From b222783ae90533f2e50cc04e2408ef8d5a9bc869 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Mon, 4 Jun 2018 13:41:09 +0200
Subject: [PATCH 01/12] Add small tweaks to the code to fix compilation when
 ISC assertions are disabled

While implementing the new unit testing framework cmocka, it was found that the
BIND 9 code doesn't compile when assertions are disabled or replaced with any
function (such as mock_assert() from cmocka unit testing framework) that's not
directly recognized as assertion by the compiler.

This made the compiler to complain about blocks of code that was recognized as
unreachable before, but now it isn't.

The changes in this commit include:

* assigns default values to couple of local variables,
* moves some return statements around INSIST assertions,
* adds __builtin_unreachable(); annotations after some INSIST assertions,
* fixes one broken assertion (= instead of ==)

(cherry picked from commit fbd2e47f519ab1d6edbd4b9b50a1cebff31217e9)
---
 bin/dig/dighost.c             |  2 +-
 bin/named/server.c            | 10 +++++-----
 bin/named/zoneconf.c          |  2 +-
 bin/tests/system/rpz/dnsrps.c |  6 ++++--
 config.h.in                   |  3 +++
 configure                     | 32 ++++++++++++++++++++++++++++++++
 configure.ac                  | 15 +++++++++++++++
 lib/dns/dnstap.c              |  1 +
 lib/dns/master.c              |  5 +++--
 lib/dns/rpz.c                 |  7 ++++---
 lib/isc/include/isc/util.h    |  6 ++++++
 lib/isc/pk11.c                |  1 +
 lib/ns/client.c               |  2 +-
 lib/ns/query.c                |  2 +-
 14 files changed, 78 insertions(+), 16 deletions(-)

diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index ac493e2cd79..e30dbe38fd7 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2343,7 +2343,7 @@ setup_lookup(dig_lookup_t *lookup) {
 
 		if (lookup->ecs_addr != NULL) {
 			uint8_t addr[16];
-			uint16_t family;
+			uint16_t family = 0;
 			uint32_t plen;
 			struct sockaddr *sa;
 			struct sockaddr_in *sin;
diff --git a/bin/named/server.c b/bin/named/server.c
index 219ec13fcd3..916ea7c1401 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -2720,7 +2720,7 @@ catz_create_chg_task(dns_catz_entry_t *entry, dns_catz_zone_t *origin,
 	catz_chgzone_event_t *event;
 	isc_task_t *task;
 	isc_result_t result;
-	isc_taskaction_t action;
+	isc_taskaction_t action = NULL;
 
 	switch (type) {
 	case DNS_EVENT_CATZADDZONE:
@@ -4332,7 +4332,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		obj2 = cfg_tuple_get(obj, "response");
 		if (!cfg_obj_isvoid(obj2)) {
 			const char *resp = cfg_obj_asstring(obj2);
-			isc_result_t r;
+			isc_result_t r = DNS_R_SERVFAIL;
 
 			if (strcasecmp(resp, "drop") == 0)
 				r = DNS_R_DROP;
@@ -4953,7 +4953,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 	obj2 = cfg_tuple_get(obj, "response");
 	if (!cfg_obj_isvoid(obj2)) {
 		const char *resp = cfg_obj_asstring(obj2);
-		isc_result_t r;
+		isc_result_t r = DNS_R_SERVFAIL;
 
 		if (strcasecmp(resp, "drop") == 0)
 			r = DNS_R_DROP;
@@ -5203,7 +5203,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *empty_dbtype[4] =
 				    { "_builtin", "empty", NULL, NULL };
 		int empty_dbtypec = 4;
-		dns_zonestat_level_t statlevel;
+		dns_zonestat_level_t statlevel = dns_zonestat_none;
 
 		name = dns_fixedname_initname(&fixed);
 
@@ -12556,7 +12556,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	const char *viewname = NULL;
 	dns_rdataclass_t rdclass;
 	dns_view_t *view = NULL;
-	const char *bn;
+	const char *bn = NULL;
 
 	REQUIRE(viewp != NULL && *viewp == NULL);
 	REQUIRE(zoneobjp != NULL && *zoneobjp == NULL);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 40965ffa236..c757a7225a1 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -866,7 +866,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	const dns_master_style_t *masterstyle = &dns_master_style_default;
 	isc_stats_t *zoneqrystats;
 	dns_stats_t *rcvquerystats;
-	dns_zonestat_level_t statlevel;
+	dns_zonestat_level_t statlevel = dns_zonestat_none;
 	int seconds;
 	dns_zone_t *mayberaw = (raw != NULL) ? raw : zone;
 	isc_dscp_t dscp;
diff --git a/bin/tests/system/rpz/dnsrps.c b/bin/tests/system/rpz/dnsrps.c
index 2674083a104..5b8a07d8e8c 100644
--- a/bin/tests/system/rpz/dnsrps.c
+++ b/bin/tests/system/rpz/dnsrps.c
@@ -81,10 +81,11 @@ main(int argc, char **argv) {
 			}
 #ifdef USE_DNSRPS
 			printf("%s\n", librpz->dnsrpzd_path);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'n':
 			if (!link_dnsrps(&emsg)) {
@@ -131,10 +132,11 @@ main(int argc, char **argv) {
 			librpz->rsp_detach(&rsp);
 			librpz->client_detach(&client);
 			printf("%u\n", serial);
-			return (0);
 #else
 			INSIST(0);
+			ISC_UNREACHABLE();
 #endif
+			return (0);
 
 		case 'w':
 			seconds = strtod(optarg, &p);
diff --git a/config.h.in b/config.h.in
index ed1d2160b91..2eb2c614fff 100644
--- a/config.h.in
+++ b/config.h.in
@@ -197,6 +197,9 @@ int sigwait(const unsigned int *set, int *sig);
 /* Define to 1 if the compiler supports __builtin_expect. */
 #undef HAVE_BUILTIN_EXPECT
 
+/* define if the compiler supports __builtin_unreachable(). */
+#undef HAVE_BUILTIN_UNREACHABLE
+
 /* Define to 1 if you have the `chroot' function. */
 #undef HAVE_CHROOT
 
diff --git a/configure b/configure
index 92666187f94..c0f9bbcb7da 100755
--- a/configure
+++ b/configure
@@ -21126,6 +21126,38 @@ fi
 ISC_ARCH_DIR=$arch
 
 
+#
+# Check for __builtin_unreachable
+#
+{ $as_echo "$as_me:${as_lineno-$LINENO}: checking compiler support for __builtin_unreachable()" >&5
+$as_echo_n "checking compiler support for __builtin_unreachable()... " >&6; }
+cat confdefs.h - <<_ACEOF >conftest.$ac_ext
+/* end confdefs.h.  */
+
+int
+main ()
+{
+__builtin_unreachable();
+
+  ;
+  return 0;
+}
+_ACEOF
+if ac_fn_c_try_link "$LINENO"; then :
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+$as_echo "yes" >&6; }
+
+$as_echo "#define HAVE_BUILTIN_UNREACHABLE 1" >>confdefs.h
+
+
+else
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+$as_echo "no" >&6; }
+
+fi
+rm -f core conftest.err conftest.$ac_objext \
+    conftest$ac_exeext conftest.$ac_ext
+
 #
 # Check for __builtin_expect
 #
diff --git a/configure.ac b/configure.ac
index 49645b28f00..112506b1ad5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -4185,6 +4185,21 @@ AC_SUBST(ISC_PLATFORM_USEMACASM)
 ISC_ARCH_DIR=$arch
 AC_SUBST(ISC_ARCH_DIR)
 
+#
+# Check for __builtin_unreachable
+#
+AC_MSG_CHECKING([compiler support for __builtin_unreachable()])
+AC_LINK_IFELSE(
+  [AC_LANG_PROGRAM(
+     [[]],
+     [[__builtin_unreachable();]]
+   )],
+  [AC_MSG_RESULT([yes])
+   AC_DEFINE([HAVE_BUILTIN_UNREACHABLE], [1], [define if the compiler supports __builtin_unreachable().])
+  ],
+  [AC_MSG_RESULT([no])
+  ])
+
 #
 # Check for __builtin_expect
 #
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index 1dbfdb7f11a..df64ebd0e46 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -706,6 +706,7 @@ dnstap_type(dns_dtmsgtype_t msgtype) {
 		return (DNSTAP__MESSAGE__TYPE__TOOL_RESPONSE);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 154cf2c47d2..1f105bcae06 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -548,8 +548,6 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 
 	lctx->format = format;
 	switch (format) {
-	default:
-		INSIST(0);
 	case dns_masterformat_text:
 		lctx->openfile = openfile_text;
 		lctx->load = load_text;
@@ -562,6 +560,9 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 		lctx->openfile = openfile_map;
 		lctx->load = load_map;
 		break;
+	default:
+		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (lex != NULL) {
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 266b908c29a..db7375c41d3 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -572,8 +572,8 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 		bool inc)
 {
-	dns_rpz_trigger_counter_t *cnt;
-	dns_rpz_zbits_t *have;
+	dns_rpz_trigger_counter_t *cnt = 0;
+	dns_rpz_zbits_t *have = 0;
 
 	switch (rpz_type) {
 	case DNS_RPZ_TYPE_CLIENT_IP:
@@ -616,6 +616,7 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (inc) {
@@ -2492,7 +2493,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 	dns_rpz_addr_zbits_t tgt_set;
 	dns_rpz_cidr_node_t *found;
 	isc_result_t result;
-	dns_rpz_num_t rpz_num;
+	dns_rpz_num_t rpz_num = 0;
 	dns_rpz_have_t have;
 	int i;
 
diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 75a63c1400b..1593a327938 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -203,6 +203,12 @@
  */
 #include <isc/likely.h>
 
+#ifdef HAVE_BUILTIN_UNREACHABLE
+#define ISC_UNREACHABLE() __builtin_unreachable();
+#else
+#define ISC_UNREACHABLE()
+#endif
+
 /*
  * Assertions
  */
diff --git a/lib/isc/pk11.c b/lib/isc/pk11.c
index 9108056518a..cd18804c20f 100644
--- a/lib/isc/pk11.c
+++ b/lib/isc/pk11.c
@@ -997,6 +997,7 @@ pk11_numbits(CK_BYTE_PTR data, unsigned int bytecnt) {
 		break;
 	}
 	INSIST(0);
+	ISC_UNREACHABLE();
 }
 
 CK_ATTRIBUTE *
diff --git a/lib/ns/client.c b/lib/ns/client.c
index a32d58fe8f8..f6095dfa317 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1685,7 +1685,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 		isc_buffer_t buf;
 		uint8_t addr[16];
 		uint32_t plen, addrl;
-		uint16_t family;
+		uint16_t family = 0;
 
 		/* Add CLIENT-SUBNET option. */
 
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 64ac94244e9..4fde30ec3eb 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2556,7 +2556,7 @@ rpz_get_zbits(ns_client_t *client,
 	      dns_rdatatype_t ip_type, dns_rpz_type_t rpz_type)
 {
 	dns_rpz_st_t *st;
-	dns_rpz_zbits_t zbits;
+	dns_rpz_zbits_t zbits = 0;
 
 	REQUIRE(client != NULL);
 	REQUIRE(client->query.rpz_st != NULL);
-- 
GitLab


From fcd1569e2bc0dbdbfcac78ffac87fc202fd6bd05 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Thu, 11 Oct 2018 11:57:57 +0200
Subject: [PATCH 02/12] Turn (int & flag) into (int & flag) != 0 when
 implicitly typed to bool

(cherry picked from commit b2b43fd235b88b24bd68ca21ae6b9e37aad87440)
---
 bin/named/server.c                    |  9 +++---
 lib/dns/adb.c                         |  7 ++---
 lib/dns/client.c                      | 10 +++----
 lib/dns/dispatch.c                    |  4 +--
 lib/dns/dnssec.c                      | 12 ++++----
 lib/dns/dst_api.c                     |  8 ++---
 lib/dns/ecdb.c                        |  2 +-
 lib/dns/journal.c                     |  9 +++---
 lib/dns/master.c                      |  2 +-
 lib/dns/masterdump.c                  |  6 ++--
 lib/dns/message.c                     |  8 ++---
 lib/dns/name.c                        | 11 +++----
 lib/dns/nsec.c                        |  2 +-
 lib/dns/nsec3.c                       | 13 ++++-----
 lib/dns/openssl_link.c                |  2 +-
 lib/dns/private.c                     |  6 ++--
 lib/dns/rbtdb.c                       |  7 +++--
 lib/dns/rdata/generic/keydata_65533.c |  8 +++--
 lib/dns/rdata/generic/soa_6.c         |  8 +++--
 lib/dns/request.c                     |  6 ++--
 lib/dns/resolver.c                    | 14 ++++-----
 lib/dns/rpz.c                         |  4 +--
 lib/dns/sdb.c                         |  2 +-
 lib/dns/sdlz.c                        |  3 +-
 lib/dns/tsig.c                        |  2 +-
 lib/dns/update.c                      |  6 ++--
 lib/dns/zone.c                        | 18 +++++++-----
 lib/irs/getaddrinfo.c                 |  2 +-
 lib/irs/getnameinfo.c                 |  2 +-
 lib/isc/httpd.c                       |  2 +-
 lib/isc/include/isc/radix.h           |  2 --
 lib/isc/lex.c                         |  6 ++--
 lib/isc/log.c                         | 22 +++++++-------
 lib/isc/radix.c                       |  2 ++
 lib/isc/task.c                        |  4 +--
 lib/isc/tests/socket_test.c           |  2 +-
 lib/isc/tests/task_test.c             |  2 +-
 lib/isc/tm.c                          |  2 +-
 lib/isc/unix/socket.c                 | 32 +++++++++++---------
 lib/isc/win32/fsaccess.c              | 42 ++++++++++++++++++---------
 lib/isc/win32/socket.c                | 20 ++++++-------
 lib/isccfg/namedconf.c                | 14 +++++----
 lib/isccfg/parser.c                   | 30 ++++++++++---------
 lib/ns/query.c                        |  7 +++--
 lib/ns/server.c                       |  2 +-
 lib/ns/xfrout.c                       |  2 +-
 46 files changed, 212 insertions(+), 174 deletions(-)

diff --git a/bin/named/server.c b/bin/named/server.c
index 916ea7c1401..ab7d9460d41 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -8854,7 +8854,8 @@ load_configuration(const char *filename, named_server_t *server,
 	{
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
-		named_g_memstatistics = (isc_mem_debugging & ISC_MEM_DEBUGRECORD);
+		named_g_memstatistics =
+			((isc_mem_debugging & ISC_MEM_DEBUGRECORD) != 0);
 	}
 
 	obj = NULL;
@@ -14054,8 +14055,8 @@ named_server_zonestatus(named_server_t *server, isc_lex_t *lex,
 
 	/* Security */
 	secure = dns_db_issecure(db);
-	allow = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW);
-	maintain = (dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN);
+	allow = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_ALLOW) != 0);
+	maintain = ((dns_zone_getkeyopts(zone) & DNS_ZONEKEY_MAINTAIN) != 0);
 
 	/* Master files */
 	file = dns_zone_getfile(mayberaw);
@@ -14716,7 +14717,7 @@ mkey_dumpzone(dns_view_t *view, isc_buffer_t **text) {
 			snprintf(buf, sizeof(buf), "\n\talgorithm: %s", alg);
 			CHECK(putstr(text, buf));
 
-			revoked = (kd.flags & DNS_KEYFLAG_REVOKE);
+			revoked = ((kd.flags & DNS_KEYFLAG_REVOKE) != 0);
 			snprintf(buf, sizeof(buf), "\n\tflags:%s%s%s",
 				 revoked ? " REVOKE" : "",
 				 ((kd.flags & DNS_KEYFLAG_KSK) != 0)
diff --git a/lib/dns/adb.c b/lib/dns/adb.c
index fd7492663ba..68336b78b2a 100644
--- a/lib/dns/adb.c
+++ b/lib/dns/adb.c
@@ -2191,7 +2191,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find,
 
 	bucket = DNS_ADB_INVALIDBUCKET;
 
-	if (find->options & DNS_ADBFIND_INET) {
+	if ((find->options & DNS_ADBFIND_INET) != 0) {
 		namehook = ISC_LIST_HEAD(name->v4);
 		while (namehook != NULL) {
 			entry = namehook->entry;
@@ -2231,7 +2231,7 @@ copy_namehook_lists(dns_adb_t *adb, dns_adbfind_t *find,
 		}
 	}
 
-	if (find->options & DNS_ADBFIND_INET6) {
+	if ((find->options & DNS_ADBFIND_INET6) != 0) {
 		namehook = ISC_LIST_HEAD(name->v6);
 		while (namehook != NULL) {
 			entry = namehook->entry;
@@ -3714,8 +3714,7 @@ dbfind_name(dns_adbname_t *adbname, isc_stdtime_t now, dns_rdatatype_t rdtype)
 	result = dns_view_find2(adb->view, &adbname->name, rdtype, now,
 				NAME_GLUEOK(adbname) ? DNS_DBFIND_GLUEOK : 0,
 				NAME_HINTOK(adbname),
-				(adbname->flags & NAME_STARTATZONE) != 0 ?
-				true : false,
+				((adbname->flags & NAME_STARTATZONE) != 0),
 				NULL, NULL, fname, &rdataset, NULL);
 
 	/* XXXVIX this switch statement is too sparse to gen a jump table. */
diff --git a/lib/dns/client.c b/lib/dns/client.c
index 0a6313ab7ff..e1224cb9a70 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -1340,10 +1340,10 @@ dns_client_startresolve(dns_client_t *client, const dns_name_t *name,
 	mctx = client->mctx;
 	rdataset = NULL;
 	sigrdataset = NULL;
-	want_dnssec = !(options & DNS_CLIENTRESOPT_NODNSSEC);
-	want_validation = !(options & DNS_CLIENTRESOPT_NOVALIDATE);
-	want_cdflag = !(options & DNS_CLIENTRESOPT_NOCDFLAG);
-	want_tcp = (options & DNS_CLIENTRESOPT_TCP);
+	want_dnssec = ((options & DNS_CLIENTRESOPT_NODNSSEC) == 0);
+	want_validation = ((options & DNS_CLIENTRESOPT_NOVALIDATE) == 0);
+	want_cdflag = ((options & DNS_CLIENTRESOPT_NOCDFLAG) == 0);
+	want_tcp = ((options & DNS_CLIENTRESOPT_TCP) != 0);
 
 	/*
 	 * Prepare some intermediate resources
@@ -2855,7 +2855,7 @@ dns_client_startupdate(dns_client_t *client, dns_rdataclass_t rdclass,
 	if (result != ISC_R_SUCCESS)
 		return (result);
 
-	want_tcp = (options & DNS_CLIENTUPDOPT_TCP);
+	want_tcp = ((options & DNS_CLIENTUPDOPT_TCP) != 0);
 
