diff --git a/CHANGES b/CHANGES
index e06ed87a43..974f3f20e3 100644
--- a/CHANGES
+++ b/CHANGES
@@ -1,3 +1,5 @@
+3734.	[bug]		Improve building with libtool. [RT #35314]
+
 3733.	[func]		Improve interface scanning support.  Interface
 			information will be automatically updated if the
 			OS supports routing sockets (MacOS, *BSD, Linux).
diff --git a/bin/tests/system/dlzexternal/Makefile.in b/bin/tests/system/dlzexternal/Makefile.in
index 52f7de1f96..9edd51c788 100644
--- a/bin/tests/system/dlzexternal/Makefile.in
+++ b/bin/tests/system/dlzexternal/Makefile.in
@@ -43,13 +43,14 @@ OBJS =          ${DLOPENOBJS}
 @BIND9_MAKE_RULES@
 
 CFLAGS =	@CFLAGS@ @SO_CFLAGS@
+SO_LDFLAGS =	@LDFLAGS@ @SO_LDFLAGS@
 
 dlopen@EXEEXT@: ${DLOPENOBJS}
 	${LIBTOOL_MODE_LINK} ${PURIFY} ${CC} ${CFLAGS} ${LDFLAGS} \
 		-o $@ ${DLOPENOBJS} ${LIBS}
 
 driver.@SO@: ${SO_OBJS}
-	${LIBTOOL_MODE_LINK} @SO_LD@ -o $@ driver.@O@
+	${LIBTOOL_MODE_LINK} @SO_LD@ ${SO_LDFLAGS} -o $@ driver.@O@
 
 clean distclean::
 	rm -f ${TARGETS}
diff --git a/configure b/configure
index 4bcde81f8d..e3d9f824be 100755
--- a/configure
+++ b/configure
@@ -661,6 +661,7 @@ CONTRIB_DLZ
 PG_CONFIG
 SO_TARGETS
 SO_LD
+SO_LDFLAGS
 SO_CFLAGS
 SO
 BIND9_CONFIGARGS
@@ -1649,7 +1650,7 @@ Optional Features:
   --enable-largefile	  64-bit file support
   --enable-backtrace      log stack backtrace on abort [default=yes]
   --enable-symtable       use internal symbol table for backtrace
-                          [all|minimal(default)|none]
+			  [all|minimal(default)|none]
   --enable-ipv6           use IPv6 default=autodetect
   --enable-getifaddrs     Enable the use of getifaddrs() [yes|no].
   --disable-isc-spnego    use SPNEGO from GSSAPI library
@@ -1680,7 +1681,7 @@ Optional Packages:
   --with-openssl=PATH     Build with OpenSSL yes|no|path.
 			  (Crypto is required for DNSSEC)
   --with-pkcs11=PATH      Build with PKCS11 support yes|no|path
-                          (PATH is for the PKCS11 provider)
+			  (PATH is for the PKCS11 provider)
   --with-ecdsa            Crypto ECDSA
   --with-gost             Crypto GOST yes|no|raw|asn1.
   --with-libxml2=PATH     Build with libxml2 library yes|no|path
@@ -11688,14 +11689,14 @@ $as_echo "disabled" >&6; }
 			esac
 			break
 		fi
-                testscript='try: import argparse
+		testscript='try: import argparse
 except: exit(1)'
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: checking python module 'argparse'" >&5
 $as_echo_n "checking python module 'argparse'... " >&6; }
-                if $PYTHON -c "$testscript"; then
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: found, using $PYTHON" >&5
+		if $PYTHON -c "$testscript"; then
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: found, using $PYTHON" >&5
 $as_echo "found, using $PYTHON" >&6; }
-                else
+		else
 			case "$use_python" in
 			unspec)
 				PYTHON=""
@@ -11705,12 +11706,12 @@ $as_echo "found, using $PYTHON" >&6; }
 $as_echo "not found, python disabled" >&6; }
 				;;
 			yes)
-                        { $as_echo "$as_me:${as_lineno-$LINENO}: result: no found" >&5
+			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no found" >&5
 $as_echo "no found" >&6; }
-                        as_fn_error $? "python 'argparse' module not supported" "$LINENO" 5
+			as_fn_error $? "python 'argparse' module not supported" "$LINENO" 5
 				;;
 			esac
-                fi
+		fi
 		;;
 esac
 
@@ -11718,7 +11719,7 @@ PYTHON_TOOLS=''
 CHECKDS=''
 COVERAGE=''
 if test "X$PYTHON" != "X"; then
-        PYTHON_TOOLS=python
+	PYTHON_TOOLS=python
 	CHECKDS=checkds
 	COVERAGE=coverage
 fi
@@ -13503,7 +13504,7 @@ $as_echo "disabled" >&6; }
 					LIBS="$LIBS -L$use_geoip/lib"
 			esac
 		elif test "$use_geoip" = "yes"
-                then
+		then
 			as_fn_error $? "GeoIP path not found" "$LINENO" 5
 		else
 			as_fn_error $? "GeoIP path $use_geoip does not exist" "$LINENO" 5
@@ -13693,7 +13694,7 @@ main ()
 {
 
 				struct in6_addr in6;
-                                int i = GEOIP_CITY_EDITION_REV0_V6;
+				int i = GEOIP_CITY_EDITION_REV0_V6;
 				GeoIP_record_by_ipnum_v6(NULL, in6);
 
   ;
@@ -13751,10 +13752,10 @@ then
 	    for d in $krb5dirs
 	    do
 		if test -f $d/include/gssapi/gssapi_krb5.h -o \
-		        -f $d/include/krb5.h
+			-f $d/include/krb5.h
 		then
 			if test -f $d/include/gssapi/gssapi.h -o \
-			        -f $d/include/gssapi.h
+				-f $d/include/gssapi.h
 			then
 				use_gssapi=$d
 				break
@@ -15121,7 +15122,7 @@ case "$with_gost" in
 
