From e1fa37e19cce11799190472fd1881b92e55b245f Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 18 Jan 2023 22:52:41 +0000 Subject: [PATCH 001/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 2a2dbba..3199455 100644 --- a/bind.spec +++ b/bind.spec @@ -63,7 +63,7 @@ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) serv Name: bind License: MPL-2.0 Version: 9.18.10 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -951,6 +951,9 @@ fi; %endif %changelog +* Wed Jan 18 2023 Fedora Release Engineering - 32:9.18.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + * Mon Jan 16 2023 Petr Menšík - 32:9.18.10-1 - Update to 9.18.10 (#2143258) - Include rwlock.h from dns/zt.h From 6db54085387c2ad21fef4456409a8e65605d2958 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 27 Jan 2023 17:25:00 +0100 Subject: [PATCH 002/144] Update to 9.18.11 (#2164395) Resolves: CVE-2022-3094 CVE-2022-3736 CVE-2022-3924 https://downloads.isc.org/isc/bind9/9.18.11/doc/arm/html/notes.html#notes-for-bind-9-18-11 --- .gitignore | 2 ++ bind-9.11-fips-tests.patch | 22 +++++++++++----------- bind.spec | 7 +++++-- sources | 4 ++-- 4 files changed, 20 insertions(+), 15 deletions(-) diff --git a/.gitignore b/.gitignore index 87a8eb0..8c663e5 100644 --- a/.gitignore +++ b/.gitignore @@ -198,3 +198,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.9.tar.xz.asc /bind-9.18.10.tar.xz /bind-9.18.10.tar.xz.asc +/bind-9.18.11.tar.xz +/bind-9.18.11.tar.xz.asc diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch index 7efac6d..5af7c53 100644 --- a/bind-9.11-fips-tests.patch +++ b/bind-9.11-fips-tests.patch @@ -1,4 +1,4 @@ -From 3446425cf03f2b5a7cbf6af47bd167f72e4135aa Mon Sep 17 00:00:00 2001 +From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 2 Aug 2018 23:46:45 +0200 Subject: [PATCH] FIPS tests changes @@ -534,10 +534,10 @@ index 4af25b0..9f202d5 100644 }; diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf -index 93939ff..3f78622 100644 +index f8d0408..bef7174 100644 --- a/bin/tests/system/checkconf/good.conf +++ b/bin/tests/system/checkconf/good.conf -@@ -280,6 +280,6 @@ dyndb "name" "library.so" { +@@ -281,6 +281,6 @@ dyndb "name" "library.so" { system; }; key "mykey" { @@ -546,7 +546,7 @@ index 93939ff..3f78622 100644 secret "qwertyuiopasdfgh"; }; diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in -index 1304303..e9c28c6 100644 +index 025f8d0..20ebca3 100644 --- a/bin/tests/system/cookie/ns1/named.conf.in +++ b/bin/tests/system/cookie/ns1/named.conf.in @@ -18,7 +18,7 @@ key rndc_key { @@ -652,10 +652,10 @@ index 706b7fc..2565ab4 100644 grep "test string" "$fnb" > /dev/null && grep "test string" "$fnc" > /dev/null && diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in -index 2b67360..a734584 100644 +index b502ea7..461f256 100644 --- a/bin/tests/system/nsupdate/ns1/named.conf.in +++ b/bin/tests/system/nsupdate/ns1/named.conf.in -@@ -39,7 +39,7 @@ controls { +@@ -40,7 +40,7 @@ controls { }; key altkey { @@ -665,7 +665,7 @@ index 2b67360..a734584 100644 }; diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in -index c85eef5..428b6b1 100644 +index 43137fe..be0b6b4 100644 --- a/bin/tests/system/nsupdate/ns2/named.conf.in +++ b/bin/tests/system/nsupdate/ns2/named.conf.in @@ -34,7 +34,7 @@ controls { @@ -708,7 +708,7 @@ index 50056dc..a4a1a3f 100644 $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh -index d612a22..9f18e57 100755 +index 9b80dd4..6671104 100755 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -841,7 +841,12 @@ fi @@ -969,7 +969,7 @@ index c2b57dd..ea744f8 100644 }; diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh -index a6de312..ebcadb1 100644 +index 1d11bdf..456f9c5 100644 --- a/bin/tests/system/upforwd/tests.sh +++ b/bin/tests/system/upforwd/tests.sh @@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi @@ -977,10 +977,10 @@ index a6de312..ebcadb1 100644 echo_i "updating zone (signed) ($n)" ret=0 -$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - < - 32:9.18.11-1 +- Update to 9.18.11 (#2164395) + * Wed Jan 18 2023 Fedora Release Engineering - 32:9.18.10-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild diff --git a/sources b/sources index aade61e..b0b7e54 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.10.tar.xz) = 517b070e28cc3c3ab6bc47d353d00ea5d365c0f46859d80c4712df97da759de5176126efe7d53887a2f141d06e61adfe4c0036df8e79db1ca93b0818a1d65b5e -SHA512 (bind-9.18.10.tar.xz.asc) = 6d872807d0b0c87e0cec10a8f4d9cf6b6dacbf7a6c65250862e2ec3cf01a1366c7141aec36b82fe3f2320a60e9b551ebfe3d62e4ea3b60ad6e34179a1d019bbc +SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad +SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f From 3fa1236ce3b627874ff218c918c9609d49e1ec96 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 27 Jan 2023 17:25:00 +0100 Subject: [PATCH 003/144] Update to 9.18.11 (#2164395) Resolves: CVE-2022-3094 CVE-2022-3736 CVE-2022-3924 https://downloads.isc.org/isc/bind9/9.18.11/doc/arm/html/notes.html#notes-for-bind-9-18-11 --- .gitignore | 2 ++ bind-9.11-fips-tests.patch | 22 +++++++++++----------- bind.spec | 5 ++++- sources | 4 ++-- 4 files changed, 19 insertions(+), 14 deletions(-) diff --git a/.gitignore b/.gitignore index 87a8eb0..8c663e5 100644 --- a/.gitignore +++ b/.gitignore @@ -198,3 +198,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.9.tar.xz.asc /bind-9.18.10.tar.xz /bind-9.18.10.tar.xz.asc +/bind-9.18.11.tar.xz +/bind-9.18.11.tar.xz.asc diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch index 7efac6d..5af7c53 100644 --- a/bind-9.11-fips-tests.patch +++ b/bind-9.11-fips-tests.patch @@ -1,4 +1,4 @@ -From 3446425cf03f2b5a7cbf6af47bd167f72e4135aa Mon Sep 17 00:00:00 2001 +From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 2 Aug 2018 23:46:45 +0200 Subject: [PATCH] FIPS tests changes @@ -534,10 +534,10 @@ index 4af25b0..9f202d5 100644 }; diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf -index 93939ff..3f78622 100644 +index f8d0408..bef7174 100644 --- a/bin/tests/system/checkconf/good.conf +++ b/bin/tests/system/checkconf/good.conf -@@ -280,6 +280,6 @@ dyndb "name" "library.so" { +@@ -281,6 +281,6 @@ dyndb "name" "library.so" { system; }; key "mykey" { @@ -546,7 +546,7 @@ index 93939ff..3f78622 100644 secret "qwertyuiopasdfgh"; }; diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in -index 1304303..e9c28c6 100644 +index 025f8d0..20ebca3 100644 --- a/bin/tests/system/cookie/ns1/named.conf.in +++ b/bin/tests/system/cookie/ns1/named.conf.in @@ -18,7 +18,7 @@ key rndc_key { @@ -652,10 +652,10 @@ index 706b7fc..2565ab4 100644 grep "test string" "$fnb" > /dev/null && grep "test string" "$fnc" > /dev/null && diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in -index 2b67360..a734584 100644 +index b502ea7..461f256 100644 --- a/bin/tests/system/nsupdate/ns1/named.conf.in +++ b/bin/tests/system/nsupdate/ns1/named.conf.in -@@ -39,7 +39,7 @@ controls { +@@ -40,7 +40,7 @@ controls { }; key altkey { @@ -665,7 +665,7 @@ index 2b67360..a734584 100644 }; diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in -index c85eef5..428b6b1 100644 +index 43137fe..be0b6b4 100644 --- a/bin/tests/system/nsupdate/ns2/named.conf.in +++ b/bin/tests/system/nsupdate/ns2/named.conf.in @@ -34,7 +34,7 @@ controls { @@ -708,7 +708,7 @@ index 50056dc..a4a1a3f 100644 $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh -index d612a22..9f18e57 100755 +index 9b80dd4..6671104 100755 --- a/bin/tests/system/nsupdate/tests.sh +++ b/bin/tests/system/nsupdate/tests.sh @@ -841,7 +841,12 @@ fi @@ -969,7 +969,7 @@ index c2b57dd..ea744f8 100644 }; diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh -index a6de312..ebcadb1 100644 +index 1d11bdf..456f9c5 100644 --- a/bin/tests/system/upforwd/tests.sh +++ b/bin/tests/system/upforwd/tests.sh @@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi @@ -977,10 +977,10 @@ index a6de312..ebcadb1 100644 echo_i "updating zone (signed) ($n)" ret=0 -$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - < - 32:9.18.11-1 +- Update to 9.18.11 (#2164395) + * Mon Jan 16 2023 Petr Menšík - 32:9.18.10-1 - Update to 9.18.10 (#2143258) - Include rwlock.h from dns/zt.h diff --git a/sources b/sources index aade61e..b0b7e54 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.10.tar.xz) = 517b070e28cc3c3ab6bc47d353d00ea5d365c0f46859d80c4712df97da759de5176126efe7d53887a2f141d06e61adfe4c0036df8e79db1ca93b0818a1d65b5e -SHA512 (bind-9.18.10.tar.xz.asc) = 6d872807d0b0c87e0cec10a8f4d9cf6b6dacbf7a6c65250862e2ec3cf01a1366c7141aec36b82fe3f2320a60e9b551ebfe3d62e4ea3b60ad6e34179a1d019bbc +SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad +SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f From 9303298043d30e21a6306b44ed1f754205550ceb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 30 Jan 2023 17:31:14 +0100 Subject: [PATCH 004/144] Parametrize tests for this component --- plans/all.fmf | 3 +++ plans/tier1-public.fmf | 3 +++ 2 files changed, 6 insertions(+) diff --git a/plans/all.fmf b/plans/all.fmf index 1afeb5d..10bce2d 100644 --- a/plans/all.fmf +++ b/plans/all.fmf @@ -1,4 +1,7 @@ summary: Test plan with all beakerlib tests +component: bind +environment+: + PACKAGE: bind discover: how: fmf url: https://src.fedoraproject.org/tests/bind.git diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf index 35808fd..3a37d22 100644 --- a/plans/tier1-public.fmf +++ b/plans/tier1-public.fmf @@ -1,4 +1,7 @@ summary: Public (Fedora) Tier1 beakerlib tests +component: bind +environment+: + PACKAGE: bind discover: how: fmf url: https://src.fedoraproject.org/tests/bind.git From 10cb7fcdc54db43fca7f35029f62f979a5d57251 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Feb 2023 02:43:32 +0100 Subject: [PATCH 005/144] Update to 9.18.12 (#2170096) https://downloads.isc.org/isc/bind9/9.18.12/doc/arm/html/notes.html#notes-for-bind-9-18-12 --- .gitignore | 2 ++ bind-9.18-zt-include-rwlock.patch | 27 --------------------------- bind.spec | 7 ++++--- sources | 4 ++-- 4 files changed, 8 insertions(+), 32 deletions(-) delete mode 100644 bind-9.18-zt-include-rwlock.patch diff --git a/.gitignore b/.gitignore index 8c663e5..07df030 100644 --- a/.gitignore +++ b/.gitignore @@ -200,3 +200,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.10.tar.xz.asc /bind-9.18.11.tar.xz /bind-9.18.11.tar.xz.asc +/bind-9.18.12.tar.xz +/bind-9.18.12.tar.xz.asc diff --git a/bind-9.18-zt-include-rwlock.patch b/bind-9.18-zt-include-rwlock.patch deleted file mode 100644 index ebe6a4f..0000000 --- a/bind-9.18-zt-include-rwlock.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 395d6fca2638129e1cc1f55ee4b3aa0dbba44dc0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Mon, 16 Jan 2023 11:45:31 +0100 -Subject: [PATCH] Include isc_rwlocktype_t type definition in zt.h - -After changes zt.h uses rwlock type, which is not enforced to be always -defined. Ensure full type definition is ready by including appropriate -header. ---- - lib/dns/include/dns/zt.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h -index 077b26ddea..037d0a9495 100644 ---- a/lib/dns/include/dns/zt.h -+++ b/lib/dns/include/dns/zt.h -@@ -18,6 +18,7 @@ - #include - - #include -+#include - - #include - --- -2.39.0 - diff --git a/bind.spec b/bind.spec index 735ec1b..4c15dbf 100644 --- a/bind.spec +++ b/bind.spec @@ -62,7 +62,7 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind License: MPL-2.0 -Version: 9.18.11 +Version: 9.18.12 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -101,8 +101,6 @@ Patch16: bind-9.16-redhat_doc.patch Patch22: bind-9.11-fips-tests.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376/ -Patch27: bind-9.18-zt-include-rwlock.patch %{?systemd_ordering} Requires: coreutils @@ -951,6 +949,9 @@ fi; %endif %changelog +* Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 +- Update to 9.18.12 (#2170096) + * Fri Jan 27 2023 Petr Menšík - 32:9.18.11-1 - Update to 9.18.11 (#2164395) diff --git a/sources b/sources index b0b7e54..7cdcf76 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad -SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f +SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac +SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6 From 082d1da26aecdf854db0fe2b3ee53d1b8c15ab26 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Feb 2023 02:43:32 +0100 Subject: [PATCH 006/144] Update to 9.18.12 (#2170096) https://downloads.isc.org/isc/bind9/9.18.12/doc/arm/html/notes.html#notes-for-bind-9-18-12 --- .gitignore | 2 ++ bind-9.18-zt-include-rwlock.patch | 27 --------------------------- bind.spec | 7 ++++--- sources | 4 ++-- 4 files changed, 8 insertions(+), 32 deletions(-) delete mode 100644 bind-9.18-zt-include-rwlock.patch diff --git a/.gitignore b/.gitignore index 8c663e5..07df030 100644 --- a/.gitignore +++ b/.gitignore @@ -200,3 +200,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.10.tar.xz.asc /bind-9.18.11.tar.xz /bind-9.18.11.tar.xz.asc +/bind-9.18.12.tar.xz +/bind-9.18.12.tar.xz.asc diff --git a/bind-9.18-zt-include-rwlock.patch b/bind-9.18-zt-include-rwlock.patch deleted file mode 100644 index ebe6a4f..0000000 --- a/bind-9.18-zt-include-rwlock.patch +++ /dev/null @@ -1,27 +0,0 @@ -From 395d6fca2638129e1cc1f55ee4b3aa0dbba44dc0 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Mon, 16 Jan 2023 11:45:31 +0100 -Subject: [PATCH] Include isc_rwlocktype_t type definition in zt.h - -After changes zt.h uses rwlock type, which is not enforced to be always -defined. Ensure full type definition is ready by including appropriate -header. ---- - lib/dns/include/dns/zt.h | 1 + - 1 file changed, 1 insertion(+) - -diff --git a/lib/dns/include/dns/zt.h b/lib/dns/include/dns/zt.h -index 077b26ddea..037d0a9495 100644 ---- a/lib/dns/include/dns/zt.h -+++ b/lib/dns/include/dns/zt.h -@@ -18,6 +18,7 @@ - #include - - #include -+#include - - #include - --- -2.39.0 - diff --git a/bind.spec b/bind.spec index b0d555d..599993f 100644 --- a/bind.spec +++ b/bind.spec @@ -62,7 +62,7 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind License: MPL-2.0 -Version: 9.18.11 +Version: 9.18.12 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -101,8 +101,6 @@ Patch16: bind-9.16-redhat_doc.patch Patch22: bind-9.11-fips-tests.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/7376/ -Patch27: bind-9.18-zt-include-rwlock.patch %{?systemd_ordering} Requires: coreutils @@ -951,6 +949,9 @@ fi; %endif %changelog +* Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 +- Update to 9.18.12 (#2170096) + * Fri Jan 27 2023 Petr Menšík - 32:9.18.11-1 - Update to 9.18.11 (#2164395) diff --git a/sources b/sources index b0b7e54..7cdcf76 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.11.tar.xz) = 1f71560efca3b6886d71861c76d4a11d59c28f0ffed684f040a59dd9c14be594985a3f15e6d610a4d88a40a16a19e259977d4a254e146469323d15587b23f3ad -SHA512 (bind-9.18.11.tar.xz.asc) = fb093a98c8a3f8eb12b03aee65bd88df9e17bed45810d963f7e74c00d470807b5dea73f9601c51a66b2f52e2b6fb16549c0733f3fe54d6c5a74c5c7dde63075f +SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac +SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6 From e853970bcf833b9d1587cac3bc45309421bfc445 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 7 Mar 2023 15:26:38 +0100 Subject: [PATCH 007/144] Remove component from test plans again --- plans/all.fmf | 1 - plans/tier1-public.fmf | 1 - 2 files changed, 2 deletions(-) diff --git a/plans/all.fmf b/plans/all.fmf index 10bce2d..df1b3e6 100644 --- a/plans/all.fmf +++ b/plans/all.fmf @@ -1,5 +1,4 @@ summary: Test plan with all beakerlib tests -component: bind environment+: PACKAGE: bind discover: diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf index 3a37d22..31400b7 100644 --- a/plans/tier1-public.fmf +++ b/plans/tier1-public.fmf @@ -1,5 +1,4 @@ summary: Public (Fedora) Tier1 beakerlib tests -component: bind environment+: PACKAGE: bind discover: From 13b1bcc0f09f11db0865815817fd865e6affc60d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 18 Mar 2023 12:09:06 +0100 Subject: [PATCH 008/144] Update to 9.18.3 (#2178717) https://downloads.isc.org/isc/bind9/9.18.13/doc/arm/html/notes.html#notes-for-bind-9-18-13 --- .gitignore | 2 + bind-9.11-fips-tests.patch | 986 ------------------------------------- bind.spec | 6 +- sources | 4 +- 4 files changed, 8 insertions(+), 990 deletions(-) delete mode 100644 bind-9.11-fips-tests.patch diff --git a/.gitignore b/.gitignore index 07df030..af968a5 100644 --- a/.gitignore +++ b/.gitignore @@ -202,3 +202,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.11.tar.xz.asc /bind-9.18.12.tar.xz /bind-9.18.12.tar.xz.asc +/bind-9.18.13.tar.xz +/bind-9.18.13.tar.xz.asc diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch deleted file mode 100644 index 5af7c53..0000000 --- a/bind-9.11-fips-tests.patch +++ /dev/null @@ -1,986 +0,0 @@ -From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Thu, 2 Aug 2018 23:46:45 +0200 -Subject: [PATCH] FIPS tests changes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Squashed commit of the following: - -commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa -Author: Petr Menšík -Date: Wed Mar 7 20:35:13 2018 +0100 - - Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available. - -commit ab303db70082db76ecf36493d0b82ef3e8750cad -Author: Petr Menšík -Date: Wed Mar 7 18:11:10 2018 +0100 - - Changed root key to be RSASHA256 - - Change bad trusted key to be the same algorithm. - -commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8 -Author: Petr Menšík -Date: Wed Mar 7 16:56:17 2018 +0100 - - Change used key to not use hmac-md5 - - Fix upforwd test, do not use hmac-md5 - -commit aec891571626f053acfb4d0a247240cbc21a84e9 -Author: Petr Menšík -Date: Wed Mar 7 15:54:11 2018 +0100 - - Increase bitsize of DSA key to pass FIPS 140-2 mode. - -commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696 -Author: Petr Menšík -Date: Wed Mar 7 15:41:08 2018 +0100 - - Fix tsig and rndc tests for disabled md5 - - Use hmac-sha256 instead of hmac-md5. - -commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67 -Author: Petr Menšík -Date: Wed Mar 7 13:21:00 2018 +0100 - - Add md5 availability detection to featuretest - -commit f389a918803e2853e4b55fed62765dc4a492e34f -Author: Petr Menšík -Date: Wed Mar 7 10:44:23 2018 +0100 - - Change tests to not use hmac-md5 algorithms if not required - - Use hmac-sha256 instead of default hmac-md5 for allow-query - -Use DEFAULT_HMAC configured variable ---- - bin/tests/system/acl/ns2/named1.conf.in | 4 +- - bin/tests/system/acl/ns2/named2.conf.in | 4 +- - bin/tests/system/acl/ns2/named3.conf.in | 6 +- - bin/tests/system/acl/ns2/named4.conf.in | 4 +- - bin/tests/system/acl/ns2/named5.conf.in | 4 +- - bin/tests/system/acl/tests.sh | 32 ++++----- - .../system/allow-query/ns2/named10.conf.in | 2 +- - .../system/allow-query/ns2/named11.conf.in | 4 +- - .../system/allow-query/ns2/named12.conf.in | 2 +- - .../system/allow-query/ns2/named30.conf.in | 2 +- - .../system/allow-query/ns2/named31.conf.in | 4 +- - .../system/allow-query/ns2/named32.conf.in | 2 +- - .../system/allow-query/ns2/named40.conf.in | 4 +- - bin/tests/system/allow-query/tests.sh | 18 ++--- - bin/tests/system/checkconf/bad-tsig.conf | 2 +- - bin/tests/system/checkconf/good.conf | 2 +- - bin/tests/system/cookie/ns1/named.conf.in | 2 +- - bin/tests/system/dnssec/ns4/named5.conf.in | 2 +- - bin/tests/system/feature-test.c | 14 ++++ - bin/tests/system/notify/ns5/named.conf.in | 6 +- - bin/tests/system/notify/tests.sh | 6 +- - bin/tests/system/nsupdate/ns1/named.conf.in | 2 +- - bin/tests/system/nsupdate/ns2/named.conf.in | 2 +- - bin/tests/system/nsupdate/ns9/named.conf.in | 2 +- - bin/tests/system/nsupdate/setup.sh | 6 +- - bin/tests/system/nsupdate/tests.sh | 9 ++- - bin/tests/system/rndc/ns2/named.conf.in | 2 +- - bin/tests/system/rndc/ns3/named.conf.in | 2 +- - bin/tests/system/rndc/setup.sh | 2 +- - bin/tests/system/rndc/tests.sh | 22 +++--- - bin/tests/system/tsig/ns1/named.conf.in | 10 +-- - bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++ - bin/tests/system/tsig/setup.sh | 5 ++ - bin/tests/system/tsig/tests.sh | 67 ++++++++++++------- - bin/tests/system/upforwd/ns1/named.conf.in | 2 +- - bin/tests/system/upforwd/tests.sh | 2 +- - 36 files changed, 161 insertions(+), 110 deletions(-) - create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in - -diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in -index 8787c6a..682ba97 100644 ---- a/bin/tests/system/acl/ns2/named1.conf.in -+++ b/bin/tests/system/acl/ns2/named1.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in -index a95b4c1..7b1cea6 100644 ---- a/bin/tests/system/acl/ns2/named2.conf.in -+++ b/bin/tests/system/acl/ns2/named2.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in -index 14cc3fe..6b35ba5 100644 ---- a/bin/tests/system/acl/ns2/named3.conf.in -+++ b/bin/tests/system/acl/ns2/named3.conf.in -@@ -35,17 +35,17 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key three { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in -index 77cf110..b23a1ca 100644 ---- a/bin/tests/system/acl/ns2/named4.conf.in -+++ b/bin/tests/system/acl/ns2/named4.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in -index 5ccabf9..52791aa 100644 ---- a/bin/tests/system/acl/ns2/named5.conf.in -+++ b/bin/tests/system/acl/ns2/named5.conf.in -@@ -37,12 +37,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh -index ad98fa1..7a7ff4a 100644 ---- a/bin/tests/system/acl/tests.sh -+++ b/bin/tests/system/acl/tests.sh -@@ -23,14 +23,14 @@ echo_i "testing basic ACL processing" - # key "one" should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - - # any other key should be fine - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - copy_setports ns2/named2.conf.in ns2/named.conf -@@ -40,18 +40,18 @@ sleep 5 - # prefix 10/8 should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # any other address should work, as long as it sends key "one" - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - echo_i "testing nested ACL processing" -@@ -63,31 +63,31 @@ sleep 5 - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # but only one or the other should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - t=`expr $t + 1` -@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1 - # and other values? right out - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two -@@ -109,31 +109,31 @@ sleep 5 - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - echo_i "testing allow-query-on ACL processing" -diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in -index b91d19a..ae485e8 100644 ---- a/bin/tests/system/allow-query/ns2/named10.conf.in -+++ b/bin/tests/system/allow-query/ns2/named10.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in -index 308c4ca..8a5e806 100644 ---- a/bin/tests/system/allow-query/ns2/named11.conf.in -+++ b/bin/tests/system/allow-query/ns2/named11.conf.in -@@ -12,12 +12,12 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in -index 6b0fe55..a10c6d0 100644 ---- a/bin/tests/system/allow-query/ns2/named12.conf.in -+++ b/bin/tests/system/allow-query/ns2/named12.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in -index aefc474..52981a7 100644 ---- a/bin/tests/system/allow-query/ns2/named30.conf.in -+++ b/bin/tests/system/allow-query/ns2/named30.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in -index 27eccc2..f627870 100644 ---- a/bin/tests/system/allow-query/ns2/named31.conf.in -+++ b/bin/tests/system/allow-query/ns2/named31.conf.in -@@ -12,12 +12,12 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in -index adbb203..6fd516b 100644 ---- a/bin/tests/system/allow-query/ns2/named32.conf.in -+++ b/bin/tests/system/allow-query/ns2/named32.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in -index 364f94b..de37915 100644 ---- a/bin/tests/system/allow-query/ns2/named40.conf.in -+++ b/bin/tests/system/allow-query/ns2/named40.conf.in -@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; }; - acl badaccept { 10.53.0.1; }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh -index 01a13cf..3711c63 100644 ---- a/bin/tests/system/allow-query/tests.sh -+++ b/bin/tests/system/allow-query/tests.sh -@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -534,7 +534,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -544,7 +544,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -555,7 +555,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 -diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf -index 4af25b0..9f202d5 100644 ---- a/bin/tests/system/checkconf/bad-tsig.conf -+++ b/bin/tests/system/checkconf/bad-tsig.conf -@@ -13,7 +13,7 @@ - - /* Bad secret */ - key "badtsig" { -- algorithm hmac-md5; -+ algorithm hmac-sha256; - secret "jEdD+BPKg=="; - }; - -diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf -index f8d0408..bef7174 100644 ---- a/bin/tests/system/checkconf/good.conf -+++ b/bin/tests/system/checkconf/good.conf -@@ -281,6 +281,6 @@ dyndb "name" "library.so" { - system; - }; - key "mykey" { -- algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; - secret "qwertyuiopasdfgh"; - }; -diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in -index 025f8d0..20ebca3 100644 ---- a/bin/tests/system/cookie/ns1/named.conf.in -+++ b/bin/tests/system/cookie/ns1/named.conf.in -@@ -18,7 +18,7 @@ key rndc_key { - - key foo { - secret "aaaaaaaaaaaa"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - server 10.53.0.10 { -diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in -index f1b817a..e457062 100644 ---- a/bin/tests/system/dnssec/ns4/named5.conf.in -+++ b/bin/tests/system/dnssec/ns4/named5.conf.in -@@ -35,5 +35,5 @@ controls { - - key auth { - secret "1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; -diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c -index b1adaed..3942df6 100644 ---- a/bin/tests/system/feature-test.c -+++ b/bin/tests/system/feature-test.c -@@ -17,6 +17,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -143,6 +144,19 @@ main(int argc, char **argv) { - #endif - } - -+ if (strcmp(argv[1], "--md5") == 0) { -+ unsigned char digest[ISC_MAX_MD_SIZE]; -+ const unsigned char test[] = "test"; -+ unsigned int size = sizeof(digest); -+ -+ if (isc_md(ISC_MD_MD5, test, sizeof(test), -+ digest, &size) == ISC_R_SUCCESS) { -+ return (0); -+ } else { -+ return (1); -+ } -+ } -+ - if (strcmp(argv[1], "--ipv6only=no") == 0) { - #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) - int s; -diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in -index 5cab276..c0492e1 100644 ---- a/bin/tests/system/notify/ns5/named.conf.in -+++ b/bin/tests/system/notify/ns5/named.conf.in -@@ -12,17 +12,17 @@ - */ - - key "a" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "aaaaaaaaaaaaaaaaaaaa"; - }; - - key "b" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "bbbbbbbbbbbbbbbbbbbb"; - }; - - key "c" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "cccccccccccccccccccc"; - }; - -diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh -index 706b7fc..2565ab4 100644 ---- a/bin/tests/system/notify/tests.sh -+++ b/bin/tests/system/notify/tests.sh -@@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig" - $NSUPDATE << EOF - server 10.53.0.5 ${PORT} - zone x21 --key a aaaaaaaaaaaaaaaaaaaa -+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa - update add added.x21 0 in txt "test string" - send - EOF -@@ -187,9 +187,9 @@ fnb="dig.out.b.ns5.test$n" - fnc="dig.out.c.ns5.test$n" - for i in 1 2 3 4 5 6 7 8 9 - do -- dig_plus_opts added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ -+ dig_plus_opts added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ - txt > "$fnb" || ret=1 -- dig_plus_opts added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \ -+ dig_plus_opts added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \ - txt > "$fnc" || ret=1 - grep "test string" "$fnb" > /dev/null && - grep "test string" "$fnc" > /dev/null && -diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in -index b502ea7..461f256 100644 ---- a/bin/tests/system/nsupdate/ns1/named.conf.in -+++ b/bin/tests/system/nsupdate/ns1/named.conf.in -@@ -40,7 +40,7 @@ controls { - }; - - key altkey { -- algorithm hmac-md5; -+ algorithm hmac-sha512; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in -index 43137fe..be0b6b4 100644 ---- a/bin/tests/system/nsupdate/ns2/named.conf.in -+++ b/bin/tests/system/nsupdate/ns2/named.conf.in -@@ -34,7 +34,7 @@ controls { - }; - - key altkey { -- algorithm hmac-md5; -+ algorithm hmac-sha512; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in -index 6a7ff88..0b70745 100644 ---- a/bin/tests/system/nsupdate/ns9/named.conf.in -+++ b/bin/tests/system/nsupdate/ns9/named.conf.in -@@ -32,7 +32,7 @@ key rndc_key { - - key subkey { - secret "1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh -index 50056dc..a4a1a3f 100644 ---- a/bin/tests/system/nsupdate/setup.sh -+++ b/bin/tests/system/nsupdate/setup.sh -@@ -72,7 +72,11 @@ EOF - - $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key - --$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key -+if $FEATURETEST --md5; then -+ $TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key -+else -+ echo -n > ns1/md5.key -+fi - $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key - $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key - $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key -diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh -index 9b80dd4..6671104 100755 ---- a/bin/tests/system/nsupdate/tests.sh -+++ b/bin/tests/system/nsupdate/tests.sh -@@ -841,7 +841,12 @@ fi - n=$((n + 1)) - ret=0 - echo_i "check TSIG key algorithms (nsupdate -k) ($n)" --for alg in md5 sha1 sha224 sha256 sha384 sha512; do -+MD5ALG='md5' -+if ! $FEATURETEST --md5; then -+ MD5ALG='' -+ echo_i "skipping disabled md5 algorithm" -+fi -+for alg in $MD5ALG sha1 sha224 sha256 sha384 sha512; do - $NSUPDATE -k ns1/${alg}.key < /dev/null || ret=1 - server 10.53.0.1 ${PORT} - update add ${alg}.keytests.nil. 600 A 10.10.10.3 -@@ -849,7 +854,7 @@ send - END - done - sleep 2 --for alg in md5 sha1 sha224 sha256 sha384 sha512; do -+for alg in $ALGS; do - $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1 - done - if [ $ret -ne 0 ]; then -diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in -index 117a5f4..be1af25 100644 ---- a/bin/tests/system/rndc/ns2/named.conf.in -+++ b/bin/tests/system/rndc/ns2/named.conf.in -@@ -27,7 +27,7 @@ key rndc_key { - - key secondkey { - secret "abcd1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in -index 3078e90..fd97ca2 100644 ---- a/bin/tests/system/rndc/ns3/named.conf.in -+++ b/bin/tests/system/rndc/ns3/named.conf.in -@@ -25,7 +25,7 @@ key rndc_key { - - key secondkey { - secret "abcd1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh -index 5f638ef..85d6b73 100644 ---- a/bin/tests/system/rndc/setup.sh -+++ b/bin/tests/system/rndc/setup.sh -@@ -47,7 +47,7 @@ make_key () { - sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf - } - --make_key 1 ${EXTRAPORT1} hmac-md5 -+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5 - make_key 2 ${EXTRAPORT2} hmac-sha1 - make_key 3 ${EXTRAPORT3} hmac-sha224 - make_key 4 ${EXTRAPORT4} hmac-sha256 -diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh -index e68428c..acbeb52 100644 ---- a/bin/tests/system/rndc/tests.sh -+++ b/bin/tests/system/rndc/tests.sh -@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi - status=$((status+ret)) - - n=$((n+1)) --echo_i "testing rndc with hmac-md5 ($n)" --ret=0 --$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 --for i in 2 3 4 5 6 --do -- $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 --done --if [ $ret != 0 ]; then echo_i "failed"; fi --status=$((status+ret)) -+if $FEATURETEST --md5; then -+ echo_i "testing rndc with hmac-md5 ($n)" -+ ret=0 -+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 -+ for i in 2 3 4 5 6 -+ do -+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 -+ done -+ if [ $ret != 0 ]; then echo_i "failed"; fi -+ status=$((status+ret)) -+else -+ echo_i "skipping rndc with hmac-md5 ($n)" -+fi - - n=$((n+1)) - echo_i "testing rndc with hmac-sha1 ($n)" -diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in -index 76cf970..22637af 100644 ---- a/bin/tests/system/tsig/ns1/named.conf.in -+++ b/bin/tests/system/tsig/ns1/named.conf.in -@@ -23,10 +23,7 @@ options { - notify no; - }; - --key "md5" { -- secret "97rnFx24Tfna4mHPfgnerA=="; -- algorithm hmac-md5; --}; -+# md5 key appended by setup.sh at the end - - key "sha1" { - secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; -@@ -53,10 +50,7 @@ key "sha512" { - algorithm hmac-sha512; - }; - --key "md5-trunc" { -- secret "97rnFx24Tfna4mHPfgnerA=="; -- algorithm hmac-md5-80; --}; -+# md5-trunc key appended by setup.sh at the end - - key "sha1-trunc" { - secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; -diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in -new file mode 100644 -index 0000000..0682194 ---- /dev/null -+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in -@@ -0,0 +1,10 @@ -+# Conditionally included when support for MD5 is available -+key "md5" { -+ secret "97rnFx24Tfna4mHPfgnerA=="; -+ algorithm hmac-md5; -+}; -+ -+key "md5-trunc" { -+ secret "97rnFx24Tfna4mHPfgnerA=="; -+ algorithm hmac-md5-80; -+}; -diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh -index 34cc73b..d51ff21 100644 ---- a/bin/tests/system/tsig/setup.sh -+++ b/bin/tests/system/tsig/setup.sh -@@ -16,3 +16,8 @@ - $SHELL clean.sh - - copy_setports ns1/named.conf.in ns1/named.conf -+ -+if $FEATURETEST --md5 -+then -+ cat ns1/rndc5.conf.in >> ns1/named.conf -+fi -diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh -index 1067227..ee05e83 100644 ---- a/bin/tests/system/tsig/tests.sh -+++ b/bin/tests/system/tsig/tests.sh -@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f - - status=0 - --echo_i "fetching using hmac-md5 (old form)" --ret=0 --$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 --grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 --fi -- --echo_i "fetching using hmac-md5 (new form)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 --grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5 (old form)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 -+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+ -+ echo_i "fetching using hmac-md5 (new form)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 -+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5" - fi - - echo_i "fetching using hmac-sha1" -@@ -88,12 +93,17 @@ fi - # Truncated TSIG - # - # --echo_i "fetching using hmac-md5 (trunc)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 --grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5 (trunc)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 -+ grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5 (trunc)" - fi - - echo_i "fetching using hmac-sha1 (trunc)" -@@ -142,12 +152,17 @@ fi - # Check for bad truncation. - # - # --echo_i "fetching using hmac-md5-80 (BADTRUNC)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 --grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5-80 (BADTRUNC)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 -+ grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5-80 (BADTRUNC)" - fi - - echo_i "fetching using hmac-sha1-80 (BADTRUNC)" -diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in -index c2b57dd..ea744f8 100644 ---- a/bin/tests/system/upforwd/ns1/named.conf.in -+++ b/bin/tests/system/upforwd/ns1/named.conf.in -@@ -12,7 +12,7 @@ - */ - - key "update.example." { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; - }; - -diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh -index 1d11bdf..456f9c5 100644 ---- a/bin/tests/system/upforwd/tests.sh -+++ b/bin/tests/system/upforwd/tests.sh -@@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi - - echo_i "updating zone (signed) ($n)" - ret=0 --$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - < - 32:9.18.13-1 +- Update to 9.18.3 (#2178717) + * Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 - Update to 9.18.12 (#2170096) diff --git a/sources b/sources index 7cdcf76..8c333dc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac -SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6 +SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c +SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1 From 79b25071b7cc9fcab5bd8b1e0e263b877cf45940 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 18 Mar 2023 12:09:06 +0100 Subject: [PATCH 009/144] Update to 9.18.3 (#2178717) https://downloads.isc.org/isc/bind9/9.18.13/doc/arm/html/notes.html#notes-for-bind-9-18-13 --- .gitignore | 2 + bind-9.11-fips-tests.patch | 986 ------------------------------------- bind.spec | 6 +- sources | 4 +- 4 files changed, 8 insertions(+), 990 deletions(-) delete mode 100644 bind-9.11-fips-tests.patch diff --git a/.gitignore b/.gitignore index 07df030..af968a5 100644 --- a/.gitignore +++ b/.gitignore @@ -202,3 +202,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.11.tar.xz.asc /bind-9.18.12.tar.xz /bind-9.18.12.tar.xz.asc +/bind-9.18.13.tar.xz +/bind-9.18.13.tar.xz.asc diff --git a/bind-9.11-fips-tests.patch b/bind-9.11-fips-tests.patch deleted file mode 100644 index 5af7c53..0000000 --- a/bind-9.11-fips-tests.patch +++ /dev/null @@ -1,986 +0,0 @@ -From 196642ce544dbffcaa4f8651f2abbb3ff16af278 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Thu, 2 Aug 2018 23:46:45 +0200 -Subject: [PATCH] FIPS tests changes -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Squashed commit of the following: - -commit 09e5eb48698d4fef2fc1031870de86c553b6bfaa -Author: Petr Menšík -Date: Wed Mar 7 20:35:13 2018 +0100 - - Fix nsupdate test. Do not use md5 by default for rndc, skip gracefully md5 if not available. - -commit ab303db70082db76ecf36493d0b82ef3e8750cad -Author: Petr Menšík -Date: Wed Mar 7 18:11:10 2018 +0100 - - Changed root key to be RSASHA256 - - Change bad trusted key to be the same algorithm. - -commit 88ab07c0e14cc71247e1f9d11a1ea832b64c1ee8 -Author: Petr Menšík -Date: Wed Mar 7 16:56:17 2018 +0100 - - Change used key to not use hmac-md5 - - Fix upforwd test, do not use hmac-md5 - -commit aec891571626f053acfb4d0a247240cbc21a84e9 -Author: Petr Menšík -Date: Wed Mar 7 15:54:11 2018 +0100 - - Increase bitsize of DSA key to pass FIPS 140-2 mode. - -commit bca8e164fa0d9aff2f946b8b4eb0f1f7e0bf6696 -Author: Petr Menšík -Date: Wed Mar 7 15:41:08 2018 +0100 - - Fix tsig and rndc tests for disabled md5 - - Use hmac-sha256 instead of hmac-md5. - -commit 0d314c1ab6151aa13574a21ad22f28d3b7f42a67 -Author: Petr Menšík -Date: Wed Mar 7 13:21:00 2018 +0100 - - Add md5 availability detection to featuretest - -commit f389a918803e2853e4b55fed62765dc4a492e34f -Author: Petr Menšík -Date: Wed Mar 7 10:44:23 2018 +0100 - - Change tests to not use hmac-md5 algorithms if not required - - Use hmac-sha256 instead of default hmac-md5 for allow-query - -Use DEFAULT_HMAC configured variable ---- - bin/tests/system/acl/ns2/named1.conf.in | 4 +- - bin/tests/system/acl/ns2/named2.conf.in | 4 +- - bin/tests/system/acl/ns2/named3.conf.in | 6 +- - bin/tests/system/acl/ns2/named4.conf.in | 4 +- - bin/tests/system/acl/ns2/named5.conf.in | 4 +- - bin/tests/system/acl/tests.sh | 32 ++++----- - .../system/allow-query/ns2/named10.conf.in | 2 +- - .../system/allow-query/ns2/named11.conf.in | 4 +- - .../system/allow-query/ns2/named12.conf.in | 2 +- - .../system/allow-query/ns2/named30.conf.in | 2 +- - .../system/allow-query/ns2/named31.conf.in | 4 +- - .../system/allow-query/ns2/named32.conf.in | 2 +- - .../system/allow-query/ns2/named40.conf.in | 4 +- - bin/tests/system/allow-query/tests.sh | 18 ++--- - bin/tests/system/checkconf/bad-tsig.conf | 2 +- - bin/tests/system/checkconf/good.conf | 2 +- - bin/tests/system/cookie/ns1/named.conf.in | 2 +- - bin/tests/system/dnssec/ns4/named5.conf.in | 2 +- - bin/tests/system/feature-test.c | 14 ++++ - bin/tests/system/notify/ns5/named.conf.in | 6 +- - bin/tests/system/notify/tests.sh | 6 +- - bin/tests/system/nsupdate/ns1/named.conf.in | 2 +- - bin/tests/system/nsupdate/ns2/named.conf.in | 2 +- - bin/tests/system/nsupdate/ns9/named.conf.in | 2 +- - bin/tests/system/nsupdate/setup.sh | 6 +- - bin/tests/system/nsupdate/tests.sh | 9 ++- - bin/tests/system/rndc/ns2/named.conf.in | 2 +- - bin/tests/system/rndc/ns3/named.conf.in | 2 +- - bin/tests/system/rndc/setup.sh | 2 +- - bin/tests/system/rndc/tests.sh | 22 +++--- - bin/tests/system/tsig/ns1/named.conf.in | 10 +-- - bin/tests/system/tsig/ns1/rndc5.conf.in | 10 +++ - bin/tests/system/tsig/setup.sh | 5 ++ - bin/tests/system/tsig/tests.sh | 67 ++++++++++++------- - bin/tests/system/upforwd/ns1/named.conf.in | 2 +- - bin/tests/system/upforwd/tests.sh | 2 +- - 36 files changed, 161 insertions(+), 110 deletions(-) - create mode 100644 bin/tests/system/tsig/ns1/rndc5.conf.in - -diff --git a/bin/tests/system/acl/ns2/named1.conf.in b/bin/tests/system/acl/ns2/named1.conf.in -index 8787c6a..682ba97 100644 ---- a/bin/tests/system/acl/ns2/named1.conf.in -+++ b/bin/tests/system/acl/ns2/named1.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named2.conf.in b/bin/tests/system/acl/ns2/named2.conf.in -index a95b4c1..7b1cea6 100644 ---- a/bin/tests/system/acl/ns2/named2.conf.in -+++ b/bin/tests/system/acl/ns2/named2.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named3.conf.in b/bin/tests/system/acl/ns2/named3.conf.in -index 14cc3fe..6b35ba5 100644 ---- a/bin/tests/system/acl/ns2/named3.conf.in -+++ b/bin/tests/system/acl/ns2/named3.conf.in -@@ -35,17 +35,17 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key three { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named4.conf.in b/bin/tests/system/acl/ns2/named4.conf.in -index 77cf110..b23a1ca 100644 ---- a/bin/tests/system/acl/ns2/named4.conf.in -+++ b/bin/tests/system/acl/ns2/named4.conf.in -@@ -35,12 +35,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/ns2/named5.conf.in b/bin/tests/system/acl/ns2/named5.conf.in -index 5ccabf9..52791aa 100644 ---- a/bin/tests/system/acl/ns2/named5.conf.in -+++ b/bin/tests/system/acl/ns2/named5.conf.in -@@ -37,12 +37,12 @@ options { - }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/acl/tests.sh b/bin/tests/system/acl/tests.sh -index ad98fa1..7a7ff4a 100644 ---- a/bin/tests/system/acl/tests.sh -+++ b/bin/tests/system/acl/tests.sh -@@ -23,14 +23,14 @@ echo_i "testing basic ACL processing" - # key "one" should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - - # any other key should be fine - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - copy_setports ns2/named2.conf.in ns2/named.conf -@@ -40,18 +40,18 @@ sleep 5 - # prefix 10/8 should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # any other address should work, as long as it sends key "one" - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - echo_i "testing nested ACL processing" -@@ -63,31 +63,31 @@ sleep 5 - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # but only one or the other should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - t=`expr $t + 1` -@@ -98,7 +98,7 @@ grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $tt failed" ; status=1 - # and other values? right out - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 127.0.0.1 axfr -y three:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 127.0.0.1 axfr -y hmac-sha256:three:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # now we only allow 10.53.0.1 *and* key one, or 10.53.0.2 *and* key two -@@ -109,31 +109,31 @@ sleep 5 - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should succeed - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 && { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.2 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.2 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.1 axfr -y two:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.1 axfr -y hmac-sha256:two:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - # should fail - t=`expr $t + 1` - $DIG $DIGOPTS tsigzone. \ -- @10.53.0.2 -b 10.53.0.3 axfr -y one:1234abcd8765 > dig.out.${t} -+ @10.53.0.2 -b 10.53.0.3 axfr -y hmac-sha256:one:1234abcd8765 > dig.out.${t} - grep "^;" dig.out.${t} > /dev/null 2>&1 || { echo_i "test $t failed" ; status=1; } - - echo_i "testing allow-query-on ACL processing" -diff --git a/bin/tests/system/allow-query/ns2/named10.conf.in b/bin/tests/system/allow-query/ns2/named10.conf.in -index b91d19a..ae485e8 100644 ---- a/bin/tests/system/allow-query/ns2/named10.conf.in -+++ b/bin/tests/system/allow-query/ns2/named10.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named11.conf.in b/bin/tests/system/allow-query/ns2/named11.conf.in -index 308c4ca..8a5e806 100644 ---- a/bin/tests/system/allow-query/ns2/named11.conf.in -+++ b/bin/tests/system/allow-query/ns2/named11.conf.in -@@ -12,12 +12,12 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named12.conf.in b/bin/tests/system/allow-query/ns2/named12.conf.in -index 6b0fe55..a10c6d0 100644 ---- a/bin/tests/system/allow-query/ns2/named12.conf.in -+++ b/bin/tests/system/allow-query/ns2/named12.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named30.conf.in b/bin/tests/system/allow-query/ns2/named30.conf.in -index aefc474..52981a7 100644 ---- a/bin/tests/system/allow-query/ns2/named30.conf.in -+++ b/bin/tests/system/allow-query/ns2/named30.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named31.conf.in b/bin/tests/system/allow-query/ns2/named31.conf.in -index 27eccc2..f627870 100644 ---- a/bin/tests/system/allow-query/ns2/named31.conf.in -+++ b/bin/tests/system/allow-query/ns2/named31.conf.in -@@ -12,12 +12,12 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named32.conf.in b/bin/tests/system/allow-query/ns2/named32.conf.in -index adbb203..6fd516b 100644 ---- a/bin/tests/system/allow-query/ns2/named32.conf.in -+++ b/bin/tests/system/allow-query/ns2/named32.conf.in -@@ -12,7 +12,7 @@ - */ - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/allow-query/ns2/named40.conf.in b/bin/tests/system/allow-query/ns2/named40.conf.in -index 364f94b..de37915 100644 ---- a/bin/tests/system/allow-query/ns2/named40.conf.in -+++ b/bin/tests/system/allow-query/ns2/named40.conf.in -@@ -16,12 +16,12 @@ acl accept { 10.53.0.2; }; - acl badaccept { 10.53.0.1; }; - - key one { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234abcd8765"; - }; - - key two { -- algorithm hmac-md5; -+ algorithm @DEFAULT_HMAC@; - secret "1234efgh8765"; - }; - -diff --git a/bin/tests/system/allow-query/tests.sh b/bin/tests/system/allow-query/tests.sh -index 01a13cf..3711c63 100644 ---- a/bin/tests/system/allow-query/tests.sh -+++ b/bin/tests/system/allow-query/tests.sh -@@ -201,7 +201,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -214,7 +214,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -228,7 +228,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -367,7 +367,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -380,7 +380,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -394,7 +394,7 @@ rndc_reload ns2 10.53.0.2 - - echo_i "test $n: views key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.normal.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.normal.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -534,7 +534,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key allowed - query allowed" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: NOERROR' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null || ret=1 - if [ $ret != 0 ]; then echo_i "failed"; fi -@@ -544,7 +544,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key not allowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:two:1234efgh8765 a.keyallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keyallow.example' dig.out.ns2.$n > /dev/null && ret=1 -@@ -555,7 +555,7 @@ status=`expr $status + $ret` - n=`expr $n + 1` - echo_i "test $n: zone key disallowed - query refused" - ret=0 --$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 -+$DIG $DIGOPTS @10.53.0.2 -b 10.53.0.2 -y hmac-sha256:one:1234abcd8765 a.keydisallow.example a > dig.out.ns2.$n || ret=1 - grep 'status: REFUSED' dig.out.ns2.$n > /dev/null || ret=1 - grep 'EDE: 18 (Prohibited)' dig.out.ns2.$n > /dev/null || ret=1 - grep '^a.keydisallow.example' dig.out.ns2.$n > /dev/null && ret=1 -diff --git a/bin/tests/system/checkconf/bad-tsig.conf b/bin/tests/system/checkconf/bad-tsig.conf -index 4af25b0..9f202d5 100644 ---- a/bin/tests/system/checkconf/bad-tsig.conf -+++ b/bin/tests/system/checkconf/bad-tsig.conf -@@ -13,7 +13,7 @@ - - /* Bad secret */ - key "badtsig" { -- algorithm hmac-md5; -+ algorithm hmac-sha256; - secret "jEdD+BPKg=="; - }; - -diff --git a/bin/tests/system/checkconf/good.conf b/bin/tests/system/checkconf/good.conf -index f8d0408..bef7174 100644 ---- a/bin/tests/system/checkconf/good.conf -+++ b/bin/tests/system/checkconf/good.conf -@@ -281,6 +281,6 @@ dyndb "name" "library.so" { - system; - }; - key "mykey" { -- algorithm "hmac-md5"; -+ algorithm "hmac-sha256"; - secret "qwertyuiopasdfgh"; - }; -diff --git a/bin/tests/system/cookie/ns1/named.conf.in b/bin/tests/system/cookie/ns1/named.conf.in -index 025f8d0..20ebca3 100644 ---- a/bin/tests/system/cookie/ns1/named.conf.in -+++ b/bin/tests/system/cookie/ns1/named.conf.in -@@ -18,7 +18,7 @@ key rndc_key { - - key foo { - secret "aaaaaaaaaaaa"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - server 10.53.0.10 { -diff --git a/bin/tests/system/dnssec/ns4/named5.conf.in b/bin/tests/system/dnssec/ns4/named5.conf.in -index f1b817a..e457062 100644 ---- a/bin/tests/system/dnssec/ns4/named5.conf.in -+++ b/bin/tests/system/dnssec/ns4/named5.conf.in -@@ -35,5 +35,5 @@ controls { - - key auth { - secret "1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; -diff --git a/bin/tests/system/feature-test.c b/bin/tests/system/feature-test.c -index b1adaed..3942df6 100644 ---- a/bin/tests/system/feature-test.c -+++ b/bin/tests/system/feature-test.c -@@ -17,6 +17,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -143,6 +144,19 @@ main(int argc, char **argv) { - #endif - } - -+ if (strcmp(argv[1], "--md5") == 0) { -+ unsigned char digest[ISC_MAX_MD_SIZE]; -+ const unsigned char test[] = "test"; -+ unsigned int size = sizeof(digest); -+ -+ if (isc_md(ISC_MD_MD5, test, sizeof(test), -+ digest, &size) == ISC_R_SUCCESS) { -+ return (0); -+ } else { -+ return (1); -+ } -+ } -+ - if (strcmp(argv[1], "--ipv6only=no") == 0) { - #if defined(IPPROTO_IPV6) && defined(IPV6_V6ONLY) - int s; -diff --git a/bin/tests/system/notify/ns5/named.conf.in b/bin/tests/system/notify/ns5/named.conf.in -index 5cab276..c0492e1 100644 ---- a/bin/tests/system/notify/ns5/named.conf.in -+++ b/bin/tests/system/notify/ns5/named.conf.in -@@ -12,17 +12,17 @@ - */ - - key "a" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "aaaaaaaaaaaaaaaaaaaa"; - }; - - key "b" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "bbbbbbbbbbbbbbbbbbbb"; - }; - - key "c" { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "cccccccccccccccccccc"; - }; - -diff --git a/bin/tests/system/notify/tests.sh b/bin/tests/system/notify/tests.sh -index 706b7fc..2565ab4 100644 ---- a/bin/tests/system/notify/tests.sh -+++ b/bin/tests/system/notify/tests.sh -@@ -179,7 +179,7 @@ test_start "checking notify to multiple views using tsig" - $NSUPDATE << EOF - server 10.53.0.5 ${PORT} - zone x21 --key a aaaaaaaaaaaaaaaaaaaa -+key hmac-sha256:a aaaaaaaaaaaaaaaaaaaa - update add added.x21 0 in txt "test string" - send - EOF -@@ -187,9 +187,9 @@ fnb="dig.out.b.ns5.test$n" - fnc="dig.out.c.ns5.test$n" - for i in 1 2 3 4 5 6 7 8 9 - do -- dig_plus_opts added.x21. -y b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ -+ dig_plus_opts added.x21. -y hmac-sha256:b:bbbbbbbbbbbbbbbbbbbb @10.53.0.5 \ - txt > "$fnb" || ret=1 -- dig_plus_opts added.x21. -y c:cccccccccccccccccccc @10.53.0.5 \ -+ dig_plus_opts added.x21. -y hmac-sha256:c:cccccccccccccccccccc @10.53.0.5 \ - txt > "$fnc" || ret=1 - grep "test string" "$fnb" > /dev/null && - grep "test string" "$fnc" > /dev/null && -diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in -index b502ea7..461f256 100644 ---- a/bin/tests/system/nsupdate/ns1/named.conf.in -+++ b/bin/tests/system/nsupdate/ns1/named.conf.in -@@ -40,7 +40,7 @@ controls { - }; - - key altkey { -- algorithm hmac-md5; -+ algorithm hmac-sha512; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/nsupdate/ns2/named.conf.in b/bin/tests/system/nsupdate/ns2/named.conf.in -index 43137fe..be0b6b4 100644 ---- a/bin/tests/system/nsupdate/ns2/named.conf.in -+++ b/bin/tests/system/nsupdate/ns2/named.conf.in -@@ -34,7 +34,7 @@ controls { - }; - - key altkey { -- algorithm hmac-md5; -+ algorithm hmac-sha512; - secret "1234abcd8765"; - }; - -diff --git a/bin/tests/system/nsupdate/ns9/named.conf.in b/bin/tests/system/nsupdate/ns9/named.conf.in -index 6a7ff88..0b70745 100644 ---- a/bin/tests/system/nsupdate/ns9/named.conf.in -+++ b/bin/tests/system/nsupdate/ns9/named.conf.in -@@ -32,7 +32,7 @@ key rndc_key { - - key subkey { - secret "1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/nsupdate/setup.sh b/bin/tests/system/nsupdate/setup.sh -index 50056dc..a4a1a3f 100644 ---- a/bin/tests/system/nsupdate/setup.sh -+++ b/bin/tests/system/nsupdate/setup.sh -@@ -72,7 +72,11 @@ EOF - - $TSIGKEYGEN ddns-key.example.nil > ns1/ddns.key - --$TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key -+if $FEATURETEST --md5; then -+ $TSIGKEYGEN -a hmac-md5 md5-key > ns1/md5.key -+else -+ echo -n > ns1/md5.key -+fi - $TSIGKEYGEN -a hmac-sha1 sha1-key > ns1/sha1.key - $TSIGKEYGEN -a hmac-sha224 sha224-key > ns1/sha224.key - $TSIGKEYGEN -a hmac-sha256 sha256-key > ns1/sha256.key -diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh -index 9b80dd4..6671104 100755 ---- a/bin/tests/system/nsupdate/tests.sh -+++ b/bin/tests/system/nsupdate/tests.sh -@@ -841,7 +841,12 @@ fi - n=$((n + 1)) - ret=0 - echo_i "check TSIG key algorithms (nsupdate -k) ($n)" --for alg in md5 sha1 sha224 sha256 sha384 sha512; do -+MD5ALG='md5' -+if ! $FEATURETEST --md5; then -+ MD5ALG='' -+ echo_i "skipping disabled md5 algorithm" -+fi -+for alg in $MD5ALG sha1 sha224 sha256 sha384 sha512; do - $NSUPDATE -k ns1/${alg}.key < /dev/null || ret=1 - server 10.53.0.1 ${PORT} - update add ${alg}.keytests.nil. 600 A 10.10.10.3 -@@ -849,7 +854,7 @@ send - END - done - sleep 2 --for alg in md5 sha1 sha224 sha256 sha384 sha512; do -+for alg in $ALGS; do - $DIG $DIGOPTS +short @10.53.0.1 ${alg}.keytests.nil | grep 10.10.10.3 > /dev/null 2>&1 || ret=1 - done - if [ $ret -ne 0 ]; then -diff --git a/bin/tests/system/rndc/ns2/named.conf.in b/bin/tests/system/rndc/ns2/named.conf.in -index 117a5f4..be1af25 100644 ---- a/bin/tests/system/rndc/ns2/named.conf.in -+++ b/bin/tests/system/rndc/ns2/named.conf.in -@@ -27,7 +27,7 @@ key rndc_key { - - key secondkey { - secret "abcd1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/rndc/ns3/named.conf.in b/bin/tests/system/rndc/ns3/named.conf.in -index 3078e90..fd97ca2 100644 ---- a/bin/tests/system/rndc/ns3/named.conf.in -+++ b/bin/tests/system/rndc/ns3/named.conf.in -@@ -25,7 +25,7 @@ key rndc_key { - - key secondkey { - secret "abcd1234abcd8765"; -- algorithm hmac-sha256; -+ algorithm @DEFAULT_HMAC@; - }; - - controls { -diff --git a/bin/tests/system/rndc/setup.sh b/bin/tests/system/rndc/setup.sh -index 5f638ef..85d6b73 100644 ---- a/bin/tests/system/rndc/setup.sh -+++ b/bin/tests/system/rndc/setup.sh -@@ -47,7 +47,7 @@ make_key () { - sed 's/allow { 10.53.0.4/allow { any/' >> ns4/named.conf - } - --make_key 1 ${EXTRAPORT1} hmac-md5 -+$FEATURETEST --md5 && make_key 1 ${EXTRAPORT1} hmac-md5 - make_key 2 ${EXTRAPORT2} hmac-sha1 - make_key 3 ${EXTRAPORT3} hmac-sha224 - make_key 4 ${EXTRAPORT4} hmac-sha256 -diff --git a/bin/tests/system/rndc/tests.sh b/bin/tests/system/rndc/tests.sh -index e68428c..acbeb52 100644 ---- a/bin/tests/system/rndc/tests.sh -+++ b/bin/tests/system/rndc/tests.sh -@@ -350,15 +350,19 @@ if [ $ret != 0 ]; then echo_i "failed"; fi - status=$((status+ret)) - - n=$((n+1)) --echo_i "testing rndc with hmac-md5 ($n)" --ret=0 --$RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 --for i in 2 3 4 5 6 --do -- $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 --done --if [ $ret != 0 ]; then echo_i "failed"; fi --status=$((status+ret)) -+if $FEATURETEST --md5; then -+ echo_i "testing rndc with hmac-md5 ($n)" -+ ret=0 -+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key1.conf status > /dev/null 2>&1 || ret=1 -+ for i in 2 3 4 5 6 -+ do -+ $RNDC -s 10.53.0.4 -p ${EXTRAPORT1} -c ns4/key${i}.conf status > /dev/null 2>&1 && ret=1 -+ done -+ if [ $ret != 0 ]; then echo_i "failed"; fi -+ status=$((status+ret)) -+else -+ echo_i "skipping rndc with hmac-md5 ($n)" -+fi - - n=$((n+1)) - echo_i "testing rndc with hmac-sha1 ($n)" -diff --git a/bin/tests/system/tsig/ns1/named.conf.in b/bin/tests/system/tsig/ns1/named.conf.in -index 76cf970..22637af 100644 ---- a/bin/tests/system/tsig/ns1/named.conf.in -+++ b/bin/tests/system/tsig/ns1/named.conf.in -@@ -23,10 +23,7 @@ options { - notify no; - }; - --key "md5" { -- secret "97rnFx24Tfna4mHPfgnerA=="; -- algorithm hmac-md5; --}; -+# md5 key appended by setup.sh at the end - - key "sha1" { - secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; -@@ -53,10 +50,7 @@ key "sha512" { - algorithm hmac-sha512; - }; - --key "md5-trunc" { -- secret "97rnFx24Tfna4mHPfgnerA=="; -- algorithm hmac-md5-80; --}; -+# md5-trunc key appended by setup.sh at the end - - key "sha1-trunc" { - secret "FrSt77yPTFx6hTs4i2tKLB9LmE0="; -diff --git a/bin/tests/system/tsig/ns1/rndc5.conf.in b/bin/tests/system/tsig/ns1/rndc5.conf.in -new file mode 100644 -index 0000000..0682194 ---- /dev/null -+++ b/bin/tests/system/tsig/ns1/rndc5.conf.in -@@ -0,0 +1,10 @@ -+# Conditionally included when support for MD5 is available -+key "md5" { -+ secret "97rnFx24Tfna4mHPfgnerA=="; -+ algorithm hmac-md5; -+}; -+ -+key "md5-trunc" { -+ secret "97rnFx24Tfna4mHPfgnerA=="; -+ algorithm hmac-md5-80; -+}; -diff --git a/bin/tests/system/tsig/setup.sh b/bin/tests/system/tsig/setup.sh -index 34cc73b..d51ff21 100644 ---- a/bin/tests/system/tsig/setup.sh -+++ b/bin/tests/system/tsig/setup.sh -@@ -16,3 +16,8 @@ - $SHELL clean.sh - - copy_setports ns1/named.conf.in ns1/named.conf -+ -+if $FEATURETEST --md5 -+then -+ cat ns1/rndc5.conf.in >> ns1/named.conf -+fi -diff --git a/bin/tests/system/tsig/tests.sh b/bin/tests/system/tsig/tests.sh -index 1067227..ee05e83 100644 ---- a/bin/tests/system/tsig/tests.sh -+++ b/bin/tests/system/tsig/tests.sh -@@ -27,20 +27,25 @@ sha512="jI/Pa4qRu96t76Pns5Z/Ndxbn3QCkwcxLOgt9vgvnJw5wqTRvNyk3FtD6yIMd1dWVlqZ+Y4f - - status=0 - --echo_i "fetching using hmac-md5 (old form)" --ret=0 --$DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 --grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 --fi -- --echo_i "fetching using hmac-md5 (new form)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 --grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5 (old form)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "md5:$md5" @10.53.0.1 soa > dig.out.md5.old || ret=1 -+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.old > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+ -+ echo_i "fetching using hmac-md5 (new form)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5:md5:$md5" @10.53.0.1 soa > dig.out.md5.new || ret=1 -+ grep -i "md5.