Revert "import ldns 1.9.0"

Pre-push rebase bungled the metadata

This reverts commit 597a090ff2ab868242e4ec1cdec7469edbe41c50.

36 files changed, 300 insertions, 1265 deletions

diff --git a/contrib/ldns/Changelog b/contrib/ldns/Changelog
index 74e2631af72d..c7f36767b360 100644
--- a/contrib/ldns/Changelog
+++ b/contrib/ldns/Changelog
@@ -1,49 +1,3 @@
-1.9.0	2025-12-04
-	* PR #246: Make ldns_calc_keytag() available for CDNSKEY RR
-	  Thanks tgreenx and pnax
-	* PR #247: Make ldns_key_rr2ds() available for CDNSKEY RR
-	  Thanks tgreenx
-	* PR #248: Make ldns_rr_compare_{ds,ds_dnskey}() available for
-	  CDS and CDNSKEY RRs. Thanks tgreenx
-	* PR #245: Make drill trace use IPv6 when used with -6
-	  Thanks Paul Radford 
-	* Fix #254: Unquoted "value" rdata for CAA records fail to validate.
-	  Follows the long string unquoted syntax from RFC8659, section 4.1.1.
-	* Fix #266: ldns-read-zone -u fails if a type is the only type in a
-	  window and the type modulo 256 is equal to zero.
-	* Fix #271: Intermittent build failure with multi-job
-	  builds (make -j).
-	* Add ldns-verify-zone -s option. It checks all signature results,
-	  instead of passing by when one RRSIG validates. That prints output
-	  for spurious RRSIGs, the failures for them.
-	* Fix RR types NSAP-PTR, GPOS and RESINFO to print unquoted strings.
-	* Fix memory leak when trying to read zones that have equal RRs.
-	  the ldns_dnssec_*_add_rr() functions now return LDNS_STATUS_EQUAL_RR
-	  when an already existing RR is tried to be added. This is a API
-	  change, hence this also bumps the version to 1.9.0
-	* PR #282: ensure returning pkt with LDNS_STATUS_OK. Thanks grobian.
-	* PR #286: Fix RR Type AMTRELAY type nogateway, to print relay '.',
-	  and memory leaks in parsing it.
-	* DSYNC is no longer a draft RR type and compiled by default
-	* RFC 9824 support: Compact Denial of Existence in DNSSEC
-	* The HHIT and BRID draft RR types
-	* PR #249: If RNG is already seeded, return early.
-	  Thanks crrodriguez
-	* PR #221: Improve error messages. Thanks jschauma
-	* PR #256: Use SWIG_AppendOutput to support swig 4.3
-	  Thanks pemensik
-	* PR #188: Homogenize paths for source files during compilation
-	  Thanks duthils
-	* Fix #283: ldns-walk fails after update from 1.8.3 to 1.8.4
-	  Thanks jschauma
-	* PR #200: Allow compiled tests to link to ldns statically via
-	  environment variable. Thanks FGasper and pemensik
-	* PR #220: Optionally exclude ZONEMD RRs in ldns-compare-zone
-	  Thanks gjherbiet
-	* Fix #285: A WALLET RR breaks TXT signing. Thanks bortzmeyer
-	* Fix #287: ldns-verify-zone hangs with missing NSEC3 RRs.
-	  Thanks Roy Arends
-
 1.8.4	2024-07-19
 	* Fix building documentation in build directory.
 	  Thanks Michael Tokarev
diff --git a/contrib/ldns/Makefile.in b/contrib/ldns/Makefile.in
index b5ca1d3c3adf..32b91576d0d9 100644
--- a/contrib/ldns/Makefile.in
+++ b/contrib/ldns/Makefile.in
@@ -132,11 +132,11 @@ all:	setup-builddir lib linktest manpages @P5_DNS_LDNS@ @PYLDNS@ @DRILL@ @EXAMPL
 .SUFFIXES: .c .o .a .lo .h .i
 
 .c.lo:
-	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $(srcdir)/$< -o $@
+	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $< -o $@
 
 # Need libtool compile
 .c.o:
-	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $(srcdir)/$< -o $@
+	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $< -o $@
 
 $(LDNS_LOBJS) $(LIBLOBJS) $(DRILL_LOBJS) $(EXAMPLE_LOBJS):
 	$(COMP_LIB) $(LIBSSL_CPPFLAGS) -c $(srcdir)/$(@:.lo=.c) -o $@
@@ -571,9 +571,9 @@ depend:
 		done; \
 	done
 	for p in $(EXAMPLE_PROGS) $(LDNS_DPA) $(LDNS_DANE) $(EX_SSL_PROGS); do \
-		echo "$$p: $$p.lo \$$(LIB)" >> $(DEPEND_TMP) ; done
+		echo "$$p: $$p.lo $$p.o \$$(LIB)" >> $(DEPEND_TMP) ; done
 	echo "$(TESTNS): `for o in $(TESTNS_LOBJS) ; do \
-				echo -n "$$o " ; done`\$$(LIB)" \
+				echo -n "$$o $${o%lo}o " ; done` \$$(LIB)" \
 			       	>> $(DEPEND_TMP)
 	cp $(DEPEND_TARGET) $(DEPEND_TMP2)
 	head -`egrep -n "# Dependencies" $(DEPEND_TARGET) | tail -1 | sed -e 's/:.*$$//'` $(DEPEND_TMP2) > $(DEPEND_TARGET)
@@ -1114,28 +1114,28 @@ drill/work.lo drill/work.o: $(srcdir)/drill/work.c $(srcdir)/drill/drill.h ldns/
  $(srcdir)/ldns/host2wire.h ldns/net.h $(srcdir)/ldns/str2host.h $(srcdir)/ldns/update.h \
  $(srcdir)/ldns/wire2host.h $(srcdir)/ldns/rr_functions.h $(srcdir)/ldns/parse.h $(srcdir)/ldns/radix.h \
  $(srcdir)/ldns/sha1.h $(srcdir)/ldns/sha2.h
-examples/ldns-chaos: examples/ldns-chaos.lo $(LIB)
-examples/ldns-compare-zones: examples/ldns-compare-zones.lo $(LIB)
-examples/ldnsd: examples/ldnsd.lo $(LIB)
-examples/ldns-gen-zone: examples/ldns-gen-zone.lo $(LIB)
-examples/ldns-key2ds: examples/ldns-key2ds.lo $(LIB)
-examples/ldns-keyfetcher: examples/ldns-keyfetcher.lo $(LIB)
-examples/ldns-keygen: examples/ldns-keygen.lo $(LIB)
-examples/ldns-mx: examples/ldns-mx.lo $(LIB)
-examples/ldns-notify: examples/ldns-notify.lo $(LIB)
-examples/ldns-read-zone: examples/ldns-read-zone.lo $(LIB)
-examples/ldns-resolver: examples/ldns-resolver.lo $(LIB)
-examples/ldns-rrsig: examples/ldns-rrsig.lo $(LIB)
-examples/ldns-test-edns: examples/ldns-test-edns.lo $(LIB)
-examples/ldns-update: examples/ldns-update.lo $(LIB)
-examples/ldns-version: examples/ldns-version.lo $(LIB)
-examples/ldns-walk: examples/ldns-walk.lo $(LIB)
-examples/ldns-zcat: examples/ldns-zcat.lo $(LIB)
-examples/ldns-zsplit: examples/ldns-zsplit.lo $(LIB)
-examples/ldns-dpa: examples/ldns-dpa.lo $(LIB)
-examples/ldns-dane: examples/ldns-dane.lo $(LIB)
-examples/ldns-nsec3-hash: examples/ldns-nsec3-hash.lo $(LIB)
-examples/ldns-revoke: examples/ldns-revoke.lo $(LIB)
-examples/ldns-signzone: examples/ldns-signzone.lo $(LIB)
-examples/ldns-verify-zone: examples/ldns-verify-zone.lo $(LIB)
-examples/ldns-testns: examples/ldns-testns.lo examples/ldns-testpkts.lo $(LIB)
+examples/ldns-chaos: examples/ldns-chaos.lo examples/ldns-chaos.o $(LIB)
+examples/ldns-compare-zones: examples/ldns-compare-zones.lo examples/ldns-compare-zones.o $(LIB)
+examples/ldnsd: examples/ldnsd.lo examples/ldnsd.o $(LIB)
+examples/ldns-gen-zone: examples/ldns-gen-zone.lo examples/ldns-gen-zone.o $(LIB)
+examples/ldns-key2ds: examples/ldns-key2ds.lo examples/ldns-key2ds.o $(LIB)
+examples/ldns-keyfetcher: examples/ldns-keyfetcher.lo examples/ldns-keyfetcher.o $(LIB)
+examples/ldns-keygen: examples/ldns-keygen.lo examples/ldns-keygen.o $(LIB)
+examples/ldns-mx: examples/ldns-mx.lo examples/ldns-mx.o $(LIB)
+examples/ldns-notify: examples/ldns-notify.lo examples/ldns-notify.o $(LIB)
+examples/ldns-read-zone: examples/ldns-read-zone.lo examples/ldns-read-zone.o $(LIB)
+examples/ldns-resolver: examples/ldns-resolver.lo examples/ldns-resolver.o $(LIB)
+examples/ldns-rrsig: examples/ldns-rrsig.lo examples/ldns-rrsig.o $(LIB)
+examples/ldns-test-edns: examples/ldns-test-edns.lo examples/ldns-test-edns.o $(LIB)
+examples/ldns-update: examples/ldns-update.lo examples/ldns-update.o $(LIB)
+examples/ldns-version: examples/ldns-version.lo examples/ldns-version.o $(LIB)
+examples/ldns-walk: examples/ldns-walk.lo examples/ldns-walk.o $(LIB)
+examples/ldns-zcat: examples/ldns-zcat.lo examples/ldns-zcat.o $(LIB)
+examples/ldns-zsplit: examples/ldns-zsplit.lo examples/ldns-zsplit.o $(LIB)
+examples/ldns-dpa: examples/ldns-dpa.lo examples/ldns-dpa.o $(LIB)
+examples/ldns-dane: examples/ldns-dane.lo examples/ldns-dane.o $(LIB)
+examples/ldns-nsec3-hash: examples/ldns-nsec3-hash.lo examples/ldns-nsec3-hash.o $(LIB)
+examples/ldns-revoke: examples/ldns-revoke.lo examples/ldns-revoke.o $(LIB)
+examples/ldns-signzone: examples/ldns-signzone.lo examples/ldns-signzone.o $(LIB)
+examples/ldns-verify-zone: examples/ldns-verify-zone.lo examples/ldns-verify-zone.o $(LIB)
+examples/ldns-testns: examples/ldns-testns.lo examples/ldns-testns.o examples/ldns-testpkts.lo examples/ldns-testpkts.o  $(LIB)
diff --git a/contrib/ldns/README b/contrib/ldns/README
index fb588f4da586..e07fdc078aa2 100644
--- a/contrib/ldns/README
+++ b/contrib/ldns/README
@@ -1,21 +1,3 @@
-DEVELOPMENT VISION
-
-Note: ldns has been in maintenance mode since 2020, with no plans for major
-features. We welcome PRs from contributors who want to add new functionality. 
-We also actively fix bugs, so users can continue to rely on ldns if its 
-current features meet their needs.
-
-We will continue to make occasional use of ldns in an experimental
-setting, such as during an IETF Hackathon to build a proof of concept for an
-Internet Draft.
-
-The natural successor to the ldns library is the domain library for Rust:
-https://github.com/NLnetLabs/domain
-
-We offer drop-in replacements for commonly used ldns example tools in dnst:
-https://github.com/NLnetLabs/dnst
-
----
 
 Contents: 
 	REQUIREMENTS
@@ -28,6 +10,7 @@ Contents:
 		Solaris
 	KNOWN ISSUES
 		pyldns
+        Your Support
 
 Project page:
 http://www.nlnetlabs.nl/ldns/
diff --git a/contrib/ldns/config.guess b/contrib/ldns/config.guess
index a9d01fde4617..f6d217a49f8f 100755
--- a/contrib/ldns/config.guess
+++ b/contrib/ldns/config.guess
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Attempt to guess a canonical system name.
-#   Copyright 1992-2025 Free Software Foundation, Inc.
+#   Copyright 1992-2024 Free Software Foundation, Inc.
 
 # shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2025-07-10'
+timestamp='2024-01-01'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -60,7 +60,7 @@ version="\
 GNU config.guess ($timestamp)
 
 Originally written by Per Bothner.
-Copyright 1992-2025 Free Software Foundation, Inc.
+Copyright 1992-2024 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -123,7 +123,7 @@ set_cc_for_build() {
     dummy=$tmp/dummy
     case ${CC_FOR_BUILD-},${HOST_CC-},${CC-} in
 	,,)    echo "int x;" > "$dummy.c"
-	       for driver in cc gcc c17 c99 c89 ; do
+	       for driver in cc gcc c89 c99 ; do
 		   if ($driver -c -o "$dummy.o" "$dummy.c") >/dev/null 2>&1 ; then
 		       CC_FOR_BUILD=$driver
 		       break
@@ -634,8 +634,7 @@ EOF
 		sed 's/^		//' << EOF > "$dummy.c"
 		#include <sys/systemcfg.h>
 
-		int
-		main ()
+		main()
 			{
 			if (!__power_pc())
 				exit(1);
@@ -719,8 +718,7 @@ EOF
 		#include <stdlib.h>
 		#include <unistd.h>
 
-		int
-		main ()
+		int main ()
 		{
 		#if defined(_SC_KERNEL_BITS)
 		    long bits = sysconf(_SC_KERNEL_BITS);
@@ -1597,11 +1595,8 @@ EOF
     *:Unleashed:*:*)
 	GUESS=$UNAME_MACHINE-unknown-unleashed$UNAME_RELEASE
 	;;
-    x86_64:[Ii]ronclad:*:*|i?86:[Ii]ronclad:*:*)
-	GUESS=$UNAME_MACHINE-pc-ironclad-mlibc
-	;;
-    *:[Ii]ronclad:*:*)
-	GUESS=$UNAME_MACHINE-unknown-ironclad-mlibc
+    *:Ironclad:*:*)
+	GUESS=$UNAME_MACHINE-unknown-ironclad
 	;;
 esac
 
@@ -1626,7 +1621,6 @@ cat > "$dummy.c" <<EOF
 #endif
 #endif
 #endif
-int
 main ()
 {
 #if defined (sony)
@@ -1811,8 +1805,8 @@ fi
 exit 1
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp nil t)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
-# time-stamp-format: "%Y-%02m-%02d"
+# time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
 # End:
diff --git a/contrib/ldns/config.sub b/contrib/ldns/config.sub
index 3d35cde174de..2c6a07ab3c34 100755
--- a/contrib/ldns/config.sub
+++ b/contrib/ldns/config.sub
@@ -1,10 +1,10 @@
 #! /bin/sh
 # Configuration validation subroutine script.
-#   Copyright 1992-2025 Free Software Foundation, Inc.
+#   Copyright 1992-2024 Free Software Foundation, Inc.
 
-# shellcheck disable=SC2006,SC2268,SC2162 # see below for rationale
+# shellcheck disable=SC2006,SC2268 # see below for rationale
 
-timestamp='2025-07-10'
+timestamp='2024-01-01'
 
 # This file is free software; you can redistribute it and/or modify it
 # under the terms of the GNU General Public License as published by
@@ -76,7 +76,7 @@ Report bugs and patches to <config-patches@gnu.org>."
 version="\
 GNU config.sub ($timestamp)
 
-Copyright 1992-2025 Free Software Foundation, Inc.
+Copyright 1992-2024 Free Software Foundation, Inc.
 