 $as_echo "#define PREFER_GOSTASN1 1" >>confdefs.h
 
-                gosttype="asn1"
+		gosttype="asn1"
 		with_gost="yes"
 		;;
 	auto|yes|no)
@@ -15358,20 +15359,20 @@ $as_echo "Skipped OpenSSL version check" >&6; }
 ;;
 esac
 
-        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL DSA support" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL DSA support" >&5
 $as_echo_n "checking for OpenSSL DSA support... " >&6; }
-        if test -f $use_openssl/include/openssl/dsa.h
-        then
-                $as_echo "#define HAVE_OPENSSL_DSA 1" >>confdefs.h
+	if test -f $use_openssl/include/openssl/dsa.h
+	then
+		$as_echo "#define HAVE_OPENSSL_DSA 1" >>confdefs.h
 
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-        else
-                { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
+	else
+		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-        fi
+	fi
 
-        for ac_func in EVP_sha256 EVP_sha384 EVP_sha512
+	for ac_func in EVP_sha256 EVP_sha384 EVP_sha512
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -15384,10 +15385,10 @@ fi
 done
 
 
-        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL ECDSA support" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL ECDSA support" >&5
 $as_echo_n "checking for OpenSSL ECDSA support... " >&6; }
-        have_ecdsa=""
-        if test "$cross_compiling" = yes; then :
+	have_ecdsa=""
+	if test "$cross_compiling" = yes; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: using --with-ecdsa" >&5
 $as_echo "using --with-ecdsa" >&6; }
 else
@@ -15414,56 +15415,56 @@ _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-        have_ecdsa="yes"
+	have_ecdsa="yes"
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-        have_ecdsa="no"
+	have_ecdsa="no"
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
   conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 
-        case "$with_ecdsa" in
-        yes)
-            case "$have_ecdsa" in
-            no)  as_fn_error $? "ecdsa not supported" "$LINENO" 5 ;;
-            *)  have_ecdsa=yes ;;
-            esac
-            ;;
-        no)
-            have_ecdsa=no ;;
-        *)
-            case "$have_ecdsa" in
-            yes|no) ;;
-            *) as_fn_error $? "need --with-ecdsa=[yes or no]" "$LINENO" 5 ;;
-            esac
-            ;;
-        esac
-        case $have_ecdsa in
-        yes)
-                OPENSSL_ECDSA="yes"
+	case "$with_ecdsa" in
+	yes)
+	    case "$have_ecdsa" in
+	    no)  as_fn_error $? "ecdsa not supported" "$LINENO" 5 ;;
+	    *)  have_ecdsa=yes ;;
+	    esac
+	    ;;
+	no)
+	    have_ecdsa=no ;;
+	*)
+	    case "$have_ecdsa" in
+	    yes|no) ;;
+	    *) as_fn_error $? "need --with-ecdsa=[yes or no]" "$LINENO" 5 ;;
+	    esac
+	    ;;
+	esac
+	case $have_ecdsa in
+	yes)
+		OPENSSL_ECDSA="yes"
 
 $as_echo "#define HAVE_OPENSSL_ECDSA 1" >>confdefs.h
 
-                ;;
-        *)
-                ;;
-        esac
+		;;
+	*)
+		;;
+	esac
 
-        { $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL GOST support" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL GOST support" >&5
 $as_echo_n "checking for OpenSSL GOST support... " >&6; }
-        have_gost=""
-        case "$use_pkcs11" in
-                auto|no)
-                        ;;
-                *)
-                        if $use_threads; then
-                                CC="$CC -pthread"
-                        fi
-                        ;;
-        esac
-        if test "$cross_compiling" = yes; then :
+	have_gost=""
+	case "$use_pkcs11" in
+		auto|no)
+			;;
+		*)
+			if $use_threads; then
+				CC="$CC -pthread"
+			fi
+			;;
+	esac
+	if test "$cross_compiling" = yes; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: using --with-gost" >&5
 $as_echo "using --with-gost" >&6; }
 else
@@ -15495,34 +15496,34 @@ _ACEOF
 if ac_fn_c_try_run "$LINENO"; then :
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-        have_gost="yes"
+	have_gost="yes"
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: result: no" >&5
 $as_echo "no" >&6; }
-        have_gost="no"
+	have_gost="no"
 fi
 rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
   conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 
-        case "$with_gost" in
-        yes)
-            case "$have_gost" in
-            no)  as_fn_error $? "gost not supported" "$LINENO" 5 ;;
-            *)  have_gost=yes ;;
-            esac
-            ;;
-        no)
-            have_gost=no ;;
-        *)
-            case "$have_gost" in
-            yes|no) ;;
-            *) as_fn_error $? "need --with-gost=[yes, no, raw or asn1]" "$LINENO" 5 ;;
-            esac
-            ;;
-        esac
-        case $have_gost in
-        yes)
+	case "$with_gost" in
+	yes)
+	    case "$have_gost" in
+	    no)  as_fn_error $? "gost not supported" "$LINENO" 5 ;;
+	    *)  have_gost=yes ;;
+	    esac
+	    ;;
+	no)
+	    have_gost=no ;;
+	*)
+	    case "$have_gost" in
+	    yes|no) ;;
+	    *) as_fn_error $? "need --with-gost=[yes, no, raw or asn1]" "$LINENO" 5 ;;
+	    esac
+	    ;;
+	esac
+	case $have_gost in
+	yes)
 		OPENSSL_GOST="yes"
 		OPENSSLGOSTLINKOBJS='${OPENSSLGOSTLINKOBJS}'
 		OPENSSLGOSTLINKSRCS='${OPENSSLGOSTLINKSRCS}'
@@ -15530,16 +15531,16 @@ fi
 $as_echo "#define HAVE_OPENSSL_GOST 1" >>confdefs.h
 