*TSIG.*NOERROR" dig.out.md5.new > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5" - fi - - echo_i "fetching using hmac-sha1" -@@ -88,12 +93,17 @@ fi - # Truncated TSIG - # - # --echo_i "fetching using hmac-md5 (trunc)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 --grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5 (trunc)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5-trunc:$md5" @10.53.0.1 soa > dig.out.md5.trunc || ret=1 -+ grep -i "md5-trunc.*TSIG.*NOERROR" dig.out.md5.trunc > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5 (trunc)" - fi - - echo_i "fetching using hmac-sha1 (trunc)" -@@ -142,12 +152,17 @@ fi - # Check for bad truncation. - # - # --echo_i "fetching using hmac-md5-80 (BADTRUNC)" --ret=0 --$DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 --grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 --if [ $ret -eq 1 ] ; then -- echo_i "failed"; status=1 -+if $FEATURETEST --md5 -+then -+ echo_i "fetching using hmac-md5-80 (BADTRUNC)" -+ ret=0 -+ $DIG $DIGOPTS example.nil. -y "hmac-md5-80:md5:$md5" @10.53.0.1 soa > dig.out.md5-80 || ret=1 -+ grep -i "md5.*TSIG.*BADTRUNC" dig.out.md5-80 > /dev/null || ret=1 -+ if [ $ret -eq 1 ] ; then -+ echo_i "failed"; status=1 -+ fi -+else -+ echo_i "skipping using hmac-md5-80 (BADTRUNC)" - fi - - echo_i "fetching using hmac-sha1-80 (BADTRUNC)" -diff --git a/bin/tests/system/upforwd/ns1/named.conf.in b/bin/tests/system/upforwd/ns1/named.conf.in -index c2b57dd..ea744f8 100644 ---- a/bin/tests/system/upforwd/ns1/named.conf.in -+++ b/bin/tests/system/upforwd/ns1/named.conf.in -@@ -12,7 +12,7 @@ - */ - - key "update.example." { -- algorithm "hmac-md5"; -+ algorithm "@DEFAULT_HMAC@"; - secret "c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K"; - }; - -diff --git a/bin/tests/system/upforwd/tests.sh b/bin/tests/system/upforwd/tests.sh -index 1d11bdf..456f9c5 100644 ---- a/bin/tests/system/upforwd/tests.sh -+++ b/bin/tests/system/upforwd/tests.sh -@@ -80,7 +80,7 @@ if [ $ret != 0 ] ; then echo_i "failed"; status=`expr $status + $ret`; fi - - echo_i "updating zone (signed) ($n)" - ret=0 --$NSUPDATE -y update.example:c3Ryb25nIGVub3VnaCBmb3IgYSBtYW4gYnV0IG1hZGUgZm9yIGEgd29tYW4K -- - < - 32:9.18.13-1 +- Update to 9.18.3 (#2178717) + * Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 - Update to 9.18.12 (#2170096) diff --git a/sources b/sources index 7cdcf76..8c333dc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.12.tar.xz) = 9741ea1260eb0922f5e42fb7916ede3f922291edf6a6b97ca574b53c0179eecb05197d49ca8204e8aae48e0ac393a03e01129c5d9b5d0d32e836009b1b914fac -SHA512 (bind-9.18.12.tar.xz.asc) = 551844ee503f182d6e149897f8cd8b267f8cebc2b7eb9c88448f382800f6a3bf01efb8ff4be1ff1c61b1b98d33b79c52fa02be55c0b88f47f488e87592d5f2c6 +SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c +SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1 From 03b1f0a4e43abf1cc6a492ad67bea147dfd6af2f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 5 Apr 2023 14:34:25 +0200 Subject: [PATCH 010/144] Enumerate all SPDX licenses used --- bind.spec | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index 3dc741b..9409544 100644 --- a/bind.spec +++ b/bind.spec @@ -61,9 +61,23 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind -License: MPL-2.0 +License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause +# Most of code is licensed under MPL-2.0. Some additions follow: +# ./contrib/dlz/* ISC and/or MPL-2.0 +# ./lib/isccc/*.c ISC and/or MPL-2.0 +# ./lib/isccc/include/isccc/*.h ISC and/or MPL-2.0 +# ./lib/isc/picohttpparser.c Expat, should be MIT +# ./lib/isc/picohttpparser.h Expat, should be MIT +# ./lib/isc/url.c Expat and/or MPL-2.0, should be MIT +# ./lib/isc/include/isc/url.h Expat and/or MPL-2.0 +# ./lib/dns/dnstap.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/commandline.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/file.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 +# ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.13 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -948,6 +962,9 @@ fi; %endif %changelog +* Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 +- Enumerate all SPDX licenses used + * Sat Mar 18 2023 Petr Menšík - 32:9.18.13-1 - Update to 9.18.3 (#2178717) From 15dc7fb16a3085aefed4180026d6610f92ad88a8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Apr 2023 22:13:37 +0200 Subject: [PATCH 011/144] Update to 9.18.14 (#2187996) https://downloads.isc.org/isc/bind9/9.18.14/doc/arm/html/notes.html#notes-for-bind-9-18-14 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index af968a5..307b888 100644 --- a/.gitignore +++ b/.gitignore @@ -204,3 +204,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.12.tar.xz.asc /bind-9.18.13.tar.xz /bind-9.18.13.tar.xz.asc +/bind-9.18.14.tar.xz +/bind-9.18.14.tar.xz.asc diff --git a/bind.spec b/bind.spec index 9409544..a98b535 100644 --- a/bind.spec +++ b/bind.spec @@ -76,8 +76,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.13 -Release: 2%{?dist} +Version: 9.18.14 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 +- Update to 9.18.14 (#2187996) + * Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 - Enumerate all SPDX licenses used diff --git a/sources b/sources index 8c333dc..a2558fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c -SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1 +SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969 +SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584 From 72dec9a8465aabab4cb43c74e97c371f10017123 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 5 Apr 2023 14:34:25 +0200 Subject: [PATCH 012/144] Enumerate all SPDX licenses used --- bind.spec | 21 +++++++++++++++++++-- 1 file changed, 19 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index 46e08c6..f198888 100644 --- a/bind.spec +++ b/bind.spec @@ -61,9 +61,23 @@ Conflicts: %1 \ Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server Name: bind -License: MPL-2.0 +License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause +# Most of code is licensed under MPL-2.0. Some additions follow: +# ./contrib/dlz/* ISC and/or MPL-2.0 +# ./lib/isccc/*.c ISC and/or MPL-2.0 +# ./lib/isccc/include/isccc/*.h ISC and/or MPL-2.0 +# ./lib/isc/picohttpparser.c Expat, should be MIT +# ./lib/isc/picohttpparser.h Expat, should be MIT +# ./lib/isc/url.c Expat and/or MPL-2.0, should be MIT +# ./lib/isc/include/isc/url.h Expat and/or MPL-2.0 +# ./lib/dns/dnstap.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/commandline.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/file.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 +# ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 +# ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.13 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -948,6 +962,9 @@ fi; %endif %changelog +* Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 +- Enumerate all SPDX licenses used + * Sat Mar 18 2023 Petr Menšík - 32:9.18.13-1 - Update to 9.18.3 (#2178717) From 3f896eb46c83587fd31100b7bb3cdf98b04897ae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Apr 2023 22:13:37 +0200 Subject: [PATCH 013/144] Update to 9.18.14 (#2187996) https://downloads.isc.org/isc/bind9/9.18.14/doc/arm/html/notes.html#notes-for-bind-9-18-14 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index af968a5..307b888 100644 --- a/.gitignore +++ b/.gitignore @@ -204,3 +204,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.12.tar.xz.asc /bind-9.18.13.tar.xz /bind-9.18.13.tar.xz.asc +/bind-9.18.14.tar.xz +/bind-9.18.14.tar.xz.asc diff --git a/bind.spec b/bind.spec index f198888..9f19118 100644 --- a/bind.spec +++ b/bind.spec @@ -76,8 +76,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.13 -Release: 2%{?dist} +Version: 9.18.14 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 +- Update to 9.18.14 (#2187996) + * Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 - Enumerate all SPDX licenses used diff --git a/sources b/sources index 8c333dc..a2558fe 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.13.tar.xz) = e385a285c5a23bac26155f8a3f3a826a6dec0fd2bf4e3e2270debc45d21031cecc41dc05350b1ec0aed5020e0e4ae75db6632e99deea6834519756af4eb69b3c -SHA512 (bind-9.18.13.tar.xz.asc) = 7f3239ab40dbfcd95e0dd5badffbac1e4972fd68906d010399c318bf55073e82ebfe1f19ad2228dd6b5d659df71bd51397b3aacf8584f2a9a285e4dea94640d1 +SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969 +SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584 From 9678d7855f0a0650efbf5b99458d60ceca466523 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 17 May 2023 18:59:49 +0200 Subject: [PATCH 014/144] Update to 9.18.15 (#2207908) --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 307b888..af9f0bf 100644 --- a/.gitignore +++ b/.gitignore @@ -206,3 +206,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.13.tar.xz.asc /bind-9.18.14.tar.xz /bind-9.18.14.tar.xz.asc +/bind-9.18.15.tar.xz +/bind-9.18.15.tar.xz.asc diff --git a/bind.spec b/bind.spec index a98b535..1a3be30 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.14 +Version: 9.18.15 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed May 17 2023 Petr Menšík - 32:9.18.15-1 +- Update to 9.18.15 (#2207908) + * Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 - Update to 9.18.14 (#2187996) diff --git a/sources b/sources index a2558fe..c6cc47b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969 -SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584 +SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf +SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75 From b1c1dc3b777aa9996f5e7d0dec85000dc83374ba Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 17 May 2023 18:59:49 +0200 Subject: [PATCH 015/144] Update to 9.18.15 (#2207908) https://downloads.isc.org/isc/bind9/9.18.15/doc/arm/html/notes.html#notes-for-bind-9-18-15 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 307b888..af9f0bf 100644 --- a/.gitignore +++ b/.gitignore @@ -206,3 +206,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.13.tar.xz.asc /bind-9.18.14.tar.xz /bind-9.18.14.tar.xz.asc +/bind-9.18.15.tar.xz +/bind-9.18.15.tar.xz.asc diff --git a/bind.spec b/bind.spec index 9f19118..5093894 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.14 +Version: 9.18.15 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed May 17 2023 Petr Menšík - 32:9.18.15-1 +- Update to 9.18.15 (#2207908) + * Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 - Update to 9.18.14 (#2187996) diff --git a/sources b/sources index a2558fe..c6cc47b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.14.tar.xz) = 3dccda83ee4c9fa9fa74232a52d97122bd957e98152a12568a099bcfc2780367f17424702e7e0bff3a1ac427e9b71647eefeb9b4f8d462e27893a057e0a5b969 -SHA512 (bind-9.18.14.tar.xz.asc) = 681ea7d1fd2bbfa195099404aa6a85dd315beba5e3baed59a6945dc9d7afab2c7e8e9efa00422f286e1b9dcf2e8119bc9afa77f9c45c64bec1099fa92c872584 +SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf +SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75 From 7ee174a831674a1abe89a9a3b1ab079b391be18b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 22 Jun 2023 00:34:42 +0200 Subject: [PATCH 016/144] Update to 9.18.16 (#2216462) https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16 Resolves: CVE-2023-2828 CVE-2023-2911 --- .gitignore | 2 ++ bind.spec | 5 ++++- isc-keyblock.asc | 28 ++++++++++++++++++++++++++-- sources | 4 ++-- 4 files changed, 34 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index af9f0bf..a26e0b1 100644 --- a/.gitignore +++ b/.gitignore @@ -208,3 +208,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.14.tar.xz.asc /bind-9.18.15.tar.xz /bind-9.18.15.tar.xz.asc +/bind-9.18.16.tar.xz +/bind-9.18.16.tar.xz.asc diff --git a/bind.spec b/bind.spec index 1a3be30..e52c26f 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.15 +Version: 9.18.16 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 +- Update to 9.18.16 (#2216462) + * Wed May 17 2023 Petr Menšík - 32:9.18.15-1 - Update to 9.18.15 (#2207908) diff --git a/isc-keyblock.asc b/isc-keyblock.asc index 3750f41..876061d 100644 --- a/isc-keyblock.asc +++ b/isc-keyblock.asc @@ -146,6 +146,30 @@ mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9 OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86 857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN -aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8Ng== -=C1ed +aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ +apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB +qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN +Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC +R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV +B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj +7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1 +SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH +1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A +gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0 +h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC +kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp +Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T +gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ +W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w +3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI +4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V +n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX +cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g +3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T +FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX +2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4 +B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx +dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF +rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc= +=NX7P -----END PGP PUBLIC KEY BLOCK----- diff --git a/sources b/sources index c6cc47b..7d07178 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf -SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75 +SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd +SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017 From b5ef622818daf3efec2cfd1581939c5c8e4dd0f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 22 Jun 2023 00:34:42 +0200 Subject: [PATCH 017/144] Update to 9.18.16 (#2216462) https://downloads.isc.org/isc/bind9/9.18.16/doc/arm/html/notes.html#notes-for-bind-9-18-16 Resolves: CVE-2023-2828 CVE-2023-2911 --- .gitignore | 2 ++ bind.spec | 5 ++++- isc-keyblock.asc | 28 ++++++++++++++++++++++++++-- sources | 4 ++-- 4 files changed, 34 insertions(+), 5 deletions(-) diff --git a/.gitignore b/.gitignore index af9f0bf..a26e0b1 100644 --- a/.gitignore +++ b/.gitignore @@ -208,3 +208,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.14.tar.xz.asc /bind-9.18.15.tar.xz /bind-9.18.15.tar.xz.asc +/bind-9.18.16.tar.xz +/bind-9.18.16.tar.xz.asc diff --git a/bind.spec b/bind.spec index 5093894..58ef799 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.15 +Version: 9.18.16 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 +- Update to 9.18.16 (#2216462) + * Wed May 17 2023 Petr Menšík - 32:9.18.15-1 - Update to 9.18.15 (#2207908) diff --git a/isc-keyblock.asc b/isc-keyblock.asc index 3750f41..876061d 100644 --- a/isc-keyblock.asc +++ b/isc-keyblock.asc @@ -146,6 +146,30 @@ mEVyesjYoV40tDCG73qLtfehhV/iARDMCfnZGyGYIZdDBL+tZTNeLKVDIUi/R3x9 OmpEl8ZuCuYltyEsJnCF/rQBVMgcTOmsMu6CMx+qT3kC8iGtHqkUT2ufpKISahTn e329FQjClEWwBHkr0T4K80Z0REjSo6UBtio73IOCxXe0RqO37L/qgo8xKZbLxy86 857PRWJhgbw169FJ2kR5p+M5d/g/MUeYnigvWlORW5LyrFg6RnZ1ZbULZI80QhHN -aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8Ng== -=C1ed +aSFf/w020HBsLCkzWA/XM6MO2ifJTSn8NpkCDQRkSjCrARAApLUMHAbmxUMWLgDQ +apRZBwWXriEyIVqA/SIy1PyWPPFXqs3LZ5Kn5Gw1WO8PfzkPZNtccGmNLjujIoRB +qR41nV5zxcpS896SujBoYl80A4F4v9Op9i2pFeI9r9acFcUDjbGWBqNro4EfRcJN +Ctkd9+pl3TUvFX06QCTxmmHy3M81SW3b4NWI+jia1cKjCd+qBFBgKWdjSMBeVTBC +R9eKqsBQ1UJql2bRzc8pReS+TYCeEbhaOCvUCCKCwGtsSUOW726iNB/4zR4OOuQV +B9ORufwed+E/RXa8N08/l5O96uXG0krJtOVm0/qQcXOaKxiDo6djnAgCdjFK5zaj +7594wqbI7de58alWb/egqIhjBTgk+/cO+epZ05qx5SoJZL7ny2ottrfS2cBqP4g1 +SIt1sYl9ImHmJkNrNDy0s25nE9Nga6OfRqVbwnwot4ouTGwj0oZsCjw+gWjDdztH +1fUWSnlA8jaX9/RZG2wKt9dI+Tp/U4d5dyTb8lIIzzgtAzDmDfPxwwT0rxAAL13A +gDkJ0AzXA4WTOxb/JE2yfCz//kt7n8SYM//LixL4VAB7e/wnfZBhTq0OFpaPjFU0 +h/k0dc40AqcUuK3lSSjQr3KTzRHtjz8qtN4DFSuyZac83QSVtWE1rFKjS8bl3XHC +kFFRJ2dMt2WRSkLOYNiTGbYLvmEAEQEAAbQwQW5kcmVpIFBhdmVsIChDb2RlLVNp +Z25pbmcgS2V5KSA8YW5kcmVpQGlzYy5vcmc+iQJOBBMBCgA4FiEE2mo1COZypJ3T +gq/ZW49NkbiO2QkFAmRKMKsCGwMFCwkIBwMFFQoJCAsFFgIDAQACHgECF4AACgkQ +W49NkbiO2QnQZw//XCpeqT0z/sqtu4FYWwYLz1OvWqhe+uA45f9BccnNSVkGFa7w +3hlLQC/FLUIx2cVy9AluJBP29iQge/bCcXnzo/QvCbhe/4lCTxhr7nsBe1bWpuNI +4Pl+cQxZQBwcz74zZ1jjaaQOqm3XtdZxeKNfCQmNvz389UZEk2m8K6qJD23fy20V +n5Y2C502UuP3MitbYKBxBSbs+Auwy1evz/prQ9VeD4Nv3Zr+jWbWFW+dSDC8jkrX +cGdwWrUQ51QD8VBB9lPWPGY6yTbRmacr4AlVSo2DAfyjHRrGHigRF/VAD5p1+u2g +3UFLJaEyujfzwU1kG4+zQCWZ2W2UBOekklq/yefxEY5vU1/Lad7vQhBmogQNF21T +FvLUE6ez7XNsdMZStDPiT8OoTyFZYLRM4yw5rWKw+1mICBv7NV82YD/8hoMoZPyX +2tNRTXv2MZ6qD++0dMCIZNEyFTB344srvQSyJ7K7vwxulc7iFWngRA8oe6JkAhH4 +B0yNq1FJm6jIL41S2FmnDL3DlfAdKWapBqzgqkv+X5DQBaTlG9a4BcSsdMJgU/Yx +dD03YsKhDtEWTqBmmEamR1K1CgCC3mOJfsHB5z+Qhdraz2hMr00EQrD5lnpLLpcF +rYWoilvVlRy7Y7U5wfhY4074L2ZfB+yElKsvtfGKJX/8g+eJdeRuII+hjEc= +=NX7P -----END PGP PUBLIC KEY BLOCK----- diff --git a/sources b/sources index c6cc47b..7d07178 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.15.tar.xz) = e038574f9c7b1156c8e3049b9b2464421d6d5e53ab09c47dc68d3b66af9cec1eda9f41b2517909573307a5341f8cf14a8c5f5155e8bbfffee4e06ecb61baa8bf -SHA512 (bind-9.18.15.tar.xz.asc) = 282dabb481b3cd9f61cbeddee5cefe0eb6a3a45b6d6b27f789bd34dd175927dcbacbeeb3fe67b21d3666ca591b9608c18a442519b56b921e5b40fba340cf6f75 +SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd +SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017 From 3deb8ee24562356fe231cec9f37d37e3a1cd113a Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 19 Jul 2023 14:36:49 +0000 Subject: [PATCH 018/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild Signed-off-by: Fedora Release Engineering --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index e52c26f..e3b4314 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.16 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Jul 19 2023 Fedora Release Engineering - 32:9.18.16-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + * Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 - Update to 9.18.16 (#2216462) From fc196eb713021be30611b1fa4d254e77ecd829da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 19 Jul 2023 23:47:02 +0200 Subject: [PATCH 019/144] Update to 9.18.17 (#2223913) https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index a26e0b1..d2b5b35 100644 --- a/.gitignore +++ b/.gitignore @@ -210,3 +210,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.15.tar.xz.asc /bind-9.18.16.tar.xz /bind-9.18.16.tar.xz.asc +/bind-9.18.17.tar.xz +/bind-9.18.17.tar.xz.asc diff --git a/bind.spec b/bind.spec index e3b4314..4df5f4c 100644 --- a/bind.spec +++ b/bind.spec @@ -76,8 +76,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.16 -Release: 2%{?dist} +Version: 9.18.17 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 +- Update to 9.18.17 (#2223913) + * Wed Jul 19 2023 Fedora Release Engineering - 32:9.18.16-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild diff --git a/sources b/sources index 7d07178..dbdfccc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd -SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017 +SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe +SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56 From aa29051b02d59594676753f4970dfe5d926b2396 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 19 Jul 2023 23:47:02 +0200 Subject: [PATCH 020/144] Update to 9.18.17 (#2223913) https://downloads.isc.org/isc/bind9/9.18.17/doc/arm/html/notes.html#notes-for-bind-9-18-17 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index a26e0b1..d2b5b35 100644 --- a/.gitignore +++ b/.gitignore @@ -210,3 +210,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.15.tar.xz.asc /bind-9.18.16.tar.xz /bind-9.18.16.tar.xz.asc +/bind-9.18.17.tar.xz +/bind-9.18.17.tar.xz.asc diff --git a/bind.spec b/bind.spec index 58ef799..90c3e34 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.16 +Version: 9.18.17 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 +- Update to 9.18.17 (#2223913) + * Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 - Update to 9.18.16 (#2216462) diff --git a/sources b/sources index 7d07178..dbdfccc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.16.tar.xz) = 90b510552e8fd0c358a627e32bd840eaafc946a2b3c5c4623d0e24aa167fb99aedd91ed19392a104ed5bfce341d9944bab02c680e19d312b59e6688f9546a1fd -SHA512 (bind-9.18.16.tar.xz.asc) = 31f4f2d00975c576d551aa6cbd231ea91022c8d97c23c2341c844744258aec73965b2671e4f6a6bc20cd12e1c4dcca915dde0d99cff9cbb6b449fe23ebb79017 +SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe +SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56 From bd877cd86b926933a8cb285a6056f9a4fc6a6744 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 25 Aug 2023 13:21:19 +0200 Subject: [PATCH 021/144] Add preparation for multi-component shared tests Define explicit component for testing run from this component. Alternative component in fedora is bind9-next --- plans/all.fmf | 2 ++ plans/tier1-public.fmf | 2 ++ 2 files changed, 4 insertions(+) diff --git a/plans/all.fmf b/plans/all.fmf index df1b3e6..03bf500 100644 --- a/plans/all.fmf +++ b/plans/all.fmf @@ -6,3 +6,5 @@ discover: url: https://src.fedoraproject.org/tests/bind.git execute: how: tmt +context: + component: bind diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf index 31400b7..e5b273a 100644 --- a/plans/tier1-public.fmf +++ b/plans/tier1-public.fmf @@ -7,3 +7,5 @@ discover: filter: 'tier: 1' execute: how: tmt +context: + component: bind From 782e6f0ca58724bc95941a72a4be459d33cdc64d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 6 Sep 2023 20:06:06 +0200 Subject: [PATCH 022/144] Update to 9.18.18 (#2232346) https://downloads.isc.org/isc/bind9/9.18.18/doc/arm/html/notes.html#notes-for-bind-9-18-18 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index d2b5b35..0fdf8e7 100644 --- a/.gitignore +++ b/.gitignore @@ -212,3 +212,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.16.tar.xz.asc /bind-9.18.17.tar.xz /bind-9.18.17.tar.xz.asc +/bind-9.18.18.tar.xz +/bind-9.18.18.tar.xz.asc diff --git a/bind.spec b/bind.spec index 4df5f4c..8691bc2 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.17 +Version: 9.18.18 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -962,6 +962,9 @@ fi; %endif %changelog +* Wed Sep 06 2023 Petr Menšík - 32:9.18.18-1 +- Update to 9.18.18 (#2232346) + * Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 - Update to 9.18.17 (#2223913) diff --git a/sources b/sources index dbdfccc..519b6ef 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe -SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56 +SHA512 (bind-9.18.18.tar.xz) = 8d94ec93915c776b9035bce2c3e707c6fb2fa526dbc3b08211c8265daa2c3c88bde51bec08dc416b5b7ba61604754846c4d1efa3f09eebd23847c417c9dc8760 +SHA512 (bind-9.18.18.tar.xz.asc) = f928d702967940f60fd8a0c9e6458f75abaf2f902220094aa0c1df7b158cb22230689c06b987cea3cbe88b0f8847d0bd073fb542730ff0c879086019d2917f32 From 286970af6adc3deb395870b5074763de2065c02c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 22 Sep 2023 20:01:32 +0200 Subject: [PATCH 023/144] Skip failing test on i686 (#2240253) --- bind-9.18-tests-rbtdb_test-i686.patch | 41 +++++++++++++++++++++++++++ bind.spec | 10 ++++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-tests-rbtdb_test-i686.patch diff --git a/bind-9.18-tests-rbtdb_test-i686.patch b/bind-9.18-tests-rbtdb_test-i686.patch new file mode 100644 index 0000000..a709217 --- /dev/null +++ b/bind-9.18-tests-rbtdb_test-i686.patch @@ -0,0 +1,41 @@ +From 37643c9689c2dee85b453879f7145bb393b99dfa Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Fri, 22 Sep 2023 19:54:36 +0200 +Subject: [PATCH] Skip failing tests on 32 platform + +Reported to fail also on 32 bit arm, but skip it only on current builds. +--- + tests/dns/rbtdb_test.