 This is free software; see the source for copying conditions.  There is NO
 warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE."
@@ -120,6 +120,7 @@ case $# in
 esac
 
 # Split fields of configuration type
+# shellcheck disable=SC2162
 saved_IFS=$IFS
 IFS="-" read field1 field2 field3 field4 <<EOF
 $1
@@ -141,21 +142,10 @@ case $1 in
 		# parts
 		maybe_os=$field2-$field3
 		case $maybe_os in
-			  cloudabi*-eabi* \
-			| kfreebsd*-gnu* \
-			| knetbsd*-gnu* \
-			| kopensolaris*-gnu* \
-			| ironclad-* \
-			| linux-* \
-			| managarm-* \
-			| netbsd*-eabi* \
-			| netbsd*-gnu* \
-			| nto-qnx* \
-			| os2-emx* \
-			| rtmk-nova* \
-			| storm-chaos* \
-			| uclinux-gnu* \
-			| uclinux-uclibc* \
+			nto-qnx* | linux-* | uclinux-uclibc* \
+			| uclinux-gnu* | kfreebsd*-gnu* | knetbsd*-gnu* | netbsd*-gnu* \
+			| netbsd*-eabi* | kopensolaris*-gnu* | cloudabi*-eabi* \
+			| storm-chaos* | os2-emx* | rtmk-nova* | managarm-* \
 			| windows-* )
 				basic_machine=$field1
 				basic_os=$maybe_os
@@ -171,12 +161,8 @@ case $1 in
 		esac
 		;;
 	*-*)
+		# A lone config we happen to match not fitting any pattern
 		case $field1-$field2 in
-			# Shorthands that happen to contain a single dash
-			convex-c[12] | convex-c3[248])
-				basic_machine=$field2-convex
-				basic_os=
-				;;
 			decstation-3100)
 				basic_machine=mips-dec
 				basic_os=
@@ -184,87 +170,28 @@ case $1 in
 			*-*)
 				# Second component is usually, but not always the OS
 				case $field2 in
-					# Do not treat sunos as a manufacturer
+					# Prevent following clause from handling this valid os
 					sun*os*)
 						basic_machine=$field1
 						basic_os=$field2
 						;;
+					zephyr*)
+						basic_machine=$field1-unknown
+						basic_os=$field2
+						;;
 					# Manufacturers
-					  3100* \
-					| 32* \
-					| 3300* \
-					| 3600* \
-					| 7300* \
-					| acorn \
-					| altos* \
-					| apollo \
-					| apple \
-					| atari \
-					| att* \
-					| axis \
-					| be \
-					| bull \
-					| cbm \
-					| ccur \
-					| cisco \
-					| commodore \
-					| convergent* \
-					| convex* \
-					| cray \
-					| crds \
-					| dec* \
-					| delta* \
-					| dg \
-					| digital \
-					| dolphin \
-					| encore* \
-					| gould \
-					| harris \
-					| highlevel \
-					| hitachi* \
-					| hp \
-					| ibm* \
-					| intergraph \
-					| isi* \
-					| knuth \
-					| masscomp \
-					| microblaze* \
-					| mips* \
-					| motorola* \
-					| ncr* \
-					| news \
-					| next \
-					| ns \
-					| oki \
-					| omron* \
-					| pc533* \
-					| rebel \
-					| rom68k \
-					| rombug \
-					| semi \
-					| sequent* \
-					| sgi* \
-					| siemens \
-					| sim \
-					| sni \
-					| sony* \
-					| stratus \
-					| sun \
-					| sun[234]* \
-					| tektronix \
-					| tti* \
-					| ultra \
-					| unicom* \
-					| wec \
-					| winbond \
-					| wrs)
+					dec* | mips* | sequent* | encore* | pc533* | sgi* | sony* \
+					| att* | 7300* | 3300* | delta* | motorola* | sun[234]* \
+					| unicom* | ibm* | next | hp | isi* | apollo | altos* \
+					| convergent* | ncr* | news | 32* | 3600* | 3100* \
+					| hitachi* | c[123]* | convex* | sun | crds | omron* | dg \
+					| ultra | tti* | harris | dolphin | highlevel | gould \
+					| cbm | ns | masscomp | apple | axis | knuth | cray \
+					| microblaze* | sim | cisco \
+					| oki | wec | wrs | winbond)
 						basic_machine=$field1-$field2
 						basic_os=
 						;;
-					tock* | zephyr*)
-						basic_machine=$field1-unknown
-						basic_os=$field2
-						;;
 					*)
 						basic_machine=$field1
 						basic_os=$field2
@@ -345,6 +272,26 @@ case $1 in
 				basic_machine=arm-unknown
 				basic_os=cegcc
 				;;
+			convex-c1)
+				basic_machine=c1-convex
+				basic_os=bsd
+				;;
+			convex-c2)
+				basic_machine=c2-convex
+				basic_os=bsd
+				;;
+			convex-c32)
+				basic_machine=c32-convex
+				basic_os=bsd
+				;;
+			convex-c34)
+				basic_machine=c34-convex
+				basic_os=bsd
+				;;
+			convex-c38)
+				basic_machine=c38-convex
+				basic_os=bsd
+				;;
 			cray)
 				basic_machine=j90-cray
 				basic_os=unicos
@@ -767,26 +714,15 @@ case $basic_machine in
 		vendor=dec
 		basic_os=tops20
 		;;
-	delta | 3300 | delta-motorola | 3300-motorola | motorola-delta | motorola-3300)
+	delta | 3300 | motorola-3300 | motorola-delta \
+	      | 3300-motorola | delta-motorola)
 		cpu=m68k
 		vendor=motorola
 		;;
-	# This used to be dpx2*, but that gets the RS6000-based
-	# DPX/20 and the x86-based DPX/2-100 wrong.  See
-	# https://oldskool.silicium.org/stations/bull_dpx20.htm
-	# https://www.feb-patrimoine.com/english/bull_dpx2.htm
-	# https://www.feb-patrimoine.com/english/unix_and_bull.htm
-	dpx2 | dpx2[23]00 | dpx2[23]xx)
+	dpx2*)
 		cpu=m68k
 		vendor=bull
-		;;
-	dpx2100 | dpx21xx)
-		cpu=i386
-		vendor=bull
-		;;
-	dpx20)
-		cpu=rs6000
-		vendor=bull
+		basic_os=sysv3
 		;;
 	encore | umax | mmax)
 		cpu=ns32k
@@ -901,6 +837,18 @@ case $basic_machine in
 	next | m*-next)
 		cpu=m68k
 		vendor=next
+		case $basic_os in
+		    openstep*)
+		        ;;
+		    nextstep*)
+			;;
+		    ns2*)
+		      basic_os=nextstep2
+			;;
+		    *)
+		      basic_os=nextstep3
+			;;
+		esac
 		;;
 	np1)
 		cpu=np1
@@ -989,6 +937,7 @@ case $basic_machine in
 		;;
 
 	*-*)
+		# shellcheck disable=SC2162
 		saved_IFS=$IFS
 		IFS="-" read cpu vendor <<EOF
 $basic_machine
@@ -1023,19 +972,15 @@ unset -v basic_machine
 
 # Decode basic machines in the full and proper CPU-Company form.
 case $cpu-$vendor in
-	# Here we handle the default manufacturer of certain CPU types in canonical form.
-	# It is in some cases the only manufacturer, in others, it is the most popular.
-	c[12]-convex | c[12]-unknown | c3[248]-convex | c3[248]-unknown)
-		vendor=convex
-		basic_os=${basic_os:-bsd}
-		;;
+	# Here we handle the default manufacturer of certain CPU types in canonical form. It is in
+	# some cases the only manufacturer, in others, it is the most popular.
 	craynv-unknown)
 		vendor=cray
 		basic_os=${basic_os:-unicosmp}
 		;;
 	c90-unknown | c90-cray)
 		vendor=cray
-		basic_os=${basic_os:-unicos}
+		basic_os=${Basic_os:-unicos}
 		;;
 	fx80-unknown)
 		vendor=alliant
@@ -1081,29 +1026,11 @@ case $cpu-$vendor in
 		vendor=alt
 		basic_os=${basic_os:-linux-gnueabihf}
 		;;
-
-	# Normalized CPU+vendor pairs that imply an OS, if not otherwise specified
-	m68k-isi)
-		basic_os=${basic_os:-sysv}
-		;;
-	m68k-sony)
-		basic_os=${basic_os:-newsos}
-		;;
-	m68k-tektronix)
-		basic_os=${basic_os:-bsd}
-		;;
-	m88k-harris)
-		basic_os=${basic_os:-sysv3}
-		;;
-	i386-bull | m68k-bull)
-		basic_os=${basic_os:-sysv3}
-		;;
-	rs6000-bull)
+	dpx20-unknown | dpx20-bull)
+		cpu=rs6000
+		vendor=bull
 		basic_os=${basic_os:-bosx}
 		;;
-	mips-sni)
-		basic_os=${basic_os:-sysv4}
-		;;
 
 	# Here we normalize CPU types irrespective of the vendor
 	amd64-*)
@@ -1111,7 +1038,7 @@ case $cpu-$vendor in
 		;;
 	blackfin-*)
 		cpu=bfin
-		basic_os=${basic_os:-linux}
+		basic_os=linux
 		;;
 	c54x-*)
 		cpu=tic54x
@@ -1134,7 +1061,7 @@ case $cpu-$vendor in
 		;;
 	m68knommu-*)
 		cpu=m68k
-		basic_os=${basic_os:-linux}
+		basic_os=linux
 		;;
 	m9s12z-* | m68hcs12z-* | hcs12z-* | s12z-*)
 		cpu=s12z
@@ -1144,7 +1071,7 @@ case $cpu-$vendor in
 		;;
 	parisc-*)
 		cpu=hppa
-		basic_os=${basic_os:-linux}
+		basic_os=linux
 		;;
 	pentium-* | p5-* | k5-* | k6-* | nexgen-* | viac3-*)
 		cpu=i586
@@ -1158,6 +1085,9 @@ case $cpu-$vendor in
 	pentium4-*)
 		cpu=i786
 		;;
+	pc98-*)
+		cpu=i386
+		;;
 	ppc-* | ppcbe-*)
 		cpu=powerpc
 		;;
@@ -1191,10 +1121,13 @@ case $cpu-$vendor in
 	tx39el-*)
 		cpu=mipstx39el
 		;;
+	x64-*)
+		cpu=x86_64
+		;;
 	xscale-* | xscalee[bl]-*)
 		cpu=`echo "$cpu" | sed 's/^xscale/arm/'`
 		;;
-	arm64-* | aarch64le-* | arm64_32-*)
+	arm64-* | aarch64le-*)
 		cpu=aarch64
 		;;
 
@@ -1246,228 +1179,90 @@ case $cpu-$vendor in
 		# Recognize the canonical CPU types that are allowed with any
 		# company name.
 		case $cpu in
-			  1750a \
-			| 580 \
-			| [cjt]90 \
+			1750a | 580 \
 			| a29k \
-			| aarch64 \
-			| aarch64_be \
-			| aarch64c \
+			| aarch64 | aarch64_be | aarch64c | arm64ec \
 			| abacus \
-			| alpha \
-			| alpha64 \
-			| alpha64ev56 \
-			| alpha64ev6[78] \
-			| alpha64ev[4-8] \
-			| alpha64pca5[67] \
-			| alphaev56 \
-			| alphaev6[78] \
-			| alphaev[4-8] \
-			| alphapca5[67] \
+			| alpha | alphaev[4-8] | alphaev56 | alphaev6[78] \
+			| alpha64 | alpha64ev[4-8] | alpha64ev56 | alpha64ev6[78] \
+			| alphapca5[67] | alpha64pca5[67] \
 			| am33_2.0 \
 			| amdgcn \
-			| arc \
-			| arc32 \
-			| arc64 \
-			| arceb \
-			| arm \
-			| arm64e \
-			| arm64ec \
-			| arm[lb]e \
-			| arme[lb] \
-			| armv* \
+			| arc | arceb | arc32 | arc64 \
+			| arm | arm[lb]e | arme[lb] | armv* \
+			| avr | avr32 \
 			| asmjs \
-			| avr \
-			| avr32 \
 			| ba \
-			| be32 \
-			| be64 \
-			| bfin \
-			| bpf \
-			| bs2000 \
-			| c30 \
-			| c4x \
-			| c8051 \
-			| c[123]* \
-			| clipper \
-			| craynv \
-			| csky \
-			| cydra \
-			| d10v \
-			| d30v \
-			| dlx \
-			| dsp16xx \
-			| e2k \
-			| elxsi \
-			| epiphany \
-			| f30[01] \
-			| f700 \
-			| fido \
-			| fr30 \
-			| frv \
-			| ft32 \
-			| fx80 \
-			| h8300 \
-			| h8500 \
-			| hexagon \
-			| hppa \
-			| hppa1.[01] \
-			| hppa2.0 \
-			| hppa2.0[nw] \
-			| hppa64 \
-			| i*86 \
-			| i370 \
-			| i860 \
-			| i960 \
-			| ia16 \
-			| ia64 \
-			| intelgt \
-			| ip2k \
-			| iq2000 \
+			| be32 | be64 \
+			| bfin | bpf | bs2000 \
+			| c[123]* | c30 | [cjt]90 | c4x \
+			| c8051 | clipper | craynv | csky | cydra \
+			| d10v | d30v | dlx | dsp16xx \
+			| e2k | elxsi | epiphany \
+			| f30[01] | f700 | fido | fr30 | frv | ft32 | fx80 \
 			| javascript \
+			| h8300 | h8500 \
+			| hppa | hppa1.[01] | hppa2.0 | hppa2.0[nw] | hppa64 \
+			| hexagon \
+			| i370 | i*86 | i860 | i960 | ia16 | ia64 \
+			| ip2k | iq2000 \
 			| k1om \
 			| kvx \
-			| le32 \
-			| le64 \
+			| le32 | le64 \
 			| lm32 \
-			| loongarch32 \
-			| loongarch64 \
-			| m32c \
-			| m32r \
-			| m32rle \
-			| m5200 \
-			| m68000 \
-			| m680[012346]0 \
-			| m6811 \
-			| m6812 \
-			| m68360 \
-			| m683?2 \
-			| m68hc11 \
-			| m68hc12 \
-			| m68hcs12x \
-			| m68k \
-			| m88110 \
-			| m88k \
-			| maxq \
-			| mb \
-			| mcore \
-			| mep \
-			| metag \
-			| microblaze \
-			| microblazeel \
+			| loongarch32 | loongarch64 \
+			| m32c | m32r | m32rle \
+			| m5200 | m68000 | m680[012346]0 | m68360 | m683?2 | m68k \
+			| m6811 | m68hc11 | m6812 | m68hc12 | m68hcs12x \
+			| m88110 | m88k | maxq | mb | mcore | mep | metag \
+			| microblaze | microblazeel \
 			| mips* \
 			| mmix \
-			| mn10200 \
-			| mn10300 \
+			| mn10200 | mn10300 \
 			| moxie \
-			| msp430 \
 			| mt \
+			| msp430 \
 			| nanomips* \
-			| nds32 \
-			| nds32be \
-			| nds32le \
+			| nds32 | nds32le | nds32be \
 			| nfp \
-			| nios \
-			| nios2 \
-			| nios2eb \
-			| nios2el \
-			| none \
-			| np1 \
-			| ns16k \
-			| ns32k \
-			| nvptx \
+			| nios | nios2 | nios2eb | nios2el \
+			| none | np1 | ns16k | ns32k | nvptx \
 			| open8 \
 			| or1k* \
 			| or32 \
 			| orion \
-			| pdp10 \
-			| pdp11 \
 			| picochip \
-			| pj \
-			| pjl \
-			| pn \
-			| power \
-			| powerpc \
-			| powerpc64 \
-			| powerpc64le \
-			| powerpcle \
-			| powerpcspe \
+			| pdp10 | pdp11 | pj | pjl | pn | power \
+			| powerpc | powerpc64 | powerpc64le | powerpcle | powerpcspe \
 			| pru \
 			| pyramid \
-			| riscv \
-			| riscv32 \
-			| riscv32be \
-			| riscv64 \
-			| riscv64be \
-			| rl78 \
-			| romp \
-			| rs6000 \
-			| rx \
-			| s390 \
-			| s390x \
+			| riscv | riscv32 | riscv32be | riscv64 | riscv64be \
+			| rl78 | romp | rs6000 | rx \
+			| s390 | s390x \
 			| score \
-			| sh \
-			| sh64 \
-			| sh64le \
-			| sh[12345][lb]e \
-			| sh[1234] \
-			| sh[1234]e[lb] \
-			| sh[23]e \
-			| sh[23]ele \
-			| sh[24]a \
-			| sh[24]ae[lb] \
-			| sh[lb]e \
-			| she[lb] \
-			| shl \
-			| sparc \
-			| sparc64 \
-			| sparc64b \
-			| sparc64v \
-			| sparc86x \
-			| sparclet \
+			| sh | shl \
+			| sh[1234] | sh[24]a | sh[24]ae[lb] | sh[23]e | she[lb] | sh[lb]e \
+			| sh[1234]e[lb] |  sh[12345][lb]e | sh[23]ele | sh64 | sh64le \
+			| sparc | sparc64 | sparc64b | sparc64v | sparc86x | sparclet \
 			| sparclite \
-			| sparcv8 \
-			| sparcv9 \
-			| sparcv9b \
-			| sparcv9v \
+			| sparcv8 | sparcv9 | sparcv9b | sparcv9v | sv1 | sx* \
 			| spu \
-			| sv1 \
-			| sx* \
 			| tahoe \
 			| thumbv7* \
-			| tic30 \
-			| tic4x \
-			| tic54x \
-			| tic55x \
-			| tic6x \
-			| tic80 \
+			| tic30 | tic4x | tic54x | tic55x | tic6x | tic80 \
 			| tron \
 			| ubicom32 \
-			| v70 \
-			| v810 \
-			| v850 \
-			| v850e \
-			| v850e1 \
-			| v850e2 \
-			| v850e2v3 \
-			| v850es \
+			| v70 | v850 | v850e | v850e1 | v850es | v850e2 | v850e2v3 \
 			| vax \
 			| vc4 \
 			| visium \
 			| w65 \
-			| wasm32 \
-			| wasm64 \
+			| wasm32 | wasm64 \
 			| we32k \
-			| x86 \
-			| x86_64 \
-			| xc16x \
-			| xgate \
-			| xps100 \
-			| xstormy16 \
-			| xtensa* \
+			| x86 | x86_64 | xc16x | xgate | xps100 \
+			| xstormy16 | xtensa* \
 			| ymp \
-			| z80 \
-			| z8k)
+			| z8k | z80)
 				;;
 