 		;;
-        *)
-                ;;
-        esac
-        CC="$saved_cc"
-        CFLAGS="$saved_cflags"
-        LIBS="$saved_libs"
-        OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
-        OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'
+	*)
+		;;
+	esac
+	CC="$saved_cc"
+	CFLAGS="$saved_cflags"
+	LIBS="$saved_libs"
+	OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
+	OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'
 
-        ;;
+	;;
 esac
 
 #
@@ -15612,17 +15613,17 @@ $as_echo "no" >&6; }
 	yes|*)
 		{ $as_echo "$as_me:${as_lineno-$LINENO}: result: yes" >&5
 $as_echo "yes" >&6; }
-                if ! $use_threads; then
+		if ! $use_threads; then
 			as_fn_error $? "PKCS11 requires thread support" "$LINENO" 5
-                fi
+		fi
 		if test "$CRYPTO" != ""
 		then
 			{ $as_echo "$as_me:${as_lineno-$LINENO}: checking for OpenSSL with PKCS11 support" >&5
 $as_echo_n "checking for OpenSSL with PKCS11 support... " >&6; }
-                        saved_cc="$CC"
+			saved_cc="$CC"
 			saved_cflags="$CFLAGS"
 			saved_libs="$LIBS"
-                        CC="$CC -pthread"
+			CC="$CC -pthread"
 			CFLAGS="$CFLAGS $DST_OPENSSL_INC"
 			LIBS="$LIBS $DNS_OPENSSL_LIBS"
 			if test "$cross_compiling" = yes; then :
@@ -15664,7 +15665,7 @@ rm -f core *.core core.conftest.* gmon.out bb.out conftest$ac_exeext \
   conftest.$ac_objext conftest.beam conftest.$ac_ext
 fi
 
-                        CC="$saved_cc"
+			CC="$saved_cc"
 			CFLAGS="$saved_cflags"
 			LIBS="$saved_libs"
 		else
@@ -15720,7 +15721,7 @@ $as_echo "using native PKCS11 crypto" >&6; }
 		CRYPTO="-DPKCS11CRYPTO"
 		PKCS11LINKOBJS='${PKCS11LINKOBJS}'
 		PKCS11LINKSRCS='${PKCS11LINKSRCS}'
-                PKCS11_TEST=pkcs11
+		PKCS11_TEST=pkcs11
 		case "$with_ecdsa" in
 		no)
 			{ $as_echo "$as_me:${as_lineno-$LINENO}: result: disabled PKCS11 ECDSA" >&5
@@ -15891,18 +15892,18 @@ case "$use_libjson" in
 		;;
 	auto|yes)
 		if test -f "/usr/include/json/json.h"
-                then
+		then
 			libjson_cflags="-I /usr/include/json"
 			have_libjson="yes"
-                elif test -f "/usr/include/json-c/json.h"
-                then
+		elif test -f "/usr/include/json-c/json.h"
+		then
 			libjson_cflags="-I /usr/include/json-c"
 			have_libjson="yes"
-                fi
+		fi
 		;;
 	*)
 		if test -f "${use_libjson}/include/json/json.h"
-                then
+		then
 			libjson_cflags="-I${use_libjson}/include/json"
 			LIBS="$LIBS -L${use_libjson}/lib"
 			have_libjson="yes"
@@ -15978,7 +15979,7 @@ if test "$ac_res" != no; then :
 else
   { $as_echo "$as_me:${as_lineno-$LINENO}: WARNING: found libjson include but not library." >&5
 $as_echo "$as_me: WARNING: found libjson include but not library." >&2;}
-		        have_libjson=""
+			have_libjson=""
 fi
 
 else
@@ -17411,7 +17412,7 @@ cat confdefs.h - <<_ACEOF >conftest.$ac_ext
 #include <sys/socket.h>
 #include <netdb.h>
 int getnameinfo(const struct sockaddr *, socklen_t, char *,
-                socklen_t, char *, socklen_t, unsigned int);
+		socklen_t, char *, socklen_t, unsigned int);
 int
 main ()
 {
@@ -17437,7 +17438,7 @@ else
 #include <sys/socket.h>
 #include <netdb.h>
 int getnameinfo(const struct sockaddr *, socklen_t, char *,
-                size_t, char *, size_t, int);
+		size_t, char *, size_t, int);
 int
 main ()
 {
@@ -17721,7 +17722,7 @@ done
 		READLINE_LIB="$readline"
 	fi
 	LIBS="$saved_LIBS"
-        ;;
+	;;
 esac
 
 
@@ -18191,7 +18192,7 @@ rm -f core conftest.err conftest.$ac_objext conftest.$ac_ext
 # Older HP-UX doesn't have gettune
 #
 case "$host" in
-  	*-hp-hpux*)
+	*-hp-hpux*)
 		for ac_header in sys/dyntune.h
 do :
   ac_fn_c_check_header_mongrel "$LINENO" "sys/dyntune.h" "ac_cv_header_sys_dyntune_h" "$ac_includes_default"
@@ -18563,7 +18564,7 @@ $as_echo_n "checking architecture type for atomic operations... " >&6; }
 	i[3456]86-*)
 		# XXX: some old x86 architectures actually do not support
 		#      (some of) these operations.  Do we need stricter checks?
-                # The cast to long int works around a bug in the HP C Compiler
+		# The cast to long int works around a bug in the HP C Compiler
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
 # This bug is HP SR number 8606223364.
@@ -18604,7 +18605,7 @@ _ACEOF
 		fi
 	;;
 	x86_64-*|amd64-*)
-                # The cast to long int works around a bug in the HP C Compiler
+		# The cast to long int works around a bug in the HP C Compiler
 # version HP92453-01 B.11.11.23709.GP, which incorrectly rejects
 # declarations like `int a3[[(sizeof (unsigned char)) >= 0]];'.
 # This bug is HP SR number 8606223364.
@@ -19273,7 +19274,7 @@ $as_echo "auto" >&6; }
 	;;
 *)
 	docbook_xsl_trees="$withval"
-    	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $docbook_xsl_trees" >&5
+	{ $as_echo "$as_me:${as_lineno-$LINENO}: result: $docbook_xsl_trees" >&5
 $as_echo "$docbook_xsl_trees" >&6; }
 	;;
 esac
@@ -19828,6 +19829,7 @@ DLZ_SYSTEM_TEST=""
 #
 SO="so"
 SO_CFLAGS=""
+SO_LDFLAGS=""
 SO_LD=""
 SO_TARGETS=""
 