 	/*
 	 * Create a context and prepare some resources.
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 0692711fe2c..3e15b7ccc0f 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -1171,7 +1171,7 @@ udp_recv(isc_event_t *ev_in, dns_dispatch_t *disp, dispsocket_t *dispsock) {
 
 	dispatch_log(disp, LVL(92),
 		     "got valid DNS message header, /QR %c, id %u",
-		     ((flags & DNS_MESSAGEFLAG_QR) ? '1' : '0'), id);
+		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);
 
 	/*
 	 * Look at flags.  If query, drop it. If response,
@@ -1424,7 +1424,7 @@ tcp_recv(isc_task_t *task, isc_event_t *ev_in) {
 
 	dispatch_log(disp, LVL(92),
 		     "got valid DNS message header, /QR %c, id %u",
-		     ((flags & DNS_MESSAGEFLAG_QR) ? '1' : '0'), id);
+		     (((flags & DNS_MESSAGEFLAG_QR) != 0) ? '1' : '0'), id);
 
 	/*
 	 * Allocate an event to send to the query or response client, and
diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c
index 156406f6b56..ff171b9fdf1 100644
--- a/lib/dns/dnssec.c
+++ b/lib/dns/dnssec.c
@@ -46,7 +46,7 @@
 
 LIBDNS_EXTERNAL_DATA isc_stats_t *dns_dnssec_stats;
 
-#define is_response(msg) (msg->flags & DNS_MESSAGEFLAG_QR)
+#define is_response(msg) ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
 
 #define RETERR(x) do { \
 	result = (x); \
@@ -220,10 +220,12 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Is the key allowed to sign data?
 	 */
 	flags = dst_key_flags(key);
-	if (flags & DNS_KEYTYPE_NOAUTH)
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
 		return (DNS_R_KEYUNAUTHORIZED);
-	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE)
+	}
+	if ((flags & DNS_KEYFLAG_OWNERMASK) != DNS_KEYOWNER_ZONE) {
 		return (DNS_R_KEYUNAUTHORIZED);
+	}
 
 	sig.mctx = mctx;
 	sig.common.rdclass = set->rdclass;
@@ -456,7 +458,7 @@ dns_dnssec_verify3(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key,
 	 * Is the key allowed to sign data?
 	 */
 	flags = dst_key_flags(key);
-	if (flags & DNS_KEYTYPE_NOAUTH) {
+	if ((flags & DNS_KEYTYPE_NOAUTH) != 0) {
 		inc_stat(dns_dnssecstats_fail);
 		return (DNS_R_KEYUNAUTHORIZED);
 	}
@@ -1287,7 +1289,7 @@ dns_dnsseckey_create(isc_mem_t *mctx, dst_key_t **dstkey,
 	dk->index = 0;
 
 	/* KSK or ZSK? */
-	dk->ksk = (dst_key_flags(dk->key) & DNS_KEYFLAG_KSK);
+	dk->ksk = ((dst_key_flags(dk->key) & DNS_KEYFLAG_KSK) != 0);
 
 	/* Is this an old-style key? */
 	result = dst_key_getprivateformat(dk->key, &major, &minor);
diff --git a/lib/dns/dst_api.c b/lib/dns/dst_api.c
index 77cfea3ca81..e130a9240fe 100644
--- a/lib/dns/dst_api.c
+++ b/lib/dns/dst_api.c
@@ -515,13 +515,13 @@ dst_key_tofile(const dst_key_t *key, int type, const char *directory) {
 	if (key->func->tofile == NULL)
 		return (DST_R_UNSUPPORTEDALG);
 
-	if (type & DST_TYPE_PUBLIC) {
+	if ((type & DST_TYPE_PUBLIC) != 0) {
 		ret = write_public_key(key, type, directory);
 		if (ret != ISC_R_SUCCESS)
 			return (ret);
 	}
 
-	if ((type & DST_TYPE_PRIVATE) &&
+	if (((type & DST_TYPE_PRIVATE) != 0) &&
 	    (key->key_flags & DNS_KEYFLAG_TYPEMASK) != DNS_KEYTYPE_NOKEY)
 		return (key->func->tofile(key, directory));
 	else
@@ -737,7 +737,7 @@ dst_key_todns(const dst_key_t *key, isc_buffer_t *target) {
 	isc_buffer_putuint8(target, (uint8_t)key->key_proto);
 	isc_buffer_putuint8(target, (uint8_t)key->key_alg);
 
-	if (key->key_flags & DNS_KEYFLAG_EXTENDED) {
+	if ((key->key_flags & DNS_KEYFLAG_EXTENDED) != 0) {
 		if (isc_buffer_availablelength(target) < 2)
 			return (ISC_R_NOSPACE);
 		isc_buffer_putuint16(target,
@@ -775,7 +775,7 @@ dst_key_fromdns(const dns_name_t *name, dns_rdataclass_t rdclass,
 	id = dst_region_computeid(&r, alg);
 	rid = dst_region_computerid(&r, alg);
 
-	if (flags & DNS_KEYFLAG_EXTENDED) {
+	if ((flags & DNS_KEYFLAG_EXTENDED) != 0) {
 		if (isc_buffer_remaininglength(source) < 2)
 			return (DST_R_INVALIDPUBLICKEY);
 		extflags = isc_buffer_getuint16(source);
diff --git a/lib/dns/ecdb.c b/lib/dns/ecdb.c
index 12f149c1562..62fed490ee7 100644
--- a/lib/dns/ecdb.c
+++ b/lib/dns/ecdb.c
@@ -725,7 +725,7 @@ rdataset_current(dns_rdataset_t *rdataset, dns_rdata_t *rdata) {
 	raw += 2;
 #endif
 	if (rdataset->type == dns_rdatatype_rrsig) {
-		if (*raw & DNS_RDATASLAB_OFFLINE)
+		if ((*raw & DNS_RDATASLAB_OFFLINE) != 0)
 			flags |= DNS_RDATA_OFFLINE;
 		length--;
 		raw++;
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 9bb50f8a9ae..89e1e101903 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -361,7 +361,7 @@ journal_header_decode(journal_rawheader_t *raw, journal_header_t *cooked) {
 	journal_pos_decode(&raw->h.end, &cooked->end);
 	cooked->index_size = decode_uint32(raw->h.index_size);
 	cooked->sourceserial = decode_uint32(raw->h.sourceserial);
-	cooked->serialset = (raw->h.flags & JOURNAL_SERIALSET);
+	cooked->serialset = ((raw->h.flags & JOURNAL_SERIALSET) != 0);
 }
 
 static void
@@ -375,8 +375,9 @@ journal_header_encode(journal_header_t *cooked, journal_rawheader_t *raw) {
 	journal_pos_encode(&raw->h.end, &cooked->end);
 	encode_uint32(cooked->index_size, raw->h.index_size);
 	encode_uint32(cooked->sourceserial, raw->h.sourceserial);
-	if (cooked->serialset)
+	if (cooked->serialset) {
 		flags |= JOURNAL_SERIALSET;
+	}
 	raw->h.flags = flags;
 }
 
@@ -699,8 +700,8 @@ dns_journal_open(isc_mem_t *mctx, const char *filename, unsigned int mode,
 	char backup[1024];
 	bool writable, create;
 
-	create = (mode & DNS_JOURNAL_CREATE);
-	writable = (mode & (DNS_JOURNAL_WRITE|DNS_JOURNAL_CREATE));
+	create = ((mode & DNS_JOURNAL_CREATE) != 0);
+	writable = ((mode & (DNS_JOURNAL_WRITE|DNS_JOURNAL_CREATE)) != 0);
 
 	result = journal_open(mctx, filename, writable, create, journalp);
 	if (result == ISC_R_NOTFOUND) {
diff --git a/lib/dns/master.c b/lib/dns/master.c
index 1f105bcae06..724235ddd1c 100644
--- a/lib/dns/master.c
+++ b/lib/dns/master.c
@@ -583,7 +583,7 @@ loadctx_create(dns_masterformat_t format, isc_mem_t *mctx,
 		isc_lex_setcomments(lctx->lex, ISC_LEXCOMMENT_DNSMASTERFILE);
 	}
 
-	lctx->ttl_known = (options & DNS_MASTER_NOTTL);
+	lctx->ttl_known = ((options & DNS_MASTER_NOTTL) != 0);
 	lctx->ttl = 0;
 	lctx->default_ttl_known = lctx->ttl_known;
 	lctx->default_ttl = 0;
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index 357ae863b23..f45345c8d5b 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1024,7 +1024,7 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 
 	for (i = 0; i < n; i++) {
 		dns_rdataset_t *rds = sorted[i];
-		if (ctx->style.flags & DNS_STYLEFLAG_TRUST) {
+		if ((ctx->style.flags & DNS_STYLEFLAG_TRUST) != 0) {
 			if ((ctx->style.flags & DNS_STYLEFLAG_INDENT) != 0 ||
 			    (ctx->style.flags & DNS_STYLEFLAG_YAML) != 0)
 			{
@@ -1047,8 +1047,8 @@ dump_rdatasets_text(isc_mem_t *mctx, const dns_name_t *name,
 			if ((ctx->style.flags & DNS_STYLEFLAG_OMIT_OWNER) != 0)
 				name = NULL;
 		}
-		if (ctx->style.flags & DNS_STYLEFLAG_RESIGN &&
-		    rds->attributes & DNS_RDATASETATTR_RESIGN) {
+		if (((ctx->style.flags & DNS_STYLEFLAG_RESIGN) != 0) &&
+		    ((rds->attributes & DNS_RDATASETATTR_RESIGN) != 0)) {
 			isc_buffer_t b;
 			char buf[sizeof("YYYYMMDDHHMMSS")];
 			memset(buf, 0, sizeof(buf));
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 8b82d153397..3359dafdf2d 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1007,7 +1007,7 @@ getquestions(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 
 	section = &msg->sections[DNS_SECTION_QUESTION];
 
-	best_effort = (options & DNS_MESSAGEPARSE_BESTEFFORT);
+	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	seen_problem = false;
 
 	name = NULL;
@@ -1239,8 +1239,8 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t *dctx,
 	bool preserve_order, best_effort, seen_problem;
 	bool issigzero;
 
-	preserve_order = (options & DNS_MESSAGEPARSE_PRESERVEORDER);
-	best_effort = (options & DNS_MESSAGEPARSE_BESTEFFORT);
+	preserve_order = ((options & DNS_MESSAGEPARSE_PRESERVEORDER) != 0);
+	best_effort = ((options & DNS_MESSAGEPARSE_BESTEFFORT) != 0);
 	seen_problem = false;
 
 	section = &msg->sections[sectionid];
@@ -1676,7 +1676,7 @@ dns_message_parse(dns_message_t *msg, isc_buffer_t *source,
 	REQUIRE(msg->from_to_wire == DNS_MESSAGE_INTENTPARSE);
 
 	seen_problem = false;
-	ignore_tc = (options & DNS_MESSAGEPARSE_IGNORETRUNCATION);
+	ignore_tc = ((options & DNS_MESSAGEPARSE_IGNORETRUNCATION) != 0);
 
 	origsource = *source;
 
diff --git a/lib/dns/name.c b/lib/dns/name.c
index 75996daad25..a66cc5b34c1 100644
--- a/lib/dns/name.c
+++ b/lib/dns/name.c
@@ -1113,7 +1113,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source,
 	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
 		(target == NULL && ISC_BUFFER_VALID(name->buffer)));
 
-	downcase = (options & DNS_NAME_DOWNCASE);
+	downcase = ((options & DNS_NAME_DOWNCASE) != 0);
 
 	if (target == NULL && name->buffer != NULL) {
 		target = name->buffer;
@@ -1408,7 +1408,7 @@ dns_name_totext2(const dns_name_t *name, unsigned int options,
 	dns_name_totextfilter_t totext_filter_proc = NULL;
 	isc_result_t result;
 #endif
-	bool omit_final_dot = (options & DNS_NAME_OMITFINALDOT);
+	bool omit_final_dot = ((options & DNS_NAME_OMITFINALDOT) != 0);
 
 	/*
 	 * This function assumes the name is in proper uncompressed
@@ -1824,7 +1824,7 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 	REQUIRE((target != NULL && ISC_BUFFER_VALID(target)) ||
 		(target == NULL && ISC_BUFFER_VALID(name->buffer)));
 
-	downcase = (options & DNS_NAME_DOWNCASE);
+	downcase = ((options & DNS_NAME_DOWNCASE) != 0);
 
 	if (target == NULL && name->buffer != NULL) {
 		target = name->buffer;
@@ -1908,9 +1908,10 @@ dns_name_fromwire(dns_name_t *name, isc_buffer_t *source,
 				/*
 				 * Ordinary 14-bit pointer.
 				 */
-				if ((dctx->allowed & DNS_COMPRESS_GLOBAL14) ==
-				    0)
+				if ((dctx->allowed & DNS_COMPRESS_GLOBAL14) == 0)
+				{
 					return (DNS_R_DISALLOWED);
+				}
 				new_current = c & 0x3F;
 				state = fw_newcurrent;
 			} else
diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c
index 253298b5bea..daef882cb79 100644
--- a/lib/dns/nsec.c
+++ b/lib/dns/nsec.c
@@ -58,7 +58,7 @@ dns_nsec_isset(const unsigned char *array, unsigned int type) {
 	shift = 7 - (type % 8);
 	mask = 1 << shift;
 
-	return (byte & mask);
+	return ((byte & mask) != 0);
 }
 
 unsigned int
diff --git a/lib/dns/nsec3.c b/lib/dns/nsec3.c
index 505ed0db9ef..c404b5f35de 100644
--- a/lib/dns/nsec3.c
+++ b/lib/dns/nsec3.c
@@ -2098,13 +2098,12 @@ dns_nsec3_noexistnodata(dns_rdatatype_t type, const dns_name_t *name,
 			*exists = false;
 			*data = false;
 			if (optout != NULL) {
-				if ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0)
-					(*logit)(arg, ISC_LOG_DEBUG(3),
-						 "NSEC3 indicates optout");
-				else
-					(*logit)(arg, ISC_LOG_DEBUG(3),
-						 "NSEC3 indicates secure range");
-				*optout = (nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
+				*optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT)
+					   != 0);
+				(*logit)(arg, ISC_LOG_DEBUG(3),
+					 (*optout
+					  ? "NSEC3 indicates optout"
+					  : "NSEC3 indicates secure range"));
 			}
 			answer = ISC_R_SUCCESS;
 		}
diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c
index 1bde9d83fc0..aad75939165 100644
--- a/lib/dns/openssl_link.c
+++ b/lib/dns/openssl_link.c
@@ -480,7 +480,7 @@ dst__openssl_toresult3(isc_logcategory_t *category,
 		isc_log_write(dns_lctx, category,
 			      DNS_LOGMODULE_CRYPTO, ISC_LOG_INFO,
 			      "%s:%s:%d:%s", buf, file, line,
-			      (flags & ERR_TXT_STRING) ? data : "");
+			      ((flags & ERR_TXT_STRING) != 0) ? data : "");
 	}
 
     done:
diff --git a/lib/dns/private.c b/lib/dns/private.c
index b694f8cd151..9651381d2e5 100644
--- a/lib/dns/private.c
+++ b/lib/dns/private.c
@@ -312,9 +312,9 @@ dns_private_totext(dns_rdata_t *private, isc_buffer_t *buf) {
 
 		CHECK(dns_rdata_tostruct(&rdata, &nsec3param, NULL));
 
-		del = (nsec3param.flags & DNS_NSEC3FLAG_REMOVE);
-		init = (nsec3param.flags & DNS_NSEC3FLAG_INITIAL);
-		nonsec = (nsec3param.flags & DNS_NSEC3FLAG_NONSEC);
+		del = ((nsec3param.flags & DNS_NSEC3FLAG_REMOVE) != 0);
+		init = ((nsec3param.flags & DNS_NSEC3FLAG_INITIAL) != 0);
+		nonsec = ((nsec3param.flags & DNS_NSEC3FLAG_NONSEC) != 0);
 
 		nsec3param.flags &= ~(DNS_NSEC3FLAG_CREATE|
 				      DNS_NSEC3FLAG_REMOVE|
diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c
index 0dc7ae59ad5..f1b0ab5fa8e 100644
--- a/lib/dns/rbtdb.c
+++ b/lib/dns/rbtdb.c
@@ -5742,7 +5742,8 @@ createiterator(dns_db_t *db, unsigned int options, dns_dbiterator_t **iteratorp)
 	rbtdbiter->common.methods = &dbiterator_methods;
 	rbtdbiter->common.db = NULL;
 	dns_db_attach(db, &rbtdbiter->common.db);
-	rbtdbiter->common.relative_names = (options & DNS_DB_RELATIVENAMES);
+	rbtdbiter->common.relative_names =
+		((options & DNS_DB_RELATIVENAMES) != 0);
 	rbtdbiter->common.magic = DNS_DBITERATOR_MAGIC;
 	rbtdbiter->common.cleaning = false;
 	rbtdbiter->paused = true;
@@ -5752,8 +5753,8 @@ createiterator(dns_db_t *db, unsigned int options, dns_dbiterator_t **iteratorp)
 	dns_fixedname_init(&rbtdbiter->origin);
 	rbtdbiter->node = NULL;
 	rbtdbiter->delcnt = 0;
-	rbtdbiter->nsec3only = (options & DNS_DB_NSEC3ONLY);
-	rbtdbiter->nonsec3 = (options & DNS_DB_NONSEC3);
+	rbtdbiter->nsec3only = ((options & DNS_DB_NSEC3ONLY) != 0);
+	rbtdbiter->nonsec3 = ((options & DNS_DB_NONSEC3) != 0);
 	memset(rbtdbiter->deletions, 0, sizeof(rbtdbiter->deletions));
 	dns_rbtnodechain_init(&rbtdbiter->chain, db->mctx);
 	dns_rbtnodechain_init(&rbtdbiter->nsec3chain, db->mctx);
diff --git a/lib/dns/rdata/generic/keydata_65533.c b/lib/dns/rdata/generic/keydata_65533.c
index 06b56c1e1ad..30ba9676e7f 100644
--- a/lib/dns/rdata/generic/keydata_65533.c
+++ b/lib/dns/rdata/generic/keydata_65533.c
@@ -129,12 +129,14 @@ totext_keydata(ARGS_TOTEXT) {
 	RETERR(str_totext(buf, target));
 	RETERR(str_totext(" ", target));
 	if ((flags & DNS_KEYFLAG_KSK) != 0) {
-		if (flags & DNS_KEYFLAG_REVOKE)
+		if ((flags & DNS_KEYFLAG_REVOKE) != 0) {
 			keyinfo = "revoked KSK";
-		else
+		} else {
 			keyinfo = "KSK";
-	} else
+		}
+	} else {
 		keyinfo = "ZSK";
+	}
 