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c +index 59a5786..384a26a 100644 +--- a/tests/dns/rbtdb_test.c ++++ b/tests/dns/rbtdb_test.c +@@ -326,6 +326,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) { + isc_mem_destroy(&mctx2); + } + ++#ifndef i386 + ISC_RUN_TEST_IMPL(overmempurge_longname) { + size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */ + size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */ +@@ -370,12 +371,15 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) { + dns_db_detach(&db); + isc_mem_destroy(&mctx2); + } ++#endif + + ISC_TEST_LIST_START + ISC_TEST_ENTRY(ownercase) + ISC_TEST_ENTRY(setownercase) + ISC_TEST_ENTRY(overmempurge_bigrdata) ++#ifndef i386 + ISC_TEST_ENTRY(overmempurge_longname) ++#endif + ISC_TEST_LIST_END + + ISC_TEST_MAIN +-- +2.41.0 + diff --git a/bind.spec b/bind.spec index 8691bc2..e88b33c 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.18 +Version: 9.18.19 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -114,6 +114,8 @@ Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2240253 +Patch27: bind-9.18-tests-rbtdb_test-i686.patch %{?systemd_ordering} Requires: coreutils @@ -962,6 +964,12 @@ fi; %endif %changelog +* Fri Sep 22 2023 Petr Menšík - 32:9.18.19-1 +- Update to 9.18.19 (#2232346) + +* Fri Sep 22 2023 Petr Menšík - 32:9.18.18-2 +- Skip failing rbtdb_test unit test on i686 (#2240253) + * Wed Sep 06 2023 Petr Menšík - 32:9.18.18-1 - Update to 9.18.18 (#2232346) From d03e0852a993f2b23e44d2c7ab753b6e919c4e87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 22 Sep 2023 20:18:07 +0200 Subject: [PATCH 024/144] Update to 9.18.19 (#2232346) https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-bind-9-18-19 Resolves: CVE-2023-3341 CVE-2023-4236 --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index 0fdf8e7..20245ab 100644 --- a/.gitignore +++ b/.gitignore @@ -214,3 +214,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.17.tar.xz.asc /bind-9.18.18.tar.xz /bind-9.18.18.tar.xz.asc +/bind-9.18.19.tar.xz +/bind-9.18.19.tar.xz.asc diff --git a/sources b/sources index 519b6ef..cc18249 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.18.tar.xz) = 8d94ec93915c776b9035bce2c3e707c6fb2fa526dbc3b08211c8265daa2c3c88bde51bec08dc416b5b7ba61604754846c4d1efa3f09eebd23847c417c9dc8760 -SHA512 (bind-9.18.18.tar.xz.asc) = f928d702967940f60fd8a0c9e6458f75abaf2f902220094aa0c1df7b158cb22230689c06b987cea3cbe88b0f8847d0bd073fb542730ff0c879086019d2917f32 +SHA512 (bind-9.18.19.tar.xz) = 51af9a246f23afc9ac9a1ef2d793bc91f43fe835b6c4101ad557799ee3aa4253bd12b2f12d9d101c1ce616e2a852a42c5567b031adaaaf06677fcc11c98cf393 +SHA512 (bind-9.18.19.tar.xz.asc) = 3903ff0cf9af09c111572677eb9b2707aa253cf59ed22e67c7a2272ab10087ef8a2bb54b15286f86035e59a5bef02fee01e17cef71c5f8f7a38ce8ec7e1b01a3 From 6fb5cf0d21b10de761c1d31a245be3dff2963aa4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 22 Sep 2023 20:01:32 +0200 Subject: [PATCH 025/144] Skip failing test on i686 (#2240253) --- bind-9.18-tests-rbtdb_test-i686.patch | 41 +++++++++++++++++++++++++++ bind.spec | 10 ++++++- 2 files changed, 50 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-tests-rbtdb_test-i686.patch diff --git a/bind-9.18-tests-rbtdb_test-i686.patch b/bind-9.18-tests-rbtdb_test-i686.patch new file mode 100644 index 0000000..a709217 --- /dev/null +++ b/bind-9.18-tests-rbtdb_test-i686.patch @@ -0,0 +1,41 @@ +From 37643c9689c2dee85b453879f7145bb393b99dfa Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Fri, 22 Sep 2023 19:54:36 +0200 +Subject: [PATCH] Skip failing tests on 32 platform + +Reported to fail also on 32 bit arm, but skip it only on current builds. +--- + tests/dns/rbtdb_test.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c +index 59a5786..384a26a 100644 +--- a/tests/dns/rbtdb_test.c ++++ b/tests/dns/rbtdb_test.c +@@ -326,6 +326,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) { + isc_mem_destroy(&mctx2); + } + ++#ifndef i386 + ISC_RUN_TEST_IMPL(overmempurge_longname) { + size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */ + size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */ +@@ -370,12 +371,15 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) { + dns_db_detach(&db); + isc_mem_destroy(&mctx2); + } ++#endif + + ISC_TEST_LIST_START + ISC_TEST_ENTRY(ownercase) + ISC_TEST_ENTRY(setownercase) + ISC_TEST_ENTRY(overmempurge_bigrdata) ++#ifndef i386 + ISC_TEST_ENTRY(overmempurge_longname) ++#endif + ISC_TEST_LIST_END + + ISC_TEST_MAIN +-- +2.41.0 + diff --git a/bind.spec b/bind.spec index 90c3e34..a1d1724 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.17 +Version: 9.18.19 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -114,6 +114,8 @@ Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2240253 +Patch27: bind-9.18-tests-rbtdb_test-i686.patch %{?systemd_ordering} Requires: coreutils @@ -962,6 +964,12 @@ fi; %endif %changelog +* Fri Sep 22 2023 Petr Menšík - 32:9.18.19-1 +- Update to 9.18.19 (#2232346) + +* Fri Sep 22 2023 Petr Menšík - 32:9.18.18-2 +- Skip failing rbtdb_test unit test on i686 (#2240253) + * Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 - Update to 9.18.17 (#2223913) From 554b5e36e6d3c689c18c01dcacc9ded2ce78dd7f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 22 Sep 2023 20:18:07 +0200 Subject: [PATCH 026/144] Update to 9.18.19 (#2232346) https://downloads.isc.org/isc/bind9/9.18.19/doc/arm/html/notes.html#notes-for-bind-9-18-19 Resolves: CVE-2023-3341 CVE-2023-4236 --- .gitignore | 2 ++ sources | 4 ++-- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/.gitignore b/.gitignore index d2b5b35..a32e0cd 100644 --- a/.gitignore +++ b/.gitignore @@ -212,3 +212,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.16.tar.xz.asc /bind-9.18.17.tar.xz /bind-9.18.17.tar.xz.asc +/bind-9.18.19.tar.xz +/bind-9.18.19.tar.xz.asc diff --git a/sources b/sources index dbdfccc..cc18249 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.17.tar.xz) = d4843a864c012c7fa3c276a0d304b3d8184cb9c2c80f4a8bb55178ff654fba1f244b39f38a8ac4fe7ca0e68722a539bccb80f896d1c18946ab6540d4a57d3abe -SHA512 (bind-9.18.17.tar.xz.asc) = 13b0baa4d18bf644f40863482be28711d57b46c742a15a99569ab272d45ecb8af5e9302f20e04615954532f6d07abd8e0e0b9bfabf8754123365d942fe4f8b56 +SHA512 (bind-9.18.19.tar.xz) = 51af9a246f23afc9ac9a1ef2d793bc91f43fe835b6c4101ad557799ee3aa4253bd12b2f12d9d101c1ce616e2a852a42c5567b031adaaaf06677fcc11c98cf393 +SHA512 (bind-9.18.19.tar.xz.asc) = 3903ff0cf9af09c111572677eb9b2707aa253cf59ed22e67c7a2272ab10087ef8a2bb54b15286f86035e59a5bef02fee01e17cef71c5f8f7a38ce8ec7e1b01a3 From 00135d6b207d17ae97d0437c39762b30f813db6e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 16 Nov 2023 15:58:46 +0100 Subject: [PATCH 027/144] Update to 9.18.20 (#2249835) - B.ROOT-SERVERS.NET address update - lock-file fixes https://downloads.isc.org/isc/bind9/9.18.20/doc/arm/html/notes.html#notes-for-bind-9-18-20 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 20245ab..9916d69 100644 --- a/.gitignore +++ b/.gitignore @@ -216,3 +216,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.18.tar.xz.asc /bind-9.18.19.tar.xz /bind-9.18.19.tar.xz.asc +/bind-9.18.20.tar.xz +/bind-9.18.20.tar.xz.asc diff --git a/bind.spec b/bind.spec index e88b33c..3408c6c 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.19 +Version: 9.18.20 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -964,6 +964,9 @@ fi; %endif %changelog +* Thu Nov 16 2023 Petr Menšík - 32:9.18.20-1 +- Update to 9.18.20 (#2249835) + * Fri Sep 22 2023 Petr Menšík - 32:9.18.19-1 - Update to 9.18.19 (#2232346) diff --git a/sources b/sources index cc18249..549d8ab 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.19.tar.xz) = 51af9a246f23afc9ac9a1ef2d793bc91f43fe835b6c4101ad557799ee3aa4253bd12b2f12d9d101c1ce616e2a852a42c5567b031adaaaf06677fcc11c98cf393 -SHA512 (bind-9.18.19.tar.xz.asc) = 3903ff0cf9af09c111572677eb9b2707aa253cf59ed22e67c7a2272ab10087ef8a2bb54b15286f86035e59a5bef02fee01e17cef71c5f8f7a38ce8ec7e1b01a3 +SHA512 (bind-9.18.20.tar.xz) = 1ad89e5aa3d83a3c6536c2931e2ecdf6aca0d9d2678cf45dca8b0fb37968f7ef7aedff5d351083e6b09aeee1329b8885fd06263b21f5ebcde959ef0d84a86ffb +SHA512 (bind-9.18.20.tar.xz.asc) = 9e8170fb5aacb8ea3c5c5512bd18ba8739c72df1416551493d8098427c7a9b1756ffb7ce7c93bbf43d1caed6e39ecf839eac15041de37ac0a89623b79b9281a7 From db9d0ed8b69755715645e8afb6a081402605e5de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Jan 2024 16:51:36 +0100 Subject: [PATCH 028/144] Update to 9.18.21 https://downloads.isc.org/isc/bind9/9.18.21/doc/arm/html/notes.html#notes-for-bind-9-18-21 Removed Features - Support for using AES as the DNS COOKIE algorithm (cookie-algorithm aes;) has been deprecated and will be removed in a future release. Please use the current default, SipHash-2-4, instead. [GL #4421] - The resolver-nonbackoff-tries and resolver-retry-interval statements have been deprecated. Using them now causes a warning to be logged. [GL #4405] --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9916d69..907f352 100644 --- a/.gitignore +++ b/.gitignore @@ -218,3 +218,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.19.tar.xz.asc /bind-9.18.20.tar.xz /bind-9.18.20.tar.xz.asc +/bind-9.18.21.tar.xz +/bind-9.18.21.tar.xz.asc diff --git a/bind.spec b/bind.spec index 3408c6c..c8a6a36 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.20 +Version: 9.18.21 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -964,6 +964,9 @@ fi; %endif %changelog +* Mon Jan 15 2024 Petr Menšík - 32:9.18.21-1 +- Update to 9.18.21 (#2255407) + * Thu Nov 16 2023 Petr Menšík - 32:9.18.20-1 - Update to 9.18.20 (#2249835) diff --git a/sources b/sources index 549d8ab..0b5b7ad 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.20.tar.xz) = 1ad89e5aa3d83a3c6536c2931e2ecdf6aca0d9d2678cf45dca8b0fb37968f7ef7aedff5d351083e6b09aeee1329b8885fd06263b21f5ebcde959ef0d84a86ffb -SHA512 (bind-9.18.20.tar.xz.asc) = 9e8170fb5aacb8ea3c5c5512bd18ba8739c72df1416551493d8098427c7a9b1756ffb7ce7c93bbf43d1caed6e39ecf839eac15041de37ac0a89623b79b9281a7 +SHA512 (bind-9.18.21.tar.xz) = 3cbc1775b6ca3d5eda0c277ab1246b5baa535dac53df3e60690aa7a2529bcb0fb644f7749b21b757870e5b3bc5f53ae9f0c0db182664de1b23f7e62c3fa8757d +SHA512 (bind-9.18.21.tar.xz.asc) = 1afa22dddb5d6c42e2dea2369cc048d548ad86e3d215c692320716488419c012ac849f1699d61451353574ec4621fc93f7111658e9de7fa286336d97e33d5de6 From 7a039e1831f1d717477ff040c2ad335cc7c088de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Jan 2024 16:55:15 +0100 Subject: [PATCH 029/144] Revert Skip failing test on i686 (#2240253) Selective revert removing the patch, but keeping changelog. --- bind-9.18-tests-rbtdb_test-i686.patch | 41 --------------------------- bind.spec | 2 -- 2 files changed, 43 deletions(-) delete mode 100644 bind-9.18-tests-rbtdb_test-i686.patch diff --git a/bind-9.18-tests-rbtdb_test-i686.patch b/bind-9.18-tests-rbtdb_test-i686.patch deleted file mode 100644 index a709217..0000000 --- a/bind-9.18-tests-rbtdb_test-i686.patch +++ /dev/null @@ -1,41 +0,0 @@ -From 37643c9689c2dee85b453879f7145bb393b99dfa Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Fri, 22 Sep 2023 19:54:36 +0200 -Subject: [PATCH] Skip failing tests on 32 platform - -Reported to fail also on 32 bit arm, but skip it only on current builds. ---- - tests/dns/rbtdb_test.c | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/tests/dns/rbtdb_test.c b/tests/dns/rbtdb_test.c -index 59a5786..384a26a 100644 ---- a/tests/dns/rbtdb_test.c -+++ b/tests/dns/rbtdb_test.c -@@ -326,6 +326,7 @@ ISC_RUN_TEST_IMPL(overmempurge_bigrdata) { - isc_mem_destroy(&mctx2); - } - -+#ifndef i386 - ISC_RUN_TEST_IMPL(overmempurge_longname) { - size_t maxcache = 2097152U; /* 2MB - same as DNS_CACHE_MINSIZE */ - size_t hiwater = maxcache - (maxcache >> 3); /* borrowed from cache.c */ -@@ -370,12 +371,15 @@ ISC_RUN_TEST_IMPL(overmempurge_longname) { - dns_db_detach(&db); - isc_mem_destroy(&mctx2); - } -+#endif - - ISC_TEST_LIST_START - ISC_TEST_ENTRY(ownercase) - ISC_TEST_ENTRY(setownercase) - ISC_TEST_ENTRY(overmempurge_bigrdata) -+#ifndef i386 - ISC_TEST_ENTRY(overmempurge_longname) -+#endif - ISC_TEST_LIST_END - - ISC_TEST_MAIN --- -2.41.0 - diff --git a/bind.spec b/bind.spec index c8a6a36..ac7d94d 100644 --- a/bind.spec +++ b/bind.spec @@ -114,8 +114,6 @@ Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch -# https://bugzilla.redhat.com/show_bug.cgi?id=2240253 -Patch27: bind-9.18-tests-rbtdb_test-i686.patch %{?systemd_ordering} Requires: coreutils From 9899e74f4da0b423440978534cc49e26b265fc5b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 16 Jan 2024 11:14:58 +0100 Subject: [PATCH 030/144] Update changed b.root-servers.net address in hints (#2253460) --- bind.spec | 5 ++++- named.root | 10 +++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/bind.spec b/bind.spec index ac7d94d..2f5ce9b 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.21 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Tue Jan 16 2024 Petr Menšík - 32:9.18.21-2 +- Update changed b.root-servers.net address in hints (#2253460) + * Mon Jan 15 2024 Petr Menšík - 32:9.18.21-1 - Update to 9.18.21 (#2255407) diff --git a/named.root b/named.root index cd808e8..8b8a3b1 100644 --- a/named.root +++ b/named.root @@ -8,9 +8,9 @@ ; file /domain/named.cache ; on server FTP.INTERNIC.NET ; -OR- RS.INTERNIC.NET -; -; last update: June 24, 2021 -; related version of root zone: 2021062401 +; +; last update: December 20, 2023 +; related version of root zone: 2023122001 ; ; FORMERLY NS.INTERNIC.NET ; @@ -21,8 +21,8 @@ A.ROOT-SERVERS.NET. 3600000 AAAA 2001:503:ba3e::2:30 ; FORMERLY NS1.ISI.EDU ; . 3600000 NS B.ROOT-SERVERS.NET. -B.ROOT-SERVERS.NET. 3600000 A 199.9.14.201 -B.ROOT-SERVERS.NET. 3600000 AAAA 2001:500:200::b +B.ROOT-SERVERS.NET. 3600000 A 170.247.170.2 +B.ROOT-SERVERS.NET. 3600000 AAAA 2801:1b8:10::b ; ; FORMERLY C.PSI.NET ; From 5e93e0b0789f4175b16109a3d5030d10d7be0583 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 19 Jan 2024 14:23:22 +0000 Subject: [PATCH 031/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 2f5ce9b..a6823c0 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.21 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Fri Jan 19 2024 Fedora Release Engineering - 32:9.18.21-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Tue Jan 16 2024 Petr Menšík - 32:9.18.21-2 - Update changed b.root-servers.net address in hints (#2253460) From 59820e13a52724d2f77d2ae604933ef9ce1a9c85 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Tue, 23 Jan 2024 00:22:04 +0000 Subject: [PATCH 032/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index a6823c0..591c8e3 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.21 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Tue Jan 23 2024 Fedora Release Engineering - 32:9.18.21-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + * Fri Jan 19 2024 Fedora Release Engineering - 32:9.18.21-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild From fcaee16034a3042e67d405c1759c7971fc0c5d87 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 15 Feb 2024 20:55:55 +0100 Subject: [PATCH 033/144] Update to BIND 9.18.24 https://downloads.isc.org/isc/bind9/9.18.24/doc/arm/html/notes.html#notes-for-bind-9-18-24 Resolves: CVE-2023-4408 CVE-2023-5517 CVE-2023-5679 CVE-2023-6516 CVE-2023-50387 CVE-2023-50868 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 907f352..9444f7f 100644 --- a/.gitignore +++ b/.gitignore @@ -220,3 +220,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.20.tar.xz.asc /bind-9.18.21.tar.xz /bind-9.18.21.tar.xz.asc +/bind-9.18.24.tar.xz +/bind-9.18.24.tar.xz.asc diff --git a/bind.spec b/bind.spec index 591c8e3..f781fbe 100644 --- a/bind.spec +++ b/bind.spec @@ -76,8 +76,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.21 -Release: 4%{?dist} +Version: 9.18.24 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -962,6 +962,9 @@ fi; %endif %changelog +* Thu Feb 15 2024 Petr Menšík - 32:9.18.24-1 +- Update to 9.18.24 (#2264032) + * Tue Jan 23 2024 Fedora Release Engineering - 32:9.18.21-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild diff --git a/sources b/sources index 0b5b7ad..07cff5c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.21.tar.xz) = 3cbc1775b6ca3d5eda0c277ab1246b5baa535dac53df3e60690aa7a2529bcb0fb644f7749b21b757870e5b3bc5f53ae9f0c0db182664de1b23f7e62c3fa8757d -SHA512 (bind-9.18.21.tar.xz.asc) = 1afa22dddb5d6c42e2dea2369cc048d548ad86e3d215c692320716488419c012ac849f1699d61451353574ec4621fc93f7111658e9de7fa286336d97e33d5de6 +SHA512 (bind-9.18.24.tar.xz) = 465f5b01570fdde5c95adfb780f54e0585814bd25baf914bb95bf5972f15a672e3e7b743a55f1804e69e17609d5a0cd66cc2bbab9174238b3c89e5ad732dc085 +SHA512 (bind-9.18.24.tar.xz.asc) = ee16356b2f523bea1a98fb74216aafa134af3dca42e64438f1c89d8a971919614274af316a170ff9d6f952a5101f44ec1f9fe2c460de42797b06a361c994fb6d From e79cdb27f2e4016952d8b1f16dfc715e51734f74 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 19 Feb 2024 22:26:20 +0100 Subject: [PATCH 034/144] Include dependency on python3-dns from SYSTEMTEST suite --- bind.spec | 1 + 1 file changed, 1 insertion(+) diff --git a/bind.spec b/bind.spec index f781fbe..75d00c8 100644 --- a/bind.spec +++ b/bind.spec @@ -151,6 +151,7 @@ BuildRequires: softhsm %if %{with SYSTEMTEST} # bin/tests/system dependencies BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) +BuildRequires: python3-dns # manual configuration requires this tool BuildRequires: iproute %endif From 91d60335005d38c4fa34b1cc3c835a0ec15983ed Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Fri, 12 Apr 2024 18:07:33 +0200 Subject: [PATCH 035/144] Fix build and installation when %_bindir==%_sbindir Preparation for https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin. No change in builds with unmerged sbin. --- bind.spec | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/bind.spec b/bind.spec index 75d00c8..503dcec 100644 --- a/bind.spec +++ b/bind.spec @@ -570,13 +570,10 @@ mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files -pushd ${RPM_BUILD_ROOT}%{_sbindir} +%if "%{_sbindir}" != "%{_bindir}" # Compatibility with previous major versions, only for selected binaries -for BIN in named-checkconf named-checkzone named-compilezone -do - ln -s ../bin/$BIN $BIN -done -popd +ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/ +%endif %if %{with DLZ} pushd build @@ -784,7 +781,9 @@ fi; %{_bindir}/mdig %{_sbindir}/named %{_sbindir}/rndc* +%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf +%endif %{_libexecdir}/generate-rndc-key.sh %{_libexecdir}/setup-named-softhsm.sh %{_mandir}/man1/mdig.1* @@ -850,8 +849,10 @@ fi; %{_bindir}/nsec3hash %{_bindir}/named-checkzone %{_bindir}/named-compilezone +%if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkzone %{_sbindir}/named-compilezone +%endif %if %{with DNSTAP} %{_bindir}/dnstap-read %{_mandir}/man1/dnstap-read.1* From 283878c63d1e5627f2fe5b608b8259f0433cd409 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 22 Apr 2024 12:13:52 +0200 Subject: [PATCH 036/144] Update to 9.18.26 (rhbz#2270476) New Features - The statistics channel now includes counters that indicate the number of currently connected TCP IPv4/IPv6 clients. [GL #4425] - Added RESOLVER.ARPA to the built in empty zones. [GL #4580] And bug fixes https://downloads.isc.org/isc/bind9/9.18.26/doc/arm/html/notes.html#notes-for-bind-9-18-26 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index 9444f7f..8813adc 100644 --- a/.gitignore +++ b/.gitignore @@ -222,3 +222,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.21.tar.xz.asc /bind-9.18.24.tar.xz /bind-9.18.24.tar.xz.asc +/bind-9.18.26.tar.xz +/bind-9.18.26.tar.xz.asc diff --git a/bind.spec b/bind.spec index 503dcec..0c88955 100644 --- a/bind.spec +++ b/bind.spec @@ -76,7 +76,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.24 +Version: 9.18.26 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -964,6 +964,9 @@ fi; %endif %changelog +* Mon Apr 22 2024 Petr Menšík - 32:9.18.26-1 +- Update to 9.18.26 (rhbz#2270476) + * Thu Feb 15 2024 Petr Menšík - 32:9.18.24-1 - Update to 9.18.24 (#2264032) diff --git a/sources b/sources index 07cff5c..e87d974 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.24.tar.xz) = 465f5b01570fdde5c95adfb780f54e0585814bd25baf914bb95bf5972f15a672e3e7b743a55f1804e69e17609d5a0cd66cc2bbab9174238b3c89e5ad732dc085 -SHA512 (bind-9.18.24.tar.xz.asc) = ee16356b2f523bea1a98fb74216aafa134af3dca42e64438f1c89d8a971919614274af316a170ff9d6f952a5101f44ec1f9fe2c460de42797b06a361c994fb6d +SHA512 (bind-9.18.26.tar.xz) = 517951bd462aff206706a4bbae3ef917299f90af361fb931a50d2340f0580010b8a0eedce1d4e8c99e99389fc44d71221b907e30d91be0d398acbe29688d6e55 +SHA512 (bind-9.18.26.tar.xz.asc) = f310613ec1681a0041c6528081eae2a2e02c12514f7adffd339a62929c78afacaa53cb21b126220007cea56c7748a3ea808a0db6ecdbed9502daee9608407438 From 3a874644a6a8d42790fecb18d39e2676fe45be63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 12:51:00 +0200 Subject: [PATCH 037/144] Rebuilt for the bin-sbin merge https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 0c88955..7aaf721 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.26 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -964,6 +964,9 @@ fi; %endif %changelog +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 32:9.18.26-2 +- Rebuilt for the bin-sbin merge + * Mon Apr 22 2024 Petr Menšík - 32:9.18.26-1 - Update to 9.18.26 (rhbz#2270476) From 741c22ffcd5453dd8fe0eafbee6938ceebe1f0ad Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 9 Jul 2024 14:36:09 +0200 Subject: [PATCH 038/144] Pull in openssl-devel-engine to fix build --- bind.spec | 3 +++ 1 file changed, 3 insertions(+) diff --git a/bind.spec b/bind.spec index 7aaf721..73efcc5 100644 --- a/bind.spec +++ b/bind.spec @@ -128,6 +128,9 @@ Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 BuildRequires: gcc, make BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel +%if 0%{?fedora} >= 41 +BuildRequires: openssl-devel-engine +%endif BuildRequires: libidn2-devel, libxml2-devel BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy From 245d49eb176c36cd7695b63c3343e8eedde89264 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 17 Jul 2024 18:17:04 +0000 Subject: [PATCH 039/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 73efcc5..0f9fa65 100644 --- a/bind.spec +++ b/bind.spec @@ -77,7 +77,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 Version: 9.18.26 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -967,6 +967,9 @@ fi; %endif %changelog +* Wed Jul 17 2024 Fedora Release Engineering - 32:9.18.26-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + * Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 32:9.18.26-2 - Rebuilt for the bin-sbin merge From 41715d279a7c9a8d9ceb992a60808ff34704b3e9 Mon Sep 17 00:00:00 2001 From: Jonathan Wright Date: Fri, 26 Jul 2024 11:11:36 -0500 Subject: [PATCH 040/144] update to 9.18.28 rhbz#2299467 Fixes CVE-2024-4076 Fixes CVE-2024-1975 Fixes CVE-2024-1737 Fixes CVE-2024-0760 --- .gitignore | 2 ++ bind.spec | 11 +++++++++-- sources | 4 ++-- 3 files changed, 13 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 8813adc..22659a3 100644 --- a/.gitignore +++ b/.gitignore @@ -224,3 +224,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.24.tar.xz.asc /bind-9.18.26.tar.xz /bind-9.18.26.tar.xz.asc +/bind-9.18.28.tar.xz +/bind-9.18.28.tar.xz.asc diff --git a/bind.spec b/bind.spec index 0f9fa65..beae5d4 100644 --- a/bind.spec +++ b/bind.spec @@ -76,8 +76,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 -Version: 9.18.26 -Release: 3%{?dist} +Version: 9.18.28 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -967,6 +967,13 @@ fi; %endif %changelog +* Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 +- update to 9.18.28 rhbz#2299467 +- Fixes CVE-2024-4076 +- Fixes CVE-2024-1975 +- Fixes CVE-2024-1737 +- Fixes CVE-2024-0760 + * Wed Jul 17 2024 Fedora Release Engineering - 32:9.18.26-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild diff --git a/sources b/sources index e87d974..704a085 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.26.tar.xz) = 517951bd462aff206706a4bbae3ef917299f90af361fb931a50d2340f0580010b8a0eedce1d4e8c99e99389fc44d71221b907e30d91be0d398acbe29688d6e55 -SHA512 (bind-9.18.26.tar.xz.asc) = f310613ec1681a0041c6528081eae2a2e02c12514f7adffd339a62929c78afacaa53cb21b126220007cea56c7748a3ea808a0db6ecdbed9502daee9608407438 +SHA512 (bind-9.18.28.tar.xz) = 19ba625f155c60dd821e3afe52adf3897b3e81289320282b3f43d604af1e7d4e67fafb98a9849782684935008bcd148f190e05234d501aa056daa6724e0119bb +SHA512 (bind-9.18.28.tar.xz.asc) = e6efe2a9995cabd70c1d2e8e4cb97a9a146e3289d75cfdc81ff8052329db3dd920b9f8f6ad0f1552a0e4e776b01fb077edd5f3d4ea3461952f71dda64574d640 From 8346c4c3cd8d97f2c75d7a81276d95e25ce43bae Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 31 Jul 2024 18:42:05 +0200 Subject: [PATCH 041/144] Warn both in README and spec rebase is not simple bind-libs are needed by bind-dyndb-ldap, but symbol exported by bind-libs changes with every rebase. Make it more obvious to external people. --- README.md | 7 +++++++ bind.spec | 3 +++ 2 files changed, 10 insertions(+) diff --git a/README.md b/README.md index 42aad62..773d2cb 100644 --- a/README.md +++ b/README.md @@ -14,6 +14,13 @@ More details about upstream project can be found on their only upstream sources and packaging instructions for [Fedora Project](https://fedoraproject.org). +Any rebase requires to be built together with +[bind-dyndb-ldap](https://src.fedoraproject.org/rpms/bind-dyndb-ldap/) to prevent conflict +at installation of [freeipa-server-dns](https://src.fedoraproject.org/rpms/freeipa). +Stable bodhi updates are checked, but rawhide are not checked explicitly. +Symbol of libraries in *bind-libs* changes with every minor version change of bind, +therefore they break any package dependent on bind-libs. + ## Subpackages The package contains several subpackages, some of them can be disabled on rebuild. diff --git a/bind.spec b/bind.spec index beae5d4..24b621c 100644 --- a/bind.spec +++ b/bind.spec @@ -76,6 +76,9 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # ./lib/isc/string.c BSD-3-clause and/or MPL-2.0 # ./lib/isc/tm.c BSD-2-clause and/or MPL-2.0 # ./lib/isccfg/parser.c BSD-2-clause and/or MPL-2.0 +# +# Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. +# Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.28 Release: 1%{?dist} Epoch: 32 From 2616681202944a27806b03d9bb2315ed6dc794c2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 19 Jun 2024 20:36:47 +0200 Subject: [PATCH 042/144] Conflict explicitly with more bind subpackages List conflicts for each package explicitly, if it should conflict. --- bind.spec | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index 24b621c..8f32e2c 100644 --- a/bind.spec +++ b/bind.spec @@ -8,8 +8,10 @@ %bcond_with SYSTEMTEST %bcond_without GSSTSIG %bcond_without JSON +%if ! 0%{?rhel} # FIXME: Not ready. Should it be worked on? %bcond_without DLZ +%endif # New MaxMind GeoLite support %bcond_without GEOIP2 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779 @@ -52,10 +54,10 @@ # Upstream package name %global upname bind +# Epoch is intentionally missing from Provides to be lower than bind package %define upname_compat() \ %if "%{name}" != "%{upname}" \ -Provides: %1 = %{epoch}:%{version}-%{release} \ -Obsoletes: %1 < 32:9.17.0 \ +Provides: %1 = %{version}-%{release} \ Conflicts: %1 \ %endif @@ -80,7 +82,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.28 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -126,7 +128,7 @@ Requires(post): glibc-common Requires(post): grep Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils -%upname_compat %{upname} +%upname_compat %{upname} Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 BuildRequires: gcc, make @@ -255,6 +257,7 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} +%upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: krb5-devel%{?