@@ -19891,7 +19893,7 @@ fi
 	if test "$have_dl" = "yes"; then
 		LIBS="-ldl $LIBS"
 	fi
-        for ac_func in dlopen dlclose dlsym
+	for ac_func in dlopen dlclose dlsym
 do :
   as_ac_var=`$as_echo "ac_cv_func_$ac_func" | $as_tr_sh`
 ac_fn_c_check_func "$LINENO" "$ac_func" "$as_ac_var"
@@ -19911,30 +19913,37 @@ if test "$dlopen" = "yes"; then
 	case $host in
 		*-linux*)
 			SO_CFLAGS="-fPIC"
+			SO_LDFLAGS=""
 			if test "$have_dl" = "yes"
 			then
 				if test "$use_libtool" = "yes"; then
-					SO_LD="${CC} -Xcompiler -shared"
+					SO_LDFLAGS="-Xcompiler -shared"
+					SO_LD="${CC}"
 				else
-					SO_LD="${CC} -shared"
+					SO_LDFLAGS="-shared"
+					SO_LD="${CC}"
 				fi
 			else
-				SO_LD="ld -shared"
+				SO_LDFLAGS="-shared"
+				SO_LD="ld"
 			fi
 			;;
 		*-freebsd*|*-openbsd*|*-netbsd*)
 			SO_CFLAGS="-fpic"
-			SO_LD="ld -Bshareable -x"
+			SO_LDFLAGS="-Bshareable -x"
+			SO_LD="ld"
 			;;
 		*-solaris*)
 			SO_CFLAGS="-KPIC"
-			SO_LD="ld -G -z text"
-                        ;;
+			SO_LDFLAGS="-G -z text"
+			SO_LD="ld"
+			;;
 		*-hp-hpux*)
 			SO=sl
 			SO_CFLAGS="+z"
-			SO_LD="ld -b"
-                        ;;
+			SO_LDFLAGS="-b"
+			SO_LD="ld"
+			;;
 		*)
 			SO_CFLAGS="-fPIC"
 			;;
@@ -19942,7 +19951,16 @@ if test "$dlopen" = "yes"; then
 
 	if test "X$GCC" = "Xyes"; then
 		SO_CFLAGS="-fPIC"
-                test -n "$SO_LD" || SO_LD="${CC} -shared"
+		if test -z "$SO_LD"
+		then
+			if test "$use_libtool" = "yes"; then
+				SO_LDFLAGS="-Xcompiler -shared"
+				SO_LD="${CC}"
+			else
+				SO_LDFLAGS="-shared"
+				SO_LD="${CC}"
+			fi
+		fi
 	fi
 
 	# If we still don't know how to make shared objects, don't make any.
@@ -19959,6 +19977,7 @@ fi
 
 
 
+
 # Copyright (C) 2005  Internet Systems Consortium, Inc. ("ISC")
 #
 # Permission to use, copy, modify, and distribute this software for any
@@ -23201,9 +23220,9 @@ test "$use_gssapi" = "no" || echo "    GSS-API (--with-gssapi)"
 # these lines are only printed if run with --enable-full-report
 if test "$enable_full_report" = "yes"; then
     test "$enable_ipv6" = "no" -o "$found_ipv6" = "no" || \
-        echo "    IPv6 support (--enable-ipv6)"
+	echo "    IPv6 support (--enable-ipv6)"
     test "X$CRYPTO" = "X" -o "$want_native_pkcs11" = "yes" || \
-            echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+	    echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
     test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
     test "X$libxml2_libs" = "X" || echo "    XML statistics (--with-libxml2)"
     test "X$have_libjson" = "X" || echo "    JSON statistics (--with-libjson)"
@@ -23211,9 +23230,9 @@ fi
 
 if test "$use_pkcs11" != "no"; then
     if test "$want_native_pkcs11" = "yes"; then
-        echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
     else
-        echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
+	echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
     fi
     echo "        Provider library: $PKCS11_PROVIDER"
 fi
@@ -23256,7 +23275,7 @@ echo
 echo "Features disabled or unavailable on this platform:"
 $use_threads || echo "    Multiprocessing support (--enable-threads)"
 test "$enable_ipv6" = "no" -o "$found_ipv6" = "no" && \
-        echo "    IPv6 support (--enable-ipv6)"
+	echo "    IPv6 support (--enable-ipv6)"
 
 test "$use_geoip" = "no" && echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" && echo "    GSS-API (--with-gssapi)"
diff --git a/configure.in b/configure.in
index bc7826be46..b5b4777b18 100644
--- a/configure.in
+++ b/configure.in
@@ -163,12 +163,12 @@ case "$use_python" in
 			esac
 			break
 		fi
-                testscript='try: import argparse
+		testscript='try: import argparse
 except: exit(1)'
 		AC_MSG_CHECKING([python module 'argparse'])
-                if $PYTHON -c "$testscript"; then
-                        AC_MSG_RESULT([found, using $PYTHON])
-                else
+		if $PYTHON -c "$testscript"; then
+			AC_MSG_RESULT([found, using $PYTHON])
+		else
 			case "$use_python" in
 			unspec)
 				PYTHON=""
@@ -177,11 +177,11 @@ except: exit(1)'
 				AC_MSG_RESULT([not found, python disabled])
 				;;
 			yes)
-                        AC_MSG_RESULT([no found])
-                        AC_MSG_ERROR([python 'argparse' module not supported])
+			AC_MSG_RESULT([no found])
+			AC_MSG_ERROR([python 'argparse' module not supported])
 				;;
 			esac
-                fi
+		fi
 		;;
 esac
 
