Update to 9.18.39 (rhbz#2389765)

New Features:

- Support for parsing the DSYNC record has been added.

Feature Changes:

- Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1.

Bug Fixes:

- Clean enough memory when adding new ADB names/entries under memory pressure.
- Rescan the interfaces again when reconfiguring the server.

https://downloads.isc.org/isc/bind9/9.18.39/doc/arm/html/notes.html#notes-for-bind-9-18-39

bind-9.18-query-fname-relative.patch

@@ -1,90 +0,0 @@
-From 4ac85ace54798ba8ea0d3ef12926730ed4f55fac Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Fri, 25 Apr 2025 02:00:00 +0200
-Subject: [PATCH] Insert additional checks ensuring name is not relative
-
-Mitigation for crashes put in various places, where obviously relative
-uninitialized name must not appear. This seems unnecessary once true
-cause were identified, but may prevent similar places.
----
- lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++
- 1 file changed, 35 insertions(+)
-
-diff --git a/lib/ns/query.c b/lib/ns/query.c
-index 5a75601160..d45c66c86d 100644
---- a/lib/ns/query.c
-+++ b/lib/ns/query.c
-@@ -2203,6 +2203,20 @@ regular:
- 	CTRACE(ISC_LOG_DEBUG(3), "query_additional: done");
- }
- 
-+static void
-+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) {
-+	if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) {
-+		char namebuf[DNS_NAME_FORMATSIZE] = "!";
-+		dns_name_format(name, namebuf, sizeof(namebuf));
-+		ns_client_log(
-+			qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY,
-+			ISC_LOG_DEBUG(1),
-+			"%s: fname=%s leading to relative name, aborting query.",
-+			func, namebuf
-+		);
-+	}
-+}
-+
- static void
- query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 	       dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp,
-@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep,
- 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
- 	}
- 
-+	if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) {
-+		log_query_relative(qctx, "query_addrrset", mname);
-+		QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+		return;
-+	}
- 	/*
- 	 * Update message name, set rdataset order, and do additional
- 	 * section processing if needed.
-@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) {
- 							     : qctx->tname;
- 				query_prefetch(qctx->client, name,
- 					       qctx->rdataset);
-+				if (name && !dns_name_isabsolute(name)) {
-+					log_query_relative(qctx, "query_respond_any", name);
-+					result = DNS_R_DROP;
-+					break;
-+				}
- 			}
- 
- 			/*
-@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_cname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
- 
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
-@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) {
- 
- 	if (!qctx->is_zone && RECURSIONOK(qctx->client)) {
- 		query_prefetch(qctx->client, qctx->fname, qctx->rdataset);
-+		if (qctx->fname && !dns_name_isabsolute(qctx->fname)) {
-+			log_query_relative(qctx, "query_dname", qctx->fname);
-+			QUERY_ERROR(qctx, DNS_R_SERVFAIL);
-+			return (ns_query_done(qctx));
-+		}
- 	}
-+
- 	query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp,
- 		       qctx->dbuf, DNS_SECTION_ANSWER);
- 
--- 
-2.49.0
-

bind-9.21-resume-qmin-cname.patch

@@ -1,44 +0,0 @@
-From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001
-From: Petr Mensik <pemensik@redhat.com>
-Date: Tue, 3 Jun 2025 21:00:58 +0200
-Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way
-
-When authoritative zone is loaded when query minimization query for the
-same zone is already pending, it might receive unexpected result codes.
-
-Normally DNS_R_CNAME would follow to query_cname after processing sent
-events, but dns_view_findzonecut does not fill CNAME target into
-event->foundevent. Usual lookup via query_lookup would always have that
-filled.
-
-Ideally we would restart the query with unmodified search name, if
-unexpected change from recursing to local zone cut were detected. Until
-dns_view_findzonecut is modified to export zone/cache source of the cut,
-at least fail queries which went into unexpected state.
----
- lib/dns/resolver.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
-diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
-index 795791246b..39a294437e 100644
---- a/lib/dns/resolver.c
-+++ b/lib/dns/resolver.c
-@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) {
- 	if (result == DNS_R_NXDOMAIN) {
- 		result = DNS_R_SERVFAIL;
- 	}
-+	/*
-+	 * CNAME or DNAME means zone were added with that record
-+	 * after the start of query minimization queries. It means
-+	 * we do not have initialized correct hevent->foundname
-+	 * and have to fail.
-+	 */
-+	if (result == DNS_R_CNAME || result == DNS_R_DNAME) {
-+		result = DNS_R_SERVFAIL;
-+	}
- 
- 	if (result != ISC_R_SUCCESS) {
- 		goto cleanup;
--- 
-2.49.0
-

bind.spec

@@ -85,7 +85,7 @@ License:  MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause
 #
 # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it.
 # Updating just bind will cause freeipa-dns-server package to be uninstallable.
-Version:  9.18.38
+Version:  9.18.39
 Release:  1%{?dist}
 Epoch:    32
 Url:      https://www.isc.org/downloads/bind/
@@ -135,12 +135,6 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch
 Patch30: bind-9.20-nsupdate-tls-test.patch
 # https://bugzilla.redhat.com/show_bug.cgi?id=2123076
 Patch31: bind-9.18-pkcs11-provider.patch
-# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562
-# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357
-# downstream patch fixing bind-dyndb-ldap causing issue
-Patch32: bind-9.21-resume-qmin-cname.patch
-# downstream only, extra check for above change, RHEL-30407
-Patch33: bind-9.18-query-fname-relative.patch
 
 %{?systemd_ordering}
 # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers
@@ -928,6 +922,9 @@ fi;
 %endif
 
 %changelog
+* Thu Aug 21 2025 Petr Menšík <pemensik@redhat.com> - 32:9.18.39-1
+- Update to 9.18.39 (rhbz#2389765)
+
 * Wed Jul 30 2025 'Petr Mensik' <<pemensik@redhat.com>> - 32:9.18.38-1
 - Update to 9.18.38 (rhbz#2367771)
 

sources

@@ -1,2 +1,2 @@
-SHA512 (bind-9.18.38.tar.xz) = 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c
-SHA512 (bind-9.18.38.tar.xz.asc) = 52a06f8357aab7a4a100e17ae3168b368b7e8c623c47ddd90b605ab4175fa9a182bedca8aebaebce1aa6d013b32bec5651fdd4f38be99225c0716c6dddea3fa9
+SHA512 (bind-9.18.39.tar.xz) = fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07
+SHA512 (bind-9.18.39.tar.xz.asc) = 17e8aad74f1eaa42119f84ab3df05e85a1775f97c628259e00f7224d4f0d250050d022db670bc036b0ba05a3cd586de331da0b77c42ab58307711fed36c7ee9e