 	/* protocol */
 	snprintf(buf, sizeof(buf), "%u", sr.base[0]);
diff --git a/lib/dns/rdata/generic/soa_6.c b/lib/dns/rdata/generic/soa_6.c
index c21d64b35fc..246a998993e 100644
--- a/lib/dns/rdata/generic/soa_6.c
+++ b/lib/dns/rdata/generic/soa_6.c
@@ -92,9 +92,11 @@ totext_soa(ARGS_TOTEXT) {
 	REQUIRE(rdata->length != 0);
 
 	multiline = (tctx->flags & DNS_STYLEFLAG_MULTILINE);
-	comm = (multiline) ?
-		(tctx->flags & DNS_STYLEFLAG_RRCOMMENT) :
-		false;
+	if (multiline) {
+		comm = ((tctx->flags & DNS_STYLEFLAG_RRCOMMENT) != 0);
+	} else {
+		comm = false;
+	}
 
 	dns_name_init(&mname, NULL);
 	dns_name_init(&rname, NULL);
diff --git a/lib/dns/request.c b/lib/dns/request.c
index b2468c7fd74..a244b4b0979 100644
--- a/lib/dns/request.c
+++ b/lib/dns/request.c
@@ -1055,8 +1055,8 @@ dns_request_createvia4(dns_requestmgr_t *requestmgr, dns_message_t *message,
 		dns_tsigkey_attach(key, &request->tsigkey);
 
  use_tcp:
-	tcp = (options & DNS_REQUESTOPT_TCP);
-	share = (options & DNS_REQUESTOPT_SHARE);
+	tcp = ((options & DNS_REQUESTOPT_TCP) != 0);
+	share = ((options & DNS_REQUESTOPT_SHARE) != 0);
 	result = get_dispatch(tcp, false, share,
 			      requestmgr, srcaddr, destaddr,
 			      dscp, &connected, &request->dispatch);
@@ -1317,7 +1317,7 @@ bool
 dns_request_usedtcp(dns_request_t *request) {
 	REQUIRE(VALID_REQUEST(request));
 
-	return (request->flags & DNS_REQUEST_F_TCP);
+	return ((request->flags & DNS_REQUEST_F_TCP) != 0);
 }
 
 void
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 3b70d77b5ae..79d65a27aab 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -2347,7 +2347,7 @@ resquery_send(resquery_t *query) {
 	bool cleanup_cctx = false;
 	bool secure_domain;
 	bool connecting = false;
-	bool tcp = (query->options & DNS_FETCHOPT_TCP);
+	bool tcp = ((query->options & DNS_FETCHOPT_TCP) != 0);
 	dns_ednsopt_t ednsopts[DNS_EDNSOPTIONS];
 	unsigned ednsopt = 0;
 	uint16_t hint = 0, udpsize = 0;	/* No EDNS */
@@ -2435,7 +2435,7 @@ resquery_send(resquery_t *query) {
 	else if (res->view->enablevalidation &&
 		 ((fctx->qmessage->flags & DNS_MESSAGEFLAG_RD) != 0))
 	{
-		bool checknta = !(query->options & DNS_FETCHOPT_NONTA);
+		bool checknta = ((query->options & DNS_FETCHOPT_NONTA) == 0);
 		result = issecuredomain(res->view, &fctx->name, fctx->type,
 					isc_time_seconds(&query->start),
 					checknta, &secure_domain);
@@ -3344,7 +3344,7 @@ findname(fetchctx_t *fctx, const dns_name_t *name, in_port_t port,
 	isc_result_t result;
 
 	res = fctx->res;
-	unshared = (fctx->options & DNS_FETCHOPT_UNSHARED);
+	unshared = ((fctx->options & DNS_FETCHOPT_UNSHARED) != 0);
 	/*
 	 * If this name is a subdomain of the query domain, tell
 	 * the ADB to start looking using zone/hint data. This keeps us
@@ -5102,7 +5102,7 @@ validated(isc_task_t *task, isc_event_t *event) {
 
 	negative = (vevent->rdataset == NULL);
 
-	sentresponse = (fctx->options & DNS_FETCHOPT_NOVALIDATE);
+	sentresponse = ((fctx->options & DNS_FETCHOPT_NOVALIDATE) != 0);
 
 	/*
 	 * If shutting down, ignore the results.  Check to see if we're
@@ -5724,7 +5724,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_adbaddrinfo_t *addrinfo,
 	/*
 	 * Cache or validate each cacheable rdataset.
 	 */
-	fail = (fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL);
+	fail = ((fctx->res->options & DNS_RESOLVER_CHECKNAMESFAIL) != 0);
 	for (rdataset = ISC_LIST_HEAD(name->list);
 	     rdataset != NULL;
 	     rdataset = ISC_LIST_NEXT(rdataset, link))
@@ -7417,7 +7417,7 @@ static void
 rctx_answer_init(respctx_t *rctx) {
 	fetchctx_t *fctx = rctx->fctx;
 
-	rctx->aa = (fctx->rmessage->flags & DNS_MESSAGEFLAG_AA);
+	rctx->aa = ((fctx->rmessage->flags & DNS_MESSAGEFLAG_AA) != 0);
 	if (rctx->aa) {
 		rctx->trust = dns_trust_authanswer;
 	} else {
@@ -9280,7 +9280,7 @@ rctx_logpacket(respctx_t *rctx) {
 
 	dns_dt_send(fctx->res->view, dtmsgtype, la,
 		    &rctx->query->addrinfo->sockaddr,
-		    (rctx->query->options & DNS_FETCHOPT_TCP),
+		    ((rctx->query->options & DNS_FETCHOPT_TCP) != 0),
 		    &zr, &rctx->query->start, NULL, &rctx->devent->buffer);
 #endif /* HAVE_DNSTAP */
 }
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index db7375c41d3..518eb27409f 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -572,8 +572,8 @@ adj_trigger_cnt(dns_rpz_zones_t *rpzs, dns_rpz_num_t rpz_num,
 		const dns_rpz_cidr_key_t *tgt_ip, dns_rpz_prefix_t tgt_prefix,
 		bool inc)
 {
-	dns_rpz_trigger_counter_t *cnt = 0;
-	dns_rpz_zbits_t *have = 0;
+	dns_rpz_trigger_counter_t *cnt = NULL;
+	dns_rpz_zbits_t *have = NULL;
 
 	switch (rpz_type) {
 	case DNS_RPZ_TYPE_CLIENT_IP:
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index 1a20f36b6f6..0b61fb8f6ff 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1085,7 +1085,7 @@ createiterator(dns_db_t *db, unsigned int options, dns_dbiterator_t **iteratorp)
 	sdbiter->common.methods = &dbiterator_methods;
 	sdbiter->common.db = NULL;
 	dns_db_attach(db, &sdbiter->common.db);
-	sdbiter->common.relative_names = (options & DNS_DB_RELATIVENAMES);
+	sdbiter->common.relative_names = ((options & DNS_DB_RELATIVENAMES) != 0);
 	sdbiter->common.magic = DNS_DBITERATOR_MAGIC;
 	ISC_LIST_INIT(sdbiter->nodelist);
 	sdbiter->current = NULL;
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index 9661d85c520..d570d7db308 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -821,7 +821,8 @@ createiterator(dns_db_t *db, unsigned int options, dns_dbiterator_t **iteratorp)
 	sdlziter->common.methods = &dbiterator_methods;
 	sdlziter->common.db = NULL;
 	dns_db_attach(db, &sdlziter->common.db);
-	sdlziter->common.relative_names = (options & DNS_DB_RELATIVENAMES);
+	sdlziter->common.relative_names =
+		((options & DNS_DB_RELATIVENAMES) != 0);
 	sdlziter->common.magic = DNS_DBITERATOR_MAGIC;
 	ISC_LIST_INIT(sdlziter->nodelist);
 	sdlziter->current = NULL;
diff --git a/lib/dns/tsig.c b/lib/dns/tsig.c
index 9f25b932781..9864569514d 100644
--- a/lib/dns/tsig.c
+++ b/lib/dns/tsig.c
@@ -50,7 +50,7 @@
 #define DNS_TSIG_MAXGENERATEDKEYS 4096
 #endif
 
-#define is_response(msg) (msg->flags & DNS_MESSAGEFLAG_QR)
+#define is_response(msg) ((msg->flags & DNS_MESSAGEFLAG_QR) != 0)
 
 #define BADTIMELEN 6
 
diff --git a/lib/dns/update.c b/lib/dns/update.c
index b235ccb6690..6c9df17bd97 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1430,9 +1430,11 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		 * and one doesn't.
 		 */
 		state->check_ksk =
-			(dns_zone_getoptions(zone) & DNS_ZONEOPT_UPDATECHECKKSK);
+			((dns_zone_getoptions(zone) &
+			  DNS_ZONEOPT_UPDATECHECKKSK) != 0);
 		state->keyset_kskonly =
-			(dns_zone_getoptions(zone) & DNS_ZONEOPT_DNSKEYKSKONLY);
+			((dns_zone_getoptions(zone) &
+			  DNS_ZONEOPT_DNSKEYKSKONLY) != 0);
 
 		/*
 		 * Get the NSEC/NSEC3 TTL from the SOA MINIMUM field.
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index b9de7f33ec9..44127e6a70c 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -3428,27 +3428,28 @@ zone_addnsec3chain(dns_zone_t *zone, dns_rdata_nsec3param_t *nsec3param) {
 		strlcpy(flags, "NONE", sizeof(flags));
 	else {
 		flags[0] = '\0';
-		if (nsec3param->flags & DNS_NSEC3FLAG_REMOVE)
+		if ((nsec3param->flags & DNS_NSEC3FLAG_REMOVE) != 0) {
 			strlcat(flags, "REMOVE", sizeof(flags));
-		if (nsec3param->flags & DNS_NSEC3FLAG_INITIAL) {
+		}
+		if ((nsec3param->flags & DNS_NSEC3FLAG_INITIAL) != 0) {
 			if (flags[0] == '\0')
 				strlcpy(flags, "INITIAL", sizeof(flags));
 			else
 				strlcat(flags, "|INITIAL", sizeof(flags));
 		}
-		if (nsec3param->flags & DNS_NSEC3FLAG_CREATE) {
+		if ((nsec3param->flags & DNS_NSEC3FLAG_CREATE) != 0) {
 			if (flags[0] == '\0')
 				strlcpy(flags, "CREATE", sizeof(flags));
 			else
 				strlcat(flags, "|CREATE", sizeof(flags));
 		}
-		if (nsec3param->flags & DNS_NSEC3FLAG_NONSEC) {
+		if ((nsec3param->flags & DNS_NSEC3FLAG_NONSEC) != 0) {
 			if (flags[0] == '\0')
 				strlcpy(flags, "NONSEC", sizeof(flags));
 			else
 				strlcat(flags, "|NONSEC", sizeof(flags));
 		}
-		if (nsec3param->flags & DNS_NSEC3FLAG_OPTOUT) {
+		if ((nsec3param->flags & DNS_NSEC3FLAG_OPTOUT) != 0) {
 			if (flags[0] == '\0')
 				strlcpy(flags, "OPTOUT", sizeof(flags));
 			else
@@ -9558,13 +9559,14 @@ keyfetch_done(isc_task_t *task, isc_event_t *event) {
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
 		/* Skip ZSK's */
-		if (!(dnskey.flags & DNS_KEYFLAG_KSK))
+		if ((dnskey.flags & DNS_KEYFLAG_KSK) == 0) {
 			continue;
+		}
 
 		result = compute_tag(keyname, &dnskey, mctx, &keytag);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 
-		revoked = (dnskey.flags & DNS_KEYFLAG_REVOKE);
+		revoked = ((dnskey.flags & DNS_KEYFLAG_REVOKE) != 0);
 
 		if (matchkey(&kfetch->keydataset, &dnskeyrr)) {
 			dns_rdata_reset(&keydatarr);
@@ -11279,7 +11281,7 @@ notify_send(dns_notify_t *notify) {
 		zone_iattach(notify->zone, &newnotify->zone);
 		ISC_LIST_APPEND(newnotify->zone->notifies, newnotify, link);
 		newnotify->dst = dst;
-		startup = (notify->flags & DNS_NOTIFY_STARTUP);
+		startup = ((notify->flags & DNS_NOTIFY_STARTUP) != 0);
 		result = notify_send_queue(newnotify, startup);
 		if (result != ISC_R_SUCCESS)
 			goto cleanup;
diff --git a/lib/irs/getaddrinfo.c b/lib/irs/getaddrinfo.c
index b603aaac8d6..c828e14b352 100644
--- a/lib/irs/getaddrinfo.c
+++ b/lib/irs/getaddrinfo.c
@@ -750,7 +750,7 @@ process_answer(isc_task_t *task, isc_event_t *event) {
 		goto done;
 	}
 
-	wantcname = (resstate->head->ai_flags & AI_CANONNAME);
+	wantcname = ((resstate->head->ai_flags & AI_CANONNAME) != 0);
 
 	/* Parse the response and construct the addrinfo chain */
 	for (name = ISC_LIST_HEAD(rev->answerlist); name != NULL;
diff --git a/lib/irs/getnameinfo.c b/lib/irs/getnameinfo.c
index 5069ba7a7f4..f5754263289 100644
--- a/lib/irs/getnameinfo.c
+++ b/lib/irs/getnameinfo.c
@@ -197,7 +197,7 @@ getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
 	default:
 		INSIST(0);
 	}
-	proto = (flags & NI_DGRAM) ? "udp" : "tcp";
+	proto = ((flags & NI_DGRAM) != 0) ? "udp" : "tcp";
 
 	if (serv == NULL || servlen == 0U) {
 		/*
diff --git a/lib/isc/httpd.c b/lib/isc/httpd.c
index f3931ad76c1..c0616ff03e3 100644
--- a/lib/isc/httpd.c
+++ b/lib/isc/httpd.c
@@ -923,7 +923,7 @@ isc_httpd_recvdone(isc_task_t *task, isc_event_t *ev) {
 	}
 
 #ifdef HAVE_ZLIB
-	if (httpd->flags & HTTPD_ACCEPT_DEFLATE) {
+	if ((httpd->flags & HTTPD_ACCEPT_DEFLATE) != 0) {
 			result = isc_httpd_compress(httpd);
 			if (result == ISC_R_SUCCESS) {
 				is_compressed = true;
diff --git a/lib/isc/include/isc/radix.h b/lib/isc/include/isc/radix.h
index 135552a6275..c201d573696 100644
--- a/lib/isc/include/isc/radix.h
+++ b/lib/isc/include/isc/radix.h
@@ -61,8 +61,6 @@ typedef void (*isc_radix_processfunc_t)(isc_prefix_t *, void **);
 #define isc_prefix_tochar(prefix) ((char *)&(prefix)->add.sin)
 #define isc_prefix_touchar(prefix) ((u_char *)&(prefix)->add.sin)
 
-#define BIT_TEST(f, b)  ((f) & (b))
-
 /*
  * We need "first match" when we search the radix tree to preserve
  * compatibility with the existing ACL implementation. Radix trees
diff --git a/lib/isc/lex.c b/lib/isc/lex.c
index a8955bc78d5..c9758872a6b 100644
--- a/lib/isc/lex.c
+++ b/lib/isc/lex.c
@@ -650,10 +650,10 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) {
 						goto done;
 					done = true;
 					continue;
-				} else if (!(options & ISC_LEXOPT_CNUMBER) ||
+				} else if ((options & ISC_LEXOPT_CNUMBER) == 0 ||
 					   ((c != 'x' && c != 'X') ||
-					   (curr != &lex->data[1]) ||
-					   (lex->data[0] != '0'))) {
+					    (curr != &lex->data[1]) ||
+					    (lex->data[0] != '0'))) {
 					/* Above test supports hex numbers */
 					state = lexstate_string;
 				}
diff --git a/lib/isc/log.c b/lib/isc/log.c
index 1784159cf21..5de8a3a28da 100644
--- a/lib/isc/log.c
+++ b/lib/isc/log.c
@@ -1837,18 +1837,18 @@ isc_log_doit(isc_log_t *lctx, isc_logcategory_t *category,
 			}
 		}
 
-		utc	      = (channel->flags & ISC_LOG_UTC);
-		iso8601       = (channel->flags & ISC_LOG_ISO8601);
-		printtime     = (channel->flags & ISC_LOG_PRINTTIME);
+		utc	      = ((channel->flags & ISC_LOG_UTC) != 0);
+		iso8601       = ((channel->flags & ISC_LOG_ISO8601) != 0);
+		printtime     = ((channel->flags & ISC_LOG_PRINTTIME) != 0);
 		printtag      = ((channel->flags &
-				  (ISC_LOG_PRINTTAG|ISC_LOG_PRINTPREFIX))
-				 && lcfg->tag != NULL);
-		printcolon    = ((channel->flags & ISC_LOG_PRINTTAG)
-				 && lcfg->tag != NULL);
-		printcategory = (channel->flags & ISC_LOG_PRINTCATEGORY);
-		printmodule   = (channel->flags & ISC_LOG_PRINTMODULE);
-		printlevel    = (channel->flags & ISC_LOG_PRINTLEVEL);
-		buffered      = (channel->flags & ISC_LOG_BUFFERED);
+				  (ISC_LOG_PRINTTAG|ISC_LOG_PRINTPREFIX)) != 0 &&
+				 lcfg->tag != NULL);
+		printcolon    = ((channel->flags & ISC_LOG_PRINTTAG) != 0 &&
+				 lcfg->tag != NULL);
+		printcategory = ((channel->flags & ISC_LOG_PRINTCATEGORY) != 0);
+		printmodule   = ((channel->flags & ISC_LOG_PRINTMODULE) != 0);
+		printlevel    = ((channel->flags & ISC_LOG_PRINTLEVEL) != 0);
+		buffered      = ((channel->flags & ISC_LOG_BUFFERED) != 0);
 
 		if (printtime) {
 			if (iso8601) {
diff --git a/lib/isc/radix.c b/lib/isc/radix.c
index 6299dfef41c..3781861ce2d 100644
--- a/lib/isc/radix.c
+++ b/lib/isc/radix.c
@@ -25,6 +25,8 @@
 #include <isc/util.h>
 #include <isc/radix.h>
 
+#define BIT_TEST(f, b)  (((f) & (b)) != 0)
+
 static isc_result_t
 _new_prefix(isc_mem_t *mctx, isc_prefix_t **target, int family,
 	    void *dest, int bitlen);
diff --git a/lib/isc/task.c b/lib/isc/task.c
index db3eb97801c..683e358c202 100644
--- a/lib/isc/task.c
+++ b/lib/isc/task.c
@@ -1773,7 +1773,7 @@ isc__task_setprivilege(isc_task_t *task0, bool priv) {
 	bool oldpriv;
 
 	LOCK(&task->lock);
-	oldpriv = (task->flags & TASK_F_PRIVILEGED);
+	oldpriv = ((task->flags & TASK_F_PRIVILEGED) != 0);
 	if (priv)
 		task->flags |= TASK_F_PRIVILEGED;
 	else
@@ -1799,7 +1799,7 @@ isc__task_privilege(isc_task_t *task0) {
 	bool priv;
 