@@ -189,7 +189,7 @@ PYTHON_TOOLS=''
 CHECKDS=''
 COVERAGE=''
 if test "X$PYTHON" != "X"; then
-        PYTHON_TOOLS=python
+	PYTHON_TOOLS=python
 	CHECKDS=checkds
 	COVERAGE=coverage
 fi
@@ -636,7 +636,7 @@ case "$use_geoip" in
 					LIBS="$LIBS -L$use_geoip/lib"
 			esac
 		elif test "$use_geoip" = "yes"
-                then
+		then
 			AC_MSG_ERROR([GeoIP path not found])
 		else
 			AC_MSG_ERROR([GeoIP path $use_geoip does not exist])
@@ -650,7 +650,7 @@ case "$use_geoip" in
 		AC_SEARCH_LIBS(fabsf, m, [],
 			[AC_MSG_ERROR([Math library not found])]
 		)
-                AC_DEFINE(HAVE_GEOIP, 1, Build with GeoIP support)
+		AC_DEFINE(HAVE_GEOIP, 1, Build with GeoIP support)
 		GEOIPLINKSRCS='${GEOIPLINKSRCS}'
 		GEOIPLINKOBJS='${GEOIPLINKOBJS}'
 		AC_MSG_CHECKING([for GeoIP support])
@@ -667,7 +667,7 @@ case "$use_geoip" in
 			])],
 			[
 				AC_MSG_RESULT([yes])
-                                AC_DEFINE(HAVE_GEOIP_V6, 1, Build with GeoIP Country IPv6 support)
+				AC_DEFINE(HAVE_GEOIP_V6, 1, Build with GeoIP Country IPv6 support)
 			],
 			[AC_MSG_RESULT([no])]
 		)
@@ -680,12 +680,12 @@ case "$use_geoip" in
 				#include <netinet/in.h>
 			], [
 				struct in6_addr in6;
-                                int i = GEOIP_CITY_EDITION_REV0_V6;
+				int i = GEOIP_CITY_EDITION_REV0_V6;
 				GeoIP_record_by_ipnum_v6(NULL, in6);
 			])],
 			[
 				AC_MSG_RESULT([yes])
-                                AC_DEFINE(HAVE_GEOIP_CITY_V6, 1, Build with GeoIP City IPv6 support)
+				AC_DEFINE(HAVE_GEOIP_CITY_V6, 1, Build with GeoIP City IPv6 support)
 			],
 			[AC_MSG_RESULT([no])]
 		)
@@ -720,10 +720,10 @@ then
 	    for d in $krb5dirs
 	    do
 		if test -f $d/include/gssapi/gssapi_krb5.h -o \
-		        -f $d/include/krb5.h
+			-f $d/include/krb5.h
 		then
 			if test -f $d/include/gssapi/gssapi.h -o \
-			        -f $d/include/gssapi.h
+				-f $d/include/gssapi.h
 			then
 				use_gssapi=$d
 				break
@@ -1124,7 +1124,7 @@ AC_ARG_WITH(openssl,
 #
 AC_ARG_WITH(pkcs11,
 [  --with-pkcs11[=PATH]      Build with PKCS11 support [yes|no|path]
-                          (PATH is for the PKCS11 provider)],
+			  (PATH is for the PKCS11 provider)],
    use_pkcs11="$withval", use_pkcs11="auto")
 
 openssldirs="/usr /usr/local /usr/local/ssl /usr/pkg /usr/sfw"
@@ -1147,10 +1147,10 @@ fi
 OPENSSL_ECDSA=""
 OPENSSL_GOST=""
 AC_ARG_WITH(ecdsa, [  --with-ecdsa            Crypto ECDSA],
-            with_ecdsa="$withval", with_ecdsa="auto")
+	    with_ecdsa="$withval", with_ecdsa="auto")
 AC_ARG_WITH(gost,
 [  --with-gost             Crypto GOST [yes|no|raw|asn1].],
-            with_gost="$withval", with_gost="auto")
+	    with_gost="$withval", with_gost="auto")
 gosttype="raw"
 case "$with_gost" in
 	raw)
@@ -1159,7 +1159,7 @@ case "$with_gost" in
 	asn1)
 		AC_DEFINE(PREFER_GOSTASN1, 1,
 			  [Define if GOST private keys are encoded in ASN.1.])
-                gosttype="asn1"
+		gosttype="asn1"
 		with_gost="yes"
 		;;
 	auto|yes|no)
@@ -1329,20 +1329,20 @@ no)
 ;;
 esac
 
-        AC_MSG_CHECKING(for OpenSSL DSA support)
-        if test -f $use_openssl/include/openssl/dsa.h
-        then
-                AC_DEFINE(HAVE_OPENSSL_DSA)
-                AC_MSG_RESULT(yes)
-        else
-                AC_MSG_RESULT(no)
-        fi
+	AC_MSG_CHECKING(for OpenSSL DSA support)
+	if test -f $use_openssl/include/openssl/dsa.h
+	then
+		AC_DEFINE(HAVE_OPENSSL_DSA)
+		AC_MSG_RESULT(yes)
+	else
+		AC_MSG_RESULT(no)
+	fi
 
-        AC_CHECK_FUNCS(EVP_sha256 EVP_sha384 EVP_sha512)
+	AC_CHECK_FUNCS(EVP_sha256 EVP_sha384 EVP_sha512)
 
