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 {
 	isc_result_t result;
@@ -469,7 +480,8 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		dns_rdata_ds_t ds;
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_t newdsrdata = DNS_RDATA_INIT;
-		bool c;
+		dns_rdatatype_t keytype;
 		isc_boolean_t c;
 		dns_rdataset_current(dsset, &dsrdata);
 		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
@@ -479,8 +491,12 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 			continue;
 		}
 		/* allow for both DNSKEY and CDNSKEY */
 		keytype = ki->rdata.type;
 		ki->rdata.type = dns_rdatatype_dnskey;
 		result = dns_ds_buildrdata(name, &ki->rdata, ds.digest_type,
 					   dsbuf, &newdsrdata);
 		ki->rdata.type = keytype;
 		if (result != ISC_R_SUCCESS) {
 			vbprintf(3, "dns_ds_buildrdata("
 				 "keytag=%d, algo=%d, digest=%d): %s\n",
@@ -495,13 +511,13 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 			vbprintf(1, "found matching %s %d %d %d\n",
 				 c ? "CDS" : "DS",
 				 ds.key_tag, ds.algorithm, ds.digest_type);
-			return (true);
+			return (ISC_TRUE);
 		} else if (strictness == TIGHT) {
 			vbprintf(0, "key does not match %s %d %d %d "
 				"when it looks like it should\n",
 				 c ? "CDS" : "DS",
 				 ds.key_tag, ds.algorithm, ds.digest_type);
-			return (false);
+			return (ISC_FALSE);
 		}
 	}
@@ -512,7 +528,7 @@ match_key_dsset(keyinfo_t *ki, dns_rdataset_t *dsset, strictness_t strictness)
 		 ? "CDNSKEY" : "DNSKEY",
 		 ki->tag, ki->algo);
-	return (false);
+	return (ISC_FALSE);
 }
 /*
@@ -555,7 +571,7 @@ match_keyset_dsset(dns_rdataset_t *keyset, dns_rdataset_t *dsset,
 		ki->algo = dnskey.algorithm;
 		dns_rdata_toregion(keyrdata, &r);
-		ki->tag = dst_region_computeid(&r);
+		ki->tag = dst_region_computeid(&r, ki->algo);
 		ki->dst = NULL;
 		if (!match_key_dsset(ki, dsset, strictness)) {
@@ -601,12 +617,12 @@ free_keytable(keyinfo_t **keytable_p) {
 * otherwise the key algorithm. This is used by the signature coverage
 * check functions below.
 */
-static dns_secalg_t *
+static isc_uint8_t *
 matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 	      dns_rdataset_t *sigset)
 {
 	isc_result_t result;
-	dns_secalg_t *algo;
+	isc_uint8_t *algo;
 	int i;
 	algo = isc_mem_get(mctx, nkey);
@@ -652,7 +668,7 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 			}
 			result = dns_dnssec_verify(name, rdataset, ki->dst,
-						   false, 0, mctx,
+						   ISC_FALSE, 0, mctx,
 						   &sigrdata, NULL);
 			if (result != ISC_R_SUCCESS &&
@@ -688,13 +704,13 @@ matching_sigs(keyinfo_t *keytbl, dns_rdataset_t *rdataset,
 * Consume the result of matching_sigs(). When checking records
 * fetched from the child zone, any working signature is enough.
 */
-static bool
+static isc_boolean_t
-signed_loose(dns_secalg_t *algo) {
+signed_loose(isc_uint8_t *algo) {
-	bool ok = false;
+	isc_boolean_t ok = ISC_FALSE;
 	int i;
 	for (i = 0; i < nkey; i++) {
 		if (algo[i] != 0) {
-			ok = true;
+			ok = ISC_TRUE;
 		}
 	}
 	isc_mem_put(mctx, algo, nkey);
@@ -707,10 +723,10 @@ signed_loose(dns_secalg_t *algo) {
 * key algorithm in the DS RRset must have a signature in the DNSKEY
 * RRset.
 */
-static bool
+static isc_boolean_t
-signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
+signed_strict(dns_rdataset_t *dsset, isc_uint8_t *algo) {
 	isc_result_t result;
-	bool all_ok = true;
+	isc_boolean_t all_ok = ISC_TRUE;
 	for (result = dns_rdataset_first(dsset);
 	     result == ISC_R_SUCCESS;
@@ -718,23 +734,23 @@ signed_strict(dns_rdataset_t *dsset, dns_secalg_t *algo) {
 	{
 		dns_rdata_t dsrdata = DNS_RDATA_INIT;
 		dns_rdata_ds_t ds;
-		bool ds_ok;
+		isc_boolean_t ds_ok;
 		int i;
 		dns_rdataset_current(dsset, &dsrdata);
 		result = dns_rdata_tostruct(&dsrdata, &ds, NULL);
 		check_result(result, "dns_rdata_tostruct(DS)");
-		ds_ok = false;
+		ds_ok = ISC_FALSE;
 		for (i = 0; i < nkey; i++) {
 			if (algo[i] == ds.algorithm) {
-				ds_ok = true;
+				ds_ok = ISC_TRUE;
 			}
 		}
 		if (!ds_ok) {
 			vbprintf(0, "missing signature for algorithm %d "
 				 "(key %d)\n", ds.algorithm, ds.key_tag);
-			all_ok = false;
+			all_ok = ISC_FALSE;
 		}
 	}
@@ -808,6 +824,7 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 				return (ISC_R_NOSPACE);
 			}
 			cdnskey->type = dns_rdatatype_dnskey;
 			rdata = rdata_get();
 			result = dns_ds_buildrdata(name, cdnskey, dtype[i],
 						   r.base, rdata);
@@ -825,9 +842,37 @@ ds_from_cdnskey(dns_rdatalist_t *dslist, isc_buffer_t *buf,
 	return (ISC_R_SUCCESS);
 }
 /*
 * For sorting the digest types so that DS records generated
 * from CDNSKEY records are in canonical order.
 */
 static int
 cmp_dtype(const void *ap, const void *bp) {
 	int a = *(const isc_uint8_t *)ap;
 	int b = *(const isc_uint8_t *)bp;
 	return (a - b);
 }
 static void
 add_dtype(const char *dn) {
 	isc_uint8_t dt;
 	unsigned i, n;
 	dt = strtodsdigest(dn);
 	n = sizeof(dtype)/sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
 		if (dtype[i] == 0 || dtype[i] == dt) {
 			dtype[i] = dt;
 			qsort(dtype, i+1, 1, cmp_dtype);
 			return;
 		}
 	}
 	fatal("too many -a digest type arguments");
 }
 static void
 make_new_ds_set(ds_maker_func_t *ds_from_rdata,
-		uint32_t ttl, dns_rdataset_t *rdset)
+		isc_uint32_t ttl, dns_rdataset_t *rdset)
 {
 	unsigned int size = 16;
 	for (;;) {
@@ -889,14 +934,14 @@ rdata_cmp(const void *rdata1, const void *rdata2) {
 * Ensure that every key identified by the DS RRset has the same set of
 * digest types.