 	LOCK(&task->lock);
-	priv = (task->flags & TASK_F_PRIVILEGED);
+	priv = ((task->flags & TASK_F_PRIVILEGED) != 0);
 	UNLOCK(&task->lock);
 	return (priv);
 }
diff --git a/lib/isc/tests/socket_test.c b/lib/isc/tests/socket_test.c
index a58655538f7..72ea98e2efc 100644
--- a/lib/isc/tests/socket_test.c
+++ b/lib/isc/tests/socket_test.c
@@ -78,7 +78,7 @@ event_done(isc_task_t *task, isc_event_t *event) {
 	} else {
 		recv_dscp = false;
 	}
-	recv_trunc = (dev->attributes & ISC_SOCKEVENTATTR_TRUNC);
+	recv_trunc = ((dev->attributes & ISC_SOCKEVENTATTR_TRUNC) != 0);
 	isc_event_free(&event);
 }
 
diff --git a/lib/isc/tests/task_test.c b/lib/isc/tests/task_test.c
index 569f9a2090c..9b382a9075c 100644
--- a/lib/isc/tests/task_test.c
+++ b/lib/isc/tests/task_test.c
@@ -1012,7 +1012,7 @@ pg_event2(isc_task_t *task, isc_event_t *event) {
 	}
 
 	if (sender_match && type_match && tag_match) {
-		if (event->ev_attributes & ISC_EVENTATTR_NOPURGE) {
+		if ((event->ev_attributes & ISC_EVENTATTR_NOPURGE) != 0) {
 			printf("event %p,%d,%p matched but was not purgeable\n",
 			       event->ev_sender, (int)event->ev_type,
 			       event->ev_tag);
diff --git a/lib/isc/tm.c b/lib/isc/tm.c
index c39039663d3..338157ade5f 100644
--- a/lib/isc/tm.c
+++ b/lib/isc/tm.c
@@ -61,7 +61,7 @@
  */
 #define ALT_E			0x01
 #define ALT_O			0x02
-#define	LEGAL_ALT(x)		{ if (alt_format & ~(x)) return (0); }
+#define	LEGAL_ALT(x)		{ if ((alt_format & ~(x)) != 0) return (0); }
 
 #ifndef TM_YEAR_BASE
 #define TM_YEAR_BASE 1900
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index 5b281d390ee..c057761f02b 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -1365,13 +1365,15 @@ process_cmsg(isc__socket_t *sock, struct msghdr *msg, isc_socketevent_t *dev) {
 #ifdef ISC_NET_BSD44MSGHDR
 
 #ifdef MSG_TRUNC
-	if ((msg->msg_flags & MSG_TRUNC) == MSG_TRUNC)
+	if ((msg->msg_flags & MSG_TRUNC) != 0) {
 		dev->attributes |= ISC_SOCKEVENTATTR_TRUNC;
+	}
 #endif
 
 #ifdef MSG_CTRUNC
-	if ((msg->msg_flags & MSG_CTRUNC) == MSG_CTRUNC)
+	if ((msg->msg_flags & MSG_CTRUNC) != 0) {
 		dev->attributes |= ISC_SOCKEVENTATTR_CTRUNC;
+	}
 #endif
 
 #ifndef USE_CMSG
@@ -3145,10 +3147,12 @@ isc__socket_fdwatchcreate(isc_socketmgr_t *manager0, int fd, int flags,
 #endif
 	UNLOCK(&manager->lock);
 
-	if (flags & ISC_SOCKFDWATCH_READ)
+	if ((flags & ISC_SOCKFDWATCH_READ) != 0) {
 		select_poke(sock->manager, sock->fd, SELECT_POKE_READ);
-	if (flags & ISC_SOCKFDWATCH_WRITE)
+	}
+	if ((flags & ISC_SOCKFDWATCH_WRITE) != 0) {
 		select_poke(sock->manager, sock->fd, SELECT_POKE_WRITE);
+	}
 
 	socket_log(sock, NULL, CREATION, isc_msgcat, ISC_MSGSET_SOCKET,
 		   ISC_MSG_CREATED, "fdwatch-created");
@@ -3426,11 +3430,11 @@ send_recvdone_event(isc__socket_t *sock, isc_socketevent_t **dev) {
 	if (ISC_LINK_LINKED(*dev, ev_link))
 		ISC_LIST_DEQUEUE(sock->recv_list, *dev, ev_link);
 
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED)
-	    == ISC_SOCKEVENTATTR_ATTACHED)
+	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
 		isc_task_sendanddetach(&task, (isc_event_t **)dev);
-	else
+	} else {
 		isc_task_send(task, (isc_event_t **)dev);
+	}
 }
 
 /*
@@ -3450,11 +3454,11 @@ send_senddone_event(isc__socket_t *sock, isc_socketevent_t **dev) {
 	if (ISC_LINK_LINKED(*dev, ev_link))
 		ISC_LIST_DEQUEUE(sock->send_list, *dev, ev_link);
 
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED)
-	    == ISC_SOCKEVENTATTR_ATTACHED)
+	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
 		isc_task_sendanddetach(&task, (isc_event_t **)dev);
-	else
+	} else {
 		isc_task_send(task, (isc_event_t **)dev);
+	}
 }
 
 /*
@@ -6174,7 +6178,7 @@ isc__socket_cancel(isc_socket_t *sock0, isc_task_t *task, unsigned int how) {
 	 *	  its done event with status of "ISC_R_CANCELED".
 	 *	o Reset any state needed.
 	 */
-	if (((how & ISC_SOCKCANCEL_RECV) == ISC_SOCKCANCEL_RECV)
+	if (((how & ISC_SOCKCANCEL_RECV) != 0)
 	    && !ISC_LIST_EMPTY(sock->recv_list)) {
 		isc_socketevent_t      *dev;
 		isc_socketevent_t      *next;
@@ -6194,7 +6198,7 @@ isc__socket_cancel(isc_socket_t *sock0, isc_task_t *task, unsigned int how) {
 		}
 	}
 
-	if (((how & ISC_SOCKCANCEL_SEND) == ISC_SOCKCANCEL_SEND)
+	if (((how & ISC_SOCKCANCEL_SEND) != 0)
 	    && !ISC_LIST_EMPTY(sock->send_list)) {
 		isc_socketevent_t      *dev;
 		isc_socketevent_t      *next;
@@ -6214,7 +6218,7 @@ isc__socket_cancel(isc_socket_t *sock0, isc_task_t *task, unsigned int how) {
 		}
 	}
 
-	if (((how & ISC_SOCKCANCEL_ACCEPT) == ISC_SOCKCANCEL_ACCEPT)
+	if (((how & ISC_SOCKCANCEL_ACCEPT) != 0)
 	    && !ISC_LIST_EMPTY(sock->accept_list)) {
 		isc_socket_newconnev_t *dev;
 		isc_socket_newconnev_t *next;
@@ -6243,7 +6247,7 @@ isc__socket_cancel(isc_socket_t *sock0, isc_task_t *task, unsigned int how) {
 		}
 	}
 
-	if (((how & ISC_SOCKCANCEL_CONNECT) == ISC_SOCKCANCEL_CONNECT)
+	if (((how & ISC_SOCKCANCEL_CONNECT) != 0)
 	    && !ISC_LIST_EMPTY(sock->connect_list)) {
 		isc_socket_connev_t    *dev;
 		isc_socket_connev_t    *next;
diff --git a/lib/isc/win32/fsaccess.c b/lib/isc/win32/fsaccess.c
index 164985da7b0..e64d172a0cc 100644
--- a/lib/isc/win32/fsaccess.c
+++ b/lib/isc/win32/fsaccess.c
@@ -189,23 +189,30 @@ NTFS_Access_Control(const char *filename, const char *user, int access,
 	/* Owner check */
 
 	NTFSbits = 0;
-	if (caccess & ISC_FSACCESS_READ)
+	if ((caccess & ISC_FSACCESS_READ) != 0) {
 		NTFSbits |= FILE_GENERIC_READ;
-	if (caccess & ISC_FSACCESS_WRITE)
+	}
+	if ((caccess & ISC_FSACCESS_WRITE) != 0) {
 		NTFSbits |= FILE_GENERIC_WRITE;
-	if (caccess & ISC_FSACCESS_EXECUTE)
+	}
+	if ((caccess & ISC_FSACCESS_EXECUTE) != 0) {
 		NTFSbits |= FILE_GENERIC_EXECUTE;
+	}
 
 	/* For directories check the directory-specific bits */
 	if (isdir == true) {
-		if (caccess & ISC_FSACCESS_CREATECHILD)
+		if ((caccess & ISC_FSACCESS_CREATECHILD) != 0) {
 			NTFSbits |= FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE;
-		if (caccess & ISC_FSACCESS_DELETECHILD)
+		}
+		if ((caccess & ISC_FSACCESS_DELETECHILD) != 0) {
 			NTFSbits |= FILE_DELETE_CHILD;
-		if (caccess & ISC_FSACCESS_LISTDIRECTORY)
+		}
+		if ((caccess & ISC_FSACCESS_LISTDIRECTORY) != 0) {
 			NTFSbits |= FILE_LIST_DIRECTORY;
-		if (caccess & ISC_FSACCESS_ACCESSCHILD)
+		}
+		if ((caccess & ISC_FSACCESS_ACCESSCHILD) != 0) {
 			NTFSbits |= FILE_TRAVERSE;
+		}
 	}
 
 	if (NTFSbits == (FILE_GENERIC_READ | FILE_GENERIC_WRITE
@@ -238,23 +245,30 @@ NTFS_Access_Control(const char *filename, const char *user, int access,
 	caccess = caccess >> STEP;
 
 	NTFSbits = 0;
-	if (caccess & ISC_FSACCESS_READ)
+	if ((caccess & ISC_FSACCESS_READ) != 0) {
 		NTFSbits |= FILE_GENERIC_READ;
-	if (caccess & ISC_FSACCESS_WRITE)
+	}
+	if ((caccess & ISC_FSACCESS_WRITE) != 0) {
 		NTFSbits |= FILE_GENERIC_WRITE;
-	if (caccess & ISC_FSACCESS_EXECUTE)
+	}
+	if ((caccess & ISC_FSACCESS_EXECUTE) != 0) {
 		NTFSbits |= FILE_GENERIC_EXECUTE;
+	}
 
 	/* For directories check the directory-specific bits */
 	if (isdir == TRUE) {
-		if (caccess & ISC_FSACCESS_CREATECHILD)
+		if ((caccess & ISC_FSACCESS_CREATECHILD) != 0) {
 			NTFSbits |= FILE_ADD_SUBDIRECTORY | FILE_ADD_FILE;
-		if (caccess & ISC_FSACCESS_DELETECHILD)
+		}
+		if ((caccess & ISC_FSACCESS_DELETECHILD) != 0) {
 			NTFSbits |= FILE_DELETE_CHILD;
-		if (caccess & ISC_FSACCESS_LISTDIRECTORY)
+		}
+		if ((caccess & ISC_FSACCESS_LISTDIRECTORY) != 0) {
 			NTFSbits |= FILE_LIST_DIRECTORY;
-		if (caccess & ISC_FSACCESS_ACCESSCHILD)
+		}
+		if ((caccess & ISC_FSACCESS_ACCESSCHILD) != 0) {
 			NTFSbits |= FILE_TRAVERSE;
+		}
 	}
 	/* Add the ACE to the ACL */
 	if (!AddAccessAllowedAce(pacl, ACL_REVISION, NTFSbits,
diff --git a/lib/isc/win32/socket.c b/lib/isc/win32/socket.c
index 674128ae9d1..e12ffe4030b 100644
--- a/lib/isc/win32/socket.c
+++ b/lib/isc/win32/socket.c
@@ -1950,11 +1950,11 @@ send_recvdone_event(isc_socket_t *sock, isc_socketevent_t **dev) {
 	if (ISC_LINK_LINKED(*dev, ev_link))
 		ISC_LIST_DEQUEUE(sock->recv_list, *dev, ev_link);
 
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED)
-	    == ISC_SOCKEVENTATTR_ATTACHED)
+	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
 		isc_task_sendanddetach(&task, (isc_event_t **)dev);
-	else
+	} else {
 		isc_task_send(task, (isc_event_t **)dev);
+	}
 
 	CONSISTENT(sock);
 }
@@ -1974,11 +1974,11 @@ send_senddone_event(isc_socket_t *sock, isc_socketevent_t **dev) {
 	if (ISC_LINK_LINKED(*dev, ev_link))
 		ISC_LIST_DEQUEUE(sock->send_list, *dev, ev_link);
 
-	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED)
-	    == ISC_SOCKEVENTATTR_ATTACHED)
+	if (((*dev)->attributes & ISC_SOCKEVENTATTR_ATTACHED) != 0) {
 		isc_task_sendanddetach(&task, (isc_event_t **)dev);
-	else
+	} else {
 		isc_task_send(task, (isc_event_t **)dev);
+	}
 
 	CONSISTENT(sock);
 }
@@ -3737,7 +3737,7 @@ isc__socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
 	 *	o Reset any state needed.
 	 */
 
-	if ((how & ISC_SOCKCANCEL_RECV) == ISC_SOCKCANCEL_RECV) {
+	if ((how & ISC_SOCKCANCEL_RECV) != 0) {
 		isc_socketevent_t      *dev;
 		isc_socketevent_t      *next;
 		isc_task_t	       *current_task;
@@ -3755,7 +3755,7 @@ isc__socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
 	}
 	how &= ~ISC_SOCKCANCEL_RECV;
 
-	if ((how & ISC_SOCKCANCEL_SEND) == ISC_SOCKCANCEL_SEND) {
+	if ((how & ISC_SOCKCANCEL_SEND) != 0) {
 		isc_socketevent_t      *dev;
 		isc_socketevent_t      *next;
 		isc_task_t	       *current_task;
@@ -3774,7 +3774,7 @@ isc__socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
 	}
 	how &= ~ISC_SOCKCANCEL_SEND;
 
-	if (((how & ISC_SOCKCANCEL_ACCEPT) == ISC_SOCKCANCEL_ACCEPT)
+	if (((how & ISC_SOCKCANCEL_ACCEPT) != 0)
 	    && !ISC_LIST_EMPTY(sock->accept_list)) {
 		isc_socket_newconnev_t *dev;
 		isc_socket_newconnev_t *next;
@@ -3801,7 +3801,7 @@ isc__socket_cancel(isc_socket_t *sock, isc_task_t *task, unsigned int how) {
 	}
 	how &= ~ISC_SOCKCANCEL_ACCEPT;
 
-	if (((how & ISC_SOCKCANCEL_CONNECT) == ISC_SOCKCANCEL_CONNECT)
+	if (((how & ISC_SOCKCANCEL_CONNECT) != 0)
 	    && !ISC_LIST_EMPTY(sock->connect_list)) {
 		isc_socket_connev_t    *dev;
 		isc_socket_connev_t    *next;
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 30815fca069..9970566890e 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -3337,20 +3337,22 @@ doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
 	const unsigned int *flagp = type->of;
 
 	cfg_print_cstr(pctx, "( ( [ address ] ( ");
-	if (*flagp & CFG_ADDR_V4OK)
+	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv4_address>");
-	else if (*flagp & CFG_ADDR_V6OK)
+	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv6_address>");
-	else
+	} else {
 		INSIST(0);
+	}
 	cfg_print_cstr(pctx, " | * ) [ port ( <integer> | * ) ] ) | "
 		       "( [ [ address ] ( ");
-	if (*flagp & CFG_ADDR_V4OK)
+	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv4_address>");
-	else if (*flagp & CFG_ADDR_V6OK)
+	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv6_address>");
-	else
+	} else {
 		INSIST(0);
+	}
 	cfg_print_cstr(pctx, " | * ) ] port ( <integer> | * ) ) )"
 		       " [ dscp <integer> ]");
 }
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index aa3563b7cd8..c36a04a9b8f 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -1803,7 +1803,8 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret)
 			/* Single-valued clause */
 			if (result == ISC_R_NOTFOUND) {
 				bool callback =
-					(clause->flags & CFG_CLAUSEFLAG_CALLBACK);
+					((clause->flags &
+					  CFG_CLAUSEFLAG_CALLBACK) != 0);
 				CHECK(parse_symtab_elt(pctx, clause->name,
 						       clause->type,
 						       obj->value.map.symtab,
@@ -2504,27 +2505,29 @@ static void
 cfg_doc_netaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 	const unsigned int *flagp = type->of;
 	int n = 0;
-	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK)
+	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK) {
 		cfg_print_cstr(pctx, "( ");
-	if (*flagp & CFG_ADDR_V4OK) {
+	}
+	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv4_address>");
 		n++;
 	}
-	if (*flagp & CFG_ADDR_V6OK) {
+	if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		if (n != 0)
 			cfg_print_cstr(pctx, " | ");
 		cfg_print_cstr(pctx, "<ipv6_address>");
 		n++;
 	}
-	if (*flagp & CFG_ADDR_WILDOK) {
+	if ((*flagp & CFG_ADDR_WILDOK) != 0) {
 		if (n != 0)
 			cfg_print_cstr(pctx, " | ");
 		cfg_print_cstr(pctx, "*");
 		n++;
 		POST(n);
 	}
-	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK)
+	if (*flagp != CFG_ADDR_V4OK && *flagp != CFG_ADDR_V6OK) {
 		cfg_print_cstr(pctx, " )");
+	}
 }
 
 LIBISCCFG_EXTERNAL_DATA cfg_type_t cfg_type_netaddr = {
@@ -2752,17 +2755,17 @@ cfg_doc_sockaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 	REQUIRE(type != NULL);
 
 	cfg_print_cstr(pctx, "( ");
-	if (*flagp & CFG_ADDR_V4OK) {
+	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		cfg_print_cstr(pctx, "<ipv4_address>");
 		n++;
 	}
-	if (*flagp & CFG_ADDR_V6OK) {
+	if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		if (n != 0)
 			cfg_print_cstr(pctx, " | ");
 		cfg_print_cstr(pctx, "<ipv6_address>");
 		n++;
 	}
-	if (*flagp & CFG_ADDR_WILDOK) {
+	if ((*flagp & CFG_ADDR_WILDOK) != 0) {
 		if (n != 0)
 			cfg_print_cstr(pctx, " | ");
 		cfg_print_cstr(pctx, "*");
@@ -2770,7 +2773,7 @@ cfg_doc_sockaddr(cfg_printer_t *pctx, const cfg_type_t *type) {
 		POST(n);
 	}
 	cfg_print_cstr(pctx, " ) ");
-	if (*flagp & CFG_ADDR_WILDOK) {
+	if ((*flagp & CFG_ADDR_WILDOK) != 0) {
 		cfg_print_cstr(pctx, "[ port ( <integer> | * ) ]");
 	} else {
 		cfg_print_cstr(pctx, "[ port <integer> ]");
@@ -3011,12 +3014,13 @@ parser_complain(cfg_parser_t *pctx, bool is_warning,
 		}
 