-        AC_MSG_CHECKING(for OpenSSL ECDSA support)
-        have_ecdsa=""
-        AC_TRY_RUN([
+	AC_MSG_CHECKING(for OpenSSL ECDSA support)
+	have_ecdsa=""
+	AC_TRY_RUN([
 #include <stdio.h>
 #include <openssl/ecdsa.h>
 #include <openssl/objects.h>
@@ -1359,49 +1359,49 @@ int main() {
 	return (0);
 }
 ],
-        [AC_MSG_RESULT(yes)
-        have_ecdsa="yes"],
-        [AC_MSG_RESULT(no)
-        have_ecdsa="no"],
-        [AC_MSG_RESULT(using --with-ecdsa)])
-        case "$with_ecdsa" in
-        yes)
-            case "$have_ecdsa" in
-            no)  AC_MSG_ERROR([ecdsa not supported]) ;;
-            *)  have_ecdsa=yes ;;
-            esac
-            ;;
-        no)
-            have_ecdsa=no ;;
-        *)
-            case "$have_ecdsa" in
-            yes|no) ;;
-            *) AC_MSG_ERROR([need --with-ecdsa=[[yes or no]]]) ;;
-            esac
-            ;;
-        esac
-        case $have_ecdsa in
-        yes)
-                OPENSSL_ECDSA="yes"
-                AC_DEFINE(HAVE_OPENSSL_ECDSA, 1,
-                          [Define if your OpenSSL version supports ECDSA.])
-                ;;
-        *)
-                ;;
-        esac
+	[AC_MSG_RESULT(yes)
+	have_ecdsa="yes"],
+	[AC_MSG_RESULT(no)
+	have_ecdsa="no"],
+	[AC_MSG_RESULT(using --with-ecdsa)])
+	case "$with_ecdsa" in
+	yes)
+	    case "$have_ecdsa" in
+	    no)  AC_MSG_ERROR([ecdsa not supported]) ;;
+	    *)  have_ecdsa=yes ;;
+	    esac
+	    ;;
+	no)
+	    have_ecdsa=no ;;
+	*)
+	    case "$have_ecdsa" in
+	    yes|no) ;;
+	    *) AC_MSG_ERROR([need --with-ecdsa=[[yes or no]]]) ;;
+	    esac
+	    ;;
+	esac
+	case $have_ecdsa in
+	yes)
+		OPENSSL_ECDSA="yes"
+		AC_DEFINE(HAVE_OPENSSL_ECDSA, 1,
+			  [Define if your OpenSSL version supports ECDSA.])
+		;;
+	*)
+		;;
+	esac
 
-        AC_MSG_CHECKING(for OpenSSL GOST support)
-        have_gost=""
-        case "$use_pkcs11" in
-                auto|no)
-                        ;;
-                *)
-                        if $use_threads; then
-                                CC="$CC -pthread"
-                        fi
-                        ;;
-        esac
-        AC_TRY_RUN([
+	AC_MSG_CHECKING(for OpenSSL GOST support)
+	have_gost=""
+	case "$use_pkcs11" in
+		auto|no)
+			;;
+		*)
+			if $use_threads; then
+				CC="$CC -pthread"
+			fi
+			;;
+	esac
+	AC_TRY_RUN([
 #include <openssl/conf.h>
 #include <openssl/engine.h>
 int main() {
@@ -1423,45 +1423,45 @@ int main() {
 #endif
 }
 ],
-        [AC_MSG_RESULT(yes)
-        have_gost="yes"],
-        [AC_MSG_RESULT(no)
-        have_gost="no"],
-        [AC_MSG_RESULT(using --with-gost)])
-        case "$with_gost" in
-        yes)
-            case "$have_gost" in
-            no)  AC_MSG_ERROR([gost not supported]) ;;
-            *)  have_gost=yes ;;
-            esac
-            ;;
-        no)
-            have_gost=no ;;
-        *)
-            case "$have_gost" in
-            yes|no) ;;
-            *) AC_MSG_ERROR([need --with-gost=[[yes, no, raw or asn1]]]) ;;
-            esac
-            ;;
-        esac
-        case $have_gost in
-        yes)
+	[AC_MSG_RESULT(yes)
+	have_gost="yes"],
+	[AC_MSG_RESULT(no)
+	have_gost="no"],
+	[AC_MSG_RESULT(using --with-gost)])
+	case "$with_gost" in
+	yes)
+	    case "$have_gost" in
+	    no)  AC_MSG_ERROR([gost not supported]) ;;
+	    *)  have_gost=yes ;;
+	    esac
+	    ;;
+	no)
+	    have_gost=no ;;
+	*)
+	    case "$have_gost" in
+	    yes|no) ;;
+	    *) AC_MSG_ERROR([need --with-gost=[[yes, no, raw or asn1]]]) ;;
+	    esac
+	    ;;
+	esac
+	case $have_gost in
+	yes)
 		OPENSSL_GOST="yes"
 		OPENSSLGOSTLINKOBJS='${OPENSSLGOSTLINKOBJS}'
 		OPENSSLGOSTLINKSRCS='${OPENSSLGOSTLINKSRCS}'
 		AC_DEFINE(HAVE_OPENSSL_GOST, 1,
 			  [Define if your OpenSSL version supports GOST.])
 		;;
-        *)
-                ;;
-        esac
-        CC="$saved_cc"
-        CFLAGS="$saved_cflags"
-        LIBS="$saved_libs"
-        OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
-        OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'
+	*)
+		;;
+	esac
+	CC="$saved_cc"
+	CFLAGS="$saved_cflags"
+	LIBS="$saved_libs"
+	OPENSSLLINKOBJS='${OPENSSLLINKOBJS}'
+	OPENSSLLINKSRCS='${OPENSSLLINKSRCS}'
 