 			*)
@@ -1512,6 +1307,7 @@ case $basic_os in
 		os=`echo "$basic_os" | sed -e 's|nto-qnx|qnx|'`
 		;;
 	*-*)
+		# shellcheck disable=SC2162
 		saved_IFS=$IFS
 		IFS="-" read kernel os <<EOF
 $basic_os
@@ -1523,10 +1319,6 @@ EOF
 		kernel=nto
 		os=`echo "$basic_os" | sed -e 's|nto|qnx|'`
 		;;
-	ironclad*)
-		kernel=ironclad
-		os=`echo "$basic_os" | sed -e 's|ironclad|mlibc|'`
-		;;
 	linux*)
 		kernel=linux
 		os=`echo "$basic_os" | sed -e 's|linux|gnu|'`
@@ -1562,23 +1354,6 @@ case $os in
 	unixware*)
 		os=sysv4.2uw
 		;;
-	# The marketing names for NeXT's operating systems were
-	# NeXTSTEP, NeXTSTEP 2, OpenSTEP 3, OpenSTEP 4.  'openstep' is
-	# mapped to 'openstep3', but 'openstep1' and 'openstep2' are
-	# mapped to 'nextstep' and 'nextstep2', consistent with the
-	# treatment of SunOS/Solaris.
-	ns | ns1 | nextstep | nextstep1 | openstep1)
-		os=nextstep
-		;;
-	ns2 | nextstep2 | openstep2)
-		os=nextstep2
-		;;
-	ns3 | nextstep3 | openstep | openstep3)
-		os=openstep3
-		;;
-	ns4 | nextstep4 | openstep4)
-		os=openstep4
-		;;
 	# es1800 is here to avoid being matched by es* (a different OS)
 	es1800*)
 		os=ose
@@ -1649,7 +1424,6 @@ case $os in
 		;;
 	utek*)
 		os=bsd
-		vendor=`echo "$vendor" | sed -e 's|^unknown$|tektronix|'`
 		;;
 	dynix*)
 		os=bsd
@@ -1666,25 +1440,21 @@ case $os in
 	386bsd)
 		os=bsd
 		;;
-	ctix*)
-		os=sysv
-		vendor=`echo "$vendor" | sed -e 's|^unknown$|convergent|'`
-		;;
-	uts*)
+	ctix* | uts*)
 		os=sysv
 		;;
 	nova*)
-		kernel=rtmk
-		os=nova
+		os=rtmk-nova
+		;;
+	ns2)
+		os=nextstep2
 		;;
 	# Preserve the version number of sinix5.
 	sinix5.*)
 		os=`echo "$os" | sed -e 's|sinix|sysv|'`
-		vendor=`echo "$vendor" | sed -e 's|^unknown$|sni|'`
 		;;
 	sinix*)
 		os=sysv4
-		vendor=`echo "$vendor" | sed -e 's|^unknown$|sni|'`
 		;;
 	tpf*)
 		os=tpf
@@ -1825,14 +1595,6 @@ case $cpu-$vendor in
 		os=
 		obj=elf
 		;;
-	# The -sgi and -siemens entries must be before the mips- entry
-	# or we get the wrong os.
-	*-sgi)
-		os=irix
-		;;
-	*-siemens)
-		os=sysv4
-		;;
 	mips*-cisco)
 		os=
 		obj=elf
@@ -1845,8 +1607,7 @@ case $cpu-$vendor in
 		os=
 		obj=coff
 		;;
-	# This must be before the sparc-* entry or we get the wrong os.
-	*-tti)
+	*-tti)	# must be before sparc entry or we get the wrong os.
 		os=sysv3
 		;;
 	sparc-* | *-sun)
@@ -1878,7 +1639,7 @@ case $cpu-$vendor in
 		os=hpux
 		;;
 	*-hitachi)
-		os=hiuxwe2
+		os=hiux
 		;;
 	i860-* | *-att | *-ncr | *-altos | *-motorola | *-convergent)
 		os=sysv
@@ -1922,6 +1683,12 @@ case $cpu-$vendor in
 	*-encore)
 		os=bsd
 		;;
+	*-sgi)
+		os=irix
+		;;
+	*-siemens)
+		os=sysv4
+		;;
 	*-masscomp)
 		os=rtu
 		;;
@@ -1968,194 +1735,40 @@ case $os in
 	ghcjs)
 		;;
 	# Now accept the basic system types.
+	# The portable systems comes first.
 	# Each alternative MUST end in a * to match a version number.
-	  abug \
-	| aix* \
-	| amdhsa* \
-	| amigados* \
-	| amigaos* \
-	| android* \
-	| aof* \
-	| aos* \
-	| aros* \
-	| atheos* \
-	| auroraux* \
-	| aux* \
-	| banan_os* \
-	| beos* \
-	| bitrig* \
-	| bme* \
-	| bosx* \
-	| bsd* \
-	| cegcc* \
-	| chorusos* \
-	| chorusrdb* \
-	| clix* \
-	| cloudabi* \
-	| cnk* \
-	| conix* \
-	| cos* \
-	| cxux* \
-	| cygwin* \
-	| darwin* \
-	| dgux* \
-	| dicos* \
-	| dnix* \
-	| domain* \
-	| dragonfly* \
-	| drops* \
-	| ebmon* \
-	| ecoff* \
-	| ekkobsd* \
-	| emscripten* \
-	| emx* \
-	| es* \
-	| fiwix* \
-	| freebsd* \
-	| fuchsia* \
-	| genix* \
-	| genode* \
-	| glidix* \
-	| gnu* \
-	| go32* \
-	| haiku* \
-	| hcos* \
-	| hiux* \
-	| hms* \
-	| hpux* \
-	| ieee* \
-	| interix* \
-	| ios* \
-	| iris* \
-	| irix* \
-	| isc* \
-	| its* \
-	| l4re* \
-	| libertybsd* \
-	| lites* \
-	| lnews* \
-	| luna* \
-	| lynxos* \
-	| mach* \
-	| macos* \
-	| magic* \
-	| mbr* \
-	| midipix* \
-	| midnightbsd* \
-	| mingw32* \
-	| mingw64* \
-	| minix* \
-	| mint* \
-	| mirbsd* \
-	| mks* \
-	| mlibc* \
-	| mmixware* \
-	| mon960* \
-	| morphos* \
-	| moss* \
-	| moxiebox* \
-	| mpeix* \
-	| mpw* \
-	| msdos* \
-	| msys* \
-	| mvs* \
-	| nacl* \
-	| netbsd* \
-	| netware* \
-	| newsos* \
-	| nextstep* \
-	| nindy* \
-	| nonstopux* \
-	| nova* \
-	| nsk* \
-	| nucleus* \
-	| nx6 \
-	| nx7 \
-	| oabi* \
-	| ohos* \
-	| onefs* \
-	| openbsd* \
-	| openedition* \
-	| openstep* \
-	| os108* \
-	| os2* \
-	| os400* \
-	| os68k* \
-	| os9* \
-	| ose* \
-	| osf* \
-	| oskit* \
-	| osx* \
-	| palmos* \
-	| phoenix* \
-	| plan9* \
-	| powermax* \
-	| powerunix* \
-	| proelf* \
-	| psos* \
-	| psp* \
-	| ptx* \
-	| pw32* \
-	| qnx* \
-	| rdos* \
-	| redox* \
-	| rhapsody* \
-	| riscix* \
-	| riscos* \
-	| rtems* \
-	| rtmk* \
-	| rtu* \
-	| scout* \
-	| secbsd* \
-	| sei* \
-	| serenity* \
-	| sim* \
-	| skyos* \
-	| solaris* \
-	| solidbsd* \
-	| sortix* \
-	| storm-chaos* \
-	| sunos \
-	| sunos[34]* \
-	| superux* \
-	| syllable* \
-	| sym* \
-	| sysv* \
-	| tenex* \
-	| tirtos* \
-	| tock* \
-	| toppers* \
-	| tops10* \
-	| tops20* \
-	| tpf* \
-	| tvos* \
-	| twizzler* \
-	| uclinux* \
-	| udi* \
-	| udk* \
-	| ultrix* \
-	| unicos* \
-	| uniplus* \
-	| unleashed* \
-	| unos* \
-	| uwin* \
-	| uxpv* \
-	| v88r* \
-	|*vms* \
-	| vos* \
-	| vsta* \
-	| vxsim* \
-	| vxworks* \
-	| wasi* \
-	| watchos* \
-	| wince* \
-	| windiss* \
-	| windows* \
-	| winnt* \
-	| xenix* \
-	| xray* \
-	| zephyr* \
-	| zvmoe* )
+	gnu* | android* | bsd* | mach* | minix* | genix* | ultrix* | irix* \
+	     | *vms* | esix* | aix* | cnk* | sunos | sunos[34]* \
+	     | hpux* | unos* | osf* | luna* | dgux* | auroraux* | solaris* \
+	     | sym* |  plan9* | psp* | sim* | xray* | os68k* | v88r* \
+	     | hiux* | abug | nacl* | netware* | windows* \
+	     | os9* | macos* | osx* | ios* | tvos* | watchos* \
+	     | mpw* | magic* | mmixware* | mon960* | lnews* \
+	     | amigaos* | amigados* | msdos* | newsos* | unicos* | aof* \
+	     | aos* | aros* | cloudabi* | sortix* | twizzler* \
+	     | nindy* | vxsim* | vxworks* | ebmon* | hms* | mvs* \
+	     | clix* | riscos* | uniplus* | iris* | isc* | rtu* | xenix* \
+	     | mirbsd* | netbsd* | dicos* | openedition* | ose* \
+	     | bitrig* | openbsd* | secbsd* | solidbsd* | libertybsd* | os108* \
+	     | ekkobsd* | freebsd* | riscix* | lynxos* | os400* \
+	     | bosx* | nextstep* | cxux* | oabi* \
+	     | ptx* | ecoff* | winnt* | domain* | vsta* \
+	     | udi* | lites* | ieee* | go32* | aux* | hcos* \
+	     | chorusrdb* | cegcc* | glidix* | serenity* \
+	     | cygwin* | msys* | moss* | proelf* | rtems* \
+	     | midipix* | mingw32* | mingw64* | mint* \
+	     | uxpv* | beos* | mpeix* | udk* | moxiebox* \
+	     | interix* | uwin* | mks* | rhapsody* | darwin* \
+	     | openstep* | oskit* | conix* | pw32* | nonstopux* \
+	     | storm-chaos* | tops10* | tenex* | tops20* | its* \
+	     | os2* | vos* | palmos* | uclinux* | nucleus* | morphos* \
+	     | scout* | superux* | sysv* | rtmk* | tpf* | windiss* \
+	     | powermax* | dnix* | nx6 | nx7 | sei* | dragonfly* \
+	     | skyos* | haiku* | rdos* | toppers* | drops* | es* \
+	     | onefs* | tirtos* | phoenix* | fuchsia* | redox* | bme* \
+	     | midnightbsd* | amdhsa* | unleashed* | emscripten* | wasi* \
+	     | nsk* | powerunix* | genode* | zvmoe* | qnx* | emx* | zephyr* \
+	     | fiwix* | mlibc* | cos* | mbr* | ironclad* )
 		;;
 	# This one is extra strict with allowed versions
 	sco3.2v2 | sco3.2v[4-9]* | sco5v6*)
@@ -2216,11 +1829,9 @@ esac
 case $kernel-$os-$obj in
 	linux-gnu*- | linux-android*- | linux-dietlibc*- | linux-llvm*- \
 		    | linux-mlibc*- | linux-musl*- | linux-newlib*- \
-		    | linux-relibc*- | linux-uclibc*- | linux-ohos*- )
-		;;
-	uclinux-uclibc*- | uclinux-gnu*- )
+		    | linux-relibc*- | linux-uclibc*- )
 		;;
-	ironclad-mlibc*-)
+	uclinux-uclibc*- )
 		;;
 	managarm-mlibc*- | managarm-kernel*- )
 		;;
@@ -2245,7 +1856,7 @@ case $kernel-$os-$obj in
 		echo "Invalid configuration '$1': '$os' needs 'windows'." 1>&2
 		exit 1
 		;;
-	kfreebsd*-gnu*- | knetbsd*-gnu*- | netbsd*-gnu*- | kopensolaris*-gnu*-)
+	kfreebsd*-gnu*- | kopensolaris*-gnu*-)
 		;;
 	vxworks-simlinux- | vxworks-simwindows- | vxworks-spe-)
 		;;
@@ -2253,12 +1864,8 @@ case $kernel-$os-$obj in
 		;;
 	os2-emx-)
 		;;
-	rtmk-nova-)
-		;;
 	*-eabi*- | *-gnueabi*-)
 		;;
-	ios*-simulator- | tvos*-simulator- | watchos*-simulator- )
-		;;
 	none--*)
 		# None (no kernel, i.e. freestanding / bare metal),
 		# can be paired with an machine code file format
@@ -2283,7 +1890,7 @@ case $vendor in
 			*-riscix*)
 				vendor=acorn
 				;;
-			*-sunos* | *-solaris*)
+			*-sunos*)
 				vendor=sun
 				;;
 			*-cnk* | *-aix*)
@@ -2357,8 +1964,8 @@ echo "$cpu-$vendor${kernel:+-$kernel}${os:+-$os}${obj:+-$obj}"
 exit
 
 # Local variables:
-# eval: (add-hook 'before-save-hook 'time-stamp nil t)
+# eval: (add-hook 'before-save-hook 'time-stamp)
 # time-stamp-start: "timestamp='"
-# time-stamp-format: "%Y-%02m-%02d"
+# time-stamp-format: "%:y-%02m-%02d"
 # time-stamp-end: "'"
 # End:
diff --git a/contrib/ldns/configure b/contrib/ldns/configure
index b731de6c2933..a73dc22ef349 100755
--- a/contrib/ldns/configure
+++ b/contrib/ldns/configure
@@ -1,6 +1,6 @@
 #! /bin/sh
 # Guess values for system-dependent variables and create Makefiles.
-# Generated by GNU Autoconf 2.71 for ldns 1.9.0.
+# Generated by GNU Autoconf 2.71 for ldns 1.8.4.
 #
 # Report bugs to <dns-team@nlnetlabs.nl>.
 #
@@ -621,8 +621,8 @@ MAKEFLAGS=
 # Identity of this package.
 PACKAGE_NAME='ldns'
 PACKAGE_TARNAME='libdns'
-PACKAGE_VERSION='1.9.0'
-PACKAGE_STRING='ldns 1.9.0'
+PACKAGE_VERSION='1.8.4'
+PACKAGE_STRING='ldns 1.8.4'
 PACKAGE_BUGREPORT='dns-team@nlnetlabs.nl'
 PACKAGE_URL=''
 
@@ -850,7 +850,6 @@ enable_dane_ta_usage
 enable_full_dane
 enable_no_dane_ta_usage
 enable_no_dane_verify
-enable_draft_rrtypes
 enable_rrtype_ninfo
 enable_rrtype_rkey
 enable_rrtype_openpgpkey
@@ -860,9 +859,6 @@ enable_rrtype_doa
 enable_rrtype_amtrelay
 enable_rrtype_svcb_https
 enable_rrtype_resinfo
-enable_rrtype_dsync
-enable_rrtypes_cla_ipn
-enable_rrtypes_hhit_brid
 enable_rpath
 with_xcode_sdk
 with_trust_anchor
@@ -1417,7 +1413,7 @@ if test "$ac_init_help" = "long"; then
   # Omit some internal or obsolete options to make the list less imposing.
   # This message is too long to be a string in the A/UX 3.1 sh.
   cat <<_ACEOF
-\`configure' configures ldns 1.9.0 to adapt to many kinds of systems.
+\`configure' configures ldns 1.8.4 to adapt to many kinds of systems.
 
 Usage: $0 [OPTION]... [VAR=VALUE]...
 
@@ -1482,7 +1478,7 @@ fi
 
 if test -n "$ac_init_help"; then
   case $ac_init_help in
-     short | recursive ) echo "Configuration of ldns 1.9.0:";;
+     short | recursive ) echo "Configuration of ldns 1.8.4:";;
    esac
   cat <<\_ACEOF
 
@@ -1512,7 +1508,6 @@ Optional Features:
   --disable-dane-verify   Disable DANE verify support
   --disable-dane-ta-usage Disable DANE-TA usage type support
 
-  --enable-draft-rrtypes  Enable all draft RR types.
   --enable-rrtype-ninfo   Enable draft RR type ninfo.
   --enable-rrtype-rkey    Enable draft RR type rkey.
   --disable-rrtype-openpgpkey
@@ -1524,13 +1519,7 @@ Optional Features:
                           Disable RR type AMTRELAY.
   --disable-rrtype-svcb-https
                           Disable RR types SVCB and HTTPS.
-  --disable-rrtype-resinfo
-                          Disable RR type RESINFO.
-  --disable-rrtype-dsync  Disable RR type DSYNC.
-  --enable-rrtypes-cla-ipn
-                          Enable draft RR types CLA and IPN.
-  --enable-rrtypes-hhit-brid
-                          Enable draft RR types HHIT and BRID.
+  --enable-rrtype-resinfo Disable RR type RESINFO.
   --disable-rpath         disable hardcoded rpath (default=enabled)
 
 Optional Packages:
@@ -1644,7 +1633,7 @@ fi
 test -n "$ac_init_help" && exit $ac_status
 if $ac_init_version; then
   cat <<\_ACEOF
-ldns configure 1.9.0
+ldns configure 1.8.4
 generated by GNU Autoconf 2.71
 
 Copyright (C) 2021 Free Software Foundation, Inc.
@@ -2263,7 +2252,7 @@ cat >config.log <<_ACEOF
 This file contains any messages produced by compilers while
 running configure, to aid debugging if configure makes a mistake.
 
-It was created by ldns $as_me 1.9.0, which was
+It was created by ldns $as_me 1.8.4, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   $ $0$ac_configure_args_raw
@@ -3027,9 +3016,9 @@ ac_compiler_gnu=$ac_cv_c_compiler_gnu
 # needed to build correct soname
 LDNS_VERSION_MAJOR=1
 
-LDNS_VERSION_MINOR=9
+LDNS_VERSION_MINOR=8
 
-LDNS_VERSION_MICRO=0
+LDNS_VERSION_MICRO=4
 
 
 # Library version
@@ -3051,7 +3040,6 @@ LDNS_VERSION_MICRO=0
 # ldns-1.8.1 had libversion 6:0:3
 # ldns-1.8.2 had libversion 7:0:4
 # ldns-1.8.3 has libversion 8:0:5
-# ldns-1.9.0 will have libversion 9:0:6 (new behaviour for dnssec_rrs_add_rr)
 #
 VERSION_INFO=9:0:6
 
@@ -17560,19 +17548,12 @@ printf "%s\n" "#define USE_DANE_TA_USAGE 1" >>confdefs.h
       ;;
 esac
 
-# Check whether --enable-draft-rrtypes was given.
-if test ${enable_draft_rrtypes+y}
-then :
-  enableval=$enable_draft_rrtypes;
-fi
-
 # Check whether --enable-rrtype-ninfo was given.
 if test ${enable_rrtype_ninfo+y}
 then :
   enableval=$enable_rrtype_ninfo;
 fi
 
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_ninfo="yes"; fi
 case "$enable_rrtype_ninfo" in
 	yes)
 
@@ -17588,7 +17569,6 @@ then :
   enableval=$enable_rrtype_rkey;
 fi
 
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_rkey="yes"; fi
 case "$enable_rrtype_rkey" in
 	yes)
 
@@ -17619,7 +17599,6 @@ then :
   enableval=$enable_rrtype_ta;
 fi
 
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_ta="yes"; fi
 case "$enable_rrtype_ta" in
 	yes)
 
@@ -17635,7 +17614,6 @@ then :
   enableval=$enable_rrtype_avc;
 fi
 
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_avc="yes"; fi
 case "$enable_rrtype_avc" in
 	yes)
 
@@ -17651,7 +17629,6 @@ then :
   enableval=$enable_rrtype_doa;
 fi
 
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_doa="yes"; fi
 case "$enable_rrtype_doa" in
 	yes)
 
@@ -17706,53 +17683,6 @@ printf "%s\n" "#define RRTYPE_RESINFO /**/" >>confdefs.h
 
 		;;
 esac
-# Check whether --enable-rrtype-dsync was given.
-if test ${enable_rrtype_dsync+y}
-then :
-  enableval=$enable_rrtype_dsync;
-fi
-
-case "$enable_rrtype_dsync" in
-	no)
-		;;
-	yes|*)
-
-printf "%s\n" "#define RRTYPE_DSYNC /**/" >>confdefs.h
-
-		;;
-esac
-# Check whether --enable-rrtypes-cla-ipn was given.
-if test ${enable_rrtypes_cla_ipn+y}
-then :
-  enableval=$enable_rrtypes_cla_ipn;
-fi
-
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtypes_cla_ipn="yes"; fi
-case "$enable_rrtypes_cla_ipn" in
-	yes)
-
-printf "%s\n" "#define RRTYPE_CLA_IPN /**/" >>confdefs.h
-
-		;;
-	no|*)
-		;;
-esac
-# Check whether --enable-rrtypes-hhit-brid was given.
-if test ${enable_rrtypes_hhit_brid+y}
-then :
-  enableval=$enable_rrtypes_hhit_brid;
-fi
-
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtypes_hhit_brid="yes"; fi
-case "$enable_rrtypes_hhit_brid" in
-	yes)
-
-printf "%s\n" "#define RRTYPE_HHIT_BRID /**/" >>confdefs.h
-
-		;;
-	no|*)
-		;;
-esac
 
 
 if echo "$tmp_LIBS" | grep "ws2_32" >/dev/null; then
@@ -20525,7 +20455,7 @@ cat >>$CONFIG_STATUS <<\_ACEOF || ac_write_fail=1
 # report actual input values of CONFIG_FILES etc. instead of their
 # values after options handling.
 ac_log="
-This file was extended by ldns $as_me 1.9.0, which was
+This file was extended by ldns $as_me 1.8.4, which was
 generated by GNU Autoconf 2.71.  Invocation command line was
 
   CONFIG_FILES    = $CONFIG_FILES
@@ -20593,7 +20523,7 @@ ac_cs_config_escaped=`printf "%s\n" "$ac_cs_config" | sed "s/^ //; s/'/'\\\\\\\\
 cat >>$CONFIG_STATUS <<_ACEOF || ac_write_fail=1
 ac_cs_config='$ac_cs_config_escaped'
 ac_cs_version="\\
-ldns config.status 1.9.0
+ldns config.status 1.8.4
 configured by $0, generated by GNU Autoconf 2.71,
   with options \\"\$ac_cs_config\\"
 
diff --git a/contrib/ldns/configure.ac b/contrib/ldns/configure.ac
index 91938e4a3430..9bf9823f73c1 100644
--- a/contrib/ldns/configure.ac
+++ b/contrib/ldns/configure.ac
@@ -5,8 +5,8 @@ sinclude(acx_nlnetlabs.m4)
 
 # must be numbers. ac_defun because of later processing.
 m4_define([VERSION_MAJOR],[1])
-m4_define([VERSION_MINOR],[9])
-m4_define([VERSION_MICRO],[0])
+m4_define([VERSION_MINOR],[8])
+m4_define([VERSION_MICRO],[4])
 AC_INIT([ldns],m4_defn([VERSION_MAJOR]).m4_defn([VERSION_MINOR]).m4_defn([VERSION_MICRO]),[dns-team@nlnetlabs.nl],[libdns])
 AC_CONFIG_SRCDIR([packet.c])
 # needed to build correct soname
@@ -33,7 +33,6 @@ AC_SUBST(LDNS_VERSION_MICRO, [VERSION_MICRO])
 # ldns-1.8.1 had libversion 6:0:3
 # ldns-1.8.2 had libversion 7:0:4
 # ldns-1.8.3 has libversion 8:0:5
-# ldns-1.9.0 will have libversion 9:0:6 (new behaviour for dnssec_rrs_add_rr)
 #
 AC_SUBST(VERSION_INFO, [9:0:6])
 
@@ -668,9 +667,7 @@ case "$enable_dane" in
       ;;
 esac
 
-AC_ARG_ENABLE(draft-rrtypes, AS_HELP_STRING([--enable-draft-rrtypes],[Enable all draft RR types.]))
 AC_ARG_ENABLE(rrtype-ninfo, AS_HELP_STRING([--enable-rrtype-ninfo],[Enable draft RR type ninfo.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_ninfo="yes"; fi
 case "$enable_rrtype_ninfo" in
 	yes)
 		AC_DEFINE_UNQUOTED([RRTYPE_NINFO], [], [Define this to enable RR type NINFO.])
@@ -679,7 +676,6 @@ case "$enable_rrtype_ninfo" in
 		;;
 esac
 AC_ARG_ENABLE(rrtype-rkey, AS_HELP_STRING([--enable-rrtype-rkey],[Enable draft RR type rkey.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_rkey="yes"; fi
 case "$enable_rrtype_rkey" in
 	yes)
 		AC_DEFINE_UNQUOTED([RRTYPE_RKEY], [], [Define this to enable RR type RKEY.])
@@ -696,7 +692,6 @@ case "$enable_rrtype_openpgpkey" in
 		;;
 esac
 AC_ARG_ENABLE(rrtype-ta, AS_HELP_STRING([--enable-rrtype-ta],[Enable draft RR type ta.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_ta="yes"; fi
 case "$enable_rrtype_ta" in
 	yes)
 		AC_DEFINE_UNQUOTED([RRTYPE_TA], [], [Define this to enable RR type TA.])
@@ -705,7 +700,6 @@ case "$enable_rrtype_ta" in
 		;;
 esac
 AC_ARG_ENABLE(rrtype-avc, AS_HELP_STRING([--enable-rrtype-avc],[Enable draft RR type avc.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_avc="yes"; fi
 case "$enable_rrtype_avc" in
 	yes)
 		AC_DEFINE_UNQUOTED([RRTYPE_AVC], [], [Define this to enable RR type AVC.])
@@ -714,7 +708,6 @@ case "$enable_rrtype_avc" in
 		;;
 esac
 AC_ARG_ENABLE(rrtype-doa, AS_HELP_STRING([--enable-rrtype-doa],[Enable draft RR type DOA.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtype_doa="yes"; fi
 case "$enable_rrtype_doa" in
 	yes)
 		AC_DEFINE_UNQUOTED([RRTYPE_DOA], [], [Define this to enable RR type DOA.])
@@ -738,7 +731,7 @@ case "$enable_rrtype_svcb_https" in
 		AC_DEFINE_UNQUOTED([RRTYPE_SVCB_HTTPS], [], [Define this to enable RR types SVCB and HTTPS.])
 		;;
 esac
-AC_ARG_ENABLE(rrtype-resinfo, AS_HELP_STRING([--disable-rrtype-resinfo],[Disable RR type RESINFO.]))
+AC_ARG_ENABLE(rrtype-resinfo, AS_HELP_STRING([--enable-rrtype-resinfo],[Disable RR type RESINFO.]))
 case "$enable_rrtype_resinfo" in
 	no)
 		;;
@@ -746,32 +739,6 @@ case "$enable_rrtype_resinfo" in
 		AC_DEFINE_UNQUOTED([RRTYPE_RESINFO], [], [Define this to enable RR type RESINFO.])
 		;;
 esac
-AC_ARG_ENABLE(rrtype-dsync, AS_HELP_STRING([--disable-rrtype-dsync],[Disable RR type DSYNC.]))
-case "$enable_rrtype_dsync" in
-	no)
-		;;
-	yes|*)
-		AC_DEFINE_UNQUOTED([RRTYPE_DSYNC], [], [Define this to enable RR type DSYNC.])
-		;;
-esac
-AC_ARG_ENABLE(rrtypes-cla-ipn, AS_HELP_STRING([--enable-rrtypes-cla-ipn],[Enable draft RR types CLA and IPN.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtypes_cla_ipn="yes"; fi
-case "$enable_rrtypes_cla_ipn" in
-	yes)
-		AC_DEFINE_UNQUOTED([RRTYPE_CLA_IPN], [], [Define this to enable RR types CLA and IPN.])
-		;;
-	no|*)
-		;;
-esac
-AC_ARG_ENABLE(rrtypes-hhit-brid, AS_HELP_STRING([--enable-rrtypes-hhit-brid],[Enable draft RR types HHIT and BRID.]))
-if test "x$enable_draft_rrtypes" = "xyes"; then enable_rrtypes_hhit_brid="yes"; fi
-case "$enable_rrtypes_hhit_brid" in
-	yes)
-		AC_DEFINE_UNQUOTED([RRTYPE_HHIT_BRID], [], [Define this to enable RR types HHIT and BRID.])
-		;;
-	no|*)
-		;;
-esac
 
 
 if echo "$tmp_LIBS" | grep "ws2_32" >/dev/null; then
@@ -1226,7 +1193,7 @@ size_t strlcpy(char *dst, const char *src, size_t siz);
 #define close_socket(_s) do { if (_s != SOCK_INVALID) {closesocket(_s); _s = -1;} } while(0)
 #else
 #define SOCK_INVALID -1
-#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s >= -1 ? _s : -1); _s = -1;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s); _s = -1;} } while(0)
 #endif
 