 		/* Choose a preposition. */
-		if (flags & CFG_LOG_NEAR)
+		if ((flags & CFG_LOG_NEAR) != 0) {
 			prep = " near ";
-		else if (flags & CFG_LOG_BEFORE)
+		} else if ((flags & CFG_LOG_BEFORE) != 0) {
 			prep = " before ";
-		else
+		} else {
 			prep = " ";
+		}
 	} else {
 		tokenbuf[0] = '\0';
 	}
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 4fde30ec3eb..652e286dc1b 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -4523,7 +4523,7 @@ query_findclosestnsec3(dns_name_t *qname, dns_db_t *db,
 		result = dns_rdata_tostruct(&rdata, &nsec3, NULL);
 		RUNTIME_CHECK(result == ISC_R_SUCCESS);
 		dns_rdata_reset(&rdata);
-		optout = (nsec3.flags & DNS_NSEC3FLAG_OPTOUT);
+		optout = ((nsec3.flags & DNS_NSEC3FLAG_OPTOUT) != 0);
 		if (found != NULL && optout &&
 		    dns_name_issubdomain(&name, dns_db_origin(db)))
 		{
@@ -11042,7 +11042,7 @@ ns_query_start(ns_client_t *client) {
 	 * We don't need to set DNS_DBFIND_PENDINGOK when validation is
 	 * disabled as there will be no pending data.
 	 */
-	if (message->flags & DNS_MESSAGEFLAG_CD ||
+	if ((message->flags & DNS_MESSAGEFLAG_CD) != 0 ||
 	    qtype == dns_rdatatype_rrsig)
 	{
 		client->query.dboptions |= DNS_DBFIND_PENDINGOK;
@@ -11054,8 +11054,9 @@ ns_query_start(ns_client_t *client) {
 	 * Allow glue NS records to be added to the authority section
 	 * if the answer is secure.
 	 */
-	if (message->flags & DNS_MESSAGEFLAG_CD)
+	if ((message->flags & DNS_MESSAGEFLAG_CD) != 0) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
+	}
 
 	/*
 	 * Set NS_CLIENTATTR_WANTAD if the client has set AD in the query.
diff --git a/lib/ns/server.c b/lib/ns/server.c
index 132bb15c2df..cc2b7c3fd51 100644
--- a/lib/ns/server.c
+++ b/lib/ns/server.c
@@ -263,5 +263,5 @@ bool
 ns_server_getoption(ns_server_t *sctx, unsigned int option) {
 	REQUIRE(SCTX_VALID(sctx));
 
-	return (sctx->options & option);
+	return ((sctx->options & option) != 0);
 }
diff --git a/lib/ns/xfrout.c b/lib/ns/xfrout.c
index d2851063f60..40897cf9504 100644
--- a/lib/ns/xfrout.c
+++ b/lib/ns/xfrout.c
@@ -1280,7 +1280,7 @@ sendstream(xfrout_ctx_t *xfr) {
 	isc_buffer_clear(&xfr->txlenbuf);
 	isc_buffer_clear(&xfr->txbuf);
 
-	is_tcp = (xfr->client->attributes & NS_CLIENTATTR_TCP);
+	is_tcp = ((xfr->client->attributes & NS_CLIENTATTR_TCP) != 0);
 	if (!is_tcp) {
 		/*
 		 * In the UDP case, we put the response data directly into
-- 
GitLab


From c5825eba40fd904cf76403ae6c67958a8a5765cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Sat, 13 Oct 2018 11:39:55 +0200
Subject: [PATCH 03/12] Add a GitLab CI job that runs with all assertions
 disabled

(cherry picked from commit 461ffead1f45e0f5f8811d86c0d8452f25fc4ffc)
---
 .gitlab-ci.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index db122c67cc0..25b7c5edae2 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -307,3 +307,23 @@ install:debian:sid:amd64:
   <<: *install_test_job
   dependencies:
     - build:debian:sid:amd64
+
+noassert:build:debian:sid:amd64:
+  variables:
+    CC: gcc
+    CFLAGS: "-Wall -Wextra -O2 -g -DISC_CHECK_NONE=1"
+    EXTRA_CONFIGURE: "--with-libidn2"
+  <<: *debian_sid_amd64_image
+  <<: *build_job
+
+noassert:unittest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *unit_test_job
+  dependencies:
+    - noassert:build:debian:sid:amd64
+
+noassert:systemtest:debian:sid:amd64:
+  <<: *debian_sid_amd64_image
+  <<: *system_test_job
+  dependencies:
+    - noassert:build:debian:sid:amd64
-- 
GitLab


From 3d834566f15ea2ffd6ab198826022e6983edfb38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Sat, 13 Oct 2018 11:52:08 +0200
Subject: [PATCH 04/12] When ISC assertions are disabled, still execute the
 condition to prevent unused variable warnings/errors from the compiler

(cherry picked from commit a831e0f72df901ff046ab0e4b7c14debb5d0ddbc)
---
 lib/isc/include/isc/assertions.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/lib/isc/include/isc/assertions.h b/lib/isc/include/isc/assertions.h
index e5719d98d77..62e883d17bc 100644
--- a/lib/isc/include/isc/assertions.h
+++ b/lib/isc/include/isc/assertions.h
@@ -80,7 +80,7 @@ isc_assertion_typetotext(isc_assertiontype_t type);
 					 isc_assertiontype_require, \
 					 #cond), 0)))
 #else
-#define ISC_REQUIRE(cond)	((void) 0)
+#define ISC_REQUIRE(cond)	((void) ISC_LIKELY(cond))
 #endif /* ISC_CHECK_REQUIRE */
 
 #if ISC_CHECK_ENSURE != 0
@@ -90,7 +90,7 @@ isc_assertion_typetotext(isc_assertiontype_t type);
 					 isc_assertiontype_ensure, \
 					 #cond), 0)))
 #else
-#define ISC_ENSURE(cond)	((void) 0)
+#define ISC_ENSURE(cond)	((void) ISC_LIKELY(cond))
 #endif /* ISC_CHECK_ENSURE */
 
 #if ISC_CHECK_INSIST != 0
@@ -100,7 +100,7 @@ isc_assertion_typetotext(isc_assertiontype_t type);
 					 isc_assertiontype_insist, \
 					 #cond), 0)))
 #else
-#define ISC_INSIST(cond)	((void) 0)
+#define ISC_INSIST(cond)	((void) ISC_LIKELY(cond))
 #endif /* ISC_CHECK_INSIST */
 
 #if ISC_CHECK_INVARIANT != 0
@@ -110,7 +110,7 @@ isc_assertion_typetotext(isc_assertiontype_t type);
 					 isc_assertiontype_invariant, \
 					 #cond), 0)))
 #else
-#define ISC_INVARIANT(cond)	((void) 0)
+#define ISC_INVARIANT(cond)	((void) ISC_LIKELY(cond))
 #endif /* ISC_CHECK_INVARIANT */
 
 ISC_LANG_ENDDECLS
-- 
GitLab


From 1e6329038b176e62c89ed03332206cd74db12d51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Sat, 13 Oct 2018 12:10:43 +0200
Subject: [PATCH 05/12] Don't assert on failed getrlimit call to allow called
 to handle this gracefully as it already does, just abort where we need to
 know the numbers

(cherry picked from commit e2e138a801a7fa9d31ef24ea5e8b15af07d147cd)
---
 bin/named/main.c        | 25 +++++++++++++++----------
 lib/isc/unix/resource.c | 28 ++++++++++++++++------------
 2 files changed, 31 insertions(+), 22 deletions(-)

diff --git a/bin/named/main.c b/bin/named/main.c
index 340f3981690..9892e29da7f 100644
--- a/bin/named/main.c
+++ b/bin/named/main.c
@@ -1190,14 +1190,18 @@ setup(void) {
 	/*
 	 * Get the initial resource limits.
 	 */
-	(void)isc_resource_getlimit(isc_resource_stacksize,
-				    &named_g_initstacksize);
-	(void)isc_resource_getlimit(isc_resource_datasize,
-				    &named_g_initdatasize);
-	(void)isc_resource_getlimit(isc_resource_coresize,
-				    &named_g_initcoresize);
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_stacksize,
+					    &named_g_initstacksize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_datasize,
+					    &named_g_initdatasize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_coresize,
+					    &named_g_initcoresize)
+		      == ISC_R_SUCCESS);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 
 	/*
 	 * System resources cannot effectively be tuned on some systems.
@@ -1205,8 +1209,9 @@ setup(void) {
 	 */
 	old_openfiles = named_g_initopenfiles;
 	named_os_adjustnofile();
-	(void)isc_resource_getlimit(isc_resource_openfiles,
-				    &named_g_initopenfiles);
+	RUNTIME_CHECK(isc_resource_getlimit(isc_resource_openfiles,
+					    &named_g_initopenfiles)
+		      == ISC_R_SUCCESS);
 	if (old_openfiles != named_g_initopenfiles) {
 		isc_log_write(named_g_lctx, NAMED_LOGCATEGORY_GENERAL,
 			      NAMED_LOGMODULE_MAIN, ISC_LOG_NOTICE,
diff --git a/lib/isc/unix/resource.c b/lib/isc/unix/resource.c
index 6d5c5aae245..eaebf0256c5 100644
--- a/lib/isc/unix/resource.c
+++ b/lib/isc/unix/resource.c
@@ -194,34 +194,38 @@ isc_resource_setlimit(isc_resource_t resource, isc_resourcevalue_t value) {
 
 isc_result_t
 isc_resource_getlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
-	int unixresult;
 	int unixresource;
 	struct rlimit rl;
 	isc_result_t result;
 
 	result = resource2rlim(resource, &unixresource);
-	if (result == ISC_R_SUCCESS) {
-		unixresult = getrlimit(unixresource, &rl);
-		INSIST(unixresult == 0);
-		*value = rl.rlim_max;
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	return (result);
+	if (getrlimit(unixresource, &rl) != 0) {
+		return (isc__errno2result(errno));
+	}
+
+	*value = rl.rlim_max;
+	return (ISC_R_SUCCESS);
 }
 
 isc_result_t
 isc_resource_getcurlimit(isc_resource_t resource, isc_resourcevalue_t *value) {
-	int unixresult;
 	int unixresource;
 	struct rlimit rl;
 	isc_result_t result;
 
 	result = resource2rlim(resource, &unixresource);
-	if (result == ISC_R_SUCCESS) {
-		unixresult = getrlimit(unixresource, &rl);
-		INSIST(unixresult == 0);
-		*value = rl.rlim_cur;
+	if (result != ISC_R_SUCCESS) {
+		return (result);
 	}
 
-	return (result);
+	if (getrlimit(unixresource, &rl) != 0) {
+		return (isc__errno2result(errno));
+	}
+
+	*value = rl.rlim_cur;
+	return (ISC_R_SUCCESS);
 }
-- 
GitLab


From 65536fb10bdda48c347a4a6bd6adbef9d172697f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Wed, 24 Oct 2018 16:28:21 +0200
Subject: [PATCH 06/12] Use larger buffers on snprintf buffer overflow false
 positives

(cherry picked from commit 4eaf9275719f0512993376828ecf6df310c0f340)
---
 lib/dns/rdata/generic/loc_29.c |  7 ++++---
 lib/dns/rdata/in_1/dhcid_49.c  | 11 +++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/lib/dns/rdata/generic/loc_29.c b/lib/dns/rdata/generic/loc_29.c
index 50c00ff9f7a..7af1c187313 100644
--- a/lib/dns/rdata/generic/loc_29.c
+++ b/lib/dns/rdata/generic/loc_29.c
@@ -454,11 +454,12 @@ totext_loc(ARGS_TOTEXT) {
 	bool east;
 	bool below;
 	isc_region_t sr;
-	char buf[sizeof("89 59 59.999 N 179 59 59.999 E "
-			"-42849672.95m 90000000m 90000000m 90000000m")];
 	char sbuf[sizeof("90000000m")];
 	char hbuf[sizeof("90000000m")];
 	char vbuf[sizeof("90000000m")];
+	/* "89 59 59.999 N 179 59 59.999 E " */
+	/* "-42849672.95m 90000000m 90000000m 90000000m"; */
+	char buf[8*6 + 12*1 + 2*10 + sizeof(sbuf)+sizeof(hbuf)+sizeof(vbuf)];
 	unsigned char size, hp, vp;
 	unsigned long poweroften[8] = { 1, 10, 100, 1000,
 					10000, 100000, 1000000, 10000000 };
@@ -550,7 +551,7 @@ totext_loc(ARGS_TOTEXT) {
 		altitude -= 10000000;
 	}
 
-	snprintf(buf, sizeof(buf),
+	snprintf(NULL, 0,
 		 "%d %d %d.%03d %s %d %d %d.%03d %s %s%lu.%02lum %s %s %s",
 		 d1, m1, s1, fs1, north ? "N" : "S",
 		 d2, m2, s2, fs2, east ? "E" : "W",
diff --git a/lib/dns/rdata/in_1/dhcid_49.c b/lib/dns/rdata/in_1/dhcid_49.c
index 90971b7827d..9fce42d4737 100644
--- a/lib/dns/rdata/in_1/dhcid_49.c
+++ b/lib/dns/rdata/in_1/dhcid_49.c
@@ -35,8 +35,8 @@ fromtext_in_dhcid(ARGS_FROMTEXT) {
 static inline isc_result_t
 totext_in_dhcid(ARGS_TOTEXT) {
 	isc_region_t sr, sr2;
-	char buf[sizeof(" ; 64000 255 64000")];
-	size_t n;
+	/* " ; 64000 255 64000" */
+	char buf[5 + 3*5 + 1];
 
 	REQUIRE(rdata->type == dns_rdatatype_dhcid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -55,10 +55,9 @@ totext_in_dhcid(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
 		RETERR(str_totext(/* ( */ " )", target));
 		if (rdata->length > 2) {
-			n = snprintf(buf, sizeof(buf), " ; %u %u %u",
-				     sr2.base[0] * 256U + sr2.base[1],
-				     sr2.base[2], rdata->length - 3U);
-			INSIST(n < sizeof(buf));
+			snprintf(NULL, 0, " ; %u %u %u",
+				 sr2.base[0] * 256U + sr2.base[1],
+				 sr2.base[2], rdata->length - 3U);
 			RETERR(str_totext(buf, target));
 		}
 	}
-- 
GitLab


From 2a261892561370412d30b3b15e453152cb6419f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Wed, 24 Oct 2018 16:28:55 +0200
Subject: [PATCH 07/12] Add extra return failure after INSIST(0) in default
 branch

(cherry picked from commit 29c45200e7e344920ca6d2b9a2d00596d581edfe)
---
 lib/dns/openssleddsa_link.c    | 1 +
 lib/dns/rdata/generic/loc_29.c | 2 +-
 lib/dns/rdata/in_1/dhcid_49.c  | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
index b76fac918bc..43f11e790a8 100644
--- a/lib/dns/openssleddsa_link.c
+++ b/lib/dns/openssleddsa_link.c
@@ -477,6 +477,7 @@ openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 	default:
 		INSIST(0);
 	}
+	return (DST_R_OPENSSLFAILURE);
 }
 
 static isc_result_t
diff --git a/lib/dns/rdata/generic/loc_29.c b/lib/dns/rdata/generic/loc_29.c
index 7af1c187313..388742b8368 100644
--- a/lib/dns/rdata/generic/loc_29.c
+++ b/lib/dns/rdata/generic/loc_29.c
@@ -551,7 +551,7 @@ totext_loc(ARGS_TOTEXT) {
 		altitude -= 10000000;
 	}
 
-	snprintf(NULL, 0,
+	snprintf(buf, sizeof(buf),
 		 "%d %d %d.%03d %s %d %d %d.%03d %s %s%lu.%02lum %s %s %s",
 		 d1, m1, s1, fs1, north ? "N" : "S",
 		 d2, m2, s2, fs2, east ? "E" : "W",
diff --git a/lib/dns/rdata/in_1/dhcid_49.c b/lib/dns/rdata/in_1/dhcid_49.c
index 9fce42d4737..1f2c30d8834 100644
--- a/lib/dns/rdata/in_1/dhcid_49.c
+++ b/lib/dns/rdata/in_1/dhcid_49.c
@@ -36,7 +36,7 @@ static inline isc_result_t
 totext_in_dhcid(ARGS_TOTEXT) {
 	isc_region_t sr, sr2;
 	/* " ; 64000 255 64000" */
-	char buf[5 + 3*5 + 1];
+	char buf[5 + 3*11 + 1];
 
 	REQUIRE(rdata->type == dns_rdatatype_dhcid);
 	REQUIRE(rdata->rdclass == dns_rdataclass_in);
@@ -55,7 +55,7 @@ totext_in_dhcid(ARGS_TOTEXT) {
 	if ((tctx->flags & DNS_STYLEFLAG_MULTILINE) != 0) {
 		RETERR(str_totext(/* ( */ " )", target));
 		if (rdata->length > 2) {
-			snprintf(NULL, 0, " ; %u %u %u",
+			snprintf(buf, sizeof(buf), " ; %u %u %u",
 				 sr2.base[0] * 256U + sr2.base[1],
 				 sr2.base[2], rdata->length - 3U);
 			RETERR(str_totext(buf, target));
-- 
GitLab


From ce6ef5b50e173d378a15390495fdcb2d8877e396 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Wed, 24 Oct 2018 20:00:46 +0200
Subject: [PATCH 08/12] Modify the dbversion_test.c to detect disabled
 assertions