 */
-static bool
+static isc_boolean_t
 consistent_digests(dns_rdataset_t *dsset) {
 	isc_result_t result;
 	dns_rdata_t *arrdata;
 	dns_rdata_ds_t *ds;
 	dns_keytag_t key_tag;
-	dns_secalg_t algorithm;
+	isc_uint8_t algorithm;
-	bool match;
+	isc_boolean_t match;
 	int i, j, n, d;
 	/*
@@ -950,7 +995,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 	/*
 	 * Check subsequent keys match the first one
 	 */
-	match = true;
+	match = ISC_TRUE;
 	while (i < n) {
 		key_tag = ds[i].key_tag;
 		algorithm = ds[i].algorithm;
@@ -959,7 +1004,7 @@ consistent_digests(dns_rdataset_t *dsset) {
 			    ds[i+j].algorithm != algorithm ||
 			    ds[i+j].digest_type != ds[j].digest_type)
 			{
-				match = false;
+				match = ISC_FALSE;
 			}
 		}
 		i += d;
@@ -994,7 +1039,7 @@ print_diff(const char *cmd, dns_rdataset_t *rdataset) {
 }
 static void
-update_diff(const char *cmd, uint32_t ttl,
+update_diff(const char *cmd, isc_uint32_t ttl,
 	    dns_rdataset_t *addset, dns_rdataset_t *delset)
 {
 	isc_result_t result;
@@ -1002,7 +1047,7 @@ update_diff(const char *cmd, uint32_t ttl,
 	dns_dbnode_t *node;
 	dns_dbversion_t *ver;
 	dns_rdataset_t diffset;
-	uint32_t save;
+	isc_uint32_t save;
 	db = NULL;
 	result = dns_db_create(mctx, "rbt", name, dns_dbtype_zone,
@@ -1014,7 +1059,7 @@ update_diff(const char *cmd, uint32_t ttl,
 	check_result(result, "dns_db_newversion()");
 	node = NULL;
-	result = dns_db_findnode(db, name, true, &node);
+	result = dns_db_findnode(db, name, ISC_TRUE, &node);
 	check_result(result, "dns_db_findnode()");
 	dns_rdataset_init(&diffset);
@@ -1038,12 +1083,12 @@ update_diff(const char *cmd, uint32_t ttl,
 	}
 	dns_db_detachnode(db, &node);
-	dns_db_closeversion(db, &ver, false);
+	dns_db_closeversion(db, &ver, ISC_FALSE);
 	dns_db_detach(&db);
 }
 static void
-nsdiff(uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
+nsdiff(isc_uint32_t ttl, dns_rdataset_t *oldset, dns_rdataset_t *newset) {
 	if (ttl == 0) {
 		vbprintf(1, "warning: no TTL in nsupdate script\n");
 	}
@@ -1070,7 +1115,7 @@ usage(void) {
 		program);
 	fprintf(stderr, "Version: %s\n", VERSION);
 	fprintf(stderr, "Options:\n"
-"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / SHA-384)\n"
+"    -a <algorithm>     digest algorithm (SHA-1 / SHA-256 / GOST / SHA-384)\n"
 "    -c <class>         of domain (default IN)\n"
 "    -D                 prefer CDNSKEY records instead of CDS\n"
 "    -d <file|dir>      where to find parent dsset- file\n"
@@ -1091,9 +1136,9 @@ main(int argc, char *argv[]) {
 	const char *ds_path = NULL;
 	const char *inplace = NULL;
 	isc_result_t result;
-	bool prefer_cdnskey = false;
+	isc_boolean_t prefer_cdnskey = ISC_FALSE;
-	bool nsupdate = false;
+	isc_boolean_t nsupdate = ISC_FALSE;
-	uint32_t ttl = 0;
+	isc_uint32_t ttl = 0;
 	int ch;
 	char *endp;
@@ -1102,24 +1147,24 @@ main(int argc, char *argv[]) {
 		fatal("out of memory");
 	}
-#if USE_PKCS11
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 #define OPTIONS "a:c:Dd:f:i:ms:T:uv:V"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case 'a':
-			add_dtype(strtodsdigest(isc_commandline_argument));
+			add_dtype(isc_commandline_argument);
 			break;
 		case 'c':
 			rdclass = strtoclass(isc_commandline_argument);
 			break;
 		case 'D':
-			prefer_cdnskey = true;
+			prefer_cdnskey = ISC_TRUE;
 			break;
 		case 'd':
 			ds_path = isc_commandline_argument;
@@ -1152,7 +1197,7 @@ main(int argc, char *argv[]) {
 			ttl = strtottl(isc_commandline_argument);
 			break;
 		case 'u':
-			nsupdate = true;
+			nsupdate = ISC_TRUE;
 			break;
 		case 'V':
 			/* Does not return. */
@@ -40,7 +40,6 @@
    <copyright>
      <year>2017</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -144,9 +143,9 @@
 	    record. This option has no effect when using CDS records.
          </para>
          <para>
-	    The <replaceable>algorithm</replaceable> must be one of
+	    The <replaceable>algorithm</replaceable> must be one of SHA-1
-	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
-	    and the hyphen may be omitted.  If no algorithm is specified,
+	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
          </para>
        </listitem>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2017-2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2017, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -129,9 +129,9 @@
 	    record. This option has no effect when using CDS records.
          </p>
          <p>
-	    The <em class="replaceable"><code>algorithm</code></em> must be one of
+	    The <em class="replaceable"><code>algorithm</code></em> must be one of SHA-1
-	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
+	    (SHA1), SHA-256 (SHA256), GOST, or SHA-384 (SHA384). These
-	    and the hyphen may be omitted.  If no algorithm is specified,
+	    values are case insensitive. If no algorithm is specified,
 	    the default is SHA-256.
          </p>
        </dd>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -10,12 +10,12 @@
 .\"     Title: dnssec-dsfromkey
 .\"    Author: 
 .\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
-.\"      Date: 2019-05-08
+.\"      Date: 2012-05-02
 .\"    Manual: BIND9
 .\"    Source: ISC
 .\"  Language: English
 .\"
-.TH "DNSSEC\-DSFROMKEY" "8" "2019\-05\-08" "ISC" "BIND9"
+.TH "DNSSEC\-DSFROMKEY" "8" "2012\-05\-02" "ISC" "BIND9"
 .\" -----------------------------------------------------------------
 .\" * Define some portability stuff
 .\" -----------------------------------------------------------------
@@ -39,103 +39,61 @@
 dnssec-dsfromkey \- DNSSEC DS RR generation tool
 .SH "SYNOPSIS"
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {keyfile}
+\fBdnssec\-dsfromkey\fR [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] {keyfile}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-A\fR] {\fB\-f\ \fR\fB\fIfile\fR\fR} [dnsname]
+\fBdnssec\-dsfromkey\fR {\-s} [\fB\-1\fR] [\fB\-2\fR] [\fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] [\fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-s\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-f\ \fR\fB\fIfile\fR\fR] [\fB\-A\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] {dnsname}
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
-\fBdnssec\-dsfromkey\fR [\fB\-1\fR | \fB\-2\fR | \fB\-a\ \fR\fB\fIalg\fR\fR] [\fB\-C\fR | \fB\-l\ \fR\fB\fIdomain\fR\fR] [\fB\-T\ \fR\fB\fITTL\fR\fR] [\fB\-v\ \fR\fB\fIlevel\fR\fR] [\fB\-c\ \fR\fB\fIclass\fR\fR] [\fB\-K\ \fR\fB\fIdirectory\fR\fR] {\-s} {dnsname}
+\fBdnssec\-dsfromkey\fR [\fB\-h\fR] [\fB\-V\fR]
 .HP \w'\fBdnssec\-dsfromkey\fR\ 'u
 \fBdnssec\-dsfromkey\fR [\fB\-h\fR | \fB\-V\fR]
 .SH "DESCRIPTION"
 .PP
 The
 \fBdnssec\-dsfromkey\fR
-command outputs DS (Delegation Signer) resource records (RRs) and other similarly\-constructed RRs: with the
+outputs the Delegation Signer (DS) resource record (RR), as defined in RFC 3658 and RFC 4509, for the given key(s)\&.
 \fB\-l\fR
 option it outputs DLV (DNSSEC Lookaside Validation) RRs; or with the
 \fB\-C\fR
 it outputs CDS (Child DS) RRs\&.
 .PP
 The input keys can be specified in a number of ways:
 .PP
 By default,
 \fBdnssec\-dsfromkey\fR
 reads a key file named like
 Knnnn\&.+aaa+iiiii\&.key, as generated by
 \fBdnssec\-keygen\fR\&.
 .PP
 With the
 \fB\-f \fR\fB\fIfile\fR\fR
 option,
 \fBdnssec\-dsfromkey\fR
 reads keys from a zone file or partial zone file (which can contain just the DNSKEY records)\&.