_isa} %endif @@ -282,6 +285,10 @@ Prefix: %{chroot_prefix} # grep is required due to setup-named-chroot.sh script Requires: grep Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} +%upname_compat %{upname}-chroot +%if "%{name}" != "%{upname}" +Conflicts: %{upname}-sdb-chroot +%endif %description chroot This package contains a tree of files which can be used as a @@ -970,6 +977,9 @@ fi; %endif %changelog +* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 +- Conflict explicitly with more bind subpackages + * Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 - update to 9.18.28 rhbz#2299467 - Fixes CVE-2024-4076 From bdfa7b950b427df26038f53402fd512f47d81702 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 19 Jun 2024 20:41:31 +0200 Subject: [PATCH 043/144] Remove separate license subpackage Move license to libs subpackage, it is required for everything except documentation. Include license file in docs and bind-libs, avoid extra package just for single file. --- bind.spec | 15 ++++----------- 1 file changed, 4 insertions(+), 11 deletions(-) diff --git a/bind.spec b/bind.spec index 8f32e2c..62a520f 100644 --- a/bind.spec +++ b/bind.spec @@ -200,22 +200,16 @@ tools for verifying that the DNS server is operating properly. %package libs Summary: Libraries used by the BIND DNS packages -Requires: %{name}-license = %{epoch}:%{version}-%{release} +Provides: %{name}-license = %{epoch}:%{version}-%{release} Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release} Obsoletes: %{name}-libs-lite < 32:9.16.13 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 +Obsoletes: %{name}-license < 32:9.18.27-2 %description libs Contains heavyweight version of BIND suite libraries used by both named DNS server and utilities in %{name}-utils package. -%package license -Summary: License of the BIND DNS suite -BuildArch:noarch - -%description license -Contains license of the BIND DNS suite. - %package utils Summary: Utilities for querying DNS name servers Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} @@ -332,7 +326,6 @@ Dynamic Loadable Zones sqlite3 module for BIND server. %if %{with DOC} %package doc Summary: BIND 9 Administrator Reference Manual -Requires: %{name}-license = %{epoch}:%{version}-%{release} Requires: python3-sphinx_rtd_theme BuildArch: noarch @@ -845,8 +838,6 @@ fi; %{_libdir}/libirs-%{version}*.so %{_libdir}/libisc-%{version}*.so %{_libdir}/libisccfg-%{version}*.so - -%files license %{!?_licensedir:%global license %%doc} %license COPYRIGHT @@ -971,6 +962,7 @@ fi; %dir %{_pkgdocdir} %doc %{_pkgdocdir}/html %doc %{_pkgdocdir}/Bv9ARM.html +%license COPYRIGHT %endif %if %{with DOCPDF} %doc %{_pkgdocdir}/Bv9ARM.pdf @@ -979,6 +971,7 @@ fi; %changelog * Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 - Conflict explicitly with more bind subpackages +- Merge license subpackage into libs * Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 - update to 9.18.28 rhbz#2299467 From 401d76d40df9e8f50c87b17e7588adeda4fe171d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 9 Jul 2024 14:09:06 +0200 Subject: [PATCH 044/144] Add optional QUERYTRACE feature --- bind.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/bind.spec b/bind.spec index 62a520f..dca1685 100644 --- a/bind.spec +++ b/bind.spec @@ -28,6 +28,8 @@ %bcond_without DOCPDF %endif %bcond_with TSAN +# Add experimental extra verbose logging of query processing +%bcond_with QUERYTRACE %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -377,6 +379,9 @@ CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100" %if %{with TSAN} CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie" %endif +%if %{with QUERYTRACE} + CFLAGS+=" -DWANT_QUERYTRACE" +%endif export CFLAGS CPPFLAGS export STD_CDEFINES="$CPPFLAGS" @@ -972,6 +977,7 @@ fi; * Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 - Conflict explicitly with more bind subpackages - Merge license subpackage into libs +- Add optional QUERYTRACE feature * Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 - update to 9.18.28 rhbz#2299467 From 9149d53bb7dba08ba0ed30884af91e3e197ed983 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 7 Jun 2024 17:57:17 +0200 Subject: [PATCH 045/144] Make documentation links relative Do not require absolute paths, but use relative links even to non-existent buildroot subdirectory. It should compute it correctly. --- bind.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index dca1685..0c67061 100644 --- a/bind.spec +++ b/bind.spec @@ -634,7 +634,7 @@ do BINDTHEMEDIR="${RPM_BUILD_ROOT}%{_pkgdocdir}/html/_static/$BASE" if [ -d "$BINDTHEMEDIR" ]; then rm -rf "$BINDTHEMEDIR" - ln -s "$DIR" "$BINDTHEMEDIR" + ln -sr "${RPM_BUILD_ROOT}${DIR}" "$BINDTHEMEDIR" fi done %endif @@ -978,6 +978,7 @@ fi; - Conflict explicitly with more bind subpackages - Merge license subpackage into libs - Add optional QUERYTRACE feature +- Make relative documentation links * Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 - update to 9.18.28 rhbz#2299467 From b57d168db4a61c6a926ecb408bedea4202b1571b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 31 Jul 2024 22:45:53 +0200 Subject: [PATCH 046/144] Drop PostgreSQL dependencies not used by DLZ anymore --- bind.spec | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index 0c67061..d298983 100644 --- a/bind.spec +++ b/bind.spec @@ -84,7 +84,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.28 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -149,7 +149,9 @@ BuildRequires: gnupg2 %endif BuildRequires: libuv-devel %if %{with DLZ} -BuildRequires: openldap-devel, libpq-devel, sqlite-devel, mariadb-connector-c-devel +BuildRequires: openldap-devel +BuildRequires: sqlite-devel +BuildRequires: mariadb-connector-c-devel %endif %if %{with UNITTEST} # make unit dependencies @@ -974,6 +976,9 @@ fi; %endif %changelog +* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-3 +- Drop PostgreSQL dependencies not used by DLZ anymore + * Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 - Conflict explicitly with more bind subpackages - Merge license subpackage into libs From 109d2c0507986c5342ae97fcee22854b3683bfba Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Thu, 12 Sep 2024 15:20:58 -0400 Subject: [PATCH 047/144] Fix build with OPENSSL_NO_ENGINE Most ENGINE-related includes and code are already so guarded, this fixes the last unguarded cases, and allows bind to build without openssl-devel-engine (e.g. in RHEL 10 and ELN). --- bind-9.18-openssl-no-engine.patch | 28 ++++++++++++++++++++++++++++ bind.spec | 2 ++ 2 files changed, 30 insertions(+) create mode 100644 bind-9.18-openssl-no-engine.patch diff --git a/bind-9.18-openssl-no-engine.patch b/bind-9.18-openssl-no-engine.patch new file mode 100644 index 0000000..967436d --- /dev/null +++ b/bind-9.18-openssl-no-engine.patch @@ -0,0 +1,28 @@ +diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c +index b8dbfaa..d851857 100644 +--- a/lib/isc/openssl_shim.c ++++ b/lib/isc/openssl_shim.c +@@ -16,7 +16,9 @@ + #include + + #include ++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + #include ++#endif + #include + #include + #include +diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h +index c0abd14..ec16d2f 100644 +--- a/lib/isc/openssl_shim.h ++++ b/lib/isc/openssl_shim.h +@@ -14,7 +14,9 @@ + #pragma once + + #include ++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + #include ++#endif + #include + #include + #include diff --git a/bind.spec b/bind.spec index d298983..4e953c9 100644 --- a/bind.spec +++ b/bind.spec @@ -121,6 +121,8 @@ Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch +# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine +Patch27: bind-9.18-openssl-no-engine.patch %{?systemd_ordering} Requires: coreutils From 891dc1c77c1e690debe4d803107eae2797cc58e2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 21 Aug 2024 20:41:02 +0200 Subject: [PATCH 048/144] Remove ancient triggerun and selinux boolean traces --- bind.spec | 12 +++++------- 1 file changed, 5 insertions(+), 7 deletions(-) diff --git a/bind.spec b/bind.spec index 4e953c9..28df52e 100644 --- a/bind.spec +++ b/bind.spec @@ -40,7 +40,6 @@ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\ %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4 -%global selinuxbooleans named_write_master_zones=1 ## The order of libs is important. See lib/Makefile.in for details %define bind_export_libs isc dns isccfg irs %{!?_export_dir:%global _export_dir /bind9-export/} @@ -84,7 +83,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.28 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -739,16 +738,12 @@ if [ $1 -gt 1 ]; then \ done \ fi -%triggerun -- bind < 32:9.9.0-0.6.rc1 -/sbin/chkconfig --del named >/dev/null 2>&1 || : -/bin/systemctl try-restart named.service >/dev/null 2>&1 || : - %triggerpostun -- bind < 32:9.18.4-2, selinux-policy, policycoreutils if [ -x %{_sbindir}/selinuxenabled ] && [ -x %{_sbindir}/getsebool ] && [ -x %{_sbindir}/setsebool ] \ && %{_sbindir}/selinuxenabled && [ -x %{_sbindir}/named ]; then # Return master zones after upgrade from selinux_booleans version WRITEBOOL="$(LC_ALL=C %{_sbindir}/getsebool named_write_master_zones)" - if [ "echo ${WRITEBOOL#named_write_master_zones --> }" = "off" ]; then + if [ "${WRITEBOOL#named_write_master_zones --> }" = "off" ]; then echo "Restoring new sebool default of named_write_master_zones..." %{_sbindir}/setsebool -P named_write_master_zones=1 || : fi @@ -978,6 +973,9 @@ fi; %endif %changelog +* Wed Aug 21 2024 Petr Menšík - 32:9.18.28-4 +- Remove ancient triggerun and selinux boolean traces + * Wed Jul 31 2024 Petr Menšík - 32:9.18.28-3 - Drop PostgreSQL dependencies not used by DLZ anymore From 9ac8e058afed3b1b65c6d2be00fb1465549c7aca Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 21 Aug 2024 20:50:49 +0200 Subject: [PATCH 049/144] Update to 9.18.29 (rhbz#2306542) - Tighten max-recursion-queries and add max-query-restarts configuration statement. - Raise the log level of priming failures. - Bug fixes https://downloads.isc.org/isc/bind9/9.18.29/doc/arm/html/notes.html#notes-for-bind-9-18-29 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 22659a3..cb7e3ee 100644 --- a/.gitignore +++ b/.gitignore @@ -226,3 +226,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.26.tar.xz.asc /bind-9.18.28.tar.xz /bind-9.18.28.tar.xz.asc +/bind-9.18.29.tar.xz +/bind-9.18.29.tar.xz.asc diff --git a/bind.spec b/bind.spec index 28df52e..d1fcba4 100644 --- a/bind.spec +++ b/bind.spec @@ -82,8 +82,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.28 -Release: 4%{?dist} +Version: 9.18.29 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -973,6 +973,9 @@ fi; %endif %changelog +* Wed Aug 21 2024 Petr Menšík - 32:9.18.29-1 +- Update to 9.18.29 (rhbz#2306542) + * Wed Aug 21 2024 Petr Menšík - 32:9.18.28-4 - Remove ancient triggerun and selinux boolean traces diff --git a/sources b/sources index 704a085..f0ecde1 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.28.tar.xz) = 19ba625f155c60dd821e3afe52adf3897b3e81289320282b3f43d604af1e7d4e67fafb98a9849782684935008bcd148f190e05234d501aa056daa6724e0119bb -SHA512 (bind-9.18.28.tar.xz.asc) = e6efe2a9995cabd70c1d2e8e4cb97a9a146e3289d75cfdc81ff8052329db3dd920b9f8f6ad0f1552a0e4e776b01fb077edd5f3d4ea3461952f71dda64574d640 +SHA512 (bind-9.18.29.tar.xz) = 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716 +SHA512 (bind-9.18.29.tar.xz.asc) = 6612c7151c4c1736e0237b8219cefbafbc1dcd4b04ad9b12b99cba703e6debde90d2f9838dd1465a47b9a002a598d9b8f3221dfe1a3bdc41436a92e6d06db472 From 170a2ffa18541bb575345841eb31f3cda6c55c39 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 5 Oct 2024 00:24:27 +0200 Subject: [PATCH 050/144] Update to 9.18.30 (rhbz#2306542) - Print the full path of the working directory in startup log messages. - Follow the number of CPUs set by taskset/cpuset. - Verification of the privacy of an EDDSA key was broken. - Fix algorithm rollover bug when there are two keys with the same keytag. https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-30 Update to 9.18.29 Feature Changes: - Tighten max-recursion-queries and add max-query-restarts configuration statement. - Raise the log level of priming failures. - Add a compatibility shim for older libuv versions (< 1.19.0) Bug Fixes: Return SERVFAIL for a too long CNAME chain. - Reconfigure catz member zones during named reconfiguration. - Update key lifetime and metadata after dnssec-policy reconfiguration. - Fix generation of 6to4-self name expansion from IPv4 address. - dig +yaml was producing unexpected and/or invalid YAML. output. [GL #4796] [GL !9214] - SVBC ALPN text parsing failed to reject zero-length ALPN. [GL #4775] [GL !9210] - Fix false QNAME minimisation error being reported. - Fix dig +timeout argument when using +https. https://downloads.isc.org/isc/bind9/9.18.30/doc/arm/html/notes.html#notes-for-bind-9-18-29 --- .gitignore | 2 ++ bind.spec | 5 ++++- sources | 4 ++-- 3 files changed, 8 insertions(+), 3 deletions(-) diff --git a/.gitignore b/.gitignore index cb7e3ee..1eb72ca 100644 --- a/.gitignore +++ b/.gitignore @@ -228,3 +228,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.28.tar.xz.asc /bind-9.18.29.tar.xz /bind-9.18.29.tar.xz.asc +/bind-9.18.30.tar.xz +/bind-9.18.30.tar.xz.asc diff --git a/bind.spec b/bind.spec index d1fcba4..152e7c0 100644 --- a/bind.spec +++ b/bind.spec @@ -82,7 +82,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.29 +Version: 9.18.30 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -973,6 +973,9 @@ fi; %endif %changelog +* Fri Oct 04 2024 Petr Menšík - 32:9.18.30-1 +- Update to 9.18.30 (rhbz#2306542) + * Wed Aug 21 2024 Petr Menšík - 32:9.18.29-1 - Update to 9.18.29 (rhbz#2306542) diff --git a/sources b/sources index f0ecde1..1b80d6a 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.29.tar.xz) = 6c2676e2e2cb90f3bd73afb367813c54d1c961e12df1e12e41b9d0ee5a1d5cdf368d81410469753eaef37e43358b56796f078f3b2f20c3b247c4bef91d56c716 -SHA512 (bind-9.18.29.tar.xz.asc) = 6612c7151c4c1736e0237b8219cefbafbc1dcd4b04ad9b12b99cba703e6debde90d2f9838dd1465a47b9a002a598d9b8f3221dfe1a3bdc41436a92e6d06db472 +SHA512 (bind-9.18.30.tar.xz) = 7a7d4524cf7449bdd215c4139f2345644dbcd6e009e841702beb58223ebda82ba2e46a291cf51c9c76c37781a1d89fc7c8a526763b7c3b3e43f47ee3d1a6e142 +SHA512 (bind-9.18.30.tar.xz.asc) = b419e36f6ed5afef72df64283926f45c1c0a7a375258079a92b4ae11726316a74981a5072928f708a2fd8b07108051abec65dbe6a84ab4ecfb015120d1ff375c From f25b47caaa43de1c55ce754d93062b3ce4bd56fa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sat, 3 Aug 2024 00:16:12 +0200 Subject: [PATCH 051/144] Make OpenSSL engine support optional and disabled openssl-devel-engine is now needed on rawhide to have engine header present. Make it enabled by default, but possible to disable built support for it easy way. https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine --- bind-9.18-openssl-no-engine.patch | 28 ------------------ bind-9.20-openssl-no-engine.patch | 47 +++++++++++++++++++++++++++++++ bind.spec | 15 ++++++++-- 3 files changed, 59 insertions(+), 31 deletions(-) delete mode 100644 bind-9.18-openssl-no-engine.patch create mode 100644 bind-9.20-openssl-no-engine.patch diff --git a/bind-9.18-openssl-no-engine.patch b/bind-9.18-openssl-no-engine.patch deleted file mode 100644 index 967436d..0000000 --- a/bind-9.18-openssl-no-engine.patch +++ /dev/null @@ -1,28 +0,0 @@ -diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c -index b8dbfaa..d851857 100644 ---- a/lib/isc/openssl_shim.c -+++ b/lib/isc/openssl_shim.c -@@ -16,7 +16,9 @@ - #include - - #include -+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - #include -+#endif - #include - #include - #include -diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h -index c0abd14..ec16d2f 100644 ---- a/lib/isc/openssl_shim.h -+++ b/lib/isc/openssl_shim.h -@@ -14,7 +14,9 @@ - #pragma once - - #include -+#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - #include -+#endif - #include - #include - #include diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch new file mode 100644 index 0000000..adb46aa --- /dev/null +++ b/bind-9.20-openssl-no-engine.patch @@ -0,0 +1,47 @@ +From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Sat, 3 Aug 2024 01:28:36 +0200 +Subject: [PATCH] Remove unused headers from OpenSSL + shims + +The headers were unused and including the + header might cause build failure when OpenSSL +doesn't have Engines support enabled. + +See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine +--- + lib/isc/openssl_shim.c | 2 -- + lib/isc/openssl_shim.h | 2 -- + 2 files changed, 4 deletions(-) + +diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c +index c39ba8c6827..02d0105eb9e 100644 +--- a/lib/isc/openssl_shim.c ++++ b/lib/isc/openssl_shim.c +@@ -16,9 +16,7 @@ + #include + + #include +-#include + #include +-#include + #include + #include + +diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h +index b2916e20a90..95b2f08e231 100644 +--- a/lib/isc/openssl_shim.h ++++ b/lib/isc/openssl_shim.h +@@ -14,9 +14,7 @@ + #pragma once + + #include +-#include + #include +-#include + #include + #include + +-- +2.46.2 + diff --git a/bind.spec b/bind.spec index 152e7c0..2ef83f6 100644 --- a/bind.spec +++ b/bind.spec @@ -30,6 +30,10 @@ %bcond_with TSAN # Add experimental extra verbose logging of query processing %bcond_with QUERYTRACE +%if 0%{?fedora} >= 41 && ! 0%{?rhel} +# Make this enabled on recent Fedora, but not in ELN or RHEL + %bcond_without OPENSSL_ENGINE +%endif %{?!bind_uid: %global bind_uid 25} %{?!bind_gid: %global bind_gid 25} @@ -121,7 +125,9 @@ Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch # https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine -Patch27: bind-9.18-openssl-no-engine.patch +# Correct support for building without openssl/engine.h header +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593 +Patch27: bind-9.20-openssl-no-engine.patch %{?systemd_ordering} Requires: coreutils @@ -136,7 +142,7 @@ Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 BuildRequires: gcc, make BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel -%if 0%{?fedora} >= 41 +%if %{with OPENSSL_ENGINE} BuildRequires: openssl-devel-engine %endif BuildRequires: libidn2-devel, libxml2-devel @@ -377,8 +383,11 @@ done %define systemtest_prepare_build() \ cp -Tuav bin/tests "%{1}/bin/tests/" \ -CFLAGS="$CFLAGS $RPM_OPT_FLAGS" +%if %{with OPENSSL_ENGINE} CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100" +%else +CPPFLAGS="$CPPFLAGS -DOPENSSL_NO_ENGINE=1" +%endif %if %{with TSAN} CFLAGS+=" -O1 -fsanitize=thread -fPIE -pie" %endif From ed057b3adaa2cae906d6c2845188f0a836aef6d0 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 8 Oct 2024 19:45:04 +0200 Subject: [PATCH 052/144] Make OpenSSL engine support optional Make changelog entry. Engine support is still enabled on Fedora, but disabled for RHEL builds. --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 2ef83f6..3699daf 100644 --- a/bind.spec +++ b/bind.spec @@ -87,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.30 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -982,6 +982,9 @@ fi; %endif %changelog +* Tue Oct 08 2024 Petr Menšík - 32:9.18.30-2 +- Make OpenSSL engine support optional + * Fri Oct 04 2024 Petr Menšík - 32:9.18.30-1 - Update to 9.18.30 (rhbz#2306542) From 047b52731f4fdb4a59cce8b343ee05ad044ac15f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 14 Nov 2024 21:20:38 +0100 Subject: [PATCH 053/144] Bump obsoleted license version Resolves: rhbz#2308102 --- bind.spec | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index 3699daf..7d3af4b 100644 --- a/bind.spec +++ b/bind.spec @@ -87,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.30 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -215,7 +215,7 @@ Provides: %{name}-license = %{epoch}:%{version}-%{release} Provides: %{name}-libs-lite = %{epoch}:%{version}-%{release} Obsoletes: %{name}-libs-lite < 32:9.16.13 Obsoletes: %{name}-pkcs11-libs < 32:9.18.4-2 -Obsoletes: %{name}-license < 32:9.18.27-2 +Obsoletes: %{name}-license < 32:9.18.30-3 %description libs Contains heavyweight version of BIND suite libraries used by both named DNS @@ -982,6 +982,9 @@ fi; %endif %changelog +* Thu Nov 14 2024 Petr Menšík - 32:9.18.30-3 +- Bump obsoleted license version (rhbz#2308102) + * Tue Oct 08 2024 Petr Menšík - 32:9.18.30-2 - Make OpenSSL engine support optional From a4f0681ebe024a3b3327a71ba2baf76eca3bdee2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 14 Nov 2024 20:21:13 +0100 Subject: [PATCH 054/144] Update to 9.18.31 (#2319214) New Features: - Added WALLET type. Feature Changes: - Allow IXFR-to-AXFR fallback on DNS_R_TOOMANYRECORDS. And bug fixes. https://downloads.isc.org/isc/bind9/9.18.31/doc/arm/html/notes.html#notes-for-bind-9-18-31 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 1eb72ca..5e41d3f 100644 --- a/.gitignore +++ b/.gitignore @@ -230,3 +230,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.29.tar.xz.asc /bind-9.18.30.tar.xz /bind-9.18.30.tar.xz.asc +/bind-9.18.31.tar.xz +/bind-9.18.31.tar.xz.asc diff --git a/bind.spec b/bind.spec index 7d3af4b..0439976 100644 --- a/bind.spec +++ b/bind.spec @@ -86,8 +86,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.30 -Release: 3%{?dist} +Version: 9.18.31 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -982,6 +982,9 @@ fi; %endif %changelog +* Thu Nov 14 2024 Petr Menšík - 32:9.18.31-1 +- Update to 9.18.31 (#2319214) + * Thu Nov 14 2024 Petr Menšík - 32:9.18.30-3 - Bump obsoleted license version (rhbz#2308102) diff --git a/sources b/sources index 1b80d6a..42e8fc8 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.30.tar.xz) = 7a7d4524cf7449bdd215c4139f2345644dbcd6e009e841702beb58223ebda82ba2e46a291cf51c9c76c37781a1d89fc7c8a526763b7c3b3e43f47ee3d1a6e142 -SHA512 (bind-9.18.30.tar.xz.asc) = b419e36f6ed5afef72df64283926f45c1c0a7a375258079a92b4ae11726316a74981a5072928f708a2fd8b07108051abec65dbe6a84ab4ecfb015120d1ff375c +SHA512 (bind-9.18.31.tar.xz) = e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034 +SHA512 (bind-9.18.31.tar.xz.asc) = 2c17d9a9f153264ed18b287e081b432b5310746964be3e35dfd31597622182e822e62fc3cc4034c0e1c7041949e624c43ffb10d134145d6300f8135f86e38cc6 From 87f39d667e629b29fe881d2ab73628d2a0154570 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 4 Dec 2024 17:56:42 +0100 Subject: [PATCH 055/144] Backport nsupdate TLS support This should add working nsupdate support for -S parameter and some others in addition. References: https://issues.redhat.com/browse/FREEIPA-11706 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751 https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6752 Resolves: FREEIPA-11706 --- bind-9.20-nsupdate-tls-doc.patch | 114 +++ bind-9.20-nsupdate-tls.patch | 1556 ++++++++++++++++++++++++++++++ bind.spec | 12 +- 3 files changed, 1681 insertions(+), 1 deletion(-) create mode 100644 bind-9.20-nsupdate-tls-doc.patch create mode 100644 bind-9.20-nsupdate-tls.patch diff --git a/bind-9.20-nsupdate-tls-doc.patch b/bind-9.20-nsupdate-tls-doc.patch new file mode 100644 index 0000000..d74c706 --- /dev/null +++ b/bind-9.20-nsupdate-tls-doc.patch @@ -0,0 +1,114 @@ +From c5c756ce2ac4c1563d024428e148ca27c7721f71 Mon Sep 17 00:00:00 2001 +From: Aram Sargsyan +Date: Wed, 21 Sep 2022 15:05:11 +0000 +Subject: [PATCH 2/3] Document nsupdate options related to DoT + +Add documentation for the newly implemented DoT feature of the +nsupdate program. + +(cherry picked from commit bd8299d7b501234263a6aee98049f879b1c700b7) +--- + bin/nsupdate/nsupdate.rst | 48 ++++++++++++++++++++++++++++++++++++++- + 1 file changed, 47 insertions(+), 1 deletion(-) + +diff --git a/bin/nsupdate/nsupdate.rst b/bin/nsupdate/nsupdate.rst +index 81bb4815cf4..f1ab5c76fa7 100644 +--- a/bin/nsupdate/nsupdate.rst ++++ b/bin/nsupdate/nsupdate.rst +@@ -19,7 +19,7 @@ nsupdate - dynamic DNS update utility + Synopsis + ~~~~~~~~ + +-:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename] ++:program:`nsupdate` [**-d**] [**-D**] [**-i**] [**-L** level] [ [**-g**] | [**-o**] | [**-l**] | [**-y** [hmac:]keyname:secret] | [**-k** keyfile] ] [ [**-S**] [**-K** tlskeyfile] [**-E** tlscertfile] [**-A** tlscafile] [**-H** tlshostname] [-O] ] [**-t** timeout] [**-u** udptimeout] [**-r** udpretries] [**-v**] [**-T**] [**-P**] [**-V**] [ [**-4**] | [**-6**] ] [filename] + + Description + ~~~~~~~~~~~ +@@ -71,6 +71,15 @@ Options + + This option sets use of IPv6 only. + ++.. option:: -A tlscafile ++ ++ This option specifies the file of the certificate authorities (CA) certificates ++ (in PEM format) in order to verify the remote server TLS certificate when ++ using DNS-over-TLS (DoT), to achieve Strict or Mutual TLS. When used, it will ++ override the certificates from the global certificates store, which are ++ otherwise used by default when :option:`-S` is enabled. This option can not ++ be used in conjuction with :option:`-O`, and it implies :option:`-S`. ++ + .. option:: -C + + Overrides the default `resolv.conf` file. This is only intended for testing. +@@ -84,10 +93,23 @@ Options + + This option sets extra debug mode. + ++.. option:: -E tlscertfile ++ ++ This option sets the certificate(s) file for authentication for the ++ DNS-over-TLS (DoT) transport to the remote server. The certificate ++ chain file is expected to be in PEM format. This option implies :option:`-S`, ++ and can only be used with :option:`-K`. ++ + .. option:: -g + + This option enables standard GSS-TSIG mode. + ++.. option:: -H tlshostname ++ ++ This option makes :program:`nsupdate` use the provided hostname during remote ++ server TLS certificate verification. Otherwise, the DNS server name ++ is used. This option implies :option:`-S`. ++ + .. option:: -i + + This option forces interactive mode, even when standard input is not a terminal. +@@ -104,6 +126,13 @@ Options + key used to authenticate Dynamic DNS update requests. In this case, + the key specified is not an HMAC-MD5 key. + ++.. option:: -K tlskeyfile ++ ++ This option sets the key file for authenticated encryption for the ++ DNS-over-TLS (DoT) transport with the remote server. The private key file is ++ expected to be in PEM format. This option implies :option:`-S`, and can only ++ be used with :option:`-E`. ++ + .. option:: -l + + This option sets local-host only mode, which sets the server address to localhost +@@ -123,6 +152,14 @@ Options + This option enables a non-standards-compliant variant of GSS-TSIG + used by Windows 2000. + ++.. option:: -O ++ ++ This option enables Opportunistic TLS. When used, the remote peer's TLS ++ certificate will not be verified. This option should be used for debugging ++ purposes only, and it is not recommended to use it in production. This ++ option can not be used in conjuction with :option:`-A`, and it implies ++ :option:`-S`. ++ + .. option:: -p port + + This option sets the port to use for connections to a name server. The default is +@@ -138,6 +175,15 @@ Options + This option sets the number of UDP retries. The default is 3. If zero, only one update + request is made. + ++.. option:: -S ++ ++ This option indicates whether to use DNS-over-TLS (DoT) when querying ++ name servers specified by ``server servername port`` syntax in the input ++ file, and the primary server discovered through a SOA request. When the ++ :option:`-K` and :option:`-E` options are used, then the specified TLS ++ client certificate and private key pair are used for authentication ++ (Mutual TLS). This option implies :option:`-v`. ++ + .. option:: -t timeout + + This option sets the maximum time an update request can take before it is aborted. The +-- +2.47.0 + diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch new file mode 100644 index 0000000..183ff0b --- /dev/null +++ b/bind-9.20-nsupdate-tls.patch @@ -0,0 +1,1556 @@ +From ec00ba4b215963af5e05892cf2ce1a62222ede46 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Mon, 11 Nov 2024 18:09:07 +0100 +Subject: [PATCH 1/3] Backport nsupdate TLS support into 9.18 + +Attempt to support TLS from nsupdate even in 9.18 release. + +Create few dispatch calls with 2 suffix with tls + +Keep original functions without changes and add new functions with +additional tlsctx and transport pointers passed. + +Convert xfrin.c:get_create_tlsctx() into a library function + +In order to make xfrin.c:get_create_tlsctx() reusable, move the function +into transport.c, and make changes into its prototype to not use the +'dns_xfrin_ctx_t' type, thus making it more universal. + +This change prepares ground for adding transport support into the +dispatch manager. + +Also, move the typedefs for 'dns_transport_t' and 'dns_transport_list_t' +from transport.h into types.h. + +(cherry picked from commit 881747218ba0ad411f6f1bf361c2c09c805d4aa8) + +Update calls inside libdns + +Add remaining transport additions to request and dispatch calls. Add +mctx into dispentry. + +Compilable nsupdate + +Implement DoT support for nsupdate + +Implement DNS-over-TLS support for nsupdate. Use DiG's DoT +implementation as a model for the newly added features. + +(cherry picked from commit 13000c28c2e0ab2754f0f37ab8d6edb8249a1370) + +[pemensik] Adapted to previous 9.18 changes. +Add usage and command line parsing +--- + bin/nsupdate/nsupdate.c | 192 ++++++++++++++++++++---- + lib/dns/dispatch.c | 107 ++++++++++++-- + lib/dns/include/dns/dispatch.h | 22 +++ + lib/dns/include/dns/request.h | 23 +++ + lib/dns/include/dns/transport.h | 45 +++++- + lib/dns/include/dns/types.h | 2 + + lib/dns/request.c | 63 ++++++-- + lib/dns/transport.c | 253 ++++++++++++++++++++++++++++++++ + lib/dns/xfrin.c | 232 +---------------------------- + 9 files changed, 649 insertions(+), 290 deletions(-) + +diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c +index 45ba90fba7b..93c7ea6cb17 100644 +--- a/bin/nsupdate/nsupdate.c ++++ b/bin/nsupdate/nsupdate.