(cherry picked from commit b992b5b811271f5447856cf40a0bbc41a9dc9723)
---
 lib/dns/tests/dbversion_test.c | 79 ++++++++++++++++++++++++++++------
 1 file changed, 66 insertions(+), 13 deletions(-)

diff --git a/lib/dns/tests/dbversion_test.c b/lib/dns/tests/dbversion_test.c
index 275fc9bf85f..43aa1fe7e52 100644
--- a/lib/dns/tests/dbversion_test.c
+++ b/lib/dns/tests/dbversion_test.c
@@ -103,9 +103,13 @@ attachversion(isc_assertioncallback_t callback) {
 
 	isc_assertion_setcallback(callback);
 	dns_db_attachversion(db1, VERSION(callback), &v);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_attachversion did not assert");
-
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(v, v1);
 	dns_db_closeversion(db1, &v, false);
 	ATF_REQUIRE_EQ(v, NULL);
@@ -147,8 +151,13 @@ closeversion(isc_assertioncallback_t callback) {
 
 	isc_assertion_setcallback(callback);
 	dns_db_closeversion(db1, VERSIONP(callback), false);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_closeversion did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(v1, NULL);
 
 	close_db();
@@ -195,8 +204,13 @@ find(isc_assertioncallback_t callback) {
 	result = dns_db_find(db1, dns_rootname, VERSION(callback),
 			     dns_rdatatype_soa, 0, 0, NULL,
 			     dns_fixedname_name(&fixed), &rdataset, NULL);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_find did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, DNS_R_NXDOMAIN);
 
 	close_db();
@@ -242,8 +256,13 @@ allrdatasets(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_allrdatasets(db1, node, VERSION(callback), 0,
 				     &iterator);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_allrdatasets did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	dns_rdatasetiter_destroy(&iterator);
@@ -300,8 +319,13 @@ findrdataset(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_findrdataset(db1, node, VERSION(callback),
 				     dns_rdatatype_soa, 0, 0, &rdataset, NULL);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_findrdataset did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, ISC_R_NOTFOUND);
 
 	dns_db_detachnode(db1, &node);
@@ -355,8 +379,13 @@ deleterdataset(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_deleterdataset(db1, node, VERSION(callback),
 				       dns_rdatatype_soa, 0);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_deleterdataset did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, DNS_R_UNCHANGED);
 
 	dns_db_detachnode(db1, &node);
@@ -417,8 +446,13 @@ subtract(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_subtractrdataset(db1, node, VERSION(callback),
 					 &rdataset, 0, NULL);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_subtractrdataset did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, DNS_R_UNCHANGED);
 
 	dns_db_detachnode(db1, &node);
@@ -468,8 +502,13 @@ dump(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_dump(db1, VERSION(callback), tempname);
 	(void)unlink(tempname);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_dump did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	close_db();
@@ -527,8 +566,13 @@ addrdataset(isc_assertioncallback_t callback) {
 	isc_assertion_setcallback(callback);
 	result = dns_db_addrdataset(db1, node, VERSION(callback), 0, &rdataset,
 				    0, NULL);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_adddataset did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, ISC_R_SUCCESS);
 
 	dns_db_detachnode(db1, &node);
@@ -579,8 +623,13 @@ getnsec3parameters(isc_assertioncallback_t callback) {
 	result = dns_db_getnsec3parameters(db1, VERSION(callback), &hash,
 					   &flags, &iterations, salt,
 					   &salt_length);
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_dump did not assert");
+#else
+		atf_tc_pass();
+#endif
+	}
 	ATF_REQUIRE_EQ(result, ISC_R_NOTFOUND);
 
 	close_db();
@@ -672,9 +721,13 @@ resigned(isc_assertioncallback_t callback) {
 
 	isc_assertion_setcallback(callback);
 	dns_db_resigned(db1, &added, VERSION(callback));
-	if (callback != NULL)
+	if (callback != NULL) {
+#ifndef ISC_CHECK_NONE
 		atf_tc_fail("dns_db_resigned did not assert");
-
+#else
+		atf_tc_pass();
+#endif
+	}
 	dns_rdataset_disassociate(&added);
 
 	close_db();
-- 
GitLab


From 4568669807031938f0004dd35243cb6199c8b973 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Wed, 7 Nov 2018 15:00:07 +0700
Subject: [PATCH 09/12] Hint the compiler with ISC_UNREACHABLE(); that code
 after INSIST(0); cannot be reached

(cherry picked from commit 23fff6c569e656274cf1543ac36b014e25c906ed)
---
 bin/check/named-checkconf.c   |  34 ++++++++----
 bin/check/named-checkzone.c   |   8 ++-
 bin/confgen/ddns-confgen.c    |   6 +-
 bin/delv/delv.c               |   1 +
 bin/dig/dighost.c             |   1 +
 bin/named/config.c            |  15 +++--
 bin/named/logconf.c           |   1 +
 bin/named/server.c            |  99 +++++++++++++++++++++------------
 bin/named/zoneconf.c          | 101 ++++++++++++++++++++++------------
 lib/bind9/check.c             |  12 ++--
 lib/dns/acl.c                 |   4 +-
 lib/dns/client.c              |   2 +
 lib/dns/diff.c                |   1 +
 lib/dns/dispatch.c            |   4 +-
 lib/dns/dnsrps.c              |   1 +
 lib/dns/dnstap.c              |   1 +
 lib/dns/geoip.c               |   4 ++
 lib/dns/journal.c             |   2 +
 lib/dns/masterdump.c          |   3 +-
 lib/dns/message.c             |   4 +-
 lib/dns/openssleddsa_link.c   |   2 +-
 lib/dns/opensslrsa_link.c     |  10 ++++
 lib/dns/peer.c                |   3 +-
 lib/dns/pkcs11rsa_link.c      |  10 ++++
 lib/dns/resolver.c            |   1 +
 lib/dns/rpz.c                 |  13 ++---
 lib/dns/rrl.c                 |   5 +-
 lib/dns/sdb.c                 |   2 +-
 lib/dns/sdlz.c                |   2 +-
 lib/dns/ssu.c                 |   2 +
 lib/dns/tsec.c                |   3 +
 lib/dns/update.c              |   3 +
 lib/dns/validator.c           |   4 +-
 lib/dns/xfrin.c               |   3 +-
 lib/dns/zone.c                |   6 +-
 lib/irs/getnameinfo.c         |   1 +
 lib/isc/hmacmd5.c             |  13 +----
 lib/isc/md5.c                 |  11 +---
 lib/isc/mem.c                 |   2 +
 lib/isc/netaddr.c             |   1 +
 lib/isc/sockaddr.c            |   2 +
 lib/isc/unix/interfaceiter.c  |   2 +-
 lib/isc/unix/net.c            |   1 +
 lib/isc/unix/socket.c         |   4 +-
 lib/isc/win32/interfaceiter.c |   2 +-
 lib/isccc/sexpr.c             |   1 +
 lib/isccfg/aclconf.c          |   5 +-
 lib/isccfg/namedconf.c        |  11 +++-
 lib/isccfg/parser.c           |   6 +-
 lib/ns/client.c               |  13 +++--
 lib/ns/query.c                |   9 ++-
 lib/ns/tests/query_test.c     |   2 +-
 lib/ns/xfrout.c               |   2 +-
 53 files changed, 301 insertions(+), 160 deletions(-)

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index 6653225c1e2..37fdbdbfdfb 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -275,8 +275,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRR;
 			zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKDUPRR;
 		zone_options &= ~DNS_ZONEOPT_CHECKDUPRRFAIL;
@@ -293,8 +295,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKMX;
 			zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKMX;
 		zone_options &= ~DNS_ZONEOPT_CHECKMXFAIL;
@@ -320,8 +324,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 			zone_options |= DNS_ZONEOPT_IGNOREMXCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNMXCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNOREMXCNAME;
@@ -338,8 +344,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 			zone_options |= DNS_ZONEOPT_IGNORESRVCNAME;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_WARNSRVCNAME;
 		zone_options &= ~DNS_ZONEOPT_IGNORESRVCNAME;
@@ -359,8 +367,10 @@ configure_zone(const char *vclass, const char *view,
 			zone_options |= DNS_ZONEOPT_CHECKSPF;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKSPF;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 		zone_options |= DNS_ZONEOPT_CHECKSPF;
 	}
@@ -376,8 +386,10 @@ configure_zone(const char *vclass, const char *view,
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMES;
 			zone_options &= ~DNS_ZONEOPT_CHECKNAMESFAIL;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	} else {
 	       zone_options |= DNS_ZONEOPT_CHECKNAMES;
 	       zone_options |= DNS_ZONEOPT_CHECKNAMESFAIL;
@@ -387,14 +399,16 @@ configure_zone(const char *vclass, const char *view,
 	fmtobj = NULL;
 	if (get_maps(maps, "masterfile-format", &fmtobj)) {
 		const char *masterformatstr = cfg_obj_asstring(fmtobj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c
index 0f491fa03d6..76401129074 100644
--- a/bin/check/named-checkzone.c
+++ b/bin/check/named-checkzone.c
@@ -141,12 +141,14 @@ main(int argc, char **argv) {
 #define PROGCMP(X) \
 	(strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0)
 
-	if (PROGCMP("named-checkzone"))
+	if (PROGCMP("named-checkzone")) {
 		progmode = progmode_check;
-	else if (PROGCMP("named-compilezone"))
+	} else if (PROGCMP("named-compilezone")) {
 		progmode = progmode_compile;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/* Compilation specific defaults */
 	if (progmode == progmode_compile) {
diff --git a/bin/confgen/ddns-confgen.c b/bin/confgen/ddns-confgen.c
index 5220ed6995f..9e4f6176e64 100644
--- a/bin/confgen/ddns-confgen.c
+++ b/bin/confgen/ddns-confgen.c
@@ -130,10 +130,12 @@ main(int argc, char **argv) {
 	if (PROGCMP("tsig-keygen")) {
 		progmode = progmode_keygen;
 		quiet = true;
-	} else if (PROGCMP("ddns-confgen"))
+	} else if (PROGCMP("ddns-confgen")) {
 		progmode = progmode_confgen;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	isc_commandline_errprint = false;
 
diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index d0b5515d4a7..b42027250df 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -1236,6 +1236,7 @@ dash_option(char *option, char *next, bool *open_type_class) {
 			/* NOTREACHED */
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		if (strlen(option) > 1U)
 			option = &option[1];
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index e30dbe38fd7..031dc559c26 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -2400,6 +2400,7 @@ setup_lookup(dig_lookup_t *lookup) {
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 
 			isc_buffer_init(&b, ecsbuf, sizeof(ecsbuf));
diff --git a/bin/named/config.c b/bin/named/config.c
index 1da52262647..d1decc45d9a 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -431,18 +431,20 @@ named_config_getzonetype(const cfg_obj_t *zonetypeobj) {
 	const char *str;
 
 	str = cfg_obj_asstring(zonetypeobj);
-	if (strcasecmp(str, "master") == 0)
+	if (strcasecmp(str, "master") == 0) {
 		ztype = dns_zone_master;
-	else if (strcasecmp(str, "slave") == 0)
+	} else if (strcasecmp(str, "slave") == 0) {
 		ztype = dns_zone_slave;
-	else if (strcasecmp(str, "stub") == 0)
+	} else if (strcasecmp(str, "stub") == 0) {
 		ztype = dns_zone_stub;
-	else if (strcasecmp(str, "static-stub") == 0)
+	} else if (strcasecmp(str, "static-stub") == 0) {
 		ztype = dns_zone_staticstub;
-	else if (strcasecmp(str, "redirect") == 0)
+	} else if (strcasecmp(str, "redirect") == 0) {
 		ztype = dns_zone_redirect;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 	return (ztype);
 }
 
@@ -1017,6 +1019,7 @@ named_config_getkeyalgorithm2(const char *str, const dns_name_t **name,
 		case hmacsha512: *name = dns_tsig_hmacsha512_name; break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 	if (typep != NULL)
diff --git a/bin/named/logconf.c b/bin/named/logconf.c
index d60e7fc8f06..f3dea3a6fcf 100644
--- a/bin/named/logconf.c
+++ b/bin/named/logconf.c
@@ -157,6 +157,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		type = ISC_LOG_TOFILE;
diff --git a/bin/named/server.c b/bin/named/server.c
index ab7d9460d41..e0a291e243d 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1147,6 +1147,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	sa = *(cfg_obj_assockaddr(obj));
@@ -1168,6 +1169,7 @@ get_view_querysource_dispatch(const cfg_obj_t **maps, int af,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	if (result != ISC_R_SUCCESS)
 		return (ISC_R_SUCCESS);
@@ -1275,20 +1277,22 @@ configure_order(dns_order_t *order, const cfg_obj_t *ent) {
 	obj = cfg_tuple_get(ent, "ordering");
 	INSIST(cfg_obj_isstring(obj));
 	str = cfg_obj_asstring(obj);
-	if (!strcasecmp(str, "fixed"))
+	if (!strcasecmp(str, "fixed")) {
 #if DNS_RDATASET_FIXED
 		mode = DNS_RDATASETATTR_FIXEDORDER;
 #else
 		mode = DNS_RDATASETATTR_CYCLIC;
 #endif /* DNS_RDATASET_FIXED */
-	else if (!strcasecmp(str, "random"))
+	} else if (!strcasecmp(str, "random")) {
 		mode = DNS_RDATASETATTR_RANDOMIZE;
-	else if (!strcasecmp(str, "cyclic"))
+	} else if (!strcasecmp(str, "cyclic")) {
 		mode = DNS_RDATASETATTR_CYCLIC;
-	else if (!strcasecmp(str, "none"))
+	} else if (!strcasecmp(str, "none")) {
 		mode = DNS_RDATASETATTR_NONE;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/*
 	 * "*" should match everything including the root (BIND 8 compat).
@@ -1420,14 +1424,16 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	(void)cfg_map_get(cpeer, "transfer-format", &obj);
 	if (obj != NULL) {
 		str = cfg_obj_asstring(obj);
-		if (strcasecmp(str, "many-answers") == 0)
+		if (strcasecmp(str, "many-answers") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_many_answers));
-		else if (strcasecmp(str, "one-answer") == 0)
+		} else if (strcasecmp(str, "one-answer") == 0) {
 			CHECK(dns_peer_settransferformat(peer,
 							 dns_one_answer));
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -3941,8 +3947,10 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		view->checknames = false;
 	} else if (strcasecmp(str, "ignore") == 0) {
 		view->checknames = false;
-	} else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	obj = NULL;
 	result = named_config_get(maps, "zero-no-soa-ttl-cache", &obj);
@@ -4334,12 +4342,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			const char *resp = cfg_obj_asstring(obj2);
 			isc_result_t r = DNS_R_SERVFAIL;
 
-			if (strcasecmp(resp, "drop") == 0)
+			if (strcasecmp(resp, "drop") == 0) {
 				r = DNS_R_DROP;
-			else if (strcasecmp(resp, "fail") == 0)
+			} else if (strcasecmp(resp, "fail") == 0) {
 				r = DNS_R_SERVFAIL;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 
 			dns_resolver_setquotaresponse(view->resolver,
 						      dns_quotatype_server, r);
@@ -4669,20 +4679,24 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->minimalresponses = dns_minimal_noauth;
 		} else if (strcasecmp(str, "no-auth-recursive") == 0) {
 			view->minimalresponses = dns_minimal_noauthrec;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
 	result = named_config_get(maps, "transfer-format", &obj);
 	INSIST(result == ISC_R_SUCCESS);
 	str = cfg_obj_asstring(obj);
-	if (strcasecmp(str, "many-answers") == 0)
+	if (strcasecmp(str, "many-answers") == 0) {
 		view->transfer_format = dns_many_answers;
-	else if (strcasecmp(str, "one-answer") == 0)
+	} else if (strcasecmp(str, "one-answer") == 0) {
 		view->transfer_format = dns_one_answer;
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	obj = NULL;
 	result = named_config_get(maps, "trust-anchor-telemetry", &obj);
@@ -4955,12 +4969,14 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 		const char *resp = cfg_obj_asstring(obj2);
 		isc_result_t r = DNS_R_SERVFAIL;
 
-		if (strcasecmp(resp, "drop") == 0)
+		if (strcasecmp(resp, "drop") == 0) {
 			r = DNS_R_DROP;
-		else if (strcasecmp(resp, "fail") == 0)
+		} else if (strcasecmp(resp, "fail") == 0) {
 			r = DNS_R_SERVFAIL;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 
 		dns_resolver_setquotaresponse(view->resolver,
 					      dns_quotatype_zone, r);
@@ -4976,10 +4992,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v4_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v4_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v4_aaaastr, "break-dnssec") == 0) {
 			view->v4_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -4992,10 +5010,12 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 			view->v6_aaaa = dns_aaaa_ok;
 	} else {
 		const char *v6_aaaastr = cfg_obj_asstring(obj);
-		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0)
+		if (strcasecmp(v6_aaaastr, "break-dnssec") == 0) {
 			view->v6_aaaa = dns_aaaa_break_dnssec;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	CHECK(configure_view_acl(vconfig, config, named_g_config,
@@ -5241,14 +5261,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist,
 				statlevel = dns_zonestat_none;
 		} else {
 			const char *levelstr = cfg_obj_asstring(obj);
-			if (strcasecmp(levelstr, "full") == 0)
+			if (strcasecmp(levelstr, "full") == 0) {
 				statlevel = dns_zonestat_full;
-			else if (strcasecmp(levelstr, "terse") == 0)
+			} else if (strcasecmp(levelstr, "terse") == 0) {
 				statlevel = dns_zonestat_terse;
-			else if (strcasecmp(levelstr, "none") == 0)
+			} else if (strcasecmp(levelstr, "none") == 0) {
 				statlevel = dns_zonestat_none;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 
 		for (empty = empty_zones[empty_zone];
@@ -5565,16 +5587,18 @@ configure_forward(const cfg_obj_t *config, dns_view_t *view,
 				    "forwarding");
 		fwdpolicy = dns_fwdpolicy_none;
 	} else {
-		if (forwardtype == NULL)
+		if (forwardtype == NULL) {
 			fwdpolicy = dns_fwdpolicy_first;
-		else {
+		} else {
 			const char *forwardstr = cfg_obj_asstring(forwardtype);
-			if (strcasecmp(forwardstr, "first") == 0)
+			if (strcasecmp(forwardstr, "first") == 0) {
 				fwdpolicy = dns_fwdpolicy_first;
-			else if (strcasecmp(forwardstr, "only") == 0)
+			} else if (strcasecmp(forwardstr, "only") == 0) {
 				fwdpolicy = dns_fwdpolicy_only;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 	}
 
@@ -8947,6 +8971,7 @@ load_configuration(const char *filename, named_server_t *server,
 		server->sctx->cookiealg = ns_cookiealg_aes;
 #else
 		INSIST(0);
+		ISC_UNREACHABLE();
 #endif
 	} else if (strcasecmp(cfg_obj_asstring(obj), "sha1") == 0) {
 		server->sctx->cookiealg = ns_cookiealg_sha1;
@@ -8954,6 +8979,7 @@ load_configuration(const char *filename, named_server_t *server,
 		server->sctx->cookiealg = ns_cookiealg_sha256;
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	obj = NULL;
@@ -12568,12 +12594,14 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	isc_buffer_init(&argbuf, command, (unsigned int) strlen(command));
 	isc_buffer_add(&argbuf, strlen(command));
 
-	if (strncasecmp(command, "add", 3) == 0)
+	if (strncasecmp(command, "add", 3) == 0) {
 		bn = "addzone";
-	else if (strncasecmp(command, "mod", 3) == 0)
+	} else if (strncasecmp(command, "mod", 3) == 0) {
 		bn = "modzone";
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	/*
 	 * Convert the "addzone" or "modzone" to just "zone", for
@@ -14907,6 +14935,7 @@ named_server_mkeys(named_server_t *server, isc_lex_t *lex,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		if (viewtxt != NULL) {
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index c757a7225a1..d185155c1ed 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -125,7 +125,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 		break;
 	    default:
 		INSIST(0);
-		return (ISC_R_FAILURE);
+		ISC_UNREACHABLE();
 	}
 
 	/* First check to see if ACL is defined within the zone */
@@ -231,12 +231,14 @@ configure_zone_ssutable(const cfg_obj_t *zconfig, dns_zone_t *zone,
 		unsigned int i, n;
 
 		str = cfg_obj_asstring(mode);
-		if (strcasecmp(str, "grant") == 0)
+		if (strcasecmp(str, "grant") == 0) {
 			grant = true;
-		else if (strcasecmp(str, "deny") == 0)
+		} else if (strcasecmp(str, "deny") == 0) {
 			grant = false;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 
 		str = cfg_obj_asstring(matchtype);
 		CHECK(dns_ssu_mtypefromstring(str, &mtype));
@@ -759,6 +761,7 @@ checknames(dns_zonetype_t ztype, const cfg_obj_t **maps,
 	case dns_zone_master: zone = "master"; break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	result = named_checknames_get(maps, zone, objp);
 	INSIST(result == ISC_R_SUCCESS && objp != NULL && *objp != NULL);
@@ -990,14 +993,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 	if (result == ISC_R_SUCCESS) {
 		const char *masterformatstr = cfg_obj_asstring(obj);
 