-        ;;
+	;;
 esac
 
 #
@@ -1527,16 +1527,16 @@ case "$use_pkcs11" in
 		;;
 	yes|*)
 		AC_MSG_RESULT(yes)
-                if ! $use_threads; then
+		if ! $use_threads; then
 			AC_MSG_ERROR([PKCS11 requires thread support])
-                fi
+		fi
 		if test "$CRYPTO" != ""
 		then
 			AC_MSG_CHECKING(for OpenSSL with PKCS11 support)
-                        saved_cc="$CC"
+			saved_cc="$CC"
 			saved_cflags="$CFLAGS"
 			saved_libs="$LIBS"
-                        CC="$CC -pthread"
+			CC="$CC -pthread"
 			CFLAGS="$CFLAGS $DST_OPENSSL_INC"
 			LIBS="$LIBS $DNS_OPENSSL_LIBS"
 			AC_TRY_RUN([
@@ -1563,7 +1563,7 @@ int main() {
 			[AC_MSG_RESULT(cross compile, defaulting to no)
 			PKCS11_TEST=''
 			PKCS11_ENGINE='-DPKCS11_ENGINE=NULL'])
-                        CC="$saved_cc"
+			CC="$saved_cc"
 			CFLAGS="$saved_cflags"
 			LIBS="$saved_libs"
 		else
@@ -1608,7 +1608,7 @@ case "$want_native_pkcs11" in
 		CRYPTO="-DPKCS11CRYPTO"
 		PKCS11LINKOBJS='${PKCS11LINKOBJS}'
 		PKCS11LINKSRCS='${PKCS11LINKSRCS}'
-                PKCS11_TEST=pkcs11
+		PKCS11_TEST=pkcs11
 		case "$with_ecdsa" in
 		no)
 			AC_MSG_RESULT([disabled PKCS11 ECDSA])
@@ -1616,14 +1616,14 @@ case "$want_native_pkcs11" in
 		*)
 			PKCS11_ECDSA="yes"
 			AC_DEFINE(HAVE_PKCS11_ECDSA, 1,
-			          [Define if your PKCS11 provider supports ECDSA.])
+				  [Define if your PKCS11 provider supports ECDSA.])
 			;;
 		esac
 		case "$with_gost" in
 		yes)
 			PKCS11_GOST="yes"
 			AC_DEFINE(HAVE_PKCS11_GOST, 1,
-			          [Define if your PKCS11 provider supports GOST.])
+				  [Define if your PKCS11 provider supports GOST.])
 			;;
 		*)
 			AC_MSG_RESULT([disabled PKCS11 GOST])
@@ -1712,18 +1712,18 @@ case "$use_libjson" in
 		;;
 	auto|yes)
 		if test -f "/usr/include/json/json.h"
-                then
+		then
 			libjson_cflags="-I /usr/include/json"
 			have_libjson="yes"
-                elif test -f "/usr/include/json-c/json.h"
-                then
+		elif test -f "/usr/include/json-c/json.h"
+		then
 			libjson_cflags="-I /usr/include/json-c"
 			have_libjson="yes"
-                fi
+		fi
 		;;
 	*)
 		if test -f "${use_libjson}/include/json/json.h"
-                then
+		then
 			libjson_cflags="-I${use_libjson}/include/json"
 			LIBS="$LIBS -L${use_libjson}/lib"
 			have_libjson="yes"
@@ -1743,7 +1743,7 @@ then
 	AC_MSG_RESULT(yes)
 	AC_SEARCH_LIBS([json_object_new_int64], [json json-c], [],
 		       [AC_MSG_WARN([found libjson include but not library.])
-		        have_libjson=""])
+			have_libjson=""])
 else
 	AC_MSG_RESULT(no)
 fi
@@ -2008,7 +2008,7 @@ AC_SUBST(ISC_PLATFORM_USEBACKTRACE)
 
 AC_ARG_ENABLE(symtable,
 [  --enable-symtable       use internal symbol table for backtrace
-                          [[all|minimal(default)|none]]],
+			  [[all|minimal(default)|none]]],
 		want_symtable="$enableval",  want_symtable="minimal")
 case $want_symtable in
 yes|all|minimal)     # "yes" is a hidden value equivalent to "minimal"
@@ -2545,7 +2545,7 @@ AC_TRY_COMPILE([
 #include <sys/socket.h>
 #include <netdb.h>
 int getnameinfo(const struct sockaddr *, socklen_t, char *,
-                socklen_t, char *, socklen_t, unsigned int);],
+		socklen_t, char *, socklen_t, unsigned int);],
 [ return (0);],
 	[AC_MSG_RESULT(socklen_t for buflen; u_int for flags)
 	 AC_DEFINE(IRS_GETNAMEINFO_BUFLEN_T, socklen_t,
@@ -2557,7 +2557,7 @@ int getnameinfo(const struct sockaddr *, socklen_t, char *,
 #include <sys/socket.h>
 #include <netdb.h>
 int getnameinfo(const struct sockaddr *, socklen_t, char *,
-                size_t, char *, size_t, int);],
+		size_t, char *, size_t, int);],
 [ return (0);],
 	[AC_MSG_RESULT(size_t for buflen; int for flags)
 	 AC_DEFINE(IRS_GETNAMEINFO_BUFLEN_T, size_t)
@@ -2688,8 +2688,8 @@ AC_SUBST(ISC_PLATFORM_NEEDSTRCASESTR)
 
 AC_SUBST(READLINE_LIB)
 AC_ARG_WITH(readline,
-        [  --with-readline[=LIBSPEC]    specify readline library [default -lreadline]],
-        readline="$withval", readline="-lreadline")
+	[  --with-readline[=LIBSPEC]    specify readline library [default -lreadline]],
+	readline="$withval", readline="-lreadline")
 case "$readline" in
 no)	;;
 *)
@@ -2705,7 +2705,7 @@ no)	;;
 		READLINE_LIB="$readline"
 	fi
 	LIBS="$saved_LIBS"
-        ;;
+	;;
 esac
 