 .PP
 With the
 \fB\-s\fR
 option,
 \fBdnssec\-dsfromkey\fR
 reads a
 keyset\-
 file, as generated by
 \fBdnssec\-keygen\fR\fB\-C\fR\&.
 .SH "OPTIONS"
 .PP
 \-1
 .RS 4
-An abbreviation for
+Use SHA\-1 as the digest algorithm (the default is to use both SHA\-1 and SHA\-256)\&.
 \fB\-a SHA\-1\fR\&. (Note: The SHA\-1 algorithm is no longer recommended for use when generating new DS and CDS records\&.)
 .RE
 .PP
 \-2
 .RS 4
-An abbreviation for
+Use SHA\-256 as the digest algorithm\&.
 \fB\-a SHA\-256\fR\&.
 .RE
 .PP
 \-a \fIalgorithm\fR
 .RS 4
-Specify a digest algorithm to use when converting DNSKEY records to DS records\&. This option can be repeated, so that multiple DS records are created for each DNSKEY record\&.
+Select the digest algorithm\&. The value of
-.sp
+\fBalgorithm\fR
-The
+must be one of SHA\-1 (SHA1), SHA\-256 (SHA256), GOST or SHA\-384 (SHA384)\&. These values are case insensitive\&.
 \fIalgorithm\fR
 must be one of SHA\-1, SHA\-256, or SHA\-384\&. These values are case insensitive, and the hyphen may be omitted\&. If no algorithm is specified, the default is SHA\-256\&. (Note: The SHA\-1 algorithm is no longer recommended for use when generating new DS and CDS records\&.)
 .RE
 .PP
 \-A
 .RS 4
 Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in
 \fB\-f\fR
 zone file mode\&.
 .RE
 .PP
 \-c \fIclass\fR
 .RS 4
 Specifies the DNS class (default is IN)\&. Useful only in
 \fB\-s\fR
 keyset or
 \fB\-f\fR
 zone file mode\&.
 .RE
 .PP
 \-C
 .RS 4
-Generate CDS records rather than DS records\&. This is mutually exclusive with the
+Generate CDS records rather than DS records\&. This is mutually exclusive with generating lookaside records\&.
-\fB\-l\fR
+.RE
-option for generating DLV records\&.
+.PP
 \-T \fITTL\fR
 .RS 4
 Specifies the TTL of the DS records\&.
 .RE
 .PP
 \-K \fIdirectory\fR
 .RS 4
 Look for key files (or, in keyset mode,
 keyset\-
 files) in
 \fBdirectory\fR\&.
 .RE
 .PP
 \-f \fIfile\fR
 .RS 4
-Zone file mode:
+Zone file mode: in place of the keyfile name, the argument is the DNS domain name of a zone master file, which can be read from
 \fBdnssec\-dsfromkey\fR\*(Aqs final
 \fIdnsname\fR
 argument is the DNS domain name of a zone whose master file can be read from
 \fBfile\fR\&. If the zone name is the same as
 \fBfile\fR, then it may be omitted\&.
 .sp
 If
-\fIfile\fR
+\fBfile\fR
-is
+is set to
 "\-", then the zone data is read from the standard input\&. This makes it possible to use the output of the
 \fBdig\fR
 command as input, as in:
@@ -143,41 +101,26 @@ command as input, as in:
 \fBdig dnskey example\&.com | dnssec\-dsfromkey \-f \- example\&.com\fR
 .RE
 .PP
-\-h
+\-A
 .RS 4
-Prints usage information\&.
+Include ZSKs when generating DS records\&. Without this option, only keys which have the KSK flag set will be converted to DS records and printed\&. Useful only in zone file mode\&.
 .RE
 .PP
 \-K \fIdirectory\fR
 .RS 4
 Look for key files or
 keyset\-
 files in
 \fBdirectory\fR\&.
 .RE
 .PP
 \-l \fIdomain\fR
 .RS 4
 Generate a DLV set instead of a DS set\&. The specified
-\fIdomain\fR
+\fBdomain\fR
-is appended to the name for each record in the set\&. This is mutually exclusive with the
+is appended to the name for each record in the set\&. The DNSSEC Lookaside Validation (DLV) RR is described in RFC 4431\&. This is mutually exclusive with generating CDS records\&.
 \fB\-C\fR
 option for generating CDS records\&.
 .RE
 .PP
 \-s
 .RS 4
-Keyset mode:
+Keyset mode: in place of the keyfile name, the argument is the DNS domain name of a keyset file\&.
 \fBdnssec\-dsfromkey\fR\*(Aqs final
 \fIdnsname\fR
 argument is the DNS domain name used to locate a
 keyset\-
 file\&.
 .RE
 .PP
-\-T \fITTL\fR
+\-c \fIclass\fR
 .RS 4
-Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
+Specifies the DNS class (default is IN)\&. Useful only in keyset or zone file mode\&.
 .RE
 .PP
 \-v \fIlevel\fR
@@ -185,6 +128,11 @@ Specifies the TTL of the DS records\&. By default the TTL is omitted\&.
 Sets the debugging level\&.
 .RE
 .PP
 \-h
 .RS 4
 Prints usage information\&.
 .RE
 .PP
 \-V
 .RS 4
 Prints version information\&.
@@ -193,16 +141,16 @@ Prints version information\&.
 .PP
 To build the SHA\-256 DS RR from the
 \fBKexample\&.com\&.+003+26160\fR
-keyfile name, you can issue the following command:
+keyfile name, the following command would be issued:
 .PP
 \fBdnssec\-dsfromkey \-2 Kexample\&.com\&.+003+26160\fR
 .PP
 The command would print something like:
 .PP
-\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94\fR
+\fBexample\&.com\&. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94\fR
 .SH "FILES"
 .PP
-The keyfile can be designated by the key identification
+The keyfile can be designed by the key identification
 Knnnn\&.+aaa+iiiii
 or the full file name
 Knnnn\&.+aaa+iiiii\&.key
@@ -222,20 +170,13 @@ A keyfile error can give a "file not found" even if the file exists\&.
 \fBdnssec-keygen\fR(8),
 \fBdnssec-signzone\fR(8),
 BIND 9 Administrator Reference Manual,
-RFC 3658
+RFC 3658,
-(DS RRs),
+RFC 4431\&.
-RFC 4431
+RFC 4509\&.
 (DLV RRs),
 RFC 4509
 (SHA\-256 for DS RRs),
 RFC 6605
 (SHA\-384 for DS RRs),
 RFC 7344
 (CDS and CDNSKEY RRs)\&.