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -67,6 +68,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -118,6 +120,7 @@ static bool memdebugging = false; + static bool have_ipv4 = false; + static bool have_ipv6 = false; + static bool is_dst_up = false; ++static bool use_tls = false; + static bool usevc = false; + static bool usegsstsig = false; + static bool use_win2k_gsstsig = false; +@@ -145,6 +148,14 @@ static dns_tsigkey_t *tsigkey = NULL; + static dst_key_t *sig0key = NULL; + static isc_sockaddr_t *servers = NULL; + static isc_sockaddr_t *primary_servers = NULL; ++static dns_transport_list_t *transport_list = NULL; ++static dns_transport_t *transport = NULL; ++static isc_tlsctx_cache_t *tls_ctx_cache = NULL; ++static char *tls_hostname = NULL; ++static char *tls_client_key_file = NULL; ++static char *tls_client_cert_file = NULL; ++static char *tls_ca_file = NULL; ++static bool tls_always_verify_remote = true; + static bool default_servers = true; + static int ns_inuse = 0; + static int primary_inuse = 0; +@@ -790,6 +801,19 @@ set_source_ports(dns_dispatchmgr_t *manager) { + isc_portset_destroy(gmctx, &v6portset); + } + ++static isc_result_t ++create_name(const char *str, char *namedata, size_t len, dns_name_t *name) { ++ isc_buffer_t namesrc, namebuf; ++ ++ dns_name_init(name, NULL); ++ isc_buffer_constinit(&namesrc, str, strlen(str)); ++ isc_buffer_add(&namesrc, strlen(str)); ++ isc_buffer_init(&namebuf, namedata, len); ++ ++ return dns_name_fromtext(name, &namesrc, dns_rootname, ++ DNS_NAME_DOWNCASE, &namebuf); ++} ++ + static void + setup_system(void) { + isc_result_t result; +@@ -797,6 +821,8 @@ setup_system(void) { + isc_sockaddrlist_t *nslist; + isc_logconfig_t *logconfig = NULL; + irs_resconf_t *resconf = NULL; ++ dns_name_t tlsname; ++ char namedata[DNS_NAME_FORMATSIZE + 1]; + + ddebug("setup_system()"); + +@@ -942,6 +968,31 @@ setup_system(void) { + check_result(result, "dns_dispatch_createudp (v4)"); + } + ++ transport_list = dns_transport_list_new(gmctx); ++ isc_tlsctx_cache_create(gmctx, &tls_ctx_cache); ++ ++ if (tls_client_key_file == NULL) { ++ result = create_name("tls-non-auth-client", namedata, ++ sizeof(namedata), &tlsname); ++ check_result(result, "create_name (tls-non-auth-client)"); ++ transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, ++ transport_list); ++ dns_transport_set_tlsname(transport, "tls-non-auth-client"); ++ } else { ++ result = create_name("tls-auth-client", namedata, ++ sizeof(namedata), &tlsname); ++ check_result(result, "create_name (tls-auth-client)"); ++ transport = dns_transport_new(&tlsname, DNS_TRANSPORT_TLS, ++ transport_list); ++ dns_transport_set_tlsname(transport, "tls-auth-client"); ++ dns_transport_set_keyfile(transport, tls_client_key_file); ++ dns_transport_set_certfile(transport, tls_client_cert_file); ++ } ++ dns_transport_set_cafile(transport, tls_ca_file); ++ dns_transport_set_remote_hostname(transport, tls_hostname); ++ dns_transport_set_always_verify_remote(transport, ++ tls_always_verify_remote); ++ + result = dns_requestmgr_create(gmctx, taskmgr, dispatchmgr, dispatchv4, + dispatchv6, &requestmgr); + check_result(result, "dns_requestmgr_create"); +@@ -982,7 +1033,7 @@ version(void) { + fprintf(stderr, "nsupdate %s\n", PACKAGE_VERSION); + } + +-#define PARSE_ARGS_FMT "46C:dDghilL:Mok:p:Pr:R:t:Tu:vVy:" ++#define PARSE_ARGS_FMT "46A:C:dDE:ghH:iK:lL:MoOk:p:Pr:R:St:Tu:vVy:" + + static void + pre_parse_args(int argc, char **argv) { +@@ -1025,7 +1076,9 @@ pre_parse_args(int argc, char **argv) { + fprintf(stderr, "usage: nsupdate [-CdDi] [-L level] " + "[-l] [-g | -o | -y keyname:secret " + "| -k keyfile] [-p port] " +- "[-v] [-V] [-P] [-T] [-4 | -6] " ++ "[ -S [-K tlskeyfile] [-E tlscertfile] " ++ "[-A tlscafile] [-H tlshostname] " ++ "[-O] ] [-v] [-V] [-P] [-T] [-4 | -6] " + "[filename]\n"); + exit(EXIT_FAILURE); + +@@ -1097,6 +1150,10 @@ parse_args(int argc, char **argv) { + fatal("can't find IPv6 networking"); + } + break; ++ case 'A': ++ use_tls = true; ++ tls_ca_file = isc_commandline_argument; ++ break; + case 'C': + resolvconf = isc_commandline_argument; + break; +@@ -1107,12 +1164,27 @@ parse_args(int argc, char **argv) { + debugging = true; + ddebugging = true; + break; ++ case 'E': ++ use_tls = true; ++ usevc = true; ++ tls_client_cert_file = isc_commandline_argument; ++ break; ++ case 'H': ++ use_tls = true; ++ usevc = true; ++ tls_hostname = isc_commandline_argument; ++ break; + case 'M': + break; + case 'i': + force_interactive = true; + interactive = true; + break; ++ case 'K': ++ use_tls = true; ++ usevc = true; ++ tls_client_key_file = isc_commandline_argument; ++ break; + case 'l': + local_only = true; + break; +@@ -1145,6 +1217,11 @@ parse_args(int argc, char **argv) { + usegsstsig = true; + use_win2k_gsstsig = true; + break; ++ case 'O': ++ use_tls = true; ++ usevc = true; ++ tls_always_verify_remote = false; ++ break; + case 'p': + result = isc_parse_uint16(&dnsport, + isc_commandline_argument, 10); +@@ -1156,6 +1233,10 @@ parse_args(int argc, char **argv) { + exit(EXIT_FAILURE); + } + break; ++ case 'S': ++ use_tls = true; ++ usevc = true; ++ break; + case 't': + result = isc_parse_uint32(&timeout, + isc_commandline_argument, 10); +@@ -1218,6 +1299,26 @@ parse_args(int argc, char **argv) { + } + #endif /* HAVE_GSSAPI */ + ++ if (use_tls) { ++ usevc = true; ++ if ((tls_client_key_file == NULL) != ++ (tls_client_cert_file == NULL)) ++ { ++ fprintf(stderr, ++ "%s: cannot specify the -K option without" ++ "the -E option, and vice versa.\n", ++ argv[0]); ++ exit(EXIT_FAILURE); ++ } ++ if (tls_ca_file != NULL && tls_always_verify_remote == false) { ++ fprintf(stderr, ++ "%s: cannot specify the -A option in " ++ "conjuction with the -O option.\n", ++ argv[0]); ++ exit(EXIT_FAILURE); ++ } ++ } ++ + if (argv[isc_commandline_index] != NULL) { + if (strcmp(argv[isc_commandline_index], "-") == 0) { + input = stdin; +@@ -2468,8 +2569,10 @@ static void + send_update(dns_name_t *zone, isc_sockaddr_t *primary) { + isc_result_t result; + dns_request_t *request = NULL; +- unsigned int options = DNS_REQUESTOPT_CASE; + isc_sockaddr_t *srcaddr; ++ unsigned int options = DNS_REQUESTOPT_CASE; ++ dns_transport_t *req_transport = NULL; ++ isc_tlsctx_cache_t *req_tls_ctx_cache = NULL; + + ddebug("send_update()"); + +@@ -2477,7 +2580,12 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) { + + if (usevc) { + options |= DNS_REQUESTOPT_TCP; ++ if (use_tls) { ++ req_transport = transport; ++ req_tls_ctx_cache = tls_ctx_cache; ++ } + } ++ + if (tsigkey == NULL && sig0key != NULL) { + result = dns_message_setsig0key(updatemsg, sig0key); + check_result(result, "dns_message_setsig0key"); +@@ -2500,11 +2608,11 @@ send_update(dns_name_t *zone, isc_sockaddr_t *primary) { + updatemsg->tsigname->attributes |= DNS_NAMEATTR_NOCOMPRESS; + } + +- result = dns_request_create(requestmgr, updatemsg, srcaddr, primary, +- options, tsigkey, timeout, udp_timeout, +- udp_retries, global_task, update_completed, +- NULL, &request); +- check_result(result, "dns_request_create"); ++ result = dns_request_create2( ++ requestmgr, updatemsg, srcaddr, primary, req_transport, ++ req_tls_ctx_cache, options, tsigkey, timeout, udp_timeout, ++ udp_retries, global_task, update_completed, NULL, &request); ++ check_result(result, "dns_request_create2"); + + if (debugging) { + show_message(stdout, updatemsg, "Outgoing update query:"); +@@ -2594,7 +2702,9 @@ recvsoa(isc_task_t *task, isc_event_t *event) { + result = dns_request_getresponse(request, rcvmsg, + DNS_MESSAGEPARSE_PRESERVEORDER); + if (result == DNS_R_TSIGERRORSET && servers != NULL) { +- unsigned int options = 0; ++ unsigned int options = DNS_REQUESTOPT_CASE; ++ dns_transport_t *req_transport = NULL; ++ isc_tlsctx_cache_t *req_tls_ctx_cache = NULL; + + dns_message_detach(&rcvmsg); + ddebug("Destroying request [%p]", request); +@@ -2605,8 +2715,12 @@ recvsoa(isc_task_t *task, isc_event_t *event) { + dns_message_renderreset(soaquery); + ddebug("retrying soa request without TSIG"); + +- if (!default_servers && usevc) { ++ if (usevc) { + options |= DNS_REQUESTOPT_TCP; ++ if (!default_servers && use_tls) { ++ req_transport = transport; ++ req_tls_ctx_cache = tls_ctx_cache; ++ } + } + + if (isc_sockaddr_pf(addr) == AF_INET6) { +@@ -2615,10 +2729,10 @@ recvsoa(isc_task_t *task, isc_event_t *event) { + srcaddr = localaddr4; + } + +- result = dns_request_create(requestmgr, soaquery, srcaddr, addr, +- options, NULL, timeout, udp_timeout, +- udp_retries, global_task, recvsoa, +- reqinfo, &request); ++ result = dns_request_create2( ++ requestmgr, soaquery, srcaddr, addr, req_transport, ++ req_tls_ctx_cache, options, NULL, timeout, udp_timeout, ++ udp_retries, global_task, recvsoa, reqinfo, &request); + check_result(result, "dns_request_create"); + requests++; + return; +@@ -2831,10 +2945,16 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg, + isc_result_t result; + nsu_requestinfo_t *reqinfo; + isc_sockaddr_t *srcaddr; +- unsigned int options = 0; ++ unsigned int options = DNS_REQUESTOPT_CASE; ++ dns_transport_t *req_transport = NULL; ++ isc_tlsctx_cache_t *req_tls_ctx_cache = NULL; + +- if (!default_servers && usevc) { ++ if (usevc) { + options |= DNS_REQUESTOPT_TCP; ++ if (!default_servers && use_tls) { ++ req_transport = transport; ++ req_tls_ctx_cache = tls_ctx_cache; ++ } + } + + reqinfo = isc_mem_get(gmctx, sizeof(nsu_requestinfo_t)); +@@ -2847,11 +2967,12 @@ sendrequest(isc_sockaddr_t *destaddr, dns_message_t *msg, + srcaddr = localaddr4; + } + +- result = dns_request_create(requestmgr, msg, srcaddr, destaddr, options, +- default_servers ? NULL : tsigkey, timeout, +- udp_timeout, udp_retries, global_task, +- recvsoa, reqinfo, request); +- check_result(result, "dns_request_create"); ++ result = dns_request_create2(requestmgr, msg, srcaddr, destaddr, ++ req_transport, req_tls_ctx_cache, options, ++ default_servers ? NULL : tsigkey, timeout, ++ udp_timeout, udp_retries, global_task, ++ recvsoa, reqinfo, request); ++ check_result(result, "dns_request_create2"); + requests++; + } + +@@ -2934,7 +3055,6 @@ start_gssrequest(dns_name_t *primary) { + char namestr[DNS_NAME_FORMATSIZE]; + char mykeystr[DNS_NAME_FORMATSIZE]; + char *err_message = NULL; +- + debug("start_gssrequest"); + usevc = true; + +@@ -3030,8 +3150,15 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg, + dns_request_t **request, gss_ctx_id_t context) { + isc_result_t result; + nsu_gssinfo_t *reqinfo; +- unsigned int options = 0; + isc_sockaddr_t *srcaddr; ++ unsigned int options = DNS_REQUESTOPT_CASE | DNS_REQUESTOPT_TCP; ++ dns_transport_t *req_transport = NULL; ++ isc_tlsctx_cache_t *req_tls_ctx_cache = NULL; ++ ++ if (!default_servers && use_tls) { ++ req_transport = transport; ++ req_tls_ctx_cache = tls_ctx_cache; ++ } + + debug("send_gssrequest"); + REQUIRE(destaddr != NULL); +@@ -3041,18 +3168,17 @@ send_gssrequest(isc_sockaddr_t *destaddr, dns_message_t *msg, + reqinfo->addr = destaddr; + reqinfo->context = context; + +- options |= DNS_REQUESTOPT_TCP; +- + if (isc_sockaddr_pf(destaddr) == AF_INET6) { + srcaddr = localaddr6; + } else { + srcaddr = localaddr4; + } + +- result = dns_request_create(requestmgr, msg, srcaddr, destaddr, options, +- tsigkey, timeout, udp_timeout, udp_retries, +- global_task, recvgss, reqinfo, request); +- check_result(result, "dns_request_create"); ++ result = dns_request_create2(requestmgr, msg, srcaddr, destaddr, ++ req_transport, req_tls_ctx_cache, options, ++ tsigkey, timeout, udp_timeout, udp_retries, ++ global_task, recvgss, reqinfo, request); ++ check_result(result, "dns_request_create2"); + if (debugging) { + show_message(stdout, msg, "Outgoing update query:"); + } +@@ -3321,6 +3447,14 @@ static void + cleanup(void) { + ddebug("cleanup()"); + ++ if (tls_ctx_cache != NULL) { ++ isc_tlsctx_cache_detach(&tls_ctx_cache); ++ } ++ ++ if (transport_list != NULL) { ++ dns_transport_list_detach(&transport_list); ++ } ++ + LOCK(&answer_lock); + if (answer != NULL) { + dns_message_detach(&answer); +diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c +index d737363fea4..44a2896cb03 100644 +--- a/lib/dns/dispatch.c ++++ b/lib/dns/dispatch.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -83,6 +84,10 @@ struct dns_dispentry { + dns_dispatch_t *disp; + isc_nmhandle_t *handle; /*%< netmgr handle for UDP connection */ + dns_dispatchstate_t state; ++ /* TLS support for nsupdate. */ ++ isc_mem_t *mctx; ++ dns_transport_t *transport; ++ isc_tlsctx_cache_t *tlsctx_cache; + unsigned int bucket; + unsigned int retries; + unsigned int timeout; +@@ -107,11 +112,12 @@ struct dns_dispatch { + /* Unlocked. */ + unsigned int magic; /*%< magic */ + int tid; +- dns_dispatchmgr_t *mgr; /*%< dispatch manager */ +- isc_nmhandle_t *handle; /*%< netmgr handle for TCP connection */ +- isc_sockaddr_t local; /*%< local address */ +- in_port_t localport; /*%< local UDP port */ +- isc_sockaddr_t peer; /*%< peer address (TCP) */ ++ dns_dispatchmgr_t *mgr; /*%< dispatch manager */ ++ isc_nmhandle_t *handle; /*%< netmgr handle for TCP connection */ ++ isc_sockaddr_t local; /*%< local address */ ++ in_port_t localport; /*%< local UDP port */ ++ isc_sockaddr_t peer; /*%< peer address (TCP) */ ++ dns_transport_t *transport; /*%< TCP transport parameters */ + + /*% Locked by mgr->lock. */ + ISC_LINK(dns_dispatch_t) link; +@@ -119,6 +125,7 @@ struct dns_dispatch { + /* Locked by "lock". */ + isc_mutex_t lock; /*%< locks all below */ + isc_socktype_t socktype; ++ dns_dispatchopt_t options; + dns_dispatchstate_t state; + isc_refcount_t references; + +@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout); + + static const char * + socktype2str(dns_dispentry_t *resp) { ++ dns_transport_type_t transport_type = DNS_TRANSPORT_UDP; + dns_dispatch_t *disp = resp->disp; + +- switch (disp->socktype) { +- case isc_socktype_udp: ++ if (disp->socktype == isc_socktype_tcp) { ++ if (resp->transport != NULL) { ++ transport_type = ++ dns_transport_get_type(resp->transport); ++ } else { ++ transport_type = DNS_TRANSPORT_TCP; ++ } ++ } ++ ++ switch (transport_type) { ++ case DNS_TRANSPORT_UDP: + return ("UDP"); +- case isc_socktype_tcp: ++ case DNS_TRANSPORT_TCP: + return ("TCP"); ++ case DNS_TRANSPORT_TLS: ++ return "TLS"; ++ case DNS_TRANSPORT_HTTP: ++ return "HTTP"; + default: + return (""); + } +@@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type, + isc_result_t + dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, + const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp) { ++ return dns_dispatch_createtcp2(mgr, localaddr, destaddr, NULL, 0, ++ dispp); ++} ++ ++isc_result_t ++dns_dispatch_createtcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *transport, dns_dispatchopt_t options, ++ dns_dispatch_t **dispp) { + dns_dispatch_t *disp = NULL; + + REQUIRE(VALID_DISPATCHMGR(mgr)); +@@ -1170,7 +1200,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, + + dispatch_allocate(mgr, isc_socktype_tcp, &disp); + ++ disp->options = options; + disp->peer = *destaddr; ++ if (transport != NULL) { ++ dns_transport_attach(transport, &disp->transport); ++ } + + if (localaddr != NULL) { + disp->local = *localaddr; +@@ -1185,6 +1219,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, + * Append it to the dispatcher list. + */ + ++ /* TODO: DNS_DISPATCHOPT_UNSHARED is not backported */ + /* FIXME: There should be a lookup hashtable here */ + ISC_LIST_APPEND(mgr->list, disp, link); + UNLOCK(&mgr->lock); +@@ -1208,6 +1243,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, + isc_result_t + dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, + const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp) { ++ return dns_dispatch_gettcp2(mgr, destaddr, localaddr, NULL, dispp); ++} ++ ++isc_result_t ++dns_dispatch_gettcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, ++ const isc_sockaddr_t *localaddr, ++ dns_transport_t *transport, dns_dispatch_t **dispp) { + dns_dispatch_t *disp_connected = NULL; + dns_dispatch_t *disp_fallback = NULL; + isc_result_t result = ISC_R_NOTFOUND; +@@ -1248,8 +1290,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, + if (disp->socktype != isc_socktype_tcp || + !isc_sockaddr_equal(destaddr, &peeraddr) || + (localaddr != NULL && +- !isc_sockaddr_eqaddr(localaddr, &sockname))) ++ !isc_sockaddr_eqaddr(localaddr, &sockname)) || ++ (transport != disp->transport)) + { ++ // dispatch_match alternative + UNLOCK(&disp->lock); + continue; + } +@@ -1426,7 +1470,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, + unsigned int timeout, const isc_sockaddr_t *dest, + dispatch_cb_t connected, dispatch_cb_t sent, + dispatch_cb_t response, void *arg, dns_messageid_t *idp, +- dns_dispentry_t **respp) { ++ dns_dispentry_t **resp) { ++ return dns_dispatch_add2(disp, options, timeout, dest, NULL, NULL, ++ connected, sent, response, arg, idp, resp); ++} ++ ++isc_result_t ++dns_dispatch_add2(dns_dispatch_t *disp, unsigned int options, ++ unsigned int timeout, const isc_sockaddr_t *dest, ++ dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache, ++ dispatch_cb_t connected, dispatch_cb_t sent, ++ dispatch_cb_t response, void *arg, dns_messageid_t *idp, ++ dns_dispentry_t **respp) { + dns_dispentry_t *resp = NULL; + dns_qid_t *qid = NULL; + in_port_t localport; +@@ -1444,6 +1499,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, + REQUIRE(connected != NULL); + REQUIRE(response != NULL); + REQUIRE(sent != NULL); ++ REQUIRE(disp->transport == transport); + + LOCK(&disp->lock); + +@@ -1471,6 +1527,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, + .rlink = ISC_LINK_INITIALIZER, + .magic = RESPONSE_MAGIC, + }; ++ isc_mem_attach(disp->mgr->mctx, &resp->mctx); + + #if DNS_DISPATCH_TRACE + fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n", +@@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, + return (ISC_R_NOMORE); + } + ++ if (transport != NULL) { ++ dns_transport_attach(transport, &resp->transport); ++ } ++ ++ if (tlsctx_cache != NULL) { ++ isc_tlsctx_cache_attach(tlsctx_cache, &resp->tlsctx_cache); ++ } ++ + dns_dispatch_attach(disp, &resp->disp); /* DISPATCH001 */ + + disp->requests++; +@@ -1779,6 +1844,7 @@ dns_dispatch_done(dns_dispentry_t **respp) { + *respp = NULL; + + dispentry_cancel(resp, ISC_R_CANCELED); ++ isc_mem_detach(&resp->mctx); ///< FIXME: is this ok? + dns_dispentry_detach(&resp); /* DISPENTRY000 */ + } + +@@ -1970,6 +2036,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { + + static isc_result_t + tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { ++ dns_transport_type_t transport_type = DNS_TRANSPORT_TCP; ++ isc_tlsctx_t *tlsctx = NULL; ++ isc_tlsctx_client_session_cache_t *sess_cache = NULL; ++ ++ if (resp->transport != NULL) { ++ transport_type = dns_transport_get_type(resp->transport); ++ } ++ ++ if (transport_type == DNS_TRANSPORT_TLS) { ++ isc_result_t result; ++ ++ result = dns_transport_get_tlsctx( ++ resp->transport, &resp->peer, resp->tlsctx_cache, ++ resp->mctx, &tlsctx, &sess_cache); ++ ++ if (result != ISC_R_SUCCESS) { ++ return result; ++ } ++ INSIST(tlsctx != NULL); ++ } ++ + /* Check whether the dispatch is already connecting or connected. */ + LOCK(&disp->lock); + switch (disp->state) { +diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h +index ad377f078ed..cfdc37481ce 100644 +--- a/lib/dns/include/dns/dispatch.h ++++ b/lib/dns/include/dns/dispatch.h +@@ -56,6 +56,7 @@ + #include + #include + ++#include + #include + + /* Add -DDNS_DISPATCH_TRACE=1 to CFLAGS for detailed reference tracing */ +@@ -74,6 +75,11 @@ struct dns_dispatchset { + isc_mutex_t lock; + }; + ++typedef enum dns_dispatchopt { ++ DNS_DISPATCHOPT_FIXEDID = 1 << 0, ++ DNS_DISPATCHOPT_UNSHARED = 1 << 1, /* Don't share this connection */ ++} dns_dispatchopt_t; ++ + /* + */ + #define DNS_DISPATCHOPT_FIXEDID 0x00000001U +@@ -199,6 +205,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, + * + *\li Anything else -- failure. + */ ++isc_result_t ++dns_dispatch_createtcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *transport, dns_dispatchopt_t options, ++ dns_dispatch_t **dispp); + + #if DNS_DISPATCH_TRACE + #define dns_dispatch_ref(ptr) \ +@@ -258,6 +269,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, + /* + * Attempt to connect to a existing TCP connection. + */ ++isc_result_t ++dns_dispatch_gettcp2(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, ++ const isc_sockaddr_t *localaddr, ++ dns_transport_t *transport, dns_dispatch_t **dispp); + + typedef void (*dispatch_cb_t)(isc_result_t eresult, isc_region_t *region, + void *cbarg); +@@ -268,6 +283,13 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, + dispatch_cb_t connected, dispatch_cb_t sent, + dispatch_cb_t response, void *arg, dns_messageid_t *idp, + dns_dispentry_t **resp); ++isc_result_t ++dns_dispatch_add2(dns_dispatch_t *disp, unsigned int options, ++ unsigned int timeout, const isc_sockaddr_t *dest, ++ dns_transport_t *transport, isc_tlsctx_cache_t *tlsctx_cache, ++ dispatch_cb_t connected, dispatch_cb_t sent, ++ dispatch_cb_t response, void *arg, dns_messageid_t *idp, ++ dns_dispentry_t **respp); + /*%< + * Add a response entry for this dispatch. + * +diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h +index d00574f9827..17bcbf68c3b 100644 +--- a/lib/dns/include/dns/request.h ++++ b/lib/dns/include/dns/request.h +@@ -44,6 +44,7 @@ + #define DNS_REQUESTOPT_TCP 0x00000001U + #define DNS_REQUESTOPT_CASE 0x00000002U + #define DNS_REQUESTOPT_FIXEDID 0x00000004U ++#define DNS_REQUESTOPT_LARGE 0x00000008U + + typedef struct dns_requestevent { + ISC_EVENT_COMMON(struct dns_requestevent); +@@ -161,6 +162,17 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message, + unsigned int udptimeout, unsigned int udpretries, + isc_task_t *task, isc_taskaction_t action, void *arg, + dns_request_t **requestp); ++isc_result_t ++dns_request_create2(dns_requestmgr_t *requestmgr, dns_message_t *message, ++ const isc_sockaddr_t *srcaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *req_transport, ++ isc_tlsctx_cache_t *req_tls_ctx_cache, ++ unsigned int options, ++ dns_tsigkey_t *key, unsigned int timeout, ++ unsigned int udptimeout, unsigned int udpretries, ++ isc_task_t *task, isc_taskaction_t action, void *arg, ++ dns_request_t **requestp); + /*%< + * Create and send a request. + * +@@ -204,6 +216,17 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, + unsigned int udpretries, isc_task_t *task, + isc_taskaction_t action, void *arg, + dns_request_t **requestp); ++isc_result_t ++dns_request_createraw2(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, ++ const isc_sockaddr_t *srcaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *transport, ++ isc_tlsctx_cache_t *tlsctx_cache, ++ unsigned int options, ++ unsigned int timeout, unsigned int udptimeout, ++ unsigned int udpretries, isc_task_t *task, ++ isc_taskaction_t action, void *arg, ++ dns_request_t **requestp); + /*!