 
@@ -2924,7 +2924,7 @@ AC_SUBST(ISC_PLATFORM_RLIMITTYPE)
 # Older HP-UX doesn't have gettune
 #
 case "$host" in
-  	*-hp-hpux*)
+	*-hp-hpux*)
 		AC_CHECK_HEADERS(sys/dyntune.h)
 		;;
 	*)
@@ -3125,7 +3125,7 @@ if test "$use_atomic" = "yes"; then
 	[i[3456]86-*])
 		# XXX: some old x86 architectures actually do not support
 		#      (some of) these operations.  Do we need stricter checks?
-                AC_CHECK_SIZEOF([void *])
+		AC_CHECK_SIZEOF([void *])
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
@@ -3134,7 +3134,7 @@ if test "$use_atomic" = "yes"; then
 		fi
 	;;
 	x86_64-*|amd64-*)
-                AC_CHECK_SIZEOF([void *])
+		AC_CHECK_SIZEOF([void *])
 		if test $ac_cv_sizeof_void_p = 8; then
 			arch=x86_64
 			have_xaddq=yes
@@ -3458,7 +3458,7 @@ auto)
 	;;
 *)
 	docbook_xsl_trees="$withval"
-    	AC_MSG_RESULT($docbook_xsl_trees)
+	AC_MSG_RESULT($docbook_xsl_trees)
 	;;
 esac
 
@@ -3749,6 +3749,7 @@ DLZ_SYSTEM_TEST=""
 #
 SO="so"
 SO_CFLAGS=""
+SO_LDFLAGS=""
 SO_LD=""
 SO_TARGETS=""
 
@@ -3766,37 +3767,44 @@ if test "$dlopen" = "yes"; then
 	if test "$have_dl" = "yes"; then
 		LIBS="-ldl $LIBS"
 	fi
-        AC_CHECK_FUNCS(dlopen dlclose dlsym,,dlopen=no)
+	AC_CHECK_FUNCS(dlopen dlclose dlsym,,dlopen=no)
 fi
 
 if test "$dlopen" = "yes"; then
 	case $host in
 		*-linux*)
 			SO_CFLAGS="-fPIC"
+			SO_LDFLAGS=""
 			if test "$have_dl" = "yes"
 			then
 				if test "$use_libtool" = "yes"; then
-					SO_LD="${CC} -Xcompiler -shared"
+					SO_LDFLAGS="-Xcompiler -shared"
+					SO_LD="${CC}"
 				else
-					SO_LD="${CC} -shared"
+					SO_LDFLAGS="-shared"
+					SO_LD="${CC}"
 				fi
 			else
-				SO_LD="ld -shared"
+				SO_LDFLAGS="-shared"
+				SO_LD="ld"
 			fi
 			;;
 		*-freebsd*|*-openbsd*|*-netbsd*)
 			SO_CFLAGS="-fpic"
-			SO_LD="ld -Bshareable -x"
+			SO_LDFLAGS="-Bshareable -x"
+			SO_LD="ld"
 			;;
 		*-solaris*)
 			SO_CFLAGS="-KPIC"
-			SO_LD="ld -G -z text"
-                        ;;
+			SO_LDFLAGS="-G -z text"
+			SO_LD="ld"
+			;;
 		*-hp-hpux*)
 			SO=sl
 			SO_CFLAGS="+z"
-			SO_LD="ld -b"
-                        ;;
+			SO_LDFLAGS="-b"
+			SO_LD="ld"
+			;;
 		*)
 			SO_CFLAGS="-fPIC"
 			;;
@@ -3804,7 +3812,16 @@ if test "$dlopen" = "yes"; then
 
 	if test "X$GCC" = "Xyes"; then
 		SO_CFLAGS="-fPIC"
-                test -n "$SO_LD" || SO_LD="${CC} -shared"
+		if test -z "$SO_LD"
+		then
+			if test "$use_libtool" = "yes"; then
+				SO_LDFLAGS="-Xcompiler -shared"
+				SO_LD="${CC}"
+			else
+				SO_LDFLAGS="-shared"
+				SO_LD="${CC}"
+			fi
+		fi
 	fi
 
 	# If we still don't know how to make shared objects, don't make any.
@@ -3817,6 +3834,7 @@ fi
 
 AC_SUBST(SO)
 AC_SUBST(SO_CFLAGS)
+AC_SUBST(SO_LDFLAGS)
 AC_SUBST(SO_LD)
 AC_SUBST(SO_TARGETS)
 
@@ -4139,9 +4157,9 @@ test "$use_gssapi" = "no" || echo "    GSS-API (--with-gssapi)"
 # these lines are only printed if run with --enable-full-report 
 if test "$enable_full_report" = "yes"; then
     test "$enable_ipv6" = "no" -o "$found_ipv6" = "no" || \
-        echo "    IPv6 support (--enable-ipv6)"
+	echo "    IPv6 support (--enable-ipv6)"
     test "X$CRYPTO" = "X" -o "$want_native_pkcs11" = "yes" || \
-            echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
+	    echo "    OpenSSL cryptography/DNSSEC (--with-openssl)"
     test "X$PYTHON" = "X" || echo "    Python tools (--with-python)"
     test "X$libxml2_libs" = "X" || echo "    XML statistics (--with-libxml2)"
     test "X$have_libjson" = "X" || echo "    JSON statistics (--with-libjson)"
@@ -4149,9 +4167,9 @@ fi
 
 if test "$use_pkcs11" != "no"; then
     if test "$want_native_pkcs11" = "yes"; then
-        echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
+	echo "    Native PKCS#11/Cryptoki support (--enable-native-pkcs11)"
     else
-        echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
+	echo "    PKCS#11/Cryptoki support using OpenSSL (--with-pkcs11)"
     fi
     echo "        Provider library: $PKCS11_PROVIDER"
 fi
@@ -4194,7 +4212,7 @@ echo
 echo "Features disabled or unavailable on this platform:"
 $use_threads || echo "    Multiprocessing support (--enable-threads)"
 test "$enable_ipv6" = "no" -o "$found_ipv6" = "no" && \
-        echo "    IPv6 support (--enable-ipv6)"
+	echo "    IPv6 support (--enable-ipv6)"
 
 test "$use_geoip" = "no" && echo "    GeoIP access control (--with-geoip)"
 test "$use_gssapi" = "no" && echo "    GSS-API (--with-gssapi)"