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -1013,12 +1018,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			return (ISC_R_FAILURE);
 		}
 
-		if (strcasecmp(masterstylestr, "full") == 0)
+		if (strcasecmp(masterstylestr, "full") == 0) {
 			masterstyle = &dns_master_style_full;
-		else if (strcasecmp(masterstylestr, "relative") == 0)
+		} else if (strcasecmp(masterstylestr, "relative") == 0) {
 			masterstyle = &dns_master_style_default;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	obj = NULL;
@@ -1104,16 +1111,18 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			dialup = dns_dialuptype_no;
 	} else {
 		const char *dialupstr = cfg_obj_asstring(obj);
-		if (strcasecmp(dialupstr, "notify") == 0)
+		if (strcasecmp(dialupstr, "notify") == 0) {
 			dialup = dns_dialuptype_notify;
-		else if (strcasecmp(dialupstr, "notify-passive") == 0)
+		} else if (strcasecmp(dialupstr, "notify-passive") == 0) {
 			dialup = dns_dialuptype_notifypassive;
-		else if (strcasecmp(dialupstr, "refresh") == 0)
+		} else if (strcasecmp(dialupstr, "refresh") == 0) {
 			dialup = dns_dialuptype_refresh;
-		else if (strcasecmp(dialupstr, "passive") == 0)
+		} else if (strcasecmp(dialupstr, "passive") == 0) {
 			dialup = dns_dialuptype_passive;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	if (raw != NULL)
 		dns_zone_setdialup(raw, dialup);
@@ -1129,14 +1138,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			statlevel = dns_zonestat_none;
 	} else {
 		const char *levelstr = cfg_obj_asstring(obj);
-		if (strcasecmp(levelstr, "full") == 0)
+		if (strcasecmp(levelstr, "full") == 0) {
 			statlevel = dns_zonestat_full;
-		else if (strcasecmp(levelstr, "terse") == 0)
+		} else if (strcasecmp(levelstr, "terse") == 0) {
 			statlevel = dns_zonestat_terse;
-		else if (strcasecmp(levelstr, "none") == 0)
+		} else if (strcasecmp(levelstr, "none") == 0) {
 			statlevel = dns_zonestat_none;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 	dns_zone_setstatlevel(zone, statlevel);
 
@@ -1174,12 +1185,14 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 				notifytype = dns_notifytype_no;
 		} else {
 			const char *notifystr = cfg_obj_asstring(obj);
-			if (strcasecmp(notifystr, "explicit") == 0)
+			if (strcasecmp(notifystr, "explicit") == 0) {
 				notifytype = dns_notifytype_explicit;
-			else if (strcasecmp(notifystr, "master-only") == 0)
+			} else if (strcasecmp(notifystr, "master-only") == 0) {
 				notifytype = dns_notifytype_masteronly;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 		if (raw != NULL)
 			dns_zone_setnotifytype(raw, dns_notifytype_no);
@@ -1326,8 +1339,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		if (raw != NULL) {
 			dns_zone_setoption(raw, DNS_ZONEOPT_CHECKNAMES,
 					   check);
@@ -1362,8 +1377,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(zone, DNS_ZONEOPT_CHECKSPF, check);
 
 		obj = NULL;
@@ -1508,14 +1525,16 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "auto-dnssec", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "allow") == 0)
+			if (strcasecmp(arg, "allow") == 0) {
 				allow = true;
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				allow = maint = true;
-			else if (strcasecmp(arg, "off") == 0)
+			} else if (strcasecmp(arg, "off") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_ALLOW, allow);
 			dns_zone_setkeyopt(zone, DNS_ZONEKEY_MAINTAIN, maint);
 		}
@@ -1568,8 +1587,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(dupcheck, "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRR, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKDUPRRFAIL, fail);
 
@@ -1583,8 +1604,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			fail = check = true;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			fail = check = false;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMX, check);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_CHECKMXFAIL, fail);
 
@@ -1620,8 +1643,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNMXCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNOREMXCNAME, ignore);
 
@@ -1635,8 +1660,10 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			warn = ignore = false;
 		} else if (strcasecmp(cfg_obj_asstring(obj), "ignore") == 0) {
 			warn = ignore = true;
-		} else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_WARNSRVCNAME, warn);
 		dns_zone_setoption(mayberaw, DNS_ZONEOPT_IGNORESRVCNAME,
 				   ignore);
@@ -1652,13 +1679,15 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		result = cfg_map_get(zoptions, "dnssec-update-mode", &obj);
 		if (result == ISC_R_SUCCESS) {
 			const char *arg = cfg_obj_asstring(obj);
-			if (strcasecmp(arg, "no-resign") == 0)
+			if (strcasecmp(arg, "no-resign") == 0) {
 				dns_zone_setkeyopt(zone, DNS_ZONEKEY_NORESIGN,
 						   true);
-			else if (strcasecmp(arg, "maintain") == 0)
+			} else if (strcasecmp(arg, "maintain") == 0) {
 				;
-			else
+			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
+			}
 		}
 
 		obj = NULL;
diff --git a/lib/bind9/check.c b/lib/bind9/check.c
index 5b6e7d89149..a8fb6e32d96 100644
--- a/lib/bind9/check.c
+++ b/lib/bind9/check.c
@@ -1848,6 +1848,7 @@ check_update_policy(const cfg_obj_t *policy, isc_log_t *logctx) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		for (element2 = cfg_list_first(typelist);
@@ -2103,6 +2104,7 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	}
 
@@ -2499,14 +2501,16 @@ check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	(void)cfg_map_get(zoptions, "masterfile-format", &obj);
 	if (obj != NULL) {
 		const char *masterformatstr = cfg_obj_asstring(obj);
-		if (strcasecmp(masterformatstr, "text") == 0)
+		if (strcasecmp(masterformatstr, "text") == 0) {
 			masterformat = dns_masterformat_text;
-		else if (strcasecmp(masterformatstr, "raw") == 0)
+		} else if (strcasecmp(masterformatstr, "raw") == 0) {
 			masterformat = dns_masterformat_raw;
-		else if (strcasecmp(masterformatstr, "map") == 0)
+		} else if (strcasecmp(masterformatstr, "map") == 0) {
 			masterformat = dns_masterformat_map;
-		else
+		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
+		}
 	}
 
 	if (masterformat == dns_masterformat_map) {
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 30aa160e91b..6ec486ed71a 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -494,8 +494,8 @@ dns_aclelement_match2(const isc_netaddr_t *reqaddr,
 					&e->geoip_elem));
 #endif
 	default:
-		/* Should be impossible. */
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	result = dns_acl_match2(reqaddr, reqsigner, ecs, ecslen, scope,
@@ -673,7 +673,7 @@ dns_acl_isinsecure(const dns_acl_t *a) {
 
 		default:
 			INSIST(0);
-			return (true);
+			ISC_UNREACHABLE();
 		}
 	}
 
diff --git a/lib/dns/client.c b/lib/dns/client.c
index e1224cb9a70..924f751cbbd 100644
--- a/lib/dns/client.c
+++ b/lib/dns/client.c
@@ -273,6 +273,7 @@ getudpdispatch(int family, dns_dispatchmgr_t *dispatchmgr,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	attrmask = 0;
 	attrmask |= DNS_DISPATCHATTR_UDP;
@@ -3184,6 +3185,7 @@ dns_client_updaterec(dns_client_updateop_t op, const dns_name_t *owner,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	rdatalist->type = rdata->type;
diff --git a/lib/dns/diff.c b/lib/dns/diff.c
index 00f5ff258c2..645495ded73 100644
--- a/lib/dns/diff.c
+++ b/lib/dns/diff.c
@@ -380,6 +380,7 @@ diff_apply(dns_diff_t *diff, dns_db_t *db, dns_dbversion_t *ver,
 				break;
 			default:
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 
 			if (result == ISC_R_SUCCESS) {
diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c
index 3e15b7ccc0f..18c35928f97 100644
--- a/lib/dns/dispatch.c
+++ b/lib/dns/dispatch.c
@@ -918,7 +918,7 @@ free_buffer(dns_dispatch_t *disp, void *buf, unsigned int len) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -1588,7 +1588,7 @@ startrecv(dns_dispatch_t *disp, dispsocket_t *dispsock) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	return (ISC_R_SUCCESS);
diff --git a/lib/dns/dnsrps.c b/lib/dns/dnsrps.c
index 71dc878cd00..c432f0b5a86 100644
--- a/lib/dns/dnsrps.c
+++ b/lib/dns/dnsrps.c
@@ -312,6 +312,7 @@ dns_dnsrps_2policy(librpz_policy_t rps_policy) {
 	case LIBRPZ_POLICY_DISABLED:
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/dns/dnstap.c b/lib/dns/dnstap.c
index df64ebd0e46..bc15b23107d 100644
--- a/lib/dns/dnstap.c
+++ b/lib/dns/dnstap.c
@@ -1047,6 +1047,7 @@ dns_dt_open(const char *filename, dns_dtmode_t mode, isc_mem_t *mctx,
 		return (ISC_R_NOTIMPLEMENTED);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	isc_mem_attach(mctx, &handle->mctx);
diff --git a/lib/dns/geoip.c b/lib/dns/geoip.c
index ec20baa9583..b044ef1730e 100644
--- a/lib/dns/geoip.c
+++ b/lib/dns/geoip.c
@@ -306,6 +306,7 @@ country_lookup(GeoIP *db, dns_geoip_subtype_t subtype,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		if (text == NULL)
@@ -373,6 +374,7 @@ city_string(GeoIPRecord *record, dns_geoip_subtype_t subtype, int *maxlen) {
 		return (deconst);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -467,6 +469,7 @@ static char * region_string(GeoIPRegion *region, dns_geoip_subtype_t subtype, in
 		return (deconst);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -861,6 +864,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, uint8_t *scope,
 
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE()
 	}
 
 	return (false);
diff --git a/lib/dns/journal.c b/lib/dns/journal.c
index 89e1e101903..2deeba2e8e3 100644
--- a/lib/dns/journal.c
+++ b/lib/dns/journal.c
@@ -751,6 +751,7 @@ ixfr_order(const void *av, const void *bv) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	switch (b->op) {
@@ -764,6 +765,7 @@ ixfr_order(const void *av, const void *bv) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	r = bop - aop;
diff --git a/lib/dns/masterdump.c b/lib/dns/masterdump.c
index f45345c8d5b..091579743c2 100644
--- a/lib/dns/masterdump.c
+++ b/lib/dns/masterdump.c
@@ -1493,7 +1493,7 @@ dumpctx_create(isc_mem_t *mctx, dns_db_t *db, dns_dbversion_t *version,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	result = totext_ctx_init(style, &dctx->tctx);
@@ -1633,6 +1633,7 @@ writeheader(dns_dumpctx_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	isc_mem_put(dctx->mctx, buffer.base, buffer.length);
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 3359dafdf2d..24156df9572 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -919,8 +919,8 @@ getname(dns_name_t *name, isc_buffer_t *source, dns_message_t *msg,
 		}
 	}
 
-	INSIST(0);  /* Cannot get here... */
-	return (ISC_R_UNEXPECTED);
+	INSIST(0);
+	ISC_UNREACHABLE();
 }
 
 static isc_result_t
diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c
index 43f11e790a8..fb529201c11 100644
--- a/lib/dns/openssleddsa_link.c
+++ b/lib/dns/openssleddsa_link.c
@@ -476,8 +476,8 @@ openssleddsa_todns(const dst_key_t *key, isc_buffer_t *data) {
 		return (result);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
-	return (DST_R_OPENSSLFAILURE);
 }
 
 static isc_result_t
diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c
index c03fd723880..ec35f50dd23 100644
--- a/lib/dns/opensslrsa_link.c
+++ b/lib/dns/opensslrsa_link.c
@@ -298,6 +298,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 #if USE_EVP
@@ -327,6 +328,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 #endif
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (!EVP_DigestInit_ex(evp_md_ctx, type, NULL)) {
@@ -389,6 +391,7 @@ opensslrsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 #endif
 
@@ -474,6 +477,7 @@ opensslrsa_destroyctx(dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 #endif
 }
@@ -538,6 +542,7 @@ opensslrsa_adddata(dst_context_t *dctx, const isc_region_t *data) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 #endif
 	return (ISC_R_SUCCESS);
@@ -659,6 +664,7 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 #if OPENSSL_VERSION_NUMBER < 0x00908000L
@@ -692,6 +698,7 @@ opensslrsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 #else
 	INSIST(type != 0);
@@ -821,6 +828,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (sig->length != (unsigned int) RSA_size(rsa))
@@ -874,6 +882,7 @@ opensslrsa_verify2(dst_context_t *dctx, int maxbits, const isc_region_t *sig) {
 
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 #else
 	INSIST(type != 0);
@@ -1022,6 +1031,7 @@ opensslrsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (rsa == NULL || e == NULL || cb == NULL)
diff --git a/lib/dns/peer.c b/lib/dns/peer.c
index 89447cc545e..85f895a2cba 100644
--- a/lib/dns/peer.c
+++ b/lib/dns/peer.c
@@ -206,10 +206,11 @@ dns_peer_new(isc_mem_t *mem, const isc_netaddr_t *addr, dns_peer_t **peerptr) {
 		prefixlen = 32;
 		break;
 	case AF_INET6:
-		 prefixlen = 128;
+		prefixlen = 128;
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	return (dns_peer_newprefix(mem, addr, prefixlen, peerptr));
diff --git a/lib/dns/pkcs11rsa_link.c b/lib/dns/pkcs11rsa_link.c
index 2d75286efff..9fcc7ae1038 100644
--- a/lib/dns/pkcs11rsa_link.c
+++ b/lib/dns/pkcs11rsa_link.c
@@ -121,6 +121,7 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	rsa = key->keydata.pkey;
@@ -258,6 +259,7 @@ pkcs11rsa_createctx_sign(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	PK11_RET(pkcs_C_SignInit,
@@ -357,6 +359,7 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	rsa = key->keydata.pkey;
@@ -426,6 +429,7 @@ pkcs11rsa_createctx_verify(dst_key_t *key, unsigned int maxbits,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	PK11_RET(pkcs_C_VerifyInit,
@@ -632,6 +636,7 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	switch (key->key_alg) {
@@ -652,6 +657,7 @@ pkcs11rsa_createctx(dst_key_t *key, dst_context_t *dctx) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	pk11_ctx = (pk11_context_t *) isc_mem_get(dctx->mctx,
@@ -788,6 +794,7 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	switch (key->key_alg) {
@@ -816,6 +823,7 @@ pkcs11rsa_sign(dst_context_t *dctx, isc_buffer_t *sig) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	dgstlen = derlen + hashlen;
 	INSIST(dgstlen <= sizeof(digest));
@@ -1040,6 +1048,7 @@ pkcs11rsa_verify(dst_context_t *dctx, const isc_region_t *sig) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	dgstlen = derlen + hashlen;
 	INSIST(dgstlen <= sizeof(digest));
@@ -1231,6 +1240,7 @@ pkcs11rsa_generate(dst_key_t *key, int exp, void (*callback)(int)) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	pk11_ctx = (pk11_context_t *) isc_mem_get(key->mctx,
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 79d65a27aab..54201871f3d 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -6613,6 +6613,7 @@ is_answertarget_allowed(fetchctx_t *fctx, dns_name_t *qname, dns_name_t *rname,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (chainingp != NULL)
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index 518eb27409f..6248e4ff644 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -269,9 +269,8 @@ dns_rpz_policy2str(dns_rpz_policy_t policy) {
 		str = "MISS";
 		break;
 	default:
-		str = "";
-		POST(str);
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (str);
 }
@@ -338,7 +337,7 @@ make_addr_set(dns_rpz_addr_zbits_t *tgt_set, dns_rpz_zbits_t zbits,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -357,7 +356,7 @@ make_nm_set(dns_rpz_nm_zbits_t *tgt_set,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -2521,7 +2520,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else if (netaddr->family == AF_INET6) {
 		dns_rpz_cidr_key_t src_ip6;
@@ -2547,7 +2546,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		return (DNS_RPZ_INVALID_NUM);
@@ -2584,7 +2583,7 @@ dns_rpz_find_ip(dns_rpz_zones_t *rpzs, dns_rpz_type_t rpz_type,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 	result = ip2name(&found->ip, found->prefix, dns_rootname, ip_name);
 	RWUNLOCK(&rpzs->search_lock, isc_rwlocktype_read);
diff --git a/lib/dns/rrl.c b/lib/dns/rrl.c
index 546fc6ba593..81ef052c24c 100644
--- a/lib/dns/rrl.c
+++ b/lib/dns/rrl.c
@@ -465,8 +465,8 @@ get_rate(dns_rrl_t *rrl, dns_rrl_rtype_t rtype) {
 		return (&rrl->all_per_second);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
-	return (NULL);
 }
 
 static int
@@ -823,7 +823,7 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	switch (e->key.s.rtype) {
@@ -852,6 +852,7 @@ make_log_buf(dns_rrl_t *rrl, dns_rrl_entry_t *e,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (plural)
diff --git a/lib/dns/sdb.c b/lib/dns/sdb.c
index 0b61fb8f6ff..a5ed74a8b06 100644
--- a/lib/dns/sdb.c
+++ b/lib/dns/sdb.c
@@ -1050,7 +1050,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
 	UNUSED(node);
 	UNUSED(now);
 	INSIST(0);
-	return (ISC_R_UNEXPECTED);
+	ISC_UNREACHABLE();
 }
 
 static void
diff --git a/lib/dns/sdlz.c b/lib/dns/sdlz.c
index d570d7db308..eb24652f717 100644
--- a/lib/dns/sdlz.c
+++ b/lib/dns/sdlz.c
@@ -779,7 +779,7 @@ expirenode(dns_db_t *db, dns_dbnode_t *node, isc_stdtime_t now) {
 	UNUSED(node);
 	UNUSED(now);
 	INSIST(0);
-	return (ISC_R_UNEXPECTED);
+	ISC_UNREACHABLE();
 }
 