 .SH "AUTHOR"
 .PP
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -11,8 +11,8 @@
 /*! \file */
-#include <inttypes.h>
+#include <config.h>
-#include <stdbool.h>
+
 #include <stdlib.h>
 #include <isc/buffer.h>
@@ -41,20 +41,25 @@
 #include <dst/dst.h>
-#if USE_PKCS11
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif
 #include "dnssectool.h"
 #ifndef PATH_MAX
 #define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 const char *program = "dnssec-dsfromkey";
 int verbose;
 static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;
 static dns_name_t	*name = NULL;
 static isc_mem_t	*mctx = NULL;
-static uint32_t	ttl;
+static isc_uint32_t	ttl;
-static bool	emitttl = false;
+static isc_boolean_t	emitttl = ISC_FALSE;
 static isc_result_t
 initname(char *setname) {
@@ -113,7 +118,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 			      isc_result_totext(result));
 	}
-	result = dns_db_findnode(db, name, false, &node);
+	result = dns_db_findnode(db, name, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't find %s node in %s", setname, filename);
@@ -154,7 +159,7 @@ loadkeyset(char *dirname, dns_rdataset_t *rdataset) {
 		return (ISC_R_NOSPACE);
 	isc_buffer_putstr(&buf, "keyset-");
-	result = dns_name_tofilenametext(name, false, &buf);
+	result = dns_name_tofilenametext(name, ISC_FALSE, &buf);
 	check_result(result, "dns_name_tofilenametext()");
 	if (isc_buffer_availablelength(&buf) == 0)
 		return (ISC_R_NOSPACE);
@@ -228,8 +233,8 @@ logkey(dns_rdata_t *rdata)
 }
 static void
-emit(dns_dsdigest_t dt, bool showall, char *lookaside,
+emit(unsigned int dtype, isc_boolean_t showall, char *lookaside,
-     bool cds, dns_rdata_t *rdata)
+     isc_boolean_t cds, dns_rdata_t *rdata)
 {
 	isc_result_t result;
 	unsigned char buf[DNS_DS_BUFFERSIZE];
@@ -254,11 +259,11 @@ emit(dns_dsdigest_t dt, bool showall, char *lookaside,
 	if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0 && !showall)
 		return;
-	result = dns_ds_buildrdata(name, rdata, dt, buf, &ds);
+	result = dns_ds_buildrdata(name, rdata, dtype, buf, &ds);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't build record");
-	result = dns_name_totext(name, false, &nameb);
+	result = dns_name_totext(name, ISC_FALSE, &nameb);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't print name");
@@ -305,45 +310,36 @@ emit(dns_dsdigest_t dt, bool showall, char *lookaside,
 	printf("%.*s\n", (int)r.length, r.base);
 }
 static void
 emits(bool showall, char *lookaside, bool cds, dns_rdata_t *rdata) {
 	unsigned i, n;
 	n = sizeof(dtype)/sizeof(dtype[0]);
 	for (i = 0; i < n; i++) {
 		if (dtype[i] != 0) {
 			emit(dtype[i], showall, lookaside, cds, rdata);
 		}
 	}
 }
 ISC_PLATFORM_NORETURN_PRE static void
 usage(void) ISC_PLATFORM_NORETURN_POST;
 static void
 usage(void) {
 	fprintf(stderr, "Usage:\n");
-	fprintf(stderr,	"    %s [options] keyfile\n\n", program);
+	fprintf(stderr,	"    %s options [-K dir] keyfile\n\n", program);
-	fprintf(stderr, "    %s [options] -f zonefile [zonename]\n\n", program);
+	fprintf(stderr, "    %s options [-K dir] [-c class] -s dnsname\n\n",
-	fprintf(stderr, "    %s [options] -s dnsname\n\n", program);
+		program);
-	fprintf(stderr, "    %s [-h|-V]\n\n", program);
+	fprintf(stderr, "    %s options -f zonefile (as zone name)\n\n", program);
 	fprintf(stderr, "    %s options -f zonefile zonename\n\n", program);
 	fprintf(stderr, "Version: %s\n", VERSION);
-	fprintf(stderr, "Options:\n"
+	fprintf(stderr, "Options:\n");
-"    -1: digest algorithm SHA-1\n"
+	fprintf(stderr, "    -v <verbose level>\n");
-"    -2: digest algorithm SHA-256\n"
+	fprintf(stderr, "    -V: print version information\n");
-"    -a algorithm: digest algorithm (SHA-1, SHA-256 or SHA-384)\n"
+	fprintf(stderr, "    -K <directory>: directory in which to find "
-"    -A: include all keys in DS set, not just KSKs (-f only)\n"
+			"key file or keyset file\n");
-"    -c class: rdata class for DS set (default IN) (-f or -s only)\n"
+	fprintf(stderr, "    -a algorithm: digest algorithm "
-"    -C: print CDS records\n"
+			"(SHA-1, SHA-256, GOST or SHA-384)\n");
-"    -f zonefile: read keys from a zone file\n"
+	fprintf(stderr, "    -1: use SHA-1\n");
-"    -h: print help information\n"
+	fprintf(stderr, "    -2: use SHA-256\n");
-"    -K directory: where to find key or keyset files\n"
+	fprintf(stderr, "    -C: print CDS record\n");
-"    -l zone: print DLV records in the given lookaside zone\n"
+	fprintf(stderr, "    -l: add lookaside zone and print DLV records\n");
-"    -s: read keys from keyset-<dnsname> file\n"
+	fprintf(stderr, "    -s: read keyset from keyset-<dnsname> file\n");
-"    -T: TTL of output records (omitted by default)\n"
+	fprintf(stderr, "    -c class: rdata class for DS set (default: IN)\n");
-"    -v level: verbosity\n"
+	fprintf(stderr, "    -T TTL\n");
-"    -V: print version information\n");
+	fprintf(stderr, "    -f file: read keyset from zone file\n");
-	fprintf(stderr, "Output: DS, DLV, or CDS RRs\n");
+	fprintf(stderr, "    -A: when used with -f, "
 			"include all keys in DS set, not just KSKs\n");
 	fprintf(stderr, "Output: DS or DLV RRs\n");
 	exit (-1);
 }
@@ -355,9 +351,11 @@ main(int argc, char **argv) {
 	char		*lookaside = NULL;
 	char		*endp;
 	int		ch;
-	bool		cds = false;
+	unsigned int	dtype = DNS_DSDIGEST_SHA1;
-	bool		usekeyset = false;
+	isc_boolean_t	cds = ISC_FALSE;
-	bool		showall = false;
+	isc_boolean_t	both = ISC_TRUE;
 	isc_boolean_t	usekeyset = ISC_FALSE;
 	isc_boolean_t	showall = ISC_FALSE;
 	isc_result_t	result;
 	isc_log_t	*log = NULL;
 	dns_rdataset_t	rdataset;
@@ -365,42 +363,43 @@ main(int argc, char **argv) {
 	dns_rdata_init(&rdata);
-	if (argc == 1) {
+	if (argc == 1)
 		usage();
 	}
 	result = isc_mem_create(0, 0, &mctx);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
 	}
-#if USE_PKCS11
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 #define OPTIONS "12Aa:Cc:d:Ff:K:l:sT:v:hV"
 	while ((ch = isc_commandline_parse(argc, argv, OPTIONS)) != -1) {
 		switch (ch) {
 		case '1':
-			add_dtype(DNS_DSDIGEST_SHA1);
+			dtype = DNS_DSDIGEST_SHA1;
 			both = ISC_FALSE;
 			break;
 		case '2':
-			add_dtype(DNS_DSDIGEST_SHA256);
+			dtype = DNS_DSDIGEST_SHA256;
 			both = ISC_FALSE;
 			break;
 		case 'A':
-			showall = true;
+			showall = ISC_TRUE;
 			break;
 		case 'a':
-			add_dtype(strtodsdigest(isc_commandline_argument));
+			dtype = strtodsdigest(isc_commandline_argument);
 			both = ISC_FALSE;
 			break;
 		case 'C':
 			if (lookaside != NULL)
 				fatal("lookaside and CDS are mutually"
 				      " exclusive");
-			cds = true;
+			cds = ISC_TRUE;
 			break;
 		case 'c':
 			classname = isc_commandline_argument;
@@ -426,10 +425,10 @@ main(int argc, char **argv) {
 				fatal("lookaside must be a non-empty string");
 			break;
 		case 's':
-			usekeyset = true;
+			usekeyset = ISC_TRUE;
 			break;
 		case 'T':
-			emitttl = true;
+			emitttl = ISC_TRUE;
 			ttl = strtottl(isc_commandline_argument);
 			break;
 		case 'v':
@@ -462,32 +461,22 @@ main(int argc, char **argv) {
 	rdclass = strtoclass(classname);
-	if (usekeyset && filename != NULL) {
+	if (usekeyset && filename != NULL)
 		fatal("cannot use both -s and -f");
 	}
 	/* When not using -f, -A is implicit */
-	if (filename == NULL) {
+	if (filename == NULL)
-		showall = true;
+		showall = ISC_TRUE;
 	}
-	/* Default digest type if none specified. */
+	if (argc < isc_commandline_index + 1 && filename == NULL)
 	if (dtype[0] == 0) {
 		dtype[0] = DNS_DSDIGEST_SHA256;
 	}
 	if (argc < isc_commandline_index + 1 && filename == NULL) {
 		fatal("the key file name was not specified");
-	}
+	if (argc > isc_commandline_index + 1)
 	if (argc > isc_commandline_index + 1) {
 		fatal("extraneous arguments");
 	}
 	result = dst_lib_init(mctx, NULL);
-	if (result != ISC_R_SUCCESS) {
+	if (result != ISC_R_SUCCESS)
 		fatal("could not initialize dst: %s",
 		      isc_result_totext(result));
 	}
 	setup_logging(mctx, &log);
@@ -497,38 +486,38 @@ main(int argc, char **argv) {
 		if (argc < isc_commandline_index + 1 && filename != NULL) {
 			/* using zone name as the zone file name */
 			namestr = filename;
-		} else {
+		} else
 			namestr = argv[isc_commandline_index];
 		}
 		result = initname(namestr);
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not initialize name %s", namestr);
 		}
-		if (usekeyset) {
+		if (usekeyset)
 			result = loadkeyset(dir, &rdataset);
-		} else {
+		else
 			result = loadset(filename, &rdataset);
 		}
-		if (result != ISC_R_SUCCESS) {
+		if (result != ISC_R_SUCCESS)
 			fatal("could not load DNSKEY set: %s\n",
 			      isc_result_totext(result));
 		}
 		for (result = dns_rdataset_first(&rdataset);
 		     result == ISC_R_SUCCESS;
-		     result = dns_rdataset_next(&rdataset))
+		     result = dns_rdataset_next(&rdataset)) {
 		{
 			dns_rdata_init(&rdata);
 			dns_rdataset_current(&rdataset, &rdata);
-			if (verbose > 2) {
+			if (verbose > 2)
 				logkey(&rdata);
 			}
-			emits(showall, lookaside, cds, &rdata);
+			if (both) {
 				emit(DNS_DSDIGEST_SHA1, showall, lookaside,
 				     cds, &rdata);
 				emit(DNS_DSDIGEST_SHA256, showall, lookaside,
 				     cds, &rdata);
 			} else
 				emit(dtype, showall, lookaside, cds, &rdata);
 		}
 	} else {
 		unsigned char key_buf[DST_KEY_MAXSIZE];
@@ -536,25 +525,28 @@ main(int argc, char **argv) {
 		loadkey(argv[isc_commandline_index], key_buf,
 			DST_KEY_MAXSIZE, &rdata);
-		emits(showall, lookaside, cds, &rdata);
+		if (both) {
 			emit(DNS_DSDIGEST_SHA1, showall, lookaside, cds,
 			     &rdata);
 			emit(DNS_DSDIGEST_SHA256, showall, lookaside, cds,
 			     &rdata);
 		} else
 			emit(dtype, showall, lookaside, cds, &rdata);
 	}
-	if (dns_rdataset_isassociated(&rdataset)) {
+	if (dns_rdataset_isassociated(&rdataset))
 		dns_rdataset_disassociate(&rdataset);
 	}
 	cleanup_logging(&log);
 	dst_lib_destroy();
 	dns_name_destroy();
-	if (verbose > 10) {
+	if (verbose > 10)
 		isc_mem_stats(mctx, stdout);
 	}
 	isc_mem_destroy(&mctx);
 	fflush(stdout);
 	if (ferror(stdout)) {
 		fprintf(stderr, "write error\n");
 		return (1);
-	} else {
+	} else
 		return (0);
 	}
 }
@@ -12,7 +12,7 @@
 <!-- Converted by db4-upgrade version 1.0 -->
 <refentry xmlns:db="http://docbook.org/ns/docbook" version="5.0" xml:id="man.dnssec-dsfromkey">
  <info>
-    <date>2019-05-08</date>
+    <date>2012-05-02</date>
  </info>
  <refentryinfo>
    <corpname>ISC</corpname>
@@ -41,7 +41,6 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -49,110 +48,56 @@
  <refsynopsisdiv>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
      <group choice="opt">
 	<arg choice="plain"><option>-1</option></arg>
 	<arg choice="plain"><option>-2</option></arg>
 	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
      </group>
      <group>
 	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
 	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
-      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
+      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-C</option></arg>
      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
      <arg choice="req" rep="norepeat">keyfile</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
      <group choice="opt">
 	<arg choice="plain"><option>-1</option></arg>
 	<arg choice="plain"><option>-2</option></arg>
 	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
      </group>
      <group>
 	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
 	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
      <arg choice="req" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat">dnsname</arg>
    </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
      <group choice="opt">
 	<arg choice="plain"><option>-1</option></arg>
 	<arg choice="plain"><option>-2</option></arg>
 	<arg choice="plain"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
      </group>
      <group>
 	<arg choice="plain" rep="norepeat"><option>-C</option></arg>
 	<arg choice="plain" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
      </group>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="req" rep="norepeat">-s</arg>
      <arg choice="opt" rep="norepeat"><option>-1</option></arg>
      <arg choice="opt" rep="norepeat"><option>-2</option></arg>
      <arg choice="opt" rep="norepeat"><option>-a <replaceable class="parameter">alg</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-K <replaceable class="parameter">directory</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-l <replaceable class="parameter">domain</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-s</option></arg>
      <arg choice="opt" rep="norepeat"><option>-c <replaceable class="parameter">class</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-T <replaceable class="parameter">TTL</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-f <replaceable class="parameter">file</replaceable></option></arg>
      <arg choice="opt" rep="norepeat"><option>-A</option></arg>
      <arg choice="opt" rep="norepeat"><option>-v <replaceable class="parameter">level</replaceable></option></arg>
      <arg choice="req" rep="norepeat">dnsname</arg>
-    </cmdsynopsis>
+   </cmdsynopsis>
    <cmdsynopsis sepchar=" ">
      <command>dnssec-dsfromkey</command>
-      <group choice="opt">
+      <arg choice="opt" rep="norepeat"><option>-h</option></arg>
-	<arg choice="plain" rep="norepeat"><option>-h</option></arg>
+      <arg choice="opt" rep="norepeat"><option>-V</option></arg>
-	<arg choice="plain" rep="norepeat"><option>-V</option></arg>
+   </cmdsynopsis>
      </group>
    </cmdsynopsis>
  </refsynopsisdiv>
  <refsection><info><title>DESCRIPTION</title></info>
-    <para>
+    <para><command>dnssec-dsfromkey</command>
-      The <command>dnssec-dsfromkey</command> command outputs DS (Delegation
+      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      Signer) resource records (RRs) and other similarly-constructed RRs:
+      RFC 3658 and RFC 4509, for the given key(s).
      with the <option>-l</option> option it outputs DLV (DNSSEC Lookaside
      Validation) RRs; or with the <option>-C</option> it outputs CDS (Child
      DS) RRs.
    </para>
    <para>
      The input keys can be specified in a number of ways:
    </para>
    <para>
      By default, <command>dnssec-dsfromkey</command> reads a key file
      named like <filename>Knnnn.+aaa+iiiii.key</filename>, as generated
      by <command>dnssec-keygen</command>.
    </para>
    <para>
      With the <option>-f <replaceable>file</replaceable></option>
      option, <command>dnssec-dsfromkey</command> reads keys from a zone file
      or partial zone file (which can contain just the DNSKEY records).
    </para>
    <para>
      With the <option>-s</option>
      option, <command>dnssec-dsfromkey</command> reads
      a <filename>keyset-</filename> file, as generated
      by <command>dnssec-keygen</command> <option>-C</option>.
    </para>
  </refsection>
  <refsection><info><title>OPTIONS</title></info>
    <variablelist>
      <varlistentry>
 	<term>-1</term>
 	<listitem>
 	  <para>
-	    An abbreviation for <option>-a SHA-1</option>.
+	    Use SHA-1 as the digest algorithm (the default is to use
-	    (Note: The SHA-1 algorithm is no longer recommended for use
+	    both SHA-1 and SHA-256).
 	    when generating new DS and CDS records.)
 	  </para>
 	</listitem>
      </varlistentry>
@@ -161,7 +106,7 @@
 	<term>-2</term>
 	<listitem>
 	  <para>
-	    An abbreviation for <option>-a SHA-256</option>.
+	    Use SHA-256 as the digest algorithm.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -170,51 +115,40 @@
 	<term>-a <replaceable class="parameter">algorithm</replaceable></term>
 	<listitem>
 	  <para>
-	    Specify a digest algorithm to use when converting DNSKEY
+	    Select the digest algorithm. The value of
-	    records to DS records. This option can be repeated, so
+	    <option>algorithm</option> must be one of SHA-1 (SHA1),
-	    that multiple DS records are created for each DNSKEY
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-	    record.
+	    These values are case insensitive.
          </para>
          <para>
 	    The <replaceable>algorithm</replaceable> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
 	    (Note: The SHA-1 algorithm is no longer recommended for use
 	    when generating new DS and CDS records.)
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
        <term>-A</term>
        <listitem>
          <para>
            Include ZSKs when generating DS records. Without this option, only
            keys which have the KSK flag set will be converted to DS records
            and printed. Useful only in <option>-f</option> zone file mode.
          </para>
        </listitem>
      </varlistentry>
      <varlistentry>
 	<term>-c <replaceable class="parameter">class</replaceable></term>
 	<listitem>
 	  <para>
 	    Specifies the DNS class (default is IN). Useful only
 	    in <option>-s</option> keyset or <option>-f</option>
 	    zone file mode.
 	  </para>
 	  </listitem>
      </varlistentry>
      <varlistentry>
 	<term>-C</term>
 	<listitem>
 	  <para>
-	    Generate CDS records rather than DS records. This is mutually
+	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with the <option>-l</option> option for generating DLV
+	    exclusive with generating lookaside records.
-	    records.
+	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-T <replaceable class="parameter">TTL</replaceable></term>
 	<listitem>
 	  <para>
 	    Specifies the TTL of the DS records.
 	  </para>
 	  </listitem>
      </varlistentry>
      <varlistentry>
 	<term>-K <replaceable class="parameter">directory</replaceable></term>
 	<listitem>
 	  <para>
 	    Look for key files (or, in keyset mode,
 	    <filename>keyset-</filename> files) in
 	    <option>directory</option>.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -223,14 +157,13 @@
 	<term>-f <replaceable class="parameter">file</replaceable></term>
 	<listitem>
 	  <para>
-	    Zone file mode: <command>dnssec-dsfromkey</command>'s
+	    Zone file mode: in place of the keyfile name, the argument is
-	    final <replaceable>dnsname</replaceable> argument is
+	    the DNS domain name of a zone master file, which can be read
 	    the DNS domain name of a zone whose master file can be read
 	    from <option>file</option>.  If the zone name is the same as
 	    <option>file</option>, then it may be omitted.
 	  </para>
 	  <para>
-	    If <replaceable>file</replaceable> is <literal>"-"</literal>, then
+	    If <option>file</option> is set to <literal>"-"</literal>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <command>dig</command>
 	    command as input, as in:
@@ -242,33 +175,26 @@
      </varlistentry>
      <varlistentry>
-	<term>-h</term>
+        <term>-A</term>
-	<listitem>
+        <listitem>
-	  <para>
+          <para>
-	    Prints usage information.
+            Include ZSKs when generating DS records.  Without this option,
-	  </para>
+            only keys which have the KSK flag set will be converted to DS
-	</listitem>
+            records and printed.  Useful only in zone file mode.
-      </varlistentry>
+          </para>
-
+        </listitem>
      <varlistentry>
 	<term>-K <replaceable class="parameter">directory</replaceable></term>
 	<listitem>
 	  <para>
 	    Look for key files or <filename>keyset-</filename> files in
 	    <option>directory</option>.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-l <replaceable class="parameter">domain</replaceable></term>
 	<listitem>
 	  <para>
-	    Generate a DLV set instead of a DS set. The specified
+	    Generate a DLV set instead of a DS set.  The specified
-	    <replaceable>domain</replaceable> is appended to the name for each
+	    <option>domain</option> is appended to the name for each
 	    record in the set.
-	    This is mutually exclusive with the <option>-C</option> option
+	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    for generating CDS records.
+	    in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
 	  </para>
 	</listitem>
      </varlistentry>
@@ -277,18 +203,18 @@
 	<term>-s</term>
 	<listitem>
 	  <para>
-	    Keyset mode: <command>dnssec-dsfromkey</command>'s
+	    Keyset mode: in place of the keyfile name, the argument is
-	    final <replaceable>dnsname</replaceable> argument is the DNS
+	    the DNS domain name of a keyset file.
 	    domain name used to locate a <filename>keyset-</filename> file.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
-	<term>-T <replaceable class="parameter">TTL</replaceable></term>
+	<term>-c <replaceable class="parameter">class</replaceable></term>
 	<listitem>
 	  <para>
-	    Specifies the TTL of the DS records. By default the TTL is omitted.
+	    Specifies the DNS class (default is IN).  Useful only
 	    in keyset or zone file mode.
 	  </para>
 	  </listitem>
      </varlistentry>
@@ -302,6 +228,15 @@
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-h</term>
 	<listitem>
 	  <para>
 	    Prints usage information.
 	  </para>
 	</listitem>
      </varlistentry>
      <varlistentry>
 	<term>-V</term>
 	<listitem>
@@ -318,22 +253,21 @@
    <para>
      To build the SHA-256 DS RR from the
      <userinput>Kexample.com.+003+26160</userinput>
-      keyfile name, you can issue the following command:
+      keyfile name, the following command would be issued:
    </para>
    <para><userinput>dnssec-dsfromkey -2 Kexample.com.+003+26160</userinput>
    </para>
    <para>
      The command would print something like:
    </para>
-    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</userinput>
+    <para><userinput>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</userinput>
    </para>
  </refsection>
  <refsection><info><title>FILES</title></info>
    <para>
-      The keyfile can be designated by the key identification
+      The keyfile can be designed by the key identification
      <filename>Knnnn.+aaa+iiiii</filename> or the full file name
      <filename>Knnnn.+aaa+iiiii.key</filename> as generated by
      <refentrytitle>dnssec-keygen</refentrytitle><manvolnum>8</manvolnum>.
@@ -361,11 +295,9 @@
 	<refentrytitle>dnssec-signzone</refentrytitle><manvolnum>8</manvolnum>
      </citerefentry>,
      <citetitle>BIND 9 Administrator Reference Manual</citetitle>,
-      <citetitle>RFC 3658</citetitle> (DS RRs),
+      <citetitle>RFC 3658</citetitle>,
-      <citetitle>RFC 4431</citetitle> (DLV RRs),
+      <citetitle>RFC 4431</citetitle>.
-      <citetitle>RFC 4509</citetitle> (SHA-256 for DS RRs),
+      <citetitle>RFC 4509</citetitle>.
      <citetitle>RFC 6605</citetitle> (SHA-384 for DS RRs),
      <citetitle>RFC 7344</citetitle> (CDS and CDNSKEY RRs).
    </para>
  </refsection>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2008-2012, 2014-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2008-2012, 2014-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -33,171 +33,105 @@
 <h2>Synopsis</h2>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
       [
 	 <code class="option">-1</code> 
 	 |   <code class="option">-2</code> 
 	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
      ]
       [
 	 <code class="option">-C</code> 
 	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
-       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
+       [<code class="option">-1</code>]
       [<code class="option">-2</code>]
       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
       [<code class="option">-C</code>]
       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       {keyfile}
    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
       [
 	 <code class="option">-1</code> 
 	 |   <code class="option">-2</code> 
 	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
      ]
       [
 	 <code class="option">-C</code> 
 	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-A</code>]
       {<code class="option">-f <em class="replaceable"><code>file</code></em></code>}
       [dnsname]
    </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
       [
 	 <code class="option">-1</code> 
 	 |   <code class="option">-2</code> 
 	 |   <code class="option">-a <em class="replaceable"><code>alg</code></em></code> 
      ]
       [
 	 <code class="option">-C</code> 
 	 |   <code class="option">-l <em class="replaceable"><code>domain</code></em></code> 
      ]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       {-s}
       [<code class="option">-1</code>]
       [<code class="option">-2</code>]
       [<code class="option">-a <em class="replaceable"><code>alg</code></em></code>]
       [<code class="option">-K <em class="replaceable"><code>directory</code></em></code>]
       [<code class="option">-l <em class="replaceable"><code>domain</code></em></code>]
       [<code class="option">-s</code>]
       [<code class="option">-c <em class="replaceable"><code>class</code></em></code>]
       [<code class="option">-T <em class="replaceable"><code>TTL</code></em></code>]
       [<code class="option">-f <em class="replaceable"><code>file</code></em></code>]
       [<code class="option">-A</code>]
       [<code class="option">-v <em class="replaceable"><code>level</code></em></code>]
       {dnsname}
-    </p></div>
+   </p></div>
    <div class="cmdsynopsis"><p>
      <code class="command">dnssec-dsfromkey</code> 
-       [
+       [<code class="option">-h</code>]
-	 <code class="option">-h</code> 
+       [<code class="option">-V</code>]
-	 |   <code class="option">-V</code> 
+   </p></div>
      ]
    </p></div>
  </div>
  <div class="refsection">
 <a name="id-1.7"></a><h2>DESCRIPTION</h2>
-    <p>
+    <p><span class="command"><strong>dnssec-dsfromkey</strong></span>
-      The <span class="command"><strong>dnssec-dsfromkey</strong></span> command outputs DS (Delegation
+      outputs the Delegation Signer (DS) resource record (RR), as defined in
-      Signer) resource records (RRs) and other similarly-constructed RRs:
+      RFC 3658 and RFC 4509, for the given key(s).
      with the <code class="option">-l</code> option it outputs DLV (DNSSEC Lookaside
      Validation) RRs; or with the <code class="option">-C</code> it outputs CDS (Child
      DS) RRs.
    </p>
    <p>
      The input keys can be specified in a number of ways:
    </p>
    <p>
      By default, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads a key file
      named like <code class="filename">Knnnn.+aaa+iiiii.key</code>, as generated
      by <span class="command"><strong>dnssec-keygen</strong></span>.
    </p>
    <p>
      With the <code class="option">-f <em class="replaceable"><code>file</code></em></code>
      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads keys from a zone file
      or partial zone file (which can contain just the DNSKEY records).
    </p>
    <p>
      With the <code class="option">-s</code>
      option, <span class="command"><strong>dnssec-dsfromkey</strong></span> reads
      a <code class="filename">keyset-</code> file, as generated
      by <span class="command"><strong>dnssec-keygen</strong></span> <code class="option">-C</code>.
    </p>
  </div>
  <div class="refsection">
 <a name="id-1.8"></a><h2>OPTIONS</h2>
    <div class="variablelist"><dl class="variablelist">
 <dt><span class="term">-1</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA-1</code>.
+	    Use SHA-1 as the digest algorithm (the default is to use
-	    (Note: The SHA-1 algorithm is no longer recommended for use
+	    both SHA-1 and SHA-256).
 	    when generating new DS and CDS records.)
 	  </p>
 	</dd>
 <dt><span class="term">-2</span></dt>
 <dd>
 	  <p>
-	    An abbreviation for <code class="option">-a SHA-256</code>.
+	    Use SHA-256 as the digest algorithm.
 	  </p>
 	</dd>
 <dt><span class="term">-a <em class="replaceable"><code>algorithm</code></em></span></dt>
 <dd>
 	  <p>
-	    Specify a digest algorithm to use when converting DNSKEY
+	    Select the digest algorithm. The value of
-	    records to DS records. This option can be repeated, so
+	    <code class="option">algorithm</code> must be one of SHA-1 (SHA1),
-	    that multiple DS records are created for each DNSKEY
+	    SHA-256 (SHA256), GOST or SHA-384 (SHA384).
-	    record.
+	    These values are case insensitive.
          </p>
          <p>
 	    The <em class="replaceable"><code>algorithm</code></em> must be one of
 	    SHA-1, SHA-256, or SHA-384.  These values are case insensitive,
 	    and the hyphen may be omitted.  If no algorithm is specified,
 	    the default is SHA-256.
 	    (Note: The SHA-1 algorithm is no longer recommended for use
 	    when generating new DS and CDS records.)
 	  </p>
 	</dd>
 <dt><span class="term">-A</span></dt>
 <dd>
          <p>
            Include ZSKs when generating DS records. Without this option, only
            keys which have the KSK flag set will be converted to DS records
            and printed. Useful only in <code class="option">-f</code> zone file mode.
          </p>
        </dd>
 <dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd>
 	  <p>
 	    Specifies the DNS class (default is IN). Useful only
 	    in <code class="option">-s</code> keyset or <code class="option">-f</code>
 	    zone file mode.
 	  </p>
 	  </dd>
 <dt><span class="term">-C</span></dt>
 <dd>
 	  <p>
-	    Generate CDS records rather than DS records. This is mutually
+	    Generate CDS records rather than DS records.  This is mutually
-	    exclusive with the <code class="option">-l</code> option for generating DLV
+	    exclusive with generating lookaside records.
-	    records.
+	  </p>
 	</dd>
 <dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
 <dd>
 	  <p>
 	    Specifies the TTL of the DS records.
 	  </p>
 	  </dd>
 <dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
 <dd>
 	  <p>
 	    Look for key files (or, in keyset mode,
 	    <code class="filename">keyset-</code> files) in
 	    <code class="option">directory</code>.
 	  </p>
 	</dd>
 <dt><span class="term">-f <em class="replaceable"><code>file</code></em></span></dt>
 <dd>
 	  <p>
-	    Zone file mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    Zone file mode: in place of the keyfile name, the argument is
-	    final <em class="replaceable"><code>dnsname</code></em> argument is
+	    the DNS domain name of a zone master file, which can be read
 	    the DNS domain name of a zone whose master file can be read
 	    from <code class="option">file</code>.  If the zone name is the same as
 	    <code class="option">file</code>, then it may be omitted.
 	  </p>
 	  <p>
-	    If <em class="replaceable"><code>file</code></em> is <code class="literal">"-"</code>, then
+	    If <code class="option">file</code> is set to <code class="literal">"-"</code>, then
 	    the zone data is read from the standard input.  This makes it
 	    possible to use the output of the <span class="command"><strong>dig</strong></span>
 	    command as input, as in:
@@ -206,41 +140,37 @@
 	    <strong class="userinput"><code>dig dnskey example.com | dnssec-dsfromkey -f - example.com</code></strong>
 	  </p>
 	</dd>
-<dt><span class="term">-h</span></dt>
+<dt><span class="term">-A</span></dt>
 <dd>
-	  <p>
+          <p>
-	    Prints usage information.
+            Include ZSKs when generating DS records.  Without this option,
-	  </p>
+            only keys which have the KSK flag set will be converted to DS
-	</dd>
+            records and printed.  Useful only in zone file mode.
-<dt><span class="term">-K <em class="replaceable"><code>directory</code></em></span></dt>
+          </p>
-<dd>
+        </dd>
 	  <p>
 	    Look for key files or <code class="filename">keyset-</code> files in
 	    <code class="option">directory</code>.
 	  </p>
 	</dd>
 <dt><span class="term">-l <em class="replaceable"><code>domain</code></em></span></dt>
 <dd>
 	  <p>
-	    Generate a DLV set instead of a DS set. The specified
+	    Generate a DLV set instead of a DS set.  The specified
-	    <em class="replaceable"><code>domain</code></em> is appended to the name for each
+	    <code class="option">domain</code> is appended to the name for each
 	    record in the set.