< + * \brief Create and send a request. + * +diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h +index e74ccd7f970..e6499a97e73 100644 +--- a/lib/dns/include/dns/transport.h ++++ b/lib/dns/include/dns/transport.h +@@ -13,7 +13,9 @@ + + #pragma once + +-#include ++#include ++ ++#include + + typedef enum { + DNS_TRANSPORT_NONE = 0, +@@ -29,9 +31,6 @@ typedef enum { + DNS_HTTP_POST = 1, + } dns_http_mode_t; + +-typedef struct dns_transport dns_transport_t; +-typedef struct dns_transport_list dns_transport_list_t; +- + dns_transport_t * + dns_transport_new(const dns_name_t *name, dns_transport_type_t type, + dns_transport_list_t *list); +@@ -63,15 +62,44 @@ dns_transport_get_tls_versions(const dns_transport_t *transport); + bool + dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport, + bool *preferp); ++bool ++dns_transport_get_always_verify_remote(dns_transport_t *transport); + /*%< + * Getter functions: return the type, cert file, key file, CA file, +- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'. ++ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name, ++ * TLS version, server ciphers preference mode, and always enabling ++ * authentication mode for 'transport'. + * + * dns_transport_get_prefer_server_ciphers() returns 'true' is value + * was set, 'false' otherwise. The actual value is returned via + * 'preferp' pointer. + */ + ++isc_result_t ++dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer, ++ isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx, ++ isc_tlsctx_t **pctx, ++ isc_tlsctx_client_session_cache_t **psess_cache); ++/*%< ++ * Get the transport's TLS Context and the TLS Client Session Cache associated ++ * with it. ++ * ++ * When neither the TLS hostname, nor the TLS certificates authorities (CA) ++ * file are set for the 'transport', then Opportunistic TLS (no authentication ++ * of the remote peer) will be used, unless the 'always_verify_remote' mode is ++ * enabled on the 'transport', in which case the remote peer will be ++ * authenticated by its IP address using the system's default certificates ++ * authorities store. ++ * ++ * Requires: ++ *\li 'transport' is a valid, 'DNS_TRANSPORT_TLS' type transport. ++ *\li 'peer' is not NULL. ++ *\li 'tlsctx_cache' is not NULL. ++ *\li 'mctx' is not NULL. ++ *\li 'pctx' is not NULL and '*pctx' is NULL. ++ *\li 'psess_cache' is not NULL and '*psess_cache' is NULL. ++ */ ++ + void + dns_transport_set_certfile(dns_transport_t *transport, const char *certfile); + void +@@ -96,9 +124,14 @@ dns_transport_set_tls_versions(dns_transport_t *transport, + void + dns_transport_set_prefer_server_ciphers(dns_transport_t *transport, + const bool prefer); ++void ++dns_transport_set_always_verify_remote(dns_transport_t *transport, ++ const bool always_verify_remote); + /*%< + * Setter functions: set the type, cert file, key file, CA file, +- * hostname, HTTP endpoint, or HTTP mode (GET or POST) for 'transport'. ++ * hostname, HTTP endpoint, HTTP mode (GET or POST), ciphers, TLS name, ++ * TLS version, server ciphers preference mode, and always enabling ++ * authentication mode for 'transport'. + * + * Requires: + *\li 'transport' is valid. +diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h +index 6465962bd41..f0aaa24e936 100644 +--- a/lib/dns/include/dns/types.h ++++ b/lib/dns/include/dns/types.h +@@ -141,6 +141,8 @@ typedef struct dns_ssutable dns_ssutable_t; + typedef struct dns_stats dns_stats_t; + typedef uint32_t dns_rdatastatstype_t; + typedef struct dns_tkeyctx dns_tkeyctx_t; ++typedef struct dns_transport dns_transport_t; ++typedef struct dns_transport_list dns_transport_list_t; + typedef uint16_t dns_trust_t; + typedef struct dns_tsec dns_tsec_t; + typedef struct dns_tsig_keyring dns_tsig_keyring_t; +diff --git a/lib/dns/request.c b/lib/dns/request.c +index fb17ed2262e..463a7ca6d63 100644 +--- a/lib/dns/request.c ++++ b/lib/dns/request.c +@@ -399,12 +399,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) { + static isc_result_t + tcp_dispatch(bool newtcp, dns_requestmgr_t *requestmgr, + const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr, +- dns_dispatch_t **dispatchp) { ++ dns_transport_t *transport, dns_dispatch_t **dispatchp) { + isc_result_t result; + + if (!newtcp) { +- result = dns_dispatch_gettcp(requestmgr->dispatchmgr, destaddr, +- srcaddr, dispatchp); ++ result = dns_dispatch_gettcp2(requestmgr->dispatchmgr, destaddr, ++ srcaddr, transport, dispatchp); + if (result == ISC_R_SUCCESS) { + char peer[ISC_SOCKADDR_FORMATSIZE]; + +@@ -415,8 +415,8 @@ tcp_dispatch(bool newtcp, dns_requestmgr_t *requestmgr, + } + } + +- result = dns_dispatch_createtcp(requestmgr->dispatchmgr, srcaddr, +- destaddr, dispatchp); ++ result = dns_dispatch_createtcp2(requestmgr->dispatchmgr, srcaddr, ++ destaddr, transport, 0, dispatchp); + return (result); + } + +@@ -452,12 +452,12 @@ udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr, + static isc_result_t + get_dispatch(bool tcp, bool newtcp, dns_requestmgr_t *requestmgr, + const isc_sockaddr_t *srcaddr, const isc_sockaddr_t *destaddr, +- dns_dispatch_t **dispatchp) { ++ dns_transport_t *transport, dns_dispatch_t **dispatchp) { + isc_result_t result; + + if (tcp) { + result = tcp_dispatch(newtcp, requestmgr, srcaddr, destaddr, +- dispatchp); ++ transport, dispatchp); + } else { + result = udp_dispatch(requestmgr, srcaddr, destaddr, dispatchp); + } +@@ -472,6 +472,21 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, + unsigned int udpretries, isc_task_t *task, + isc_taskaction_t action, void *arg, + dns_request_t **requestp) { ++ return dns_request_createraw2(requestmgr, msgbuf, srcaddr, destaddr, ++ NULL, NULL, options, timeout, udptimeout, ++ udpretries, task, action, arg, requestp); ++} ++ ++isc_result_t ++dns_request_createraw2(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, ++ const isc_sockaddr_t *srcaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *transport, ++ isc_tlsctx_cache_t *tlsctx_cache, unsigned int options, ++ unsigned int timeout, unsigned int udptimeout, ++ unsigned int udpretries, isc_task_t *task, ++ isc_taskaction_t action, void *arg, ++ dns_request_t **requestp) { + dns_request_t *request = NULL; + isc_result_t result; + isc_mem_t *mctx = NULL; +@@ -553,7 +568,7 @@ dns_request_createraw(dns_requestmgr_t *requestmgr, isc_buffer_t *msgbuf, + again: + + result = get_dispatch(tcp, newtcp, requestmgr, srcaddr, destaddr, +- &request->dispatch); ++ transport, &request->dispatch); + if (result != ISC_R_SUCCESS) { + goto detach; + } +@@ -563,10 +578,10 @@ again: + dispopt |= DNS_DISPATCHOPT_FIXEDID; + } + +- result = dns_dispatch_add(request->dispatch, dispopt, request->timeout, +- destaddr, req_connected, req_senddone, +- req_response, request, &id, +- &request->dispentry); ++ result = dns_dispatch_add2(request->dispatch, dispopt, request->timeout, ++ destaddr, transport, tlsctx_cache, ++ req_connected, req_senddone, req_response, ++ request, &id, &request->dispentry); + if (result != ISC_R_SUCCESS) { + if ((options & DNS_REQUESTOPT_FIXEDID) != 0 && !newtcp) { + newtcp = true; +@@ -630,6 +645,21 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message, + unsigned int udptimeout, unsigned int udpretries, + isc_task_t *task, isc_taskaction_t action, void *arg, + dns_request_t **requestp) { ++ return dns_request_create2(requestmgr, message, srcaddr, destaddr, NULL, ++ NULL, options, key, timeout, udptimeout, ++ udpretries, task, action, arg, requestp); ++} ++ ++isc_result_t ++dns_request_create2(dns_requestmgr_t *requestmgr, dns_message_t *message, ++ const isc_sockaddr_t *srcaddr, ++ const isc_sockaddr_t *destaddr, ++ dns_transport_t *req_transport, ++ isc_tlsctx_cache_t *req_tls_ctx_cache, unsigned int options, ++ dns_tsigkey_t *key, unsigned int timeout, ++ unsigned int udptimeout, unsigned int udpretries, ++ isc_task_t *task, isc_taskaction_t action, void *arg, ++ dns_request_t **requestp) { + dns_request_t *request = NULL; + isc_result_t result; + isc_mem_t *mctx = NULL; +@@ -707,14 +737,15 @@ dns_request_create(dns_requestmgr_t *requestmgr, dns_message_t *message, + + again: + result = get_dispatch(tcp, false, requestmgr, srcaddr, destaddr, +- &request->dispatch); ++ req_transport, &request->dispatch); + if (result != ISC_R_SUCCESS) { + goto detach; + } + +- result = dns_dispatch_add( +- request->dispatch, 0, request->timeout, destaddr, req_connected, +- req_senddone, req_response, request, &id, &request->dispentry); ++ result = dns_dispatch_add2(request->dispatch, 0, request->timeout, ++ destaddr, req_transport, req_tls_ctx_cache, ++ req_connected, req_senddone, req_response, ++ request, &id, &request->dispentry); + if (result != ISC_R_SUCCESS) { + goto detach; + } +diff --git a/lib/dns/transport.c b/lib/dns/transport.c +index ae1ab7415b1..59eba1db252 100644 +--- a/lib/dns/transport.c ++++ b/lib/dns/transport.c +@@ -15,9 +15,11 @@ + + #include + #include ++#include + #include + #include + #include ++#include + #include + + #include +@@ -54,6 +56,7 @@ struct dns_transport { + char *ciphers; + uint32_t protocol_versions; + ternary_t prefer_server_ciphers; ++ bool always_verify_remote; + } tls; + struct { + char *endpoint; +@@ -332,6 +335,256 @@ dns_transport_get_prefer_server_ciphers(const dns_transport_t *transport, + return false; + } + ++void ++dns_transport_set_always_verify_remote(dns_transport_t *transport, ++ const bool always_verify_remote) { ++ REQUIRE(VALID_TRANSPORT(transport)); ++ REQUIRE(transport->type == DNS_TRANSPORT_TLS || ++ transport->type == DNS_TRANSPORT_HTTP); ++ ++ transport->tls.always_verify_remote = always_verify_remote; ++} ++ ++bool ++dns_transport_get_always_verify_remote(dns_transport_t *transport) { ++ REQUIRE(VALID_TRANSPORT(transport)); ++ REQUIRE(transport->type == DNS_TRANSPORT_TLS || ++ transport->type == DNS_TRANSPORT_HTTP); ++ ++ return transport->tls.always_verify_remote; ++} ++ ++isc_result_t ++dns_transport_get_tlsctx(dns_transport_t *transport, const isc_sockaddr_t *peer, ++ isc_tlsctx_cache_t *tlsctx_cache, isc_mem_t *mctx, ++ isc_tlsctx_t **pctx, ++ isc_tlsctx_client_session_cache_t **psess_cache) { ++ isc_result_t result = ISC_R_FAILURE; ++ isc_tlsctx_t *tlsctx = NULL, *found = NULL; ++ isc_tls_cert_store_t *store = NULL, *found_store = NULL; ++ isc_tlsctx_client_session_cache_t *sess_cache = NULL; ++ isc_tlsctx_client_session_cache_t *found_sess_cache = NULL; ++ uint32_t tls_versions; ++ const char *ciphers = NULL; ++ bool prefer_server_ciphers; ++ uint16_t family; ++ const char *tlsname = NULL; ++ ++ REQUIRE(VALID_TRANSPORT(transport)); ++ REQUIRE(transport->type == DNS_TRANSPORT_TLS); ++ REQUIRE(peer != NULL); ++ REQUIRE(tlsctx_cache != NULL); ++ REQUIRE(mctx != NULL); ++ REQUIRE(pctx != NULL && *pctx == NULL); ++ REQUIRE(psess_cache != NULL && *psess_cache == NULL); ++ ++ family = (isc_sockaddr_pf(peer) == PF_INET6) ? AF_INET6 : AF_INET; ++ ++ tlsname = dns_transport_get_tlsname(transport); ++ INSIST(tlsname != NULL && *tlsname != '\0'); ++ ++ /* ++ * Let's try to re-use the already created context. This way ++ * we have a chance to resume the TLS session, bypassing the ++ * full TLS handshake procedure, making establishing ++ * subsequent TLS connections faster. ++ */ ++ result = isc_tlsctx_cache_find(tlsctx_cache, tlsname, ++ isc_tlsctx_cache_tls, family, &found, ++ &found_store, &found_sess_cache); ++ if (result != ISC_R_SUCCESS) { ++ const char *hostname = ++ dns_transport_get_remote_hostname(transport); ++ const char *ca_file = dns_transport_get_cafile(transport); ++ const char *cert_file = dns_transport_get_certfile(transport); ++ const char *key_file = dns_transport_get_keyfile(transport); ++ const bool always_verify_remote = ++ dns_transport_get_always_verify_remote(transport); ++ char peer_addr_str[INET6_ADDRSTRLEN] = { 0 }; ++ isc_netaddr_t peer_netaddr = { 0 }; ++ bool hostname_ignore_subject; ++ ++ /* ++ * So, no context exists. Let's create one using the ++ * parameters from the configuration file and try to ++ * store it for further reuse. ++ */ ++ result = isc_tlsctx_createclient(&tlsctx); ++ if (result != ISC_R_SUCCESS) { ++ goto failure; ++ } ++ tls_versions = dns_transport_get_tls_versions(transport); ++ if (tls_versions != 0) { ++ isc_tlsctx_set_protocols(tlsctx, tls_versions); ++ } ++ ciphers = dns_transport_get_ciphers(transport); ++ if (ciphers != NULL) { ++ isc_tlsctx_set_cipherlist(tlsctx, ciphers); ++ } ++ ++ if (dns_transport_get_prefer_server_ciphers( ++ transport, &prefer_server_ciphers)) ++ { ++ isc_tlsctx_prefer_server_ciphers(tlsctx, ++ prefer_server_ciphers); ++ } ++ ++ if (always_verify_remote || hostname != NULL || ca_file != NULL) ++ { ++ /* ++ * The situation when 'found_store != NULL' while ++ * 'found == NULL' may occur as there is a one-to-many ++ * relation between cert stores and per-transport TLS ++ * contexts. That is, there could be one store ++ * shared between multiple contexts. ++ */ ++ if (found_store == NULL) { ++ /* ++ * 'ca_file' can equal 'NULL' here, in ++ * which case the store with system-wide ++ * CA certificates will be created. ++ */ ++ result = isc_tls_cert_store_create(ca_file, ++ &store); ++ ++ if (result != ISC_R_SUCCESS) { ++ goto failure; ++ } ++ } else { ++ store = found_store; ++ } ++ ++ INSIST(store != NULL); ++ if (hostname == NULL) { ++ /* ++ * If hostname is not specified, then use the ++ * peer IP address for validation. ++ */ ++ isc_netaddr_fromsockaddr(&peer_netaddr, peer); ++ isc_netaddr_format(&peer_netaddr, peer_addr_str, ++ sizeof(peer_addr_str)); ++ hostname = peer_addr_str; ++ } ++ ++ /* ++ * According to RFC 8310, Subject field MUST NOT ++ * be inspected when verifying hostname for DoT. ++ * Only SubjectAltName must be checked. ++ */ ++ hostname_ignore_subject = true; ++ result = isc_tlsctx_enable_peer_verification( ++ tlsctx, false, store, hostname, ++ hostname_ignore_subject); ++ if (result != ISC_R_SUCCESS) { ++ goto failure; ++ } ++ ++ /* ++ * Let's load client certificate and enable ++ * Mutual TLS. We do that only in the case when ++ * Strict TLS is enabled, because Mutual TLS is ++ * an extension of it. ++ */ ++ if (cert_file != NULL) { ++ INSIST(key_file != NULL); ++ ++ result = isc_tlsctx_load_certificate( ++ tlsctx, key_file, cert_file); ++ if (result != ISC_R_SUCCESS) { ++ goto failure; ++ } ++ } ++ } ++ ++ isc_tlsctx_enable_dot_client_alpn(tlsctx); ++ ++ isc_tlsctx_client_session_cache_create( ++ mctx, tlsctx, ++ ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE, ++ &sess_cache); ++ ++ found_store = NULL; ++ result = isc_tlsctx_cache_add(tlsctx_cache, tlsname, ++ isc_tlsctx_cache_tls, family, ++ tlsctx, store, sess_cache, &found, ++ &found_store, &found_sess_cache); ++ if (result == ISC_R_EXISTS) { ++ /* ++ * It seems the entry has just been created from ++ * within another thread while we were initialising ++ * ours. Although this is unlikely, it could happen ++ * after startup/re-initialisation. In such a case, ++ * discard the new context and associated data and use ++ * the already established one from now on. ++ * ++ * Such situation will not occur after the ++ * initial 'warm-up', so it is not critical ++ * performance-wise. ++ */ ++ INSIST(found != NULL); ++ isc_tlsctx_free(&tlsctx); ++ /* ++ * The 'store' variable can be 'NULL' when remote server ++ * verification is not enabled (that is, when Strict or ++ * Mutual TLS are not used). ++ * ++ * The 'found_store' might be equal to 'store' as there ++ * is one-to-many relation between a store and ++ * per-transport TLS contexts. In that case, the call to ++ * 'isc_tlsctx_cache_find()' above could have returned a ++ * store via the 'found_store' variable, whose value we ++ * can assign to 'store' later. In that case, ++ * 'isc_tlsctx_cache_add()' will return the same value. ++ * When that happens, we should not free the store ++ * object, as it is managed by the TLS context cache. ++ */ ++ if (store != NULL && store != found_store) { ++ isc_tls_cert_store_free(&store); ++ } ++ isc_tlsctx_client_session_cache_detach(&sess_cache); ++ /* Let's return the data from the cache. */ ++ *psess_cache = found_sess_cache; ++ *pctx = found; ++ } else { ++ /* ++ * Adding the fresh values into the cache has been ++ * successful, let's return them ++ */ ++ INSIST(result == ISC_R_SUCCESS); ++ *psess_cache = sess_cache; ++ *pctx = tlsctx; ++ } ++ } else { ++ /* ++ * The cache lookup has been successful, let's return the ++ * results. ++ */ ++ INSIST(result == ISC_R_SUCCESS); ++ *psess_cache = found_sess_cache; ++ *pctx = found; ++ } ++ ++ return ISC_R_SUCCESS; ++ ++failure: ++ if (tlsctx != NULL) { ++ isc_tlsctx_free(&tlsctx); ++ } ++ ++ /* ++ * The 'found_store' is being managed by the TLS context ++ * cache. Thus, we should keep it as it is, as it will get ++ * destroyed alongside the cache. As there is one store per ++ * multiple TLS contexts, we need to handle store deletion in a ++ * special way. ++ */ ++ if (store != NULL && store != found_store) { ++ isc_tls_cert_store_free(&store); ++ } ++ ++ return result; ++} ++ + static void + transport_destroy(dns_transport_t *transport) { + isc_refcount_destroy(&transport->references); +diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c +index 72b24e15ac3..73bd834070c 100644 +--- a/lib/dns/xfrin.c ++++ b/lib/dns/xfrin.c +@@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr, + *xfrp = xfr; + } + +-static isc_result_t +-get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx, +- isc_tlsctx_client_session_cache_t **psess_cache) { +- isc_result_t result = ISC_R_FAILURE; +- isc_tlsctx_t *tlsctx = NULL, *found = NULL; +- isc_tls_cert_store_t *store = NULL, *found_store = NULL; +- isc_tlsctx_client_session_cache_t *sess_cache = NULL, +- *found_sess_cache = NULL; +- uint32_t tls_versions; +- const char *ciphers = NULL; +- bool prefer_server_ciphers; +- const uint16_t family = isc_sockaddr_pf(&xfr->primaryaddr) == PF_INET6 +- ? AF_INET6 +- : AF_INET; +- const char *tlsname = NULL; +- +- REQUIRE(psess_cache != NULL && *psess_cache == NULL); +- REQUIRE(pctx != NULL && *pctx == NULL); +- +- INSIST(xfr->transport != NULL); +- tlsname = dns_transport_get_tlsname(xfr->transport); +- INSIST(tlsname != NULL && *tlsname != '\0'); +- +- /* +- * Let's try to re-use the already created context. This way +- * we have a chance to resume the TLS session, bypassing the +- * full TLS handshake procedure, making establishing +- * subsequent TLS connections for XoT faster. +- */ +- result = isc_tlsctx_cache_find(xfr->tlsctx_cache, tlsname, +- isc_tlsctx_cache_tls, family, &found, +- &found_store, &found_sess_cache); +- if (result != ISC_R_SUCCESS) { +- const char *hostname = +- dns_transport_get_remote_hostname(xfr->transport); +- const char *ca_file = dns_transport_get_cafile(xfr->transport); +- const char *cert_file = +- dns_transport_get_certfile(xfr->transport); +- const char *key_file = +- dns_transport_get_keyfile(xfr->transport); +- char primary_addr_str[INET6_ADDRSTRLEN] = { 0 }; +- isc_netaddr_t primary_netaddr = { 0 }; +- bool hostname_ignore_subject; +- /* +- * So, no context exists. Let's create one using the +- * parameters from the configuration file and try to +- * store it for further reuse. +- */ +- result = isc_tlsctx_createclient(&tlsctx); +- if (result != ISC_R_SUCCESS) { +- goto failure; +- } +- tls_versions = dns_transport_get_tls_versions(xfr->transport); +- if (tls_versions != 0) { +- isc_tlsctx_set_protocols(tlsctx, tls_versions); +- } +- ciphers = dns_transport_get_ciphers(xfr->transport); +- if (ciphers != NULL) { +- isc_tlsctx_set_cipherlist(tlsctx, ciphers); +- } +- +- if (dns_transport_get_prefer_server_ciphers( +- xfr->transport, &prefer_server_ciphers)) +- { +- isc_tlsctx_prefer_server_ciphers(tlsctx, +- prefer_server_ciphers); +- } +- +- if (hostname != NULL || ca_file != NULL) { +- /* +- * The situation when 'found_store != NULL' while 'found +- * == NULL' might appear as there is one to many +- * relation between per transport TLS contexts and cert +- * stores. That is, there could be one store shared +- * between multiple contexts. +- */ +- if (found_store == NULL) { +- /* +- * 'ca_file' can equal 'NULL' here, in +- * that case the store with system-wide +- * CA certificates will be created, just +- * as planned. +- */ +- result = isc_tls_cert_store_create(ca_file, +- &store); +- +- if (result != ISC_R_SUCCESS) { +- goto failure; +- } +- } else { +- store = found_store; +- } +- +- INSIST(store != NULL); +- if (hostname == NULL) { +- /* +- * If CA bundle file is specified, but +- * hostname is not, then use the primary +- * IP address for validation, just like +- * dig does. +- */ +- INSIST(ca_file != NULL); +- isc_netaddr_fromsockaddr(&primary_netaddr, +- &xfr->primaryaddr); +- isc_netaddr_format(&primary_netaddr, +- primary_addr_str, +- sizeof(primary_addr_str)); +- hostname = primary_addr_str; +- } +- /* +- * According to RFC 8310, Subject field MUST NOT +- * be inspected when verifying hostname for DoT. +- * Only SubjectAltName must be checked. +- */ +- hostname_ignore_subject = true; +- result = isc_tlsctx_enable_peer_verification( +- tlsctx, false, store, hostname, +- hostname_ignore_subject); +- if (result != ISC_R_SUCCESS) { +- goto failure; +- } +- +- /* +- * Let's load client certificate and enable +- * Mutual TLS. We do that only in the case when +- * Strict TLS is enabled, because Mutual TLS is +- * an extension of it. +- */ +- if (cert_file != NULL) { +- INSIST(key_file != NULL); +- +- result = isc_tlsctx_load_certificate( +- tlsctx, key_file, cert_file); +- if (result != ISC_R_SUCCESS) { +- goto failure; +- } +- } +- } +- +- isc_tlsctx_enable_dot_client_alpn(tlsctx); +- +- isc_tlsctx_client_session_cache_create( +- xfr->mctx, tlsctx, +- ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE, +- &sess_cache); +- +- found_store = NULL; +- result = isc_tlsctx_cache_add(xfr->tlsctx_cache, tlsname, +- isc_tlsctx_cache_tls, family, +- tlsctx, store, sess_cache, &found, +- &found_store, &found_sess_cache); +- if (result == ISC_R_EXISTS) { +- /* +- * It seems the entry has just been created from within +- * another thread while we were initialising +- * ours. Although this is unlikely, it could happen +- * after startup/re-initialisation. In such a case, +- * discard the new context and associated data and use +- * the already established one from now on. +- * +- * Such situation will not occur after the +- * initial 'warm-up', so it is not critical +- * performance-wise. +- */ +- INSIST(found != NULL); +- isc_tlsctx_free(&tlsctx); +- /* +- * The 'store' variable can be 'NULL' when remote server +- * verification is not enabled (that is, when Strict or +- * Mutual TLS are not used). +- * +- * The 'found_store' might be equal to 'store' as there +- * is one-to-many relation between a store and +- * per-transport TLS contexts. In that case, the call to +- * 'isc_tlsctx_cache_find()' above could have returned a +- * store via the 'found_store' variable, whose value we +- * can assign to 'store' later. In that case, +- * 'isc_tlsctx_cache_add()' will return the same value. +- * When that happens, we should not free the store +- * object, as it is managed by the TLS context cache. +- */ +- if (store != NULL && store != found_store) { +- isc_tls_cert_store_free(&store); +- } +- isc_tlsctx_client_session_cache_detach(&sess_cache); +- /* Let's return the data from the cache. */ +- *psess_cache = found_sess_cache; +- *pctx = found; +- } else { +- /* +- * Adding the fresh values into the cache has been +- * successful, let's return them +- */ +- INSIST(result == ISC_R_SUCCESS); +- *psess_cache = sess_cache; +- *pctx = tlsctx; +- } +- } else { +- /* +- * The cache lookup has been successful, let's return the +- * results. +- */ +- INSIST(result == ISC_R_SUCCESS); +- *psess_cache = found_sess_cache; +- *pctx = found; +- } +- +- return (ISC_R_SUCCESS); +- +-failure: +- if (tlsctx != NULL) { +- isc_tlsctx_free(&tlsctx); +- } +- +- /* +- * The 'found_store' is being managed by the TLS context +- * cache. Thus, we should keep it as it is, as it will get +- * destroyed alongside the cache. As there is one store per +- * multiple TLS contexts, we need to handle store deletion in a +- * special way. +- */ +- if (store != NULL && store != found_store) { +- isc_tls_cert_store_free(&store); +- } +- +- return (result); +-} +- + static isc_result_t + xfrin_start(dns_xfrin_ctx_t *xfr) { + isc_result_t result; +@@ -1232,7 +1004,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) { + connect_xfr, 30000, 0); + break; + case DNS_TRANSPORT_TLS: { +- result = get_create_tlsctx(xfr, &tlsctx, &sess_cache); ++ result = dns_transport_get_tlsctx( ++ xfr->transport, &xfr->primaryaddr, xfr->tlsctx_cache, ++ xfr->mctx, &tlsctx, &sess_cache); + if (result != ISC_R_SUCCESS) { + goto failure; + } +-- +2.47.0 + diff --git a/bind.spec b/bind.spec index 0439976..09d3aed 100644 --- a/bind.spec +++ b/bind.spec @@ -87,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.31 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -128,6 +128,13 @@ Patch26: bind-9.18-unittest-netmgr-unstable.patch # Correct support for building without openssl/engine.h header # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593 Patch27: bind-9.20-openssl-no-engine.patch +# Downstream backport from 9.20 +# https://issues.redhat.com/browse/FREEIPA-11706 +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751 +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6752 +Patch28: bind-9.20-nsupdate-tls.patch +# Man change for patch28 nsupdate +Patch29: bind-9.20-nsupdate-tls-doc.patch %{?systemd_ordering} Requires: coreutils @@ -982,6 +989,9 @@ fi; %endif %changelog +* Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 +- Add nsupdate TLS support (FREEIPA-11706) + * Thu Nov 14 2024 Petr Menšík - 32:9.18.31-1 - Update to 9.18.31 (#2319214) From 0dcd8bfd6d2e5f56a07889f3018a74f8736664f6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 9 Dec 2024 21:11:44 +0100 Subject: [PATCH 056/144] Include a test for nsupdate changes --- bind-9.20-nsupdate-tls-test.patch | 1630 +++++++++++++++++++++++++++++ bind.spec | 3 + 2 files changed, 1633 insertions(+) create mode 100644 bind-9.20-nsupdate-tls-test.patch diff --git a/bind-9.20-nsupdate-tls-test.patch b/bind-9.20-nsupdate-tls-test.patch new file mode 100644 index 0000000..65d825d --- /dev/null +++ b/bind-9.20-nsupdate-tls-test.patch @@ -0,0 +1,1630 @@ +From 2e0dd9a0a3e77f21a37d894133d301afdac6db7b Mon Sep 17 00:00:00 2001 +From: Aram Sargsyan +Date: Wed, 21 Sep 2022 13:15:50 +0000 +Subject: [PATCH] Extend the nsupdate system test with DoT-related checks + +Add a simple test PKI based on the existing one in the doth test. + +Check ephemeral, forward-secrecy, and forward-secrecy-mutual-tls +TLS configurations with different scenarios. + +(cherry picked from commit f2bb80d6ae172f6fd7943bf913d1b0566b5df352) +--- + bin/tests/system/nsupdate/.gitignore | 5 + + bin/tests/system/nsupdate/CA/CA-other.pem | 26 +++ + bin/tests/system/nsupdate/CA/CA.cfg | 77 +++++++ + bin/tests/system/nsupdate/CA/CA.pem | 29 +++ + bin/tests/system/nsupdate/CA/README | 2 + + .../CA/certs/srv01.client01.example.nil.key | 40 ++++ + .../CA/certs/srv01.client01.example.nil.pem | 93 +++++++++ + .../srv01.client02-expired.example.nil.key | 40 ++++ + .../srv01.client02-expired.example.nil.pem | 93 +++++++++ + .../CA/certs/srv01.crt01.example.nil.key | 40 ++++ + .../CA/certs/srv01.crt01.example.nil.pem | 93 +++++++++ + .../certs/srv01.crt02-expired.example.nil.key | 40 ++++ + .../certs/srv01.crt02-expired.example.nil.pem | 93 +++++++++ + bin/tests/system/nsupdate/CA/index.txt | 4 + + bin/tests/system/nsupdate/CA/index.txt.attr | 1 + + .../nsupdate/CA/newcerts/70B9F4EB2FA19598.pem | 93 +++++++++ + .../nsupdate/CA/newcerts/70B9F4EB2FA19599.pem | 93 +++++++++ + .../nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem | 93 +++++++++ + .../nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem | 93 +++++++++ + .../system/nsupdate/CA/private/CA-other.key | 39 ++++ + bin/tests/system/nsupdate/CA/private/CA.key | 39 ++++ + bin/tests/system/nsupdate/CA/serial | 1 + + bin/tests/system/nsupdate/dhparam3072.pem | 11 + + bin/tests/system/nsupdate/ns1/named.conf.in | 34 +++ + bin/tests/system/nsupdate/ns10/named.conf.in | 2 + + bin/tests/system/nsupdate/tests.sh | 193 ++++++++++++++++++ + 26 files changed, 1367 insertions(+) + create mode 100644 bin/tests/system/nsupdate/.gitignore + create mode 100644 bin/tests/system/nsupdate/CA/CA-other.pem + create mode 100644 bin/tests/system/nsupdate/CA/CA.cfg + create mode 100644 bin/tests/system/nsupdate/CA/CA.pem + create mode 100644 bin/tests/system/nsupdate/CA/README + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key + create mode 100644 bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem + create mode 100644 bin/tests/system/nsupdate/CA/index.txt + create mode 100644 bin/tests/system/nsupdate/CA/index.txt.attr + create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem + create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem + create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem + create mode 100644 bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem + create mode 100644 bin/tests/system/nsupdate/CA/private/CA-other.key + create mode 100644 bin/tests/system/nsupdate/CA/private/CA.key + create mode 100644 bin/tests/system/nsupdate/CA/serial + create mode 100644 bin/tests/system/nsupdate/dhparam3072.pem + +diff --git a/bin/tests/system/nsupdate/.gitignore b/bin/tests/system/nsupdate/.gitignore +new file mode 100644 +index 0000000..df5fe68 +--- /dev/null ++++ b/bin/tests/system/nsupdate/.gitignore +@@ -0,0 +1,5 @@ ++# temporary files generated by "openssl ca" ++/CA/*.old ++# there is little point in keeping the certificate requests ++# for the issued certificates ++/CA/certs/*.csr +diff --git a/bin/tests/system/nsupdate/CA/CA-other.pem b/bin/tests/system/nsupdate/CA/CA-other.pem +new file mode 100644 +index 0000000..6bdbeda +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/CA-other.pem +@@ -0,0 +1,26 @@ ++-----BEGIN CERTIFICATE----- ++MIIEZTCCAs0CFDYlin3oeYDu16bFItl9tGZz1Ra4MA0GCSqGSIb3DQEBCwUAMG4x ++CzAJBgNVBAYTAlVBMRcwFQYDVQQIDA5LaGFya2l2IE9ibGFzdDEQMA4GA1UEBwwH ++S2hhcmtpdjEMMAoGA1UECgwDSVNDMSYwJAYDVQQLDB1Tb2Z0d2FyZSBFbmdlbmVl ++cmluZyAoQklORCA5KTAgFw0yMjA5MDcyMTIzNTBaGA8yMDUyMDgzMDIxMjM1MFow ++bjELMAkGA1UEBhMCVUExFzAVBgNVBAgMDktoYXJraXYgT2JsYXN0MRAwDgYDVQQH ++DAdLaGFya2l2MQwwCgYDVQQKDANJU0MxJjAkBgNVBAsMHVNvZnR3YXJlIEVuZ2Vu ++ZWVyaW5nIChCSU5EIDkpMIIBojANBgkqhkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA ++10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9IYVyR/0Mibg79FAs+ ++rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50OeQnbbTrBl0PuNwvzE ++kbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmwUTX5Jxndsjydk/zW ++/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA+45GT2lHu07xc+cV ++eZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QBXkotnq3rHnrI/ku6 ++dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9awEqwvy8uVbGkTmUZd ++tjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGWvcfMRZZhWaoHyhnH ++g9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeYfcQ5eaIZ3OuIpyQz ++AgMBAAEwDQYJKoZIhvcNAQELBQADggGBAKdQkmmyUqcE1by7AeHoxkqFgqUeSAlh ++flXi5DD+j5+Op2GAUrx84LGy4+heKEwAkV5Cw2c9IMHmDDMnGe/g4FjBS+dTZsTs ++JRXXDR7t20eWiBpvO/3IMqVpPq9CAQY1L9PYAVuVM5cwdzsJXdH82z2BZ3Ttg3GX ++NPnybxzD/auC051vqEp28Jzbswd4c3VvTmRnYY7rYNNKnLD7812BIp7lnE6s5X2D ++y0PPSYdhscTqfJV0+GDF5hUduOFX1xTcPlXaXfyKLLelqtrw40p3ynww9v/J4mwt ++FBV+a8gguM7tCZMoV/VJZghObglV/wpokAQchL/pnxL7+U8JklRqaU4DlxyGZ+K4 ++QlR5mJe19ZlkgHePk1MbwNZaTXjaOFirYmZzs4YynOp3iBHrW3CYY3kVlrUpKP08 ++o101hce32VxkyST6i5W24MU02O/wuPdyQpN+rJjYv32Axsrh/ePkI5qKew9eZ63i ++WzNb7BW1LrHrQ/lXoJ3ekRQd10UX3xhk/w== ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/CA.cfg b/bin/tests/system/nsupdate/CA/CA.cfg +new file mode 100644 +index 0000000..1a3ed65 