 #ifdef __cplusplus
diff --git a/contrib/ldns/dnssec.c b/contrib/ldns/dnssec.c
index 1339e73c3c78..0a7beb4ebfd4 100644
--- a/contrib/ldns/dnssec.c
+++ b/contrib/ldns/dnssec.c
@@ -285,7 +285,6 @@ ldns_calc_keytag(const ldns_rr *key)
 	}
 
 	if (ldns_rr_get_type(key) != LDNS_RR_TYPE_DNSKEY &&
-	    ldns_rr_get_type(key) != LDNS_RR_TYPE_CDNSKEY &&
 	    ldns_rr_get_type(key) != LDNS_RR_TYPE_KEY
 	    ) {
 		return 0;
@@ -518,8 +517,7 @@ ldns_key_rr2ds(const ldns_rr *key, ldns_hash h)
 	const EVP_MD* md = NULL;
 #endif
 
-	if (ldns_rr_get_type(key) != LDNS_RR_TYPE_DNSKEY &&
-	    ldns_rr_get_type(key) != LDNS_RR_TYPE_CDNSKEY) {
+	if (ldns_rr_get_type(key) != LDNS_RR_TYPE_DNSKEY) {
 		return NULL;
 	}
 
diff --git a/contrib/ldns/dnssec_zone.c b/contrib/ldns/dnssec_zone.c
index d54920952a98..c0a7a6a4933b 100644
--- a/contrib/ldns/dnssec_zone.c
+++ b/contrib/ldns/dnssec_zone.c
@@ -72,9 +72,8 @@ ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr)
 		new_rrs->next = rrs->next;
 		rrs->rr = rr;
 		rrs->next = new_rrs;
-	} else
-		return LDNS_STATUS_EQUAL_RR;
-
+	}
+	/* Silently ignore equal rr's */
 	return LDNS_STATUS_OK;
 }
 
@@ -734,37 +733,25 @@ ldns_dnssec_zone_new_frm_fp_l(ldns_dnssec_zone** z, FILE* fp, const ldns_rdf* or
 				 */
 				ldns_rr_set_ttl(cur_rr, ldns_rr_ttl(prev_rr));
 
+			prev_rr = cur_rr;
 #endif
 			status = ldns_dnssec_zone_add_rr(newzone, cur_rr);
-			switch(status) {
-			case LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND:
+			if (status ==
+				LDNS_STATUS_DNSSEC_NSEC3_ORIGINAL_NOT_FOUND) {
+
 				if (rr_is_rrsig_covering(cur_rr,
 							LDNS_RR_TYPE_NSEC3)){
 					ldns_rr_list_push_rr(todo_nsec3_rrsigs,
 							cur_rr);
 				} else {
 					ldns_rr_list_push_rr(todo_nsec3s,
-							cur_rr);
+						       	cur_rr);
 				}
 				status = LDNS_STATUS_OK;
-				break;
-			case LDNS_STATUS_EQUAL_RR:
-				ldns_rr_free(cur_rr);
-#ifndef FASTER_DNSSEC_ZONE_NEW_FRM_FP
-				cur_rr = prev_rr;
-#else
-				cur_rr = NULL;
-#endif
-				status = LDNS_STATUS_OK;
-				break;
-			case LDNS_STATUS_OK:
-				break;
-			default:
+
+			} else if (status != LDNS_STATUS_OK)
 				goto error;
-			}
-#ifndef FASTER_DNSSEC_ZONE_NEW_FRM_FP
-			prev_rr = cur_rr;
-#endif
+
 			break;
 
 		case LDNS_STATUS_SYNTAX_TTL:	/* the ttl was set*/
@@ -1524,18 +1511,11 @@ dnssec_zone_rr_iter_first(dnssec_zone_rr_iter *i, ldns_dnssec_zone *zone)
 		: (ldns_dnssec_name *)i->node->data;
 
 	if (zone->hashed_names) {
-		i->nsec3_node = ldns_rbtree_first(zone->hashed_names);
-		i->nsec3_name = i->nsec3_node == LDNS_RBTREE_NULL ? NULL
-			      : (ldns_dnssec_name*)i->nsec3_node->data;
-		/* While there is no NSEC3 RR present at this hashed name,
-		 * skip to the next hashed name.
-		 */
-		while (i->nsec3_name && !i->nsec3_name->nsec) {
-			/* next nsec3 */
-			i->nsec3_node = ldns_rbtree_next(i->nsec3_node);
-			i->nsec3_name = i->nsec3_node == LDNS_RBTREE_NULL ? NULL
-				    : (ldns_dnssec_name*)i->nsec3_node->data;
-		}
+		do {
+			i->nsec3_node = ldns_rbtree_first(zone->hashed_names);
+			i->nsec3_name = i->nsec3_node == LDNS_RBTREE_NULL ?NULL
+				      : (ldns_dnssec_name*)i->nsec3_node->data;
+		} while (i->nsec3_name && !i->nsec3_name->nsec);
 	}
 	dnssec_zone_rr_iter_set_state_for_next_name(i);
 	return dnssec_zone_rr_iter_next(i);
diff --git a/contrib/ldns/drill/drill.c b/contrib/ldns/drill/drill.c
index 9db77cf1cc7b..44c1b7687aec 100644
--- a/contrib/ldns/drill/drill.c
+++ b/contrib/ldns/drill/drill.c
@@ -855,7 +855,7 @@ main(int argc, char *argv[])
 					status = ldns_send_buffer(&pkt, res, query_buffer, NULL);
 					ldns_buffer_free(query_buffer);
 					if (status != LDNS_STATUS_OK) {
-						fprintf(stderr, "Error: %s\n", ldns_get_errorstr_by_id(status));
+						printf("Error: %s\n", ldns_get_errorstr_by_id(status));
 						exit(1);
 					}
 				} else {
diff --git a/contrib/ldns/drill/securetrace.c b/contrib/ldns/drill/securetrace.c
index dcd5c7739f44..90014b4e3007 100644
--- a/contrib/ldns/drill/securetrace.c
+++ b/contrib/ldns/drill/securetrace.c
@@ -291,12 +291,7 @@ do_secure_trace(ldns_resolver *local_res, ldns_rdf *name, ldns_rr_type t,
 				/* trust glue? */
 				new_ns_addr = NULL;
 				if (ldns_dname_is_subdomain(pop, labels[i])) {
-					if (ldns_resolver_ip6(res) == LDNS_RESOLV_INET6) {
-						new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_AAAA, LDNS_SECTION_ADDITIONAL);
-					} else {
-						/* If IPv4 is specified, or no IP version is specified, default to A record and use IPv4 */
-						new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_A, LDNS_SECTION_ADDITIONAL);
-					}
+					new_ns_addr = ldns_pkt_rr_list_by_name_and_type(local_p, pop, LDNS_RR_TYPE_A, LDNS_SECTION_ADDITIONAL);
 				}
 				if (!new_ns_addr || ldns_rr_list_rr_count(new_ns_addr) == 0) {
 					new_ns_addr = ldns_get_rr_list_addr_by_name(res, pop, c, 0);
diff --git a/contrib/ldns/error.c b/contrib/ldns/error.c
index 5723aea9b4c2..50cdc6300bdd 100644
--- a/contrib/ldns/error.c
+++ b/contrib/ldns/error.c
@@ -189,8 +189,6 @@ ldns_lookup_table ldns_error_str[] = {
 	{ LDNS_STATUS_EDE_OPTION_MALFORMED,
 		"The extended error code option is malformed, expected "
 		"at least 2 bytes of option data" },
-	{ LDNS_STATUS_EQUAL_RR,
-		"An identical RR already existed in the zone" },
 	{ 0, NULL }
 };
 
diff --git a/contrib/ldns/host2str.c b/contrib/ldns/host2str.c
index e08c67537a7c..b753566a6c6e 100644
--- a/contrib/ldns/host2str.c
+++ b/contrib/ldns/host2str.c
@@ -407,14 +407,6 @@ ldns_rdf2buffer_str_int32(ldns_buffer *output, const ldns_rdf *rdf)
 }
 
 ldns_status
-ldns_rdf2buffer_str_int64(ldns_buffer *output, const ldns_rdf *rdf)
-{
-	uint64_t data = ldns_read_uint64(ldns_rdf_data(rdf));
-	ldns_buffer_printf(output, "%llu", (unsigned long long) data);
-	return ldns_buffer_status(output);
-}
-
-ldns_status
 ldns_rdf2buffer_str_time(ldns_buffer *output, const ldns_rdf *rdf)
 {
 	/* create a YYYYMMDDHHMMSS string if possible */
@@ -1230,34 +1222,6 @@ ldns_rdf2buffer_str_eui64(ldns_buffer *output, const ldns_rdf *rdf)
 }
 
 ldns_status
-ldns_rdf2buffer_str_unquoted(ldns_buffer *output, const ldns_rdf *rdf)
-{
-	size_t amount, i;
-	uint8_t ch;
-	if(ldns_rdf_size(rdf) < 1) {
-		return LDNS_STATUS_WIRE_RDATA_ERR;
-	}
-	if((int)ldns_rdf_size(rdf) < (int)ldns_rdf_data(rdf)[0] + 1) {
-		return LDNS_STATUS_WIRE_RDATA_ERR;
-	}
-	amount = ldns_rdf_data(rdf)[0];
-	for(i=0; i<amount; i++) {
-		ch = ldns_rdf_data(rdf)[1+i];
-		if (isprint((int)ch) || ch == '\t') {
-			if (ch == '\"' || ch == '\\' || ch == '\'' ||
-				ch == '(' || ch == ')' || isspace((int)ch))
-				ldns_buffer_printf(output, "\\%c", ch);
-			else
-				ldns_buffer_printf(output, "%c", ch);
-		} else {
-			ldns_buffer_printf(output, "\\%03u",
-                                (unsigned)(uint8_t) ch);
-		}
-	}
-	return ldns_buffer_status(output);
-}
-
-ldns_status
 ldns_rdf2buffer_str_tag(ldns_buffer *output, const ldns_rdf *rdf)
 {
 	size_t nchars;
@@ -1419,8 +1383,6 @@ ldns_rdf2buffer_str_amtrelay(ldns_buffer *output, const ldns_rdf *rdf)
 			precedence, discovery_optional, relay_type);
 	if (relay)
 	  	(void) ldns_rdf2buffer_str(output, relay);
-	else
-		ldns_buffer_printf(output, ".");
 
 	ldns_rdf_deep_free(relay);
 	return ldns_buffer_status(output);
@@ -1679,10 +1641,6 @@ ldns_rdf2buffer_str_fmt(ldns_buffer *buffer,
 		case LDNS_RDF_TYPE_INT32:
 			res = ldns_rdf2buffer_str_int32(buffer, rdf);
 			break;
-		case LDNS_RDF_TYPE_INT64:
-		case LDNS_RDF_TYPE_IPN:
-			res = ldns_rdf2buffer_str_int64(buffer, rdf);
-			break;
 		case LDNS_RDF_TYPE_PERIOD:
 			res = ldns_rdf2buffer_str_period(buffer, rdf);
 			break;
@@ -1765,9 +1723,6 @@ ldns_rdf2buffer_str_fmt(ldns_buffer *buffer,
 		case LDNS_RDF_TYPE_EUI64:
 			res = ldns_rdf2buffer_str_eui64(buffer, rdf);
 			break;
-		case LDNS_RDF_TYPE_UNQUOTED:
-			res = ldns_rdf2buffer_str_unquoted(buffer, rdf);
-			break;
 		case LDNS_RDF_TYPE_TAG:
 			res = ldns_rdf2buffer_str_tag(buffer, rdf);
 			break;
@@ -2587,18 +2542,6 @@ ldns_edns_ede2buffer_str(ldns_buffer* output, uint8_t* data, size_t len)
 	case LDNS_EDE_TOO_EARLY:
 		ldns_buffer_printf(output, " 26 (Too Early)");
 		break;
-	case LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS_VALUE:
-		ldns_buffer_printf(output, " 27 (Unsupported NSEC3 Iterations Value)");
-		break;
-	case LDNS_EDE_UNABLE_TO_CONFORM_TO_POLICY:
-		ldns_buffer_printf(output, " 28 (Unable to conform to policy)");
-		break;
-	case LDNS_EDE_SYNTHESIZED:
-		ldns_buffer_printf(output, " 29 (Synthesized)");
-		break;
-	case LDNS_EDE_INVALID_QUERY_TYPE:
-		ldns_buffer_printf(output, " 30 (Invalid Query Type)");
-		break;
 	default:
 		ldns_buffer_printf(output, " %02x", data[0]);
 		ldns_buffer_printf(output, " %02x", data[1]);
@@ -2827,9 +2770,6 @@ ldns_pkt2buffer_str_fmt(ldns_buffer *output,
 			if (ldns_pkt_edns_do(pkt)) {
 				ldns_buffer_printf(output, " do");
 			}
-			if (ldns_pkt_edns_co(pkt)) {
-				ldns_buffer_printf(output, " co");
-			}
 			/* the extended rcode is the value set, shifted four bits,
 			 * and or'd with the original rcode */
 			if (ldns_pkt_edns_extended_rcode(pkt)) {
diff --git a/contrib/ldns/host2wire.c b/contrib/ldns/host2wire.c
index 01a3df2e935f..d1539214796d 100644
--- a/contrib/ldns/host2wire.c
+++ b/contrib/ldns/host2wire.c
@@ -376,7 +376,7 @@ ldns_status
 ldns_pkt2buffer_wire(ldns_buffer *buffer, const ldns_pkt *packet)
 {
 	ldns_status status;
-	ldns_rbtree_t *compression_data = ldns_rbtree_create(ldns_dname_compare_v);
+	ldns_rbtree_t *compression_data = ldns_rbtree_create((int (*)(const void *, const void *))ldns_dname_compare);
 
 	status = ldns_pkt2buffer_wire_compress(buffer, packet, compression_data);
 
diff --git a/contrib/ldns/keys.c b/contrib/ldns/keys.c
index 5e71ba6ad6b5..8125de3f6b9f 100644
--- a/contrib/ldns/keys.c
+++ b/contrib/ldns/keys.c
@@ -1530,13 +1530,11 @@ ldns_key_hmac_key(const ldns_key *k)
 size_t
 ldns_key_hmac_size(const ldns_key *k)
 {
-#ifndef __clang_analyzer__
 	if (k->_key.hmac.size) {
 		return k->_key.hmac.size;
 	} else {
 		return 0;
 	}
-#endif
 }
 
 void *
diff --git a/contrib/ldns/ldns/config.h.in b/contrib/ldns/ldns/config.h.in
index a8f061617a84..5449bee63381 100644
--- a/contrib/ldns/ldns/config.h.in
+++ b/contrib/ldns/ldns/config.h.in
@@ -394,18 +394,9 @@
 /* Define this to enable RR type AVC. */
 #undef RRTYPE_AVC
 
-/* Define this to enable RR types CLA and IPN. */
-#undef RRTYPE_CLA_IPN
-
 /* Define this to enable RR type DOA. */
 #undef RRTYPE_DOA
 
-/* Define this to enable RR type DSYNC. */
-#undef RRTYPE_DSYNC
-
-/* Define this to enable RR types HHIT and BRID. */
-#undef RRTYPE_HHIT_BRID
-
 /* Define this to enable RR type NINFO. */
 #undef RRTYPE_NINFO
 
@@ -781,7 +772,7 @@ size_t strlcpy(char *dst, const char *src, size_t siz);
 #define close_socket(_s) do { if (_s != SOCK_INVALID) {closesocket(_s); _s = -1;} } while(0)
 #else
 #define SOCK_INVALID -1
-#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s >= -1 ? _s : -1); _s = -1;} } while(0)
+#define close_socket(_s) do { if (_s != SOCK_INVALID) {close(_s); _s = -1;} } while(0)
 #endif
 
 #ifdef __cplusplus
diff --git a/contrib/ldns/ldns/dnssec_zone.h b/contrib/ldns/ldns/dnssec_zone.h
index 335f57a3c4a6..156e39102327 100644
--- a/contrib/ldns/ldns/dnssec_zone.h
+++ b/contrib/ldns/ldns/dnssec_zone.h
@@ -131,8 +131,7 @@ void ldns_dnssec_rrs_deep_free(ldns_dnssec_rrs *rrs);
  *
  * \param[in] rrs the list to add to
  * \param[in] rr the RR to add
- * \return LDNS_STATUS_OK on success and LDNS_STATUS_EQUAL_ERR when and
- *         RR with equal ownername, class, type and rdata already exists.
+ * \return LDNS_STATUS_OK on success
  */
 ldns_status ldns_dnssec_rrs_add_rr(ldns_dnssec_rrs *rrs, ldns_rr *rr);
 
@@ -200,8 +199,7 @@ ldns_status ldns_dnssec_rrsets_set_type(ldns_dnssec_rrsets *rrsets,
  *
  * \param[in] rrsets the list of rrsets to add the RR to
  * \param[in] rr the rr to add to the list of rrsets
- * \return LDNS_STATUS_OK on success and LDNS_STATUS_EQUAL_ERR when and
- *         RR with equal ownername, class, type and rdata already exists.
+ * \return LDNS_STATUS_OK on success
  */
 ldns_status ldns_dnssec_rrsets_add_rr(ldns_dnssec_rrsets *rrsets, ldns_rr *rr);
 
@@ -315,9 +313,7 @@ int ldns_dnssec_name_cmp(const void *a, const void *b);
  *
  * \param[in] name The ldns_dnssec_name to add the RR to
  * \param[in] rr The RR to add
- * \return LDNS_STATUS_OK on success and LDNS_STATUS_EQUAL_ERR when and
- *         RR with equal ownername, class, type and rdata already exists,
- *         and an error code otherwise
+ * \return LDNS_STATUS_OK on success, error code otherwise
  */
 ldns_status ldns_dnssec_name_add_rr(ldns_dnssec_name *name,
 							 ldns_rr *rr);
@@ -419,9 +415,7 @@ void ldns_dnssec_zone_deep_free(ldns_dnssec_zone *zone);
  *
  * \param[in] zone the zone to add the RR to
  * \param[in] rr The RR to add
- * \return LDNS_STATUS_OK on success and LDNS_STATUS_EQUAL_ERR when and
- *         RR with equal ownername, class, type and rdata already exists,
- *         and an error code otherwise
+ * \return LDNS_STATUS_OK on success, an error code otherwise
  */
 ldns_status ldns_dnssec_zone_add_rr(ldns_dnssec_zone *zone,
 							 ldns_rr *rr);
diff --git a/contrib/ldns/ldns/edns.h b/contrib/ldns/ldns/edns.h
index 7e51ab322cea..a33ed0557679 100644
--- a/contrib/ldns/ldns/edns.h
+++ b/contrib/ldns/ldns/edns.h
@@ -76,11 +76,7 @@ enum ldns_edns_enum_ede_code
 	LDNS_EDE_NETWORK_ERROR = 23,
 	LDNS_EDE_INVALID_DATA = 24,
 	LDNS_EDE_SIGNATURE_EXPIRED_BEFORE_VALID = 25,
-	LDNS_EDE_TOO_EARLY = 26, /* RFC 9250 */
-	LDNS_EDE_UNSUPPORTED_NSEC3_ITERATIONS_VALUE = 27, /* RFC 9276 */
-	LDNS_EDE_UNABLE_TO_CONFORM_TO_POLICY = 28, /* draft-homburg-dnsop-codcp-00 */
-	LDNS_EDE_SYNTHESIZED = 29, /* https://github.com/PowerDNS/pdns/pull/12334 */
-	LDNS_EDE_INVALID_QUERY_TYPE = 30 /* RFC 9824 */
+	LDNS_EDE_TOO_EARLY = 26
 };
 typedef enum ldns_edns_enum_ede_code ldns_edns_ede_code;
 
diff --git a/contrib/ldns/ldns/error.h b/contrib/ldns/ldns/error.h
index a76eb2ecab5d..011df284725a 100644
--- a/contrib/ldns/ldns/error.h
+++ b/contrib/ldns/ldns/error.h
@@ -143,8 +143,7 @@ enum ldns_enum_status {
 	LDNS_STATUS_SVCPARAM_KEY_MORE_THAN_ONCE,
 	LDNS_STATUS_INVALID_SVCPARAM_VALUE,
 	LDNS_STATUS_NOT_EDE,
-	LDNS_STATUS_EDE_OPTION_MALFORMED,
-	LDNS_STATUS_EQUAL_RR
+	LDNS_STATUS_EDE_OPTION_MALFORMED
 };
 typedef enum ldns_enum_status ldns_status;
 
diff --git a/contrib/ldns/ldns/host2str.h b/contrib/ldns/ldns/host2str.h
index 2f67e2787938..79f5561a9451 100644
--- a/contrib/ldns/ldns/host2str.h
+++ b/contrib/ldns/ldns/host2str.h
@@ -581,14 +581,6 @@ ldns_status ldns_rdf2buffer_str_int16(ldns_buffer *output, const ldns_rdf *rdf);
  */
 ldns_status ldns_rdf2buffer_str_int32(ldns_buffer *output, const ldns_rdf *rdf);
 
-/** 
- * Converts an LDNS_RDF_TYPE_INT64 rdata element to presentation format.
- * \param[in] *rdf The rdata to convert
- * \param[in] *output The buffer to add the data to
- * \return LDNS_STATUS_OK on success, and error status on failure
- */
-ldns_status ldns_rdf2buffer_str_int64(ldns_buffer *output, const ldns_rdf *rdf);
-
 /**
  * Converts an LDNS_RDF_TYPE_TIME rdata element to string format and adds it to the output buffer
  * \param[in] *rdf The rdata to convert
@@ -627,16 +619,6 @@ ldns_status ldns_rdf2buffer_str_eui48(ldns_buffer *output,
 ldns_status ldns_rdf2buffer_str_eui64(ldns_buffer *output,
 		const ldns_rdf *rdf);
 
-/**
- * Adds the LDNS_RDF_TYPE_UNQUOTED rdata to the output buffer,
- * it escapes nonprinting and special characters.
- * \param[in] *rdf The rdata to convert
- * \param[in] *output The buffer to add the data to
- * \return LDNS_STATUS_OK on success, and error status on failure
- */
-ldns_status ldns_rdf2buffer_str_unquoted(ldns_buffer *output,
-		const ldns_rdf *rdf);
-
 /** 
  * Adds the LDNS_RDF_TYPE_TAG rdata to the output buffer,
  * provided it contains only alphanumeric characters.
diff --git a/contrib/ldns/ldns/packet.h b/contrib/ldns/ldns/packet.h
index 974944149a27..2c60609fc07a 100644
--- a/contrib/ldns/ldns/packet.h
+++ b/contrib/ldns/ldns/packet.h
@@ -710,19 +710,6 @@ bool ldns_pkt_edns_do(const ldns_pkt *packet);
 void ldns_pkt_set_edns_do(ldns_pkt *packet, bool value);
 
 /**
- * return the packet's edns co bit
- * \param[in] packet the packet
- * \return the bit's value
- */
-bool ldns_pkt_edns_co(const ldns_pkt *packet);
-/**
- * Set the packet's edns co bit
- * \param[in] packet the packet
- * \param[in] value the bit's new value
- */
-void ldns_pkt_set_edns_co(ldns_pkt *packet, bool value);
-
-/**
  * return the packet's EDNS header bits that are unassigned.
  */
 uint16_t ldns_pkt_edns_unassigned(const ldns_pkt *packet);
diff --git a/contrib/ldns/ldns/rdata.h b/contrib/ldns/ldns/rdata.h
index 7623bd17a73b..1e2fd397a38a 100644
--- a/contrib/ldns/ldns/rdata.h
+++ b/contrib/ldns/ldns/rdata.h
@@ -54,8 +54,6 @@ enum ldns_enum_rdf_type
 	LDNS_RDF_TYPE_INT16,
 	/** 32 bits */
 	LDNS_RDF_TYPE_INT32,
-	/** 64 bits */
-	LDNS_RDF_TYPE_INT64,
 	/** A record */
 	LDNS_RDF_TYPE_A,
 	/** AAAA record */
@@ -72,7 +70,6 @@ enum ldns_enum_rdf_type
 	LDNS_RDF_TYPE_HEX,
 	/** nsec type codes */
 	LDNS_RDF_TYPE_NSEC,
-	LDNS_RDF_TYPE_BITMAP = LDNS_RDF_TYPE_NSEC,
 	/** a RR type */
 	LDNS_RDF_TYPE_TYPE,
 	/** a class */
@@ -123,9 +120,6 @@ enum ldns_enum_rdf_type
 	/** 8 * 8 bit hex numbers separated by dashes. For EUI64. */
 	LDNS_RDF_TYPE_EUI64,
 
-	/** Character string without quotes. */
-	LDNS_RDF_TYPE_UNQUOTED,
-
 	/** A non-zero sequence of US-ASCII letters and numbers in lower case.
 	 *  For CAA.
 	 */
@@ -151,8 +145,8 @@ enum ldns_enum_rdf_type
 	/** draft-ietf-dnsop-svcb-https **/
 	LDNS_RDF_TYPE_SVCPARAMS,
 
-	/** draft-johnson-dns-ipn-cla-07 **/
-	LDNS_RDF_TYPE_IPN
+	/* Aliases */
+	LDNS_RDF_TYPE_BITMAP = LDNS_RDF_TYPE_NSEC
 };
 typedef enum ldns_enum_rdf_type ldns_rdf_type;
 
diff --git a/contrib/ldns/ldns/rr.h b/contrib/ldns/ldns/rr.h
index d2e4ee90aa9c..314f159707b3 100644
--- a/contrib/ldns/ldns/rr.h
+++ b/contrib/ldns/ldns/rr.h
@@ -194,9 +194,6 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_ZONEMD = 63, /* RFC 8976 */
 	LDNS_RR_TYPE_SVCB = 64, /* RFC 9460 */
 	LDNS_RR_TYPE_HTTPS = 65, /* RFC 9460 */
-	LDNS_RR_TYPE_DSYNC = 66, /* RFC 9859 */
-	LDNS_RR_TYPE_HHIT = 67, /* draft-ietf-drip-registries-28 */
-	LDNS_RR_TYPE_BRID = 68, /* draft-ietf-drip-registries-28 */
 
 	LDNS_RR_TYPE_SPF = 99, /* RFC 4408 */
 
@@ -213,7 +210,7 @@ enum ldns_enum_rr_type
 	LDNS_RR_TYPE_EUI48 = 108, /* RFC 7043 */
 	LDNS_RR_TYPE_EUI64 = 109, /* RFC 7043 */
 
-	LDNS_RR_TYPE_NXNAME = 128, /* RFC 9824 */
+	LDNS_RR_TYPE_NXNAME = 128, /* draft-ietf-dnsop-compact-denial-of-existence */
 
 	LDNS_RR_TYPE_TKEY = 249, /* RFC 2930 */
 	LDNS_RR_TYPE_TSIG = 250,
@@ -239,12 +236,6 @@ enum ldns_enum_rr_type
 	/** https://iana.org/assignments/dns-parameters/WALLET/wallet-completed-template */
 	LDNS_RR_TYPE_WALLET = 262,
 
-	/** https://www.iana.org/assignments/dns-parameters/CLA/cla-completed-template */
-	LDNS_RR_TYPE_CLA = 263,
-
-	/** https://www.iana.org/assignments/dns-parameters/IPN/ipn-completed-template */
-	LDNS_RR_TYPE_IPN = 264,
-
 	/** DNSSEC Trust Authorities */
 	LDNS_RR_TYPE_TA = 32768,
 	/* RFC 4431, 5074, DNSSEC Lookaside Validation */
@@ -260,7 +251,7 @@ enum ldns_enum_rr_type
 typedef enum ldns_enum_rr_type ldns_rr_type;
 
 /* The first fields are contiguous and can be referenced instantly */
-#define LDNS_RDATA_FIELD_DESCRIPTORS_COMMON (LDNS_RR_TYPE_IPN + 1)
+#define LDNS_RDATA_FIELD_DESCRIPTORS_COMMON (LDNS_RR_TYPE_WALLET + 1)
 
 /**
  * Resource Record
@@ -734,13 +725,6 @@ bool ldns_rr_list_contains_rr(const ldns_rr_list *rr_list, const ldns_rr *rr);
 bool ldns_is_rrset(const ldns_rr_list *rr_list);
 
 /**
- * checks if an rr_list is a rrset, including checking for TTL.
- * \param[in] rr_list the rr_list to check
- * \return true if it is an rrset otherwise false
- */
-bool ldns_is_rrset_strict(const ldns_rr_list *rr_list);
-
-/**
  * pushes an rr to an rrset (which really are rr_list's).
  * \param[in] *rr_list the rrset to push the rr to
  * \param[in] *rr the rr to push
diff --git a/contrib/ldns/ldns/str2host.h b/contrib/ldns/ldns/str2host.h
index 18bd7f6d7e8a..2892db0bfb1c 100644
--- a/contrib/ldns/ldns/str2host.h
+++ b/contrib/ldns/ldns/str2host.h
@@ -331,16 +331,6 @@ ldns_status ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str);
  */
 ldns_status ldns_str2rdf_svcparams(ldns_rdf **rd, const char *str);
 