-	    This is mutually exclusive with the <code class="option">-C</code> option
+	    The DNSSEC Lookaside Validation (DLV) RR is described
-	    for generating CDS records.
+	    in RFC 4431.  This is mutually exclusive with generating
 	    CDS records.
 	  </p>
 	</dd>
 <dt><span class="term">-s</span></dt>
 <dd>
 	  <p>
-	    Keyset mode: <span class="command"><strong>dnssec-dsfromkey</strong></span>'s
+	    Keyset mode: in place of the keyfile name, the argument is
-	    final <em class="replaceable"><code>dnsname</code></em> argument is the DNS
+	    the DNS domain name of a keyset file.
 	    domain name used to locate a <code class="filename">keyset-</code> file.
 	  </p>
 	</dd>
-<dt><span class="term">-T <em class="replaceable"><code>TTL</code></em></span></dt>
+<dt><span class="term">-c <em class="replaceable"><code>class</code></em></span></dt>
 <dd>
 	  <p>
-	    Specifies the TTL of the DS records. By default the TTL is omitted.
+	    Specifies the DNS class (default is IN).  Useful only
 	    in keyset or zone file mode.
 	  </p>
 	  </dd>
 <dt><span class="term">-v <em class="replaceable"><code>level</code></em></span></dt>
@@ -249,6 +179,12 @@
 	    Sets the debugging level.
 	  </p>
 	</dd>
 <dt><span class="term">-h</span></dt>
 <dd>
 	  <p>
 	    Prints usage information.
 	  </p>
 	</dd>
 <dt><span class="term">-V</span></dt>
 <dd>
 	  <p>
@@ -264,23 +200,22 @@
    <p>
      To build the SHA-256 DS RR from the
      <strong class="userinput"><code>Kexample.com.+003+26160</code></strong>
-      keyfile name, you can issue the following command:
+      keyfile name, the following command would be issued:
    </p>
    <p><strong class="userinput"><code>dnssec-dsfromkey -2 Kexample.com.+003+26160</code></strong>
    </p>
    <p>
      The command would print something like:
    </p>
-    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0C5EA0B94</code></strong>
+    <p><strong class="userinput"><code>example.com. IN DS 26160 5 2 3A1EADA7A74B8D0BA86726B0C227AA85AB8BBD2B2004F41A868A54F0 C5EA0B94</code></strong>
    </p>
  </div>
  <div class="refsection">
 <a name="id-1.10"></a><h2>FILES</h2>
    <p>
-      The keyfile can be designated by the key identification
+      The keyfile can be designed by the key identification
      <code class="filename">Knnnn.+aaa+iiiii</code> or the full file name
      <code class="filename">Knnnn.+aaa+iiiii.key</code> as generated by
      <span class="refentrytitle">dnssec-keygen</span>(8).
@@ -310,11 +245,9 @@
 	<span class="refentrytitle">dnssec-signzone</span>(8)
      </span>,
      <em class="citetitle">BIND 9 Administrator Reference Manual</em>,
-      <em class="citetitle">RFC 3658</em> (DS RRs),
+      <em class="citetitle">RFC 3658</em>,
-      <em class="citetitle">RFC 4431</em> (DLV RRs),
+      <em class="citetitle">RFC 4431</em>.
-      <em class="citetitle">RFC 4509</em> (SHA-256 for DS RRs),
+      <em class="citetitle">RFC 4509</em>.
      <em class="citetitle">RFC 6605</em> (SHA-384 for DS RRs),
      <em class="citetitle">RFC 7344</em> (CDS and CDNSKEY RRs).
    </p>
  </div>
@@ -1,4 +1,4 @@
-.\" Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+.\" Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .\" 
 .\" This Source Code Form is subject to the terms of the Mozilla Public
 .\" License, v. 2.0. If a copy of the MPL was not distributed with this
@@ -134,5 +134,5 @@ RFC 5011\&.
 \fBInternet Systems Consortium, Inc\&.\fR
 .SH "COPYRIGHT"
 .br
-Copyright \(co 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+Copyright \(co 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 .br
@@ -11,7 +11,8 @@
 /*! \file */
-#include <stdbool.h>
+#include <config.h>
 #include <stdlib.h>
 #include <isc/buffer.h>
@@ -40,25 +41,30 @@
 #include <dst/dst.h>
-#if USE_PKCS11
+#if HAVE_PKCS11
 #include <pk11/result.h>
 #endif
 #include "dnssectool.h"
 #ifndef PATH_MAX
 #define PATH_MAX 1024   /* AIX, WIN32, and others don't define this. */
 #endif
 const char *program = "dnssec-importkey";
 int verbose;
 static dns_rdataclass_t rdclass;
 static dns_fixedname_t	fixed;
 static dns_name_t	*name = NULL;
 static isc_mem_t	*mctx = NULL;
-static bool	setpub = false, setdel = false;
+static isc_boolean_t	setpub = ISC_FALSE, setdel = ISC_FALSE;
-static bool	setttl = false;
+static isc_boolean_t	setttl = ISC_FALSE;
 static isc_stdtime_t	pub = 0, del = 0;
 static dns_ttl_t	ttl = 0;
 static isc_stdtime_t	syncadd = 0, syncdel = 0;
-static bool	setsyncadd = false;
+static isc_boolean_t	setsyncadd = ISC_FALSE;
-static bool	setsyncdel = false;
+static isc_boolean_t	setsyncdel = ISC_FALSE;
 static isc_result_t
 initname(char *setname) {
@@ -118,7 +124,7 @@ loadset(const char *filename, dns_rdataset_t *rdataset) {
 			      isc_result_totext(result));
 	}
-	result = dns_db_findnode(db, name, false, &node);
+	result = dns_db_findnode(db, name, ISC_FALSE, &node);
 	if (result != ISC_R_SUCCESS)
 		fatal("can't find %s node in %s", setname, filename);
@@ -220,7 +226,7 @@ emit(const char *dir, dns_rdata_t *rdata) {
 		dst_key_free(&tmp);
 	}
-	dst_key_setexternal(key, true);
+	dst_key_setexternal(key, ISC_TRUE);
 	if (setpub)
 		dst_key_settime(key, DST_TIME_PUBLISH, pub);
 	if (setdel)
@@ -304,12 +310,12 @@ main(int argc, char **argv) {
 	if (result != ISC_R_SUCCESS)
 		fatal("out of memory");
-#if USE_PKCS11
+#if HAVE_PKCS11
 	pk11_result_register();
 #endif
 	dns_result_register();
-	isc_commandline_errprint = false;
+	isc_commandline_errprint = ISC_FALSE;
 #define CMDLINE_FLAGS "D:f:hK:L:P:v:V"
 	while ((ch = isc_commandline_parse(argc, argv, CMDLINE_FLAGS)) != -1) {
@@ -340,7 +346,7 @@ main(int argc, char **argv) {
 			break;
 		case 'L':
 			ttl = strtottl(isc_commandline_argument);
-			setttl = true;
+			setttl = ISC_TRUE;
 			break;
 		case 'P':
 			/* -Psync ? */
@@ -38,7 +38,6 @@
      <year>2015</year>
      <year>2016</year>
      <year>2018</year>
      <year>2019</year>
      <holder>Internet Systems Consortium, Inc. ("ISC")</holder>
    </copyright>
  </docinfo>
@@ -1,6 +1,6 @@
 <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
 <!--
- - Copyright (C) 2013-2016, 2018, 2019 Internet Systems Consortium, Inc. ("ISC")
+ - Copyright (C) 2013-2016, 2018 Internet Systems Consortium, Inc. ("ISC")
 - 
 - This Source Code Form is subject to the terms of the Mozilla Public
 - License, v. 2.0. If a copy of the MPL was not distributed with this
--- a/Show More
+++ b/Show More