 static void
diff --git a/lib/dns/ssu.c b/lib/dns/ssu.c
index f3e06d42e1e..597af701609 100644
--- a/lib/dns/ssu.c
+++ b/lib/dns/ssu.c
@@ -290,6 +290,7 @@ reverse_from_address(dns_name_t *tcpself, const isc_netaddr_t *tcpaddr) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	isc_buffer_init(&b, buf, strlen(buf));
 	isc_buffer_add(&b, strlen(buf));
@@ -332,6 +333,7 @@ stf_from_address(dns_name_t *stfself, const isc_netaddr_t *tcpaddr) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	isc_buffer_init(&b, buf, strlen(buf));
 	isc_buffer_add(&b, strlen(buf));
diff --git a/lib/dns/tsec.c b/lib/dns/tsec.c
index b4345b5fca9..093fa6643ce 100644
--- a/lib/dns/tsec.c
+++ b/lib/dns/tsec.c
@@ -100,6 +100,7 @@ dns_tsec_create(isc_mem_t *mctx, dns_tsectype_t type, dst_key_t *key,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	tsec->magic = DNS_TSEC_MAGIC;
@@ -125,6 +126,7 @@ dns_tsec_destroy(dns_tsec_t **tsecp) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	tsec->magic = 0;
@@ -154,5 +156,6 @@ dns_tsec_getkey(dns_tsec_t *tsec, void *keyp) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
diff --git a/lib/dns/update.c b/lib/dns/update.c
index 6c9df17bd97..2ab3d0f84c0 100644
--- a/lib/dns/update.c
+++ b/lib/dns/update.c
@@ -1809,6 +1809,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 				sigs++;
 			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			ISC_LIST_APPEND(state->work.tuples, t, link);
@@ -1982,6 +1983,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 				sigs++;
 			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 			ISC_LIST_UNLINK(state->nsec_mindiff.tuples, t, link);
 			ISC_LIST_APPEND(state->work.tuples, t, link);
@@ -2008,6 +2010,7 @@ dns_update_signaturesinc(dns_update_log_t *log, dns_zone_t *zone, dns_db_t *db,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
  failure:
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index fb706c29880..c2e0ebf2f7d 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -3704,10 +3704,8 @@ validator_start(isc_task_t *task, isc_event_t *event) {
 			val->attributes |= VALATTR_NEEDNODATA;
 		result = nsecvalidate(val, false);
 	} else {
-		/*
-		 * This shouldn't happen.
-		 */
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (result != DNS_R_WAIT) {
diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c
index 4749b61073c..f80ce00f77c 100644
--- a/lib/dns/xfrin.c
+++ b/lib/dns/xfrin.c
@@ -623,7 +623,7 @@ xfr_rr(dns_xfrin_ctx_t *xfr, dns_name_t *name, uint32_t ttl,
 		/* FALLTHROUGH */
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 	result = ISC_R_SUCCESS;
  failure:
@@ -651,6 +651,7 @@ dns_xfrin_create(dns_zone_t *zone, dns_rdatatype_t xfrtype,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	return(dns_xfrin_create3(zone, xfrtype, masteraddr, &sourceaddr,
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 44127e6a70c..220283fde87 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -9012,6 +9012,7 @@ normalize_key(dns_rdata_t *rr, dns_rdata_t *target,
 		break;
 	    default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	return (ISC_R_SUCCESS);
 }
@@ -15838,7 +15839,8 @@ got_transfer_quota(isc_task_t *task, isc_event_t *event) {
 		break;
 	default:
 		INSIST(0);
-	};
+		ISC_UNREACHABLE();
+	}
 	UNLOCK_ZONE(zone);
 	INSIST(isc_sockaddr_pf(&masteraddr) == isc_sockaddr_pf(&sourceaddr));
 	result = dns_xfrin_create3(zone, xfrtype, &masteraddr, &sourceaddr,
@@ -17307,6 +17309,7 @@ dns_zone_setdialup(dns_zone_t *zone, dns_dialuptype_t dialup) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	UNLOCK_ZONE(zone);
 }
@@ -17382,6 +17385,7 @@ dns_zonemgr_getcount(dns_zonemgr_t *zmgr, int state) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	RWUNLOCK(&zmgr->rwlock, isc_rwlocktype_read);
diff --git a/lib/irs/getnameinfo.c b/lib/irs/getnameinfo.c
index f5754263289..343a65e8ab1 100644
--- a/lib/irs/getnameinfo.c
+++ b/lib/irs/getnameinfo.c
@@ -196,6 +196,7 @@ getnameinfo(const struct sockaddr *sa, IRS_GETNAMEINFO_SOCKLEN_T salen,
 
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	proto = ((flags & NI_DGRAM) != 0) ? "udp" : "tcp";
 
diff --git a/lib/isc/hmacmd5.c b/lib/isc/hmacmd5.c
index f80217b6b57..0031afb024c 100644
--- a/lib/isc/hmacmd5.c
+++ b/lib/isc/hmacmd5.c
@@ -406,16 +406,5 @@ isc_hmacmd5_check(int testing) {
 }
 
 #else /* !PK11_MD5_DISABLE */
-#ifdef WIN32
-/* Make the Visual Studio linker happy */
-#include <isc/util.h>
-
-void isc_hmacmd5_init() { INSIST(0); }
-void isc_hmacmd5_invalidate() { INSIST(0); }
-void isc_hmacmd5_sign() { INSIST(0); }
-void isc_hmacmd5_update() { INSIST(0); }
-void isc_hmacmd5_verify() { INSIST(0); }
-void isc_hmacmd5_verify2() { INSIST(0); }
-void isc_hmacmd5_check() { INSIST(0); }
-#endif
+EMPTY_TRANSLATION_UNIT
 #endif /* PK11_MD5_DISABLE */
diff --git a/lib/isc/md5.c b/lib/isc/md5.c
index 25c71a207a3..920aed5f588 100644
--- a/lib/isc/md5.c
+++ b/lib/isc/md5.c
@@ -382,14 +382,5 @@ isc_md5_check(bool testing) {
 }
 
 #else /* !PK11_MD5_DISABLE */
-#ifdef WIN32
-/* Make the Visual Studio linker happy */
-#include <isc/util.h>
-
-void isc_md5_final() { INSIST(0); }
-void isc_md5_init() { INSIST(0); }
-void isc_md5_invalidate() { INSIST(0); }
-void isc_md5_update() { INSIST(0); }
-void isc_md5_check() { INSIST(0); }
-#endif
+EMPTY_TRANSLATION_UNIT
 #endif /* PK11_MD5_DISABLE */
diff --git a/lib/isc/mem.c b/lib/isc/mem.c
index 18f54664644..036b580dbaf 100644
--- a/lib/isc/mem.c
+++ b/lib/isc/mem.c
@@ -454,6 +454,7 @@ delete_trace_entry(isc__mem_t *mctx, const void *ptr, size_t size,
 	 * screwed.
 	 */
 	INSIST(0);
+	ISC_UNREACHABLE();
 }
 #endif /* ISC_MEM_TRACKLINES */
 
@@ -2331,6 +2332,7 @@ isc_mem_checkdestroyed(FILE *file) {
 		}
 #endif
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	UNLOCK(&contextslock);
 }
diff --git a/lib/isc/netaddr.c b/lib/isc/netaddr.c
index 34038fb7193..635f8f1345a 100644
--- a/lib/isc/netaddr.c
+++ b/lib/isc/netaddr.c
@@ -350,6 +350,7 @@ isc_netaddr_fromsockaddr(isc_netaddr_t *t, const isc_sockaddr_t *s) {
 #endif
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c
index 6a97e69c46e..c2c599e1a61 100644
--- a/lib/isc/sockaddr.c
+++ b/lib/isc/sockaddr.c
@@ -293,6 +293,7 @@ isc_sockaddr_anyofpf(isc_sockaddr_t *sockaddr, int pf) {
 	     break;
      default:
 	     INSIST(0);
+	     ISC_UNREACHABLE();
      }
 }
 
@@ -384,6 +385,7 @@ isc_sockaddr_fromnetaddr(isc_sockaddr_t *sockaddr, const isc_netaddr_t *na,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	ISC_LINK_INIT(sockaddr, link);
 }
diff --git a/lib/isc/unix/interfaceiter.c b/lib/isc/unix/interfaceiter.c
index 4df4d347032..deafe4ed983 100644
--- a/lib/isc/unix/interfaceiter.c
+++ b/lib/isc/unix/interfaceiter.c
@@ -131,7 +131,7 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/isc/unix/net.c b/lib/isc/unix/net.c
index efe17bd23a7..05d8f162f59 100644
--- a/lib/isc/unix/net.c
+++ b/lib/isc/unix/net.c
@@ -564,6 +564,7 @@ cmsgsend(int s, int level, int type, struct addrinfo *res) {
 #endif
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (sendmsg(s, &msg, 0) < 0) {
diff --git a/lib/isc/unix/socket.c b/lib/isc/unix/socket.c
index c057761f02b..ddc5e4449a1 100644
--- a/lib/isc/unix/socket.c
+++ b/lib/isc/unix/socket.c
@@ -1995,6 +1995,7 @@ doio_recv(isc__socket_t *sock, isc_socketevent_t *dev) {
 	case isc_sockettype_fdwatch:
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	if (sock->type == isc_sockettype_udp) {
@@ -2624,7 +2625,7 @@ opensocket(isc__socketmgr_t *manager, isc__socket_t *sock,
 			 * sockets.
 			 */
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		sock->fd = dup(dup_socket->fd);
@@ -2966,6 +2967,7 @@ socket_create(isc_socketmgr_t *manager0, int pf, isc_sockettype_t type,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	sock->pf = pf;
diff --git a/lib/isc/win32/interfaceiter.c b/lib/isc/win32/interfaceiter.c
index 1bbd0f89fed..3fd2a9c13d9 100644
--- a/lib/isc/win32/interfaceiter.c
+++ b/lib/isc/win32/interfaceiter.c
@@ -97,7 +97,7 @@ get_addr(unsigned int family, isc_netaddr_t *dst, struct sockaddr *src) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/isccc/sexpr.c b/lib/isccc/sexpr.c
index 68dbe446c7b..bb9565b2fd6 100644
--- a/lib/isccc/sexpr.c
+++ b/lib/isccc/sexpr.c
@@ -202,6 +202,7 @@ isccc_sexpr_print(isccc_sexpr_t *sexpr, FILE *stream) {
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index 0c28ed881ac..be5c9321987 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -401,6 +401,7 @@ get_subtype(const cfg_obj_t *obj, isc_log_t *lctx,
 		return (subtype);
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -595,8 +596,10 @@ parse_geoip_element(const cfg_obj_t *obj, isc_log_t *lctx,
 	} else if (strcasecmp(stype, "netspeed") == 0) {
 		subtype = dns_geoip_netspeed_id;
 		de.geoip_elem.as_int = atoi(search);
-	} else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	de.geoip_elem.subtype = get_subtype(obj, lctx, subtype, dbname);
 
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index 9970566890e..652e5095699 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -3250,12 +3250,14 @@ parse_querysource(cfg_parser_t *pctx, const cfg_type_t *type,
 	unsigned int have_dscp = 0;
 	const unsigned int *flagp = type->of;
 
-	if ((*flagp & CFG_ADDR_V4OK) != 0)
+	if ((*flagp & CFG_ADDR_V4OK) != 0) {
 		isc_netaddr_any(&netaddr);
-	else if ((*flagp & CFG_ADDR_V6OK) != 0)
+	} else if ((*flagp & CFG_ADDR_V6OK) != 0) {
 		isc_netaddr_any6(&netaddr);
-	else
+	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
+	}
 
 	for (;;) {
 		CHECK(cfg_peektoken(pctx, 0));
@@ -3343,6 +3345,7 @@ doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
 		cfg_print_cstr(pctx, "<ipv6_address>");
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	cfg_print_cstr(pctx, " | * ) [ port ( <integer> | * ) ] ) | "
 		       "( [ [ address ] ( ");
@@ -3352,6 +3355,7 @@ doc_querysource(cfg_printer_t *pctx, const cfg_type_t *type) {
 		cfg_print_cstr(pctx, "<ipv6_address>");
 	} else {
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 	cfg_print_cstr(pctx, " | * ) ] port ( <integer> | * ) ) )"
 		       " [ dscp <integer> ]");
@@ -4142,6 +4146,7 @@ cfg_print_zonegrammar(const unsigned int zonetype,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	for (clause = clauses; clause->name != NULL; clause++) {
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index c36a04a9b8f..82ad589be49 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -368,7 +368,7 @@ cfg_tuple_get(const cfg_obj_t *tupleobj, const char* name) {
 			return (tupleobj->value.tuple[i]);
 	}
 	INSIST(0);
-	return (NULL);
+	ISC_UNREACHABLE();
 }
 
 isc_result_t
@@ -1989,6 +1989,7 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 				; /* do nothing */
 			} else {
 				INSIST(0);
+				ISC_UNREACHABLE();
 			}
 		}
 	}
@@ -2304,6 +2305,7 @@ token_addr(cfg_parser_t *pctx, unsigned int flags, isc_netaddr_t *na) {
 			return (ISC_R_SUCCESS);
 		} else {
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 	} else {
 		if ((flags & (CFG_ADDR_V4OK | CFG_ADDR_V4PREFIXOK)) != 0) {
@@ -2582,7 +2584,7 @@ cfg_parse_netprefix(cfg_parser_t *pctx, const cfg_type_t *type,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 	CHECK(cfg_peektoken(pctx, 0));
 	if (pctx->token.type == isc_tokentype_special &&
diff --git a/lib/ns/client.c b/lib/ns/client.c
index f6095dfa317..2667eb75b4e 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -652,6 +652,7 @@ exit_check(ns_client_t *client) {
 		{
 			isc_mem_stats(client->mctx, stderr);
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		/*
@@ -1272,7 +1273,7 @@ client_send(ns_client_t *client) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		respsize = isc_buffer_usedlength(&buffer);
@@ -1298,7 +1299,7 @@ client_send(ns_client_t *client) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	}
 
@@ -1711,6 +1712,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		isc_buffer_init(&buf, ecs, sizeof(ecs));
@@ -1851,6 +1853,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		isc_hmacsha1_update(&hmacsha1, cp, length);
 		isc_hmacsha1_sign(&hmacsha1, digest, sizeof(digest));
@@ -1886,6 +1889,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 		isc_hmacsha256_update(&hmacsha256, cp, length);
 		isc_hmacsha256_sign(&hmacsha256, digest, sizeof(digest));
@@ -1895,6 +1899,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 	}
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 }
 
@@ -2455,7 +2460,7 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	} else {
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
@@ -2469,7 +2474,7 @@ ns__client_request(isc_task_t *task, isc_event_t *event) {
 			break;
 		default:
 			INSIST(0);
-			break;
+			ISC_UNREACHABLE();
 		}
 	}
 
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 652e286dc1b..67b94bc4bc8 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -2606,7 +2606,7 @@ rpz_get_zbits(ns_client_t *client,
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	/*
@@ -2830,6 +2830,7 @@ rpz_get_p_name(ns_client_t *client, dns_name_t *p_name,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	/*
@@ -3247,6 +3248,7 @@ dnsrps_rewrite_ip(ns_client_t *client, const isc_netaddr_t *netaddr,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	do {
@@ -3299,6 +3301,7 @@ dnsrps_rewrite_name(ns_client_t *client, dns_name_t *trig_name,
 		break;
 	default:
 		INSIST(0);
+		ISC_UNREACHABLE();
 	}
 
 	dns_name_toregion(trig_name, &r);
@@ -6406,6 +6409,7 @@ query_checkrpz(query_ctx_t *qctx, isc_result_t result) {
 			return (ISC_R_COMPLETE);
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		/*
@@ -8222,6 +8226,7 @@ query_nodata(query_ctx_t *qctx, isc_result_t result) {
 			break;
 		default:
 			INSIST(0);
+			ISC_UNREACHABLE();
 		}
 
 		SAVE(qctx->client->query.dns64_aaaa, qctx->rdataset);
@@ -10547,7 +10552,7 @@ query_setup_sortlist(query_ctx_t *qctx) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 }
 
diff --git a/lib/ns/tests/query_test.c b/lib/ns/tests/query_test.c
index 81818c2d9ba..554893f6427 100644
--- a/lib/ns/tests/query_test.c
+++ b/lib/ns/tests/query_test.c
@@ -379,7 +379,7 @@ ns__query_start_test(const ns__query_start_test_params_t *test) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	/*
diff --git a/lib/ns/xfrout.c b/lib/ns/xfrout.c
index 40897cf9504..c9beae50051 100644
--- a/lib/ns/xfrout.c
+++ b/lib/ns/xfrout.c
@@ -764,7 +764,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 		break;
 	default:
 		INSIST(0);
-		break;
+		ISC_UNREACHABLE();
 	}
 
 	ns_client_log(client,
-- 
GitLab


From 5ad72603a81e454c29a6088eb2cf18b7c03a2e9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Thu, 8 Nov 2018 12:19:00 +0700
Subject: [PATCH 10/12] Remove dummy ISLOCKED macro

(cherry picked from commit 68ca9877921892968c718865363e9115ba5095bf)
---
 lib/isc/include/isc/util.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h
index 1593a327938..b9548808315 100644
--- a/lib/isc/include/isc/util.h
+++ b/lib/isc/include/isc/util.h
@@ -106,7 +106,6 @@
 					      ISC_MSG_UNLOCKED, "UNLOCKED"), \
 			       (lp), __FILE__, __LINE__)); \
 	} while (0)
-#define ISLOCKED(lp) (1)
 #define DESTROYLOCK(lp) \
 	RUNTIME_CHECK(isc_mutex_destroy((lp)) == ISC_R_SUCCESS)
 
-- 
GitLab


From bc7a1b00e9f42092a2a42003c04a5f4af9a10e8b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Thu, 8 Nov 2018 19:45:37 +0700
Subject: [PATCH 11/12] fixup! Hint the compiler with ISC_UNREACHABLE(); that
 code after INSIST(0); cannot be reached

---
 lib/dns/geoip.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/dns/geoip.c b/lib/dns/geoip.c
index b044ef1730e..ea19bbe9005 100644
--- a/lib/dns/geoip.c
+++ b/lib/dns/geoip.c
@@ -864,7 +864,7 @@ dns_geoip_match(const isc_netaddr_t *reqaddr, uint8_t *scope,
 
 	default:
 		INSIST(0);
-		ISC_UNREACHABLE()
+		ISC_UNREACHABLE();
 	}
 
 	return (false);
-- 
GitLab


From 03c7bb9ab3f66fe92edeb2c27052c34f869f7421 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= <ondrej@sury.org>
Date: Thu, 8 Nov 2018 19:53:05 +0700
Subject: [PATCH 12/12] Disable Ed448 algorithm, the implementation in BIND 9
 is incomplete and broken

---
 configure    | 6 +++---
 configure.ac | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/configure b/configure
index c0f9bbcb7da..e5b999d3b87 100755
--- a/configure
+++ b/configure
@@ -17117,9 +17117,9 @@ int main() {
 
 _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
-  { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
-$as_echo "yes" >&6; }
-		have_ed448="yes"
+  { $as_echo "$as_me:${as_lineno-$LINENO}: result: broken" >&5
+$as_echo "broken" >&6; }
+		have_ed448="no"
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
diff --git a/configure.ac b/configure.ac
index 112506b1ad5..ec5d7350de0 100644
--- a/configure.ac
+++ b/configure.ac
@@ -1888,9 +1888,9 @@ int main() {
 	return (0);
 }
 ],
-		[AC_MSG_RESULT(yes)
-		have_ed448="yes"],
-		[AC_MSG_RESULT(no)
+		[AC_MSG_RESULT([broken])
+		have_ed448="no"],
+		[AC_MSG_RESULT([no])
 		have_ed448="no"],
 		[AC_MSG_RESULT(using --with-eddsa)])
 		case $with_eddsa in
-- 
GitLab