-/**
- * Convert either two unsigned 32 bit decimal numbers seperated by a '.',
- * or a single unsigned 64 bit decimal number, as described in
- * [draft-johnson-dns-ipn-cla-07].
- * \param[out] rd the rdf where to put the data
- * \param[in] str the string to be converted
- * \return ldns_status
- */
-ldns_status ldns_str2rdf_ipn(ldns_rdf **rd, const char *str);
-
 
 #ifdef __cplusplus
 }
diff --git a/contrib/ldns/ldns/util.h.in b/contrib/ldns/ldns/util.h.in
index 6b243ac2b5af..7115a2b7f3bf 100644
--- a/contrib/ldns/ldns/util.h.in
+++ b/contrib/ldns/ldns/util.h.in
@@ -72,10 +72,8 @@ ldns_read_uint16(const void *src)
 #ifdef ALLOW_UNALIGNED_ACCESSES
 	return ntohs(*(const uint16_t *) src);
 #else
-# ifndef __clang_analyzer__
 	const uint8_t *p = (const uint8_t *) src;
 	return ((uint16_t) p[0] << 8) | (uint16_t) p[1];
-# endif
 #endif
 }
 
@@ -93,26 +91,6 @@ ldns_read_uint32(const void *src)
 #endif
 }
 
-INLINE uint64_t
-ldns_read_uint64(const void *src)
-{
-#ifdef ALLOW_UNALIGNED_ACCESSES
-	const uint32_t *p = (const uint32_t *) src;
-	return (  ((uint64_t) ntohl(src[0]) << 32)
-		|  (uint64_t) ntohl(src[1]));
-#else
-	const uint8_t *p = (const uint8_t *) src;
-	return (  ((uint64_t) p[0] << 56)
-		| ((uint64_t) p[1] << 48)
-		| ((uint64_t) p[2] << 40)
-		| ((uint64_t) p[3] << 32)
-		| ((uint64_t) p[4] << 24)
-		| ((uint64_t) p[5] << 16)
-		| ((uint64_t) p[6] << 8)
-		|  (uint64_t) p[7]);
-#endif
-}
-
 /*
  * Copy data allowing for unaligned accesses in network byte order
  * (big endian).
diff --git a/contrib/ldns/net.c b/contrib/ldns/net.c
index e944d018b357..8fc9c8c48d87 100644
--- a/contrib/ldns/net.c
+++ b/contrib/ldns/net.c
@@ -754,8 +754,6 @@ ldns_tcp_read_wire_timeout(int sockfd, size_t *size, struct timeval timeout)
 	uint16_t wire_size;
 	ssize_t bytes = 0, rc = 0;
 
-	if(sockfd < 0)
-		return NULL;
 	wire = LDNS_XMALLOC(uint8_t, 2);
 	if (!wire) {
 		*size = 0;
diff --git a/contrib/ldns/packet.c b/contrib/ldns/packet.c
index f11eba571ec0..d21e2e3c3fbd 100644
--- a/contrib/ldns/packet.c
+++ b/contrib/ldns/packet.c
@@ -27,10 +27,7 @@
  */
 
 #define LDNS_EDNS_MASK_DO_BIT 0x8000
-#define LDNS_EDNS_MASK_CO_BIT 0x4000
-#define LDNS_EDNS_MASK_UNASSIGNED (0xFFFF & ~( LDNS_EDNS_MASK_DO_BIT \
-                                             | LDNS_EDNS_MASK_CO_BIT ))
-
+#define LDNS_EDNS_MASK_UNASSIGNED (0xFFFF & ~LDNS_EDNS_MASK_DO_BIT)
 
 /* TODO defines for 3600 */
 /* convert to and from numerical flag values */
@@ -247,22 +244,6 @@ ldns_pkt_set_edns_do(ldns_pkt *packet, bool value)
 	}
 }
 
-bool
-ldns_pkt_edns_co(const ldns_pkt *packet)
-{
-	return (packet->_edns_z & LDNS_EDNS_MASK_CO_BIT);
-}
-
-void
-ldns_pkt_set_edns_co(ldns_pkt *packet, bool value)
-{
-	if (value) {
-		packet->_edns_z = packet->_edns_z | LDNS_EDNS_MASK_CO_BIT;
-	} else {
-		packet->_edns_z = packet->_edns_z & ~LDNS_EDNS_MASK_CO_BIT;
-	}
-}
-
 uint16_t
 ldns_pkt_edns_unassigned(const ldns_pkt *packet)
 {
@@ -773,7 +754,6 @@ ldns_pkt_edns(const ldns_pkt *pkt)
 		ldns_pkt_edns_extended_rcode(pkt) > 0 ||
 		ldns_pkt_edns_data(pkt) ||
 		ldns_pkt_edns_do(pkt) ||
-		ldns_pkt_edns_co(pkt) ||
 		pkt->_edns_list ||
                 pkt->_edns_present
 	       );
@@ -1275,7 +1255,6 @@ ldns_pkt_clone(const ldns_pkt *pkt)
 		ldns_pkt_set_edns_data(new_pkt, 
 			ldns_rdf_clone(ldns_pkt_edns_data(pkt)));
 	ldns_pkt_set_edns_do(new_pkt, ldns_pkt_edns_do(pkt));
-	ldns_pkt_set_edns_co(new_pkt, ldns_pkt_edns_co(pkt));
 	if (pkt->_edns_list)
 		ldns_pkt_set_edns_option_list(new_pkt,
 			ldns_edns_option_list_clone(pkt->_edns_list));
diff --git a/contrib/ldns/rdata.c b/contrib/ldns/rdata.c
index 5befc9e70f72..3f899a217eb7 100644
--- a/contrib/ldns/rdata.c
+++ b/contrib/ldns/rdata.c
@@ -345,9 +345,6 @@ ldns_rdf_new_frm_str(ldns_rdf_type type, const char *str)
 	case LDNS_RDF_TYPE_EUI64:
 		status = ldns_str2rdf_eui64(&rdf, str);
 		break;
-	case LDNS_RDF_TYPE_UNQUOTED:
-		status = ldns_str2rdf_str(&rdf, str);
-		break;
 	case LDNS_RDF_TYPE_TAG:
 		status = ldns_str2rdf_tag(&rdf, str);
 		break;
@@ -369,9 +366,6 @@ ldns_rdf_new_frm_str(ldns_rdf_type type, const char *str)
 	case LDNS_RDF_TYPE_SVCPARAMS:
 		status = ldns_str2rdf_svcparams(&rdf, str);
 		break;
-	case LDNS_RDF_TYPE_IPN:
-		status = ldns_str2rdf_ipn(&rdf, str);
-		break;
 	case LDNS_RDF_TYPE_NONE:
 	default:
 		/* default default ??? */
diff --git a/contrib/ldns/resolver.c b/contrib/ldns/resolver.c
index 0f2fdb52e5d0..a426b82c034e 100644
--- a/contrib/ldns/resolver.c
+++ b/contrib/ldns/resolver.c
@@ -1062,8 +1062,6 @@ ldns_resolver_search_status(ldns_pkt** pkt,
 		/* query as-is */
 		return ldns_resolver_query_status(pkt, r, name, t, c, flags);
 	} else if (ldns_resolver_dnsrch(r)) {
-		ldns_pkt *return_pkt = NULL;
-
 		search_list = ldns_resolver_searchlist(r);
 		for (i = 0; i <= ldns_resolver_searchlist_count(r); i++) {
 			if (i == ldns_resolver_searchlist_count(r)) {
@@ -1074,25 +1072,21 @@ ldns_resolver_search_status(ldns_pkt** pkt,
 						search_list[i]);
 			}
 
-			s = ldns_resolver_query_status(&return_pkt, r,
+			s = ldns_resolver_query_status(pkt, r,
 					new_name, t, c, flags);
 			ldns_rdf_deep_free(new_name);
 
-			if (return_pkt) {
+			if (pkt && *pkt) {
 				if (s == LDNS_STATUS_OK && 
-						ldns_pkt_get_rcode(return_pkt)
-						== LDNS_RCODE_NOERROR) {
+						ldns_pkt_get_rcode(*pkt) ==
+						LDNS_RCODE_NOERROR) {
 
 					return LDNS_STATUS_OK;
-				} else if (i < ldns_resolver_searchlist_count(r)) {
-					ldns_pkt_free(return_pkt);
-					return_pkt = NULL;
 				}
+				ldns_pkt_free(*pkt);
+				*pkt = NULL;
 			}
 		}
-		if (pkt && return_pkt) {
-			*pkt = return_pkt;
-		}
 	}
 	return s;
 }
diff --git a/contrib/ldns/rr.c b/contrib/ldns/rr.c
index a7ad259affaa..44e3369e32b3 100644
--- a/contrib/ldns/rr.c
+++ b/contrib/ldns/rr.c
@@ -391,6 +391,12 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 				ldns_buffer_skip(rd_buf, 1);
 				quoted = true;
 			}
+			if (!quoted && ldns_rr_descriptor_field_type(desc, r_cnt)
+					== LDNS_RDF_TYPE_LONG_STR) {
+
+				status = LDNS_STATUS_SYNTAX_RDATA_ERR;
+				goto error;
+			}
 		}
 
 		/* because number of fields can be variable, we can't rely on
@@ -406,8 +412,8 @@ ldns_rr_new_frm_str_internal(ldns_rr **newrr, const char *str,
 		}
 
 		pre_data_pos = ldns_buffer_position(rd_buf);
-		if (-1 == ldns_bget_token(
-				rd_buf, rd, delimiters, LDNS_MAX_RDFLEN)) {
+		if (-1 == (c = ldns_bget_token(
+				rd_buf, rd, delimiters, LDNS_MAX_RDFLEN))) {
 
 			done = true;
 			(void)done; /* we're breaking, so done not read anymore */
@@ -1282,47 +1288,7 @@ ldns_is_rrset(const ldns_rr_list *rr_list)
 		if (c != ldns_rr_get_class(tmp)) {
 			return false;
 		}
-		if (ldns_dname_compare(o, ldns_rr_owner(tmp)) != 0) {
-			return false;
-		}
-	}
-	return true;
-}
-
-bool
-ldns_is_rrset_strict(const ldns_rr_list *rr_list)
-{
-	ldns_rr_type t;
-	ldns_rr_class c;
-	uint32_t l;
-	ldns_rdf *o;
-	ldns_rr *tmp;
-	size_t i;
-
-	if (!rr_list || ldns_rr_list_rr_count(rr_list) == 0) {
-		return false;
-	}
-
-	tmp = ldns_rr_list_rr(rr_list, 0);
-
-	t = ldns_rr_get_type(tmp);
-	c = ldns_rr_get_class(tmp);
-	l = ldns_rr_ttl(tmp);
-	o = ldns_rr_owner(tmp);
-
-	/* compare these with the rest of the rr_list, start with 1 */
-	for (i = 1; i < ldns_rr_list_rr_count(rr_list); i++) {
-		tmp = ldns_rr_list_rr(rr_list, i);
-		if (t != ldns_rr_get_type(tmp)) {
-			return false;
-		}
-		if (c != ldns_rr_get_class(tmp)) {
-			return false;
-		}
-		if (l != ldns_rr_ttl(tmp)) {
-			return false;
-		}
-		if (ldns_dname_compare(o, ldns_rr_owner(tmp)) != 0) {
+		if (ldns_rdf_compare(o, ldns_rr_owner(tmp)) != 0) {
 			return false;
 		}
 	}
@@ -1716,8 +1682,8 @@ ldns_rr_compare(const ldns_rr *rr1, const ldns_rr *rr2)
 	return result;
 }
 
-/* convert (c)dnskey to a (c)ds with the given algorithm,
- * then compare the result with the given (c)ds */
+/* convert dnskey to a ds with the given algorithm,
+ * then compare the result with the given ds */
 static int
 ldns_rr_compare_ds_dnskey(ldns_rr *ds,
                           ldns_rr *dnskey)
@@ -1727,10 +1693,8 @@ ldns_rr_compare_ds_dnskey(ldns_rr *ds,
 	ldns_hash algo;
 
 	if (!dnskey || !ds ||
-	    (ldns_rr_get_type(ds) != LDNS_RR_TYPE_DS &&
-	     ldns_rr_get_type(ds) != LDNS_RR_TYPE_CDS) ||
-	    (ldns_rr_get_type(dnskey) != LDNS_RR_TYPE_DNSKEY &&
-	     ldns_rr_get_type(dnskey) != LDNS_RR_TYPE_CDNSKEY)) {
+	    ldns_rr_get_type(ds) != LDNS_RR_TYPE_DS ||
+	    ldns_rr_get_type(dnskey) != LDNS_RR_TYPE_DNSKEY) {
 		return false;
 	}
 
@@ -1764,12 +1728,6 @@ ldns_rr_compare_ds(const ldns_rr *orr1, const ldns_rr *orr2)
 	} else if (ldns_rr_get_type(rr1) == LDNS_RR_TYPE_DNSKEY &&
 	    ldns_rr_get_type(rr2) == LDNS_RR_TYPE_DS) {
 		result = ldns_rr_compare_ds_dnskey(rr2, rr1);
-	} else if (ldns_rr_get_type(rr1) == LDNS_RR_TYPE_CDS &&
-	    ldns_rr_get_type(rr2) == LDNS_RR_TYPE_CDNSKEY) {
-		result = ldns_rr_compare_ds_dnskey(rr1, rr2);
-	} else if (ldns_rr_get_type(rr1) == LDNS_RR_TYPE_CDNSKEY &&
-	    ldns_rr_get_type(rr2) == LDNS_RR_TYPE_CDS) {
-		result = ldns_rr_compare_ds_dnskey(rr2, rr1);
 	} else {
 		result = (ldns_rr_compare(rr1, rr2) == 0);
 	}
@@ -1940,7 +1898,7 @@ static const ldns_rdf_type type_nsap_wireformat[] = {
 	LDNS_RDF_TYPE_NSAP
 };
 static const ldns_rdf_type type_nsap_ptr_wireformat[] = {
-	LDNS_RDF_TYPE_UNQUOTED
+	LDNS_RDF_TYPE_STR
 };
 static const ldns_rdf_type type_sig_wireformat[] = {
 	LDNS_RDF_TYPE_TYPE, LDNS_RDF_TYPE_ALG, LDNS_RDF_TYPE_INT8, LDNS_RDF_TYPE_INT32,
@@ -1954,7 +1912,7 @@ static const ldns_rdf_type type_px_wireformat[] = {
 	LDNS_RDF_TYPE_INT16, LDNS_RDF_TYPE_DNAME, LDNS_RDF_TYPE_DNAME
 };
 static const ldns_rdf_type type_gpos_wireformat[] = {
-	LDNS_RDF_TYPE_UNQUOTED, LDNS_RDF_TYPE_UNQUOTED, LDNS_RDF_TYPE_UNQUOTED
+	LDNS_RDF_TYPE_STR, LDNS_RDF_TYPE_STR, LDNS_RDF_TYPE_STR
 };
 static const ldns_rdf_type type_aaaa_wireformat[] = { LDNS_RDF_TYPE_AAAA };
 static const ldns_rdf_type type_loc_wireformat[] = { LDNS_RDF_TYPE_LOC };
@@ -2031,23 +1989,6 @@ static const ldns_rdf_type type_svcb_wireformat[] = {
 	LDNS_RDF_TYPE_SVCPARAMS
 };
 #endif
-#ifdef RRTYPE_DSYNC
-static const ldns_rdf_type type_dsync_wireformat[] = {
-	LDNS_RDF_TYPE_TYPE,
-	LDNS_RDF_TYPE_INT8,
-	LDNS_RDF_TYPE_INT16,
-	LDNS_RDF_TYPE_DNAME
-};
-#endif
-#ifdef RRTYPE_HHIT_BRID
-static const ldns_rdf_type type_hhit_wireformat[] = {
-	LDNS_RDF_TYPE_B64
-};
-static const ldns_rdf_type type_brid_wireformat[] = {
-	LDNS_RDF_TYPE_B64
-};
-#endif
-
 /* nsec3 is some vars, followed by same type of data of nsec */
 static const ldns_rdf_type type_nsec3_wireformat[] = {
 /*	LDNS_RDF_TYPE_NSEC3_VARS, LDNS_RDF_TYPE_NSEC3_NEXT_OWNER, LDNS_RDF_TYPE_NSEC*/
@@ -2141,12 +2082,6 @@ static const ldns_rdf_type type_amtrelay_wireformat[] = {
 	LDNS_RDF_TYPE_AMTRELAY
 };
 #endif
-#ifdef RRTYPE_CLA_IPN
-static const ldns_rdf_type type_ipn_wireformat[] = {
-	LDNS_RDF_TYPE_IPN
-};
-#endif
-
 
 
 /** \endcond */
@@ -2314,21 +2249,9 @@ static ldns_rr_descriptor rdata_field_descriptors[] = {
 {LDNS_RR_TYPE_NULL, "TYPE64", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE65", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 #endif
-#ifdef RRTYPE_DSYNC
-	/* 66 */
-	{LDNS_RR_TYPE_DSYNC, "DSYNC", 4, 4, type_dsync_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 1 },
-#else
 {LDNS_RR_TYPE_NULL, "TYPE66", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#endif
-#ifdef RRTYPE_HHIT_BRID
-	/* 67 */
-	{LDNS_RR_TYPE_HHIT, "HHIT", 1, 1, type_hhit_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-	/* 68 */
-	{LDNS_RR_TYPE_BRID, "BRID", 1, 1, type_brid_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#else
 {LDNS_RR_TYPE_NULL, "TYPE67", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE68", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#endif
 {LDNS_RR_TYPE_NULL, "TYPE69", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE70", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 {LDNS_RR_TYPE_NULL, "TYPE71", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
@@ -2572,21 +2495,13 @@ static ldns_rr_descriptor rdata_field_descriptors[] = {
 #endif
 #ifdef RRTYPE_RESINFO
 	/* 261 */
-	{LDNS_RR_TYPE_RESINFO, "RESINFO", 1, 0, NULL, LDNS_RDF_TYPE_UNQUOTED, LDNS_RR_NO_COMPRESS, 0 },
+	{LDNS_RR_TYPE_RESINFO, "RESINFO", 1, 0, NULL, LDNS_RDF_TYPE_STR, LDNS_RR_NO_COMPRESS, 0 },
 #else
 {LDNS_RR_TYPE_NULL, "TYPE261", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
 #endif
 	/* 262 */
-	{LDNS_RR_TYPE_WALLET, "WALLET", 1, 0, NULL, LDNS_RDF_TYPE_STR, LDNS_RR_NO_COMPRESS, 0 },
-#ifdef RRTYPE_CLA_IPN
-	/* 263 */
-	{LDNS_RR_TYPE_CLA, "CLA", 1, 0, NULL, LDNS_RDF_TYPE_STR, LDNS_RR_NO_COMPRESS, 0 },
-	/* 264 */
-	{LDNS_RR_TYPE_IPN, "IPN", 1, 1, type_ipn_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#else
-{LDNS_RR_TYPE_NULL, "TYPE263", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-{LDNS_RR_TYPE_NULL, "TYPE264", 1, 1, type_0_wireformat, LDNS_RDF_TYPE_NONE, LDNS_RR_NO_COMPRESS, 0 },
-#endif
+	{LDNS_RR_TYPE_WALLET, "TXT", 1, 0, NULL, LDNS_RDF_TYPE_STR, LDNS_RR_NO_COMPRESS, 0 },
+
 /* split in array, no longer contiguous */
 
 #ifdef RRTYPE_TA
@@ -2672,14 +2587,6 @@ ldns_rdf_bitmap_known_rr_types_set(ldns_rdf** rdf, int value)
 	for (d=rdata_field_descriptors; d < rdata_field_descriptors_end; d++) {
 		window  = d->_type >> 8;
 		subtype = d->_type & 0xff;
-
-		/* In the code below, windows[window] == 0 means that the
-		 * window is not in use. So subtype == 0 is a problem. The
-		 * easiest solution is to set subtype to 1, that marks the
-		 * window as in use and doesn't have negative effects.
-		 */
-		if (subtype == 0)
-			subtype = 1;
 		if (windows[window] < subtype) {
 			windows[window] = subtype;
 		}
diff --git a/contrib/ldns/sha1.c b/contrib/ldns/sha1.c
index 470bdfec3799..9b7e60ece090 100644
--- a/contrib/ldns/sha1.c
+++ b/contrib/ldns/sha1.c
@@ -97,7 +97,7 @@ ldns_sha1_transform(uint32_t state[5], const unsigned char buffer[LDNS_SHA1_BLOC
     state[4] += e;
     /* Wipe variables */
     a = b = c = d = e = 0;
-    (void)a; (void)b; (void)c; (void)d; (void)e;
+    (void)a;
 }
 
 
diff --git a/contrib/ldns/sha2.c b/contrib/ldns/sha2.c
index 59a6b9d30fc6..8988ee06d04b 100644
--- a/contrib/ldns/sha2.c
+++ b/contrib/ldns/sha2.c
@@ -494,8 +494,7 @@ static void ldns_sha256_Transform(ldns_sha256_CTX* context,
 
 	/* Clean up */
 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
-	(void)a; (void)b; (void)c; (void)d; (void)e; (void)f; (void)g; (void)h;
-	(void)T1; (void)T2;
+	(void)a;
 }
 
 #endif /* SHA2_UNROLL_TRANSFORM */
@@ -529,7 +528,7 @@ void ldns_sha256_update(ldns_sha256_CTX* context, const sha2_byte *data, size_t
 			context->bitcount += len << 3;
 			/* Clean up: */
 			usedspace = freespace = 0;
-			(void)usedspace; (void)freespace;
+			(void)usedspace;
 			return;
 		}
 	}
@@ -547,7 +546,7 @@ void ldns_sha256_update(ldns_sha256_CTX* context, const sha2_byte *data, size_t
 	}
 	/* Clean up: */
 	usedspace = freespace = 0;
-	(void)usedspace; (void)freespace;
+	(void)usedspace;
 }
 
 typedef union _ldns_sha2_buffer_union {
@@ -738,7 +737,6 @@ static void ldns_sha512_Transform(ldns_sha512_CTX* context,
 	sha2_word64	a, b, c, d, e, f, g, h, s0, s1;
 	sha2_word64	T1, T2, *W512 = (sha2_word64*)context->buffer;
 	int		j;
-	sha2_word64	aligned;
 
 	/* initialize registers with the prev. intermediate value */
 	a = context->state[0];
@@ -754,8 +752,7 @@ static void ldns_sha512_Transform(ldns_sha512_CTX* context,
 	do {
 #if BYTE_ORDER == LITTLE_ENDIAN
 		/* Convert TO host byte order */
-		memcpy(&aligned, data++, sizeof(aligned));
-		REVERSE64(aligned, W512[j]);
+		REVERSE64(*data++, W512[j]);
 		/* Apply the SHA-512 compression function to update a..h */
 		T1 = h + Sigma1_512(e) + Ch(e, f, g) + K512[j] + W512[j];
 #else /* BYTE_ORDER == LITTLE_ENDIAN */
@@ -810,8 +807,7 @@ static void ldns_sha512_Transform(ldns_sha512_CTX* context,
 
 	/* Clean up */
 	a = b = c = d = e = f = g = h = T1 = T2 = 0;
-	(void)a; (void)b; (void)c; (void)d; (void)e; (void)f; (void)g; (void)h;
-	(void)T1; (void)T2;
+	(void)a;
 }
 
 #endif /* SHA2_UNROLL_TRANSFORM */
@@ -845,7 +841,7 @@ void ldns_sha512_update(ldns_sha512_CTX* context, const sha2_byte *data, size_t
 			ADDINC128(context->bitcount, len << 3);
 			/* Clean up: */
 			usedspace = freespace = 0;
-			(void)usedspace; (void)freespace;
+			(void)usedspace;
 			return;
 		}
 	}
@@ -863,7 +859,7 @@ void ldns_sha512_update(ldns_sha512_CTX* context, const sha2_byte *data, size_t
 	}
 	/* Clean up: */
 	usedspace = freespace = 0;
-	(void)usedspace; (void)freespace;
+	(void)usedspace;
 }
 
 static void ldns_sha512_Last(ldns_sha512_CTX* context) {
diff --git a/contrib/ldns/str2host.c b/contrib/ldns/str2host.c
index 9959a982156c..02cbb19dad0e 100644
--- a/contrib/ldns/str2host.c
+++ b/contrib/ldns/str2host.c
@@ -225,69 +225,6 @@ ldns_str2rdf_int32(ldns_rdf **rd, const char *longstr)
 	}
 }
 
-#ifdef __BYTE_ORDER__
-# if __BYTE_ORDER__ == __ORDER_BIG_ENDIAN__
-#  define htonll(x) (x)
-#  define ntohll(x) (x)
-# else
-#  define htonll(x) (((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
-#  define ntohll(x) (((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
-# endif
-#else
-# define htonll(x) ((1==htonl(1)) ? (x) : ((uint64_t)htonl((x) & 0xFFFFFFFF) << 32) | htonl((x) >> 32))
-# define ntohll(x) ((1==ntohl(1)) ? (x) : ((uint64_t)ntohl((x) & 0xFFFFFFFF) << 32) | ntohl((x) >> 32))
-#endif
-
-ldns_status
-ldns_str2rdf_ipn(ldns_rdf **rd, const char *ipnstr)
-{
-	char *end;
-	uint8_t r[sizeof(uint64_t)];
-	char left[21], *right;
-
-	if(strlen(ipnstr) > 21)
-		return LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW;
-	errno = 0; /* must set to zero before call,
-			note race condition on errno */
-	if((right = strchr(ipnstr, '.'))) {
-		uint32_t u32 = strtoul(right + 1, &end, 10);
-
-		if(*end != 0)
-			return LDNS_STATUS_ERR;
-
-		if(errno == ERANGE)
-			return LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW;
-
-		u32 = htonl(u32);
-		memcpy(r + sizeof(uint32_t), &u32, sizeof(uint32_t));
-		memcpy(left, ipnstr, right - ipnstr);
-		left[right - ipnstr] = 0;
-
-		u32 = strtoul(left, &end, 10);
-		if(*end != 0)
-			return LDNS_STATUS_ERR;
-
-		if(errno == ERANGE)
-			return LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW;
-
-		u32 = htonl(u32);
-		memcpy(r, &u32, sizeof(uint32_t));
-	} else {
-		uint64_t u64 = strtoull(ipnstr, &end, 10);
-		
-		if(*end != 0)
-			return LDNS_STATUS_ERR;
-
-		if(u64 == ULLONG_MAX && errno == ERANGE)
-			return LDNS_STATUS_SYNTAX_INTEGER_OVERFLOW;
-
-		u64 = htonll(u64);
-		memcpy(r, &u64, sizeof(uint64_t));
-	}
-	*rd = ldns_rdf_new_frm_data(LDNS_RDF_TYPE_IPN, sizeof(r), r);
-	return *rd ? LDNS_STATUS_OK : LDNS_STATUS_MEM_ERR;
-}
-
 ldns_status
 ldns_str2rdf_int8(ldns_rdf **rd, const char *bytestr)
 {
@@ -1831,7 +1768,6 @@ ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str)
 			LDNS_FREE(relay);
 		LDNS_FREE(token);
 		ldns_buffer_free(str_buf);
-		ldns_rdf_deep_free(relay_rdf);
 		return LDNS_STATUS_INVALID_STR;
 	}
 
@@ -1847,7 +1783,7 @@ ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str)
 			LDNS_FREE(relay);
 		LDNS_FREE(token);
 		ldns_buffer_free(str_buf);
-		ldns_rdf_deep_free(relay_rdf);
+		if (relay_rdf) ldns_rdf_free(relay_rdf);
 		return LDNS_STATUS_MEM_ERR;
 	}
 
@@ -1866,7 +1802,7 @@ ldns_str2rdf_amtrelay(ldns_rdf **rd, const char *str)
 		LDNS_FREE(relay);
 	LDNS_FREE(token);
 	ldns_buffer_free(str_buf);
-	ldns_rdf_deep_free(relay_rdf);
+	ldns_rdf_free(relay_rdf);
 	LDNS_FREE(data);
 	if(!*rd) return LDNS_STATUS_MEM_ERR;
 	return LDNS_STATUS_OK;
diff --git a/contrib/ldns/util.c b/contrib/ldns/util.c
index a634203e4e18..ab51a9912165 100644
--- a/contrib/ldns/util.c
+++ b/contrib/ldns/util.c
@@ -347,11 +347,6 @@ ldns_init_random(FILE *fd, unsigned int size)
 	unsigned int seed_i;
 	struct timeval tv;
 
-#ifdef HAVE_SSL
-	if(RAND_status() == 1)
-		/* already seeded */
-		return 0;
-#endif
 	/* we'll need at least sizeof(unsigned int) bytes for the
 	   standard prng seed */
 	if (size < (unsigned int) sizeof(seed_i)){
diff --git a/contrib/ldns/wire2host.c b/contrib/ldns/wire2host.c
index 9c05001493b8..91d3f1364d75 100644
--- a/contrib/ldns/wire2host.c
+++ b/contrib/ldns/wire2host.c
@@ -223,8 +223,6 @@ ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *pos)
 			break;
 		case LDNS_RDF_TYPE_ILNP64:
 		case LDNS_RDF_TYPE_EUI64:
-		case LDNS_RDF_TYPE_IPN:
-		case LDNS_RDF_TYPE_INT64:
 			cur_rdf_length = LDNS_RDF_SIZE_8BYTES;
 			break;
 		case LDNS_RDF_TYPE_AAAA:
@@ -232,7 +230,6 @@ ldns_wire2rdf(ldns_rr *rr, const uint8_t *wire, size_t max, size_t *pos)
 			break;
 		case LDNS_RDF_TYPE_STR:
 		case LDNS_RDF_TYPE_NSEC3_SALT:
-		case LDNS_RDF_TYPE_UNQUOTED:
 		case LDNS_RDF_TYPE_TAG:
 			/* len is stored in first byte
 			 * it should be in the rdf too, so just
diff --git a/contrib/ldns/zone.c b/contrib/ldns/zone.c
index bf65738527c4..feda2466def6 100644
--- a/contrib/ldns/zone.c
+++ b/contrib/ldns/zone.c
@@ -347,7 +347,7 @@ error:
 		ldns_rdf_deep_free(my_prev);
 	}
 	if (newzone) {
-		ldns_zone_deep_free(newzone);
+		ldns_zone_free(newzone);
 	}
 	return ret;
 }