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/CA.cfg +@@ -0,0 +1,77 @@ ++# See ../../doth/CA/ca.cfg for more information ++ ++# certificate authority configuration ++[ca] ++default_ca = CA_default # The default ca section ++ ++[CA_default] ++dir = . ++new_certs_dir = $dir/newcerts # new certs dir (must be created) ++certificate = $dir/CA.pem # The CA cert ++private_key = $dir/private/CA.key # CA private key ++ ++serial = $dir/serial # serial number file for the next certificate ++ # Update before issuing it: ++ # xxd -l 8 -u -ps /dev/urandom > ./serial ++database = $dir/index.txt # (must be created manually: touch ./index.txt) ++ ++default_days = 1 # how long to certify for ++ ++#default_crl_days = 30 # the number of days before the ++default_crl_days = 10950 # next CRL is due. That is the ++ # days from now to place in the ++ # CRL nextUpdate field. If CRL ++ # is expired, certificate ++ # verifications will fail even ++ # for otherwise valid ++ # certificates. Clients might ++ # cache the CRL, so the expiry ++ # period should normally be ++ # relatively short (default: ++ # 30) for production CAs. ++ ++default_md = sha256 # digest to use ++ ++policy = policy_default # default policy ++email_in_dn = no # Don't add the email into cert DN ++ ++name_opt = ca_default # Subject name display option ++cert_opt = ca_default # Certificate display option ++ ++# We need the following in order to copy Subject Alt Name(s) from a ++# request to the certificate. ++copy_extensions = copy # copy extensions from request ++ ++[policy_default] ++countryName = optional ++stateOrProvinceName = optional ++organizationalUnitName = optional ++commonName = supplied ++emailAddress = optional ++ ++# default certificate requests settings ++[req] ++# Options for the `req` tool (`man req`). ++default_bits = 3072 # for RSA only ++distinguished_name = req_default ++string_mask = utf8only ++# SHA-1 is deprecated, so use SHA-256 instead. ++default_md = sha256 ++# do not encrypt the private key file ++encrypt_key = no ++ ++[req_default] ++# See . ++countryName = Country Name (2 letter code) ++stateOrProvinceName = State or Province Name (full name) ++localityName = Locality Name (e.g., city) ++0.organizationName = Organization Name (e.g., company) ++organizationalUnitName = Organizational Unit Name (e.g. department) ++commonName = Common Name (e.g. server FQDN or YOUR name) ++emailAddress = Email Address ++# defaults ++countryName_default = UA ++stateOrProvinceName_default = Kharkiv Oblast ++localityName_default = Kharkiv ++0.organizationName_default = ISC ++organizationalUnitName_default = Software Engeneering (BIND 9) +diff --git a/bin/tests/system/nsupdate/CA/CA.pem b/bin/tests/system/nsupdate/CA/CA.pem +new file mode 100644 +index 0000000..1f725db +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/CA.pem +@@ -0,0 +1,29 @@ ++-----BEGIN CERTIFICATE----- ++MIIE3TCCA0WgAwIBAgIUeZPKrvbGEBZaRc2jNczlIsJXyPYwDQYJKoZIhvcNAQEL ++BQAwfTELMAkGA1UEBhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4G ++A1UEBwwHS2hhcmtpdjEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0 ++aXVtMRwwGgYDVQQDDBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDEyNDEyNDA1 ++NFoYDzIwNTIwMTE3MTI0MDU0WjB9MQswCQYDVQQGEwJVQTEYMBYGA1UECAwPS2hh ++cmtpdiBPYmxhc3QnMRAwDgYDVQQHDAdLaGFya2l2MSQwIgYDVQQKDBtJbnRlcm5l ++dCBTeXN0ZW1zIENvbnNvcnRpdW0xHDAaBgNVBAMME2NhLnRlc3QuZXhhbXBsZS5j ++b20wggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQCi6hEegBzpUKbE1NTo ++Z7uz7EMUY7TBckkiw/7ydTLKNa8YI4JpBguFvWQsDY0dGFJIoVwyHyNx3seW/LoI ++B5zWPZ2xbOvLLceA+t2NZpbc98E7jUOVS123yED+nqlfZjCq9Zt0r/ezwnQtjnFF ++ko1mcU4H9Jvg8aIgnU2AxE78zciU9CY8799pFFNThIjbooI8oVbfjbzbpmLzxjA5 ++3rDmZBTh+ySTlMa2U2oT4WPjRltZWnJVegRRLpG95GnTbQ1fkJAbj1Iu10XTkCee ++wBOqaA1UJem0a6pby5odE414Y7c0ETKcmaJtYENQyO0IJwZWDKtVe5OTIAklakia ++eyFTCAw1h5tHCYLaJW/Yu2wlLl5RNQcRZ9+cWXnldTY+TI1iBjfmADjLdKJYUlhX ++z7kWJtTi63Sdv6WYcEXxaWpxT+R3e2kaR/R7GOo4gdkWpX1siGlRteHHH2/36CSQ ++ZD2etcTUpGW+KDHFR4grnEfL1rt9UgvCjpa4KcssmZtWSSUCAwEAAaNTMFEwHQYD ++VR0OBBYEFHyJ6Fzr5R9ySATFj/uSCJz1YCY5MB8GA1UdIwQYMBaAFHyJ6Fzr5R9y ++SATFj/uSCJz1YCY5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggGB ++AF3y0hvzyZWtmuG1JwIcOcc1aPl1KdRy8bao/5iHYGYYrsdDgcO5/e+y9S/izalc ++TdW7SKB5iBOCiE8fBNtToCvGP+fxNxHijpAmTr37G5sWuSo1T1VYFizHWL+df/Ig ++TcSvDrEjSnAwaEdNJUWtjoIC4VzNKTLtZf16QIATTzTZa3bfgSetpWS7LhLQbHod ++CSGI2QB1LRbqGC+a1Y85QxHv81jWzPWPzXYvnOLrDdQyBMOBcxDzrN4b6zg+5Itz ++qGYt+IS71jAH0IhxAyD/U5n1jGJv02BnSq0ynLEOD6gsnZjqAwPbt/PM9pGbtbXO ++70Q9rxr+vQc1IISKAEiH3txaEPi10wU98d6LbInJvQrmgHo/ntet8skWNYuxlEzS ++wvynuE9KvvQtOTodWt5AePtKrhHdxu527a4CHVp59nYUjKSdMKjvmhMRXM1cNjFE ++rA/pyyhozR47w3RzHMJVHw2GJ2B/HeqmxpXr1CmJjoRP38QCR7N+mqiZy85Fq2j2 ++8Q== ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/README b/bin/tests/system/nsupdate/CA/README +new file mode 100644 +index 0000000..13069ca +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/README +@@ -0,0 +1,2 @@ ++Please take a look at the contents of the CA.cfg file for further ++instructions and configurations options. +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key +new file mode 100644 +index 0000000..5e3420e +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.key +@@ -0,0 +1,40 @@ ++-----BEGIN PRIVATE KEY----- ++MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQCrYC6cYeOJxlIr ++vOnhBf0YZUIg9lYWQDPSy5/37yJUp8lVcMpS8OKiWDh/EK0rBeARtmkhfy04Vt3V ++5PPepzI19zMqUoCut9Z8NXTDDIrDOhhhaHNiWFb/eCVXHHu+mIgh3RyKE6WaUkiY ++2T3EKKZ+mxFWfs4Ju1GJiqgbALVzK0GTsWJAMCnq9qPnvPDpngcrrqmgHU3Z+BhN ++g0dOaO5XyFUVhjxtHvUx8d7Pwn5rjiJaxXav0AHeq3oDspYzzKAmrt7EvXaFlseI ++5Ea8P8ZUyZWDh5xJDTHdxBdSmeRlSZud863OZghX9IO+XofaQloBKm1o0Y042Riu ++Xi5UcosBRZav9aPQKV0ii7TUMK8CNsUt6SnrLOpqfiezcPyHHyvEsTqmwum3wm9G ++Y7eWLlPYt83D9LVtsvxXSayfmMn+tPV8k0guk9zpGFRjXxij5xKq/jjwc+UXHv5A ++ZYGoj2BGwhbyqJ2xG7zOBd43sqiGR72Nkt7g5UKJuOP4sSQIfpkCAwEAAQKCAYEA ++i3PT2fsp3cXcvayXID3wSvayzgHF4YtS4FhEDsuvwvVZtsX2TXGo6fQh3Pvj/dtl ++DuTBPbmwQWUmVNRewbKKADHsl6bVAdekmCQjpEhDbkOK7VDCe6do+693qyAJbfnO ++5Md5Xr5IBoCohIBaa5Gskd97R0gePvsHiYWj730vKc1sKlOwoIzQv1r92yf7Xg7y ++xM/3RcwyuojQtdp6nspyEEp7Oe2mpCEJ4x9vcN5SYxEg0X5Xaw83RkuBGRsscHA0 ++GN+4eJ59Ld1R9uktLYvUA06ZdoAVZyblE4xxjk2vueE3K2/kT2ooKHVWulGI+PnF ++2xYedZsZkgwLbXcEhPXBo3vMTjzRlePh668ULi9B6ntMjWpCSCvGnz142Uwatfq0 ++PeasBVgRngu9Wg+smkA4kHnDi7ih3zpLh6sTcOKL7F1cBgvtjgIyzZDp9eJUEfVH ++G/89mTCswhqV1WtQ3n9zbYVbSK9vaAxCrfK50pG+IfHXG9EqnrQPzKsRxNsDpN91 ++AoHBANeNLQb3gSk6sBg53smh9oFUEwwgAjHY31ZOOInO4X7udXrtRcON6SCkZjaD ++6y1N3Orjama6mr+/eHxJeDEbWBB7INOsaqHewoQF8qaOa7HHmCbXcUIlAQFvaE6e ++Qd5e+YHLmbYZbkPfntqWmXuSmk7hUxjnPPOv1P9sgv/3b4TJQJ4FEJasKpWgIOAy ++3g8UrjtbI3ITSo3SKCei3wvOCzIdnzwgcHY420jU1yU/oDzN07D4K0iODAbasUl1 ++ZH5UvwKBwQDLiNual2aCUtjKAoRLnGDtP6LOYV3eXchBrywIj2tNAMlD7TXbjG04 ++Le+I9O+azRorvXQ2WBBIYzka1JozK8WTsxkQYRd9AEy2AsQgPlK5hfy3xcGxSscC ++vdxSdQQQ/ASKHHbCTKhDhnA2b2fvLhWxZqsbSO4hSmvjXrSUpGrAABFipK9VqS6Y ++Sg6uEo1AlTrwsGW66LHpFeG6YQ0uj4sF0x5mzH7R50And30lVg8DjJASdClzOIWJ ++WV+3opbgSqcCgcEAvGGJhJkyrJG57LJG3vlJsmWD8AjZYi8joQ3jo6zGrmRBEBnl ++6q5PnFORcPuBwapW9IGkL/vN2t6/sf+Tp3c6U80IN3ZsCuPgI/n+w0mdHVZOx0Nq ++nGAyrMps4qi08F8YuDL0N42qLG93KZqMsM7DRUTvlsghIOf+wuxW4NWjBO3OJ0xN ++3yDAZtv3X3mVUKDGVOGl7MCnW6LbrShOvsZoSnhQ/f9ryiaOnuxEyyz8IafQ5s09 ++Jr/eCu9+GbEbDr2JAoHAXUZg7Z3IupzhAOLaYhROTyvEnrP8YrWz2nY+xcWENQvR ++MLH65pyaSQ60IZ2uWND512XBZk5BWAsw1lzsNdsvdpqzN9BnBUAn55mo6+Xj32XK ++BSY5t9g/D8CWwasiq+3y3qBgxHaA/kEUF75CcVg7VMtqStzHVLZYbyCtvRkEWu0t ++CnnSaH1Z/yyhQaD63sgE9NzCIkAVmG4QvmtPsTDTU14HJrE8xVEnE28tCPlBdCzs ++sahOfqE+gU1WEkAOyMctAoHAASVc1KFfBI48tM+cr8vDt1QklVgnKn44DL6HF5tp ++iA8/xhB2fHKq6a+xuGxubXo7jo0KbKyYXPFyE5MDrzIDKp0GLUr7WtaunNVMKbKs ++B/2YSw+PELoIc5GpiH4lqP5iFYyHKmJighou4oxLcjMlHpRWUERPdxA+L6zggPyJ ++56PX2tcezcCZMVm65VpHsX3CqEQyWnFDCt0zclRNFWPKCENsl10emenBZVnxb8fc ++smxv7aRpgoWBRa5vinKvOv2T ++-----END PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem +new file mode 100644 +index 0000000..f546d35 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client01.example.nil.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 8 08:20:17 2022 GMT ++ Not After : Aug 31 08:20:17 2052 GMT ++ Subject: CN=srv01.client01.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05: ++ fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef: ++ 22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10: ++ ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4: ++ f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35: ++ 74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78: ++ 25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52: ++ 48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb: ++ 51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30: ++ 29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d: ++ 4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86: ++ 3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5: ++ 76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae: ++ de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9: ++ 95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49: ++ 9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42: ++ 5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72: ++ 8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30: ++ af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70: ++ fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63: ++ b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49: ++ ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18: ++ 54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e: ++ fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b: ++ bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5: ++ 42:89:b8:e3:f8:b1:24:08:7e:99 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.client01.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f: ++ 5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba: ++ 51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c: ++ 19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69: ++ 26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b: ++ 4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb: ++ 73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17: ++ ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e: ++ 01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07: ++ 79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9: ++ a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14: ++ 89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88: ++ ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d: ++ f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d: ++ 4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6: ++ f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98: ++ bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80: ++ af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91: ++ 76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31: ++ f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1: ++ d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79: ++ 97:e3:7f:2a:14:73 ++-----BEGIN CERTIFICATE----- ++MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx ++MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC ++AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl ++QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3 ++MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b ++EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI ++VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ ++lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF ++lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3 ++zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC ++FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE ++JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B ++AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl ++SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7 ++hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/ ++EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl ++lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD ++Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu ++ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp ++jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg ++j5x5l+N/KhRz ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key +new file mode 100644 +index 0000000..d8f68ac +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.key +@@ -0,0 +1,40 @@ ++-----BEGIN PRIVATE KEY----- ++MIIG/wIBADANBgkqhkiG9w0BAQEFAASCBukwggblAgEAAoIBgQDAEScXJTqthaA7 ++WQsiZGN9uwUyNU9o1RkrzUa94rZCjAjPCQ2ozVjZG3fbF4r88FXy4VD0/ZCqSRVd ++6ptaR8QvggdGh/YF7xUCpDyh2vxbdTYS9xJQVfi+DH0hkeKS2EE/cf6yF8BoHQm+ ++/MQk7O/SXFKpT9ZdMLiraC456YtbxvBkQve4vbKQMiJovDhwLxSuyHxjBNURsgrx ++jhMQsjtp9P464vFYViiTwSiqpxnJkRJD+PUdNFg9Mp8RZ9EfU9Tg1Qx4LG84P+GJ ++abUJPBL0qe7lL8VHZaaC+up4SDGJEbYjiiftfB1t6KugKd5A9PKbYSLanCIy9z34 ++TOE4p+LDr6Rnf5Sk/VIliU30mtY1upgg8UvJpc+sclgqzTtKPukEMeKadDLVUmA0 ++rQyFAmVYQXQqV5E0VTapFFtFzCgn1226VaPdnwAEpEPCr1yvhlOm1adJqjHWXpJ9 ++Jt2N9IeKm0joJfTHNMrP4/eEGTtDx2q42m5vha+NDPt86sdznJsCAwEAAQKCAYBv ++D3wTHiv3+rTUnICbuoDtSx+OENWCQPb1JRYq5tWNVXwie5GycktV/1QnFE4CRNbu ++QuuVPqpQTUJVtDtw0N7Yuc+LMUNJ2x3DEUUeMoqKOBS0krm8SnozKvWQW9MwJmxU ++S46DXMida20fSvoAgCGM+mWyEcBa0rl2JB/WzP0QbNDEqRSldsuyJctP1Mat2AuV ++pciHWVv7h4BcfVL47Jb+hfQcCO6Vrfx4s9DYHRgEPibZtzPFV2dOu97PKcD65HXL ++o30hP9xhhy8nT4oFijEQ9rPi0JvOpvB5bJQ42OAznWByR0uL9ZoXopkYDDemzt7t ++D5F9X/2iH9dv3GA0AiPCF6DjyVMwbh/NOt8oxS+NMY2RPlzA+r9SZpCcyPFk1hMi ++LHzrPU8dwC2GmaMKB3Uw/bA5ufw3IpcbJIZEBJQ5Ttf7zEFcfDo/jidTz3ZOptOT ++kSKoCN73AUlmcx8UoKF9JwcpJq63ww8eef+1HLL5Dk0uM4YSKd15gI6477RgfgEC ++gcEA48ZpMdz4mz7rO0CMyPfOLdHOcxHuZI4oJg6gJ1IBxCnIB1mhy6xn+NdkS5Mm ++/1S6eFuo+DgabXO/A2xSDrJ4Lnlf4H4OjQKCeJdO9JglHjdTzv7TB8Vm/IdGC0Jk ++eDRY1lmkSXcdSmGqPVgd2AHpkcTgLyUb+iIWkIspelsaNNQBHJzd4S/x9Pp/ftrg ++CpfwGKsmNia3n3m21lkeTLtKVsPuK8CAJnCDaEI22mhV83x6grPxA0GVFZ0VHfCL ++qZVhAoHBANfd/oVKWGTiJzlc+aHJAb4XRROQzCL4yi6uspT3h9QN5QiFD7PhgIOg ++mES35mpGocN78oc19zhfD4XLNkLbQuMQhpk0D4MjLfUS/IskFoOJWuQbIBPqrMzY ++Z93DDkiBno2As1IN7fZ9amw7Thcf8Qt6yVNFjIMcfk63VmC+AnPUj4KCes7IuGDH ++SA/LjjiKgMa3g3I5/HVB6q1dyZQggBF3dCJ/V8ecgtdibUfzvvViZ52Hd7XDs1SX ++yCas+IE3ewKBwQC/YSFYBRtZjacmFNl1rkitVQCKzMEp+guf1mAYSZ40TQrFqjj4 ++obaGbavWmCCHHpDCufkh/jmuRzdyT9wufyPdoJu/Sws8zaQEYNW1S/S8C66+WHvF ++psYeXiarJTC3kvwlthIErDGPIrpgap5AtXKjyPC4jAySwXuGHXdPWCaPxqXcfa0s ++HRXGSYdAdfUS0ZCpmXw0uZlFRIYsWZrMy/ztJBkE5+yE37p5qlDeeBXnzGo/UaOq ++obr6+w4YJtmiNmECgcEAsSAPqzEgrM7AnpoCn1S+4EpZvL8wMXXw+DMSh5dAVah9 ++COudwdzDxb2tk51OLF/+dderXnTSgOfHZeIjiOI+1PAHcYg9Pj5MhG5q2ITpEE9R ++TCBRxuXlmkPrnhRiEO6CudsjyK1zV7D69QoIfoMQF3pN3c0QibiEj3RyJPlkK8T7 ++aHxF5ozedVKvd35wGUbUebm02rJny5Mly9FMCQZN74cTvQa+cSSkW7UAtGx1gQWY ++vbKdcIC/Eidk7Q867VQnAoHBAKqiugBoItfhuN1GUI5bqIx0ya4DSVECpSFiF8h3 ++eK+bO7uG4OBH+qoAmC8EqQNVPtivxpsA2aBvdoUMTYPu/S5cVFXcMkEJ1jX8L8IZ ++ImE5LXC+SiZO3G9SyHfj+rgwr66G7NWDVJhZ2t/56s4qEdewwR4Vjm99gVvHHAFP ++rrkT9jfHVmozRroL/XAMNITZpJw+vwPMwWOaRncjzyyPp0JWt0h+Wv0+A3SjBIh2 ++c+Ctg5Ig6vwr2weVc7s/4jz9Kg== ++-----END PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem +new file mode 100644 +index 0000000..365b493 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.client02-expired.example.nil.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 7 08:14:18 2022 GMT ++ Not After : Sep 8 08:14:18 2022 GMT ++ Subject: CN=srv01.client02-expired.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64: ++ 63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2: ++ b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17: ++ 8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea: ++ 9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4: ++ 3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c: ++ 7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d: ++ 09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30: ++ b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd: ++ b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04: ++ d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2: ++ f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8: ++ f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5: ++ 0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9: ++ ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11: ++ b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4: ++ f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7: ++ e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a: ++ d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd: ++ 3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad: ++ 0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14: ++ 5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4: ++ 43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e: ++ 92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34: ++ ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85: ++ af:8d:0c:fb:7c:ea:c7:73:9c:9b ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4: ++ bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a: ++ c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb: ++ ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb: ++ ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22: ++ 12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31: ++ e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48: ++ 07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17: ++ 7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa: ++ 4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82: ++ b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28: ++ 33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c: ++ 51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1: ++ 6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e: ++ 5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db: ++ 52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54: ++ e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7: ++ 4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab: ++ 70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55: ++ 2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e: ++ e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b: ++ 44:b8:6f:2b:af:6e ++-----BEGIN CERTIFICATE----- ++MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4 ++MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl ++Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ ++CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q ++m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78 ++xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO ++ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp ++tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM ++4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt ++DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m ++3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz ++BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK ++NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE ++msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6 ++w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX ++XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn +++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR ++ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+ ++knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z ++3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m ++GJALaoX444MqfJHDUhxtqitEuG8rr24= ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key +new file mode 100644 +index 0000000..8a1f5dc +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.key +@@ -0,0 +1,40 @@ ++-----BEGIN PRIVATE KEY----- ++MIIG/AIBADANBgkqhkiG9w0BAQEFAASCBuYwggbiAgEAAoIBgQC0mmOYBK29qym/ ++InBUMN/Ha3dduF4LzQ6gbHQ350t40Zbaypl9krHkGgoetBy+7syVjFIDk4XhQENo ++hoa8amJt1grK7k+TLe5r33r23PpEpjmALDh8ic3Zo5ns6CtIbYRBPQ4aH2heF4iP ++pdpNHDYmrrR+0v6iWdVnOlbCIWUN3Zdv8OW0HoeulzUN9Juu3Io+KKq4oqvunbLF ++kfZxmaWGyzGcBdablBNGqZrJpVVfbMzQhCfisbVzOQh/gC8EJpYMjSmbvl7MOa+i ++24KCVwfmskrZPch5bmdh80g3qE+fs8+EtlAIPemF6al2UIDnLG9llcviI0FYOXDn ++eCk9wtYgfCuHML2Yh2PtSq257XpLE6E9Yl62dGTvJaPdk0eq0yV+KtcJG1xZUPHU ++xpzyZIp8y8xSN1CIS4Q1QFEOoQaiYLaw44/52I5Fd30OfRGSIhUPozeExCXcFLQg ++ercWlnLUv01d0qtxQ0S+h0TSuHT3hj/SXd1e5nSr+8yjXaaEgAsCAwEAAQKCAYAG ++wzkzeglfbsdTZuC55lKazwVbNwoeewEvNKBtb3W+AmsZqjhxIUsT9X2nhKsG4z45 ++41U22RFMS/G6Oj9VUs54umkRDDdilXe2Blo+YCvm4iqJCB7dWvOgUKX03wSv45nu ++L3EVvVNVIqB0cItqE8JbVHNhxFjQj3iUMvUIs+Nqz39aK7UON45xFSxhZ2Vk+NEc ++Xr11yHGTr8f/6eVGf7BZCcbDxtwwWy0Vmkg3gL9foV1R+YDc1jarJ9mPnKcmCqPH ++lW5aT5putR0kO1vO6Rh7YfbHsqw334B9v1yjB4TgaJBKVHz5Z8KTvDFHodMtLqCC ++WV61O2h7gh4mQ6lEX5tjArqYdKMuWLAhZ+9AK9sSs4k+/nlvEbqAOCbkx7UmrZoF ++QkYfDt2Gjrk7WLwb9CCFIH0a2EEB2Fms1iHBK++S3iA4w0kfbePP0mo4GTsTwA45 ++DKDbYByzJzVUvGmowMaaypE548sopQ9K4kQJ9okLV+Gc1V7fjklYIIBmwDgqfIEC ++gcEA5Xt0qFjYn4H2gu2xyD0etx83CjKUx0mjwPvdwLg79HMb9P+OTTU+NzsHTa2I ++CTEJ1gA4VkqOtKxEBJQarQmJnVL/fiIp88h9fmLBQ48HLefH33S+bF3VWvKOgJeY ++uVyyWnhTwHNQv3RsO+DEcjqG3aJ2vdzCnDLBr9ATFV8uzpk1Op0h7QljUbhHv1mS ++ip2yQVeuJwtWFixjqEp7BuTluqk/UlGP39PBjgG04Tpw3MkiZNJgk/kSnN+YYOiu ++i91rAoHBAMl4/WAaIL5lHiyakHAmE0fwUm+LUKPG1rF22qvqdBFV6OE14/VgTKNP ++LfcS7Ulzmt7hM7fbcJ0FYxeyPbbQRjBRsGXFzLU96VgoUxoI/IyFXFY83UJ0s63L ++RhZmg4GNvpO0qfOjL4wQtB3N6LPhxpF+pLkkHXSdFkUyocaXGUGOBC+ZEBaCd8Lm ++2GlGoi/f+zSl4xSY4crspS7GNG2+jcXh5K/OMdjEb1/tyRYnHf0D89WNmr10EeYG ++Pe9alaDv4QKBwDROcYa1yZqB6who2W8Ez216BfejE9pg5JxmTGNTGwda/XJYlbzv ++d+Dq6X1BIpLFxLIslqrEj8aKxW4tu+7ZD672bhn3+4v/lOsr41Vc0owaGqrKV2Un ++9iumweh5pWwKvvR0HNLu9ebNyKXVU7GduYPnNh2MpicoQpGqYc8rROX+ce2MR2Fa ++FHNaB7CL4CUMUMcoDyADK3oeYBDJ+UTXA64KSc6fnKWuBJ4zsWDtCzCn/9jvQug3 ++i5CKPpdIMhDbRQKBwEekz61B/UzXVnCUEjLfR1H4osfpqaZjyerXkhE6UUXs3+Be ++Mo8KTJZyTK0kvN62zmbdfG+wCA6+YKuHhayhyaPbGLhIK3Bz8KuZw1tpwK0Tq287 ++O48rQs3VkDndAHysdA3AXAM4j2rmcbZ7h3mYGu2YNGll71eNmOLIi4C8MI4AO3rV ++mkP25zGWt3RQWtJdes4RA3xKlVh86IyGjRRNg8rPdmwSDeXAjL53J1/KTz6vDiFt ++to4SXV8H7zRTaQwO4QKBwBwMU2zjMYXLJq0LAmn3h4h6CVZjPrqzR8PeSd/YM831 ++qdH7OvnkadqIdqMOo6BUA9PvUIY/B5c5zSSOJg9gh1PJ3vDLIZY23zkXigh7poBe ++YW6/PLvGQJ0Rzyz5pf6uPX8AWkAqTyI1Ox3NdxzirarxWDPznvA2KsVxVF/jxnvr ++TD/R5kCQUcxZuInguahGYd1JF3dArYh6NKRPyVO0r73LfVeZ+udlo/+ZMNVGlNNF ++v3Tmy/b2gUdEwuKFCxx97g== ++-----END PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem +new file mode 100644 +index 0000000..4a4556c +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt01.example.nil.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 7 20:28:03 2022 GMT ++ Not After : Aug 30 20:28:03 2052 GMT ++ Subject: CN=srv01.crt01.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30: ++ df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7: ++ 4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4: ++ 1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86: ++ 86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df: ++ 7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3: ++ 99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17: ++ 88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59: ++ d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e: ++ 87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2: ++ ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05: ++ d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84: ++ 27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d: ++ 29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2: ++ 4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3: ++ cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c: ++ 6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2: ++ d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed: ++ 7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93: ++ 47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6: ++ 9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40: ++ 51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77: ++ 7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14: ++ b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43: ++ 44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6: ++ 74:ab:fb:cc:a3:5d:a6:84:80:0b ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.crt01.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f: ++ 7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb: ++ 2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5: ++ c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00: ++ 07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a: ++ 75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14: ++ e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11: ++ 71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98: ++ 2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64: ++ 69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20: ++ b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1: ++ 1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1: ++ 79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5: ++ 9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0: ++ 90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30: ++ 0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04: ++ 93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55: ++ 33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd: ++ 87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65: ++ ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b: ++ 52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd: ++ 1c:4e:e0:3f:0a:8b ++-----BEGIN CERTIFICATE----- ++MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw ++MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw ++DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124 ++XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru ++T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S ++/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF ++1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9 ++yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw ++vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3 ++UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S ++q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf ++ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC ++AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi ++D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50 ++iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX ++Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b ++IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s ++pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM ++ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd ++TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g ++PwqL ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key +new file mode 100644 +index 0000000..307d26d +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.key +@@ -0,0 +1,40 @@ ++-----BEGIN PRIVATE KEY----- ++MIIG/gIBADANBgkqhkiG9w0BAQEFAASCBugwggbkAgEAAoIBgQDsLIgBtYs6dFYN ++V7N1/QVYBe2Kq+gpDvFSNC4iYm5BdP94M7T/FXP6zpAQpP7SZhR7C3l71iCI+UEx ++FJpJNow4dEvz4lHn5W+9ZTjmnDCAPyRW9mieCXaBW1mBRFafHD9I8JW/YEAp36xC ++PcNvhS3DDgi29xIqUQC/z/5srtd93sFy+DIDX8k/St7l+iSQRvBKXwnYk0y/HGFM ++0tzbbPivc1u3O3robRy7JiNHh/1QBg/xtYiKqCVpV+NGO9JrUvtaAfaW6SrPE+cW ++TP1a9h8Ljfclo2jXFfxcSEkF4oUkcFex2AUkriY6AJtyqEcFxfN8LfJYcjf7wYtP ++Qo/dmqxbrm8hYq0pgbmLS2z/YZkPfAnTbQAgLbEMAGyZTJLcDhEt57p7x8ixoxph +++Mwsrxe228w2Av77ZhV3hHDNQiW3FmQorp2MgYWg4FCCqujprFH8K2NEsQi4kNeM ++HCOyGwhZhdXdOUT3R15ICDTrLN91Rwi2tuYy7XZ0d849Tf4CsTMCAwEAAQKCAYA+ ++B7AtKr6HutiDJp63BZ6qsNvkCSSv7AHMAnJ/i3TD8nPK4WHPgZX1sN070eov3qnQ ++a4Ib2XCwKS9LMcsYIaCQj1MHmlDC5IsFpplcUHeYp3zm7k8p+vhKH3ERt548qhGh ++GbdrDV+s39eBinFTUBpl2cDGNXxq6t2Ug4+iggWNRL1wcenI4xabbhG/O4Tw9ADW ++t8GBRabppw2TPOrPIv7qLhVPueqdM1NRgEHR3tDUfNMhO/nB2UoCMhg6cSniEGf8 ++32NDQHI7ajIcETnn9z0tAP67+w5VUYMlP3+VGr8v4UZCL6Qal9Swv4XWPqHjHoIi ++q5by4H6HEYeoUPT5hCJjMdXlHrWWUgsX/YdgY4tJJBowMR6rovA7Ypy71FxRnXkP ++2iD36jZmDI1mBQ41Yx7P5iM+veRQmBOH/x70Bd9ZbSLlmeTX5dhjAxNShjZxxeUy ++QbQGe3JLzdCGzRY9TKFMmLa/qs+Ggqxopdh4AZuHtQpKUej6g9GI9Eo0IIWTKEkC ++gcEA+EC1ms0MEIIq/JJrsN4ByEyZXbuNKny/04h8dfkT0lTXk8QihQLke6ZLLOl9 ++mwgO9NOHkghtU9wdNXg/dNR2VDevUZCjIlYZT6stjEX7X0oNACJwSeBwEXxn6I94 ++umuvJ9hq9WchTnQA4lrIXCETIUxThjm7jfJe9RKzghQkCfGnxzclXg0viqxvm21j ++eg0iide23y9xpFd8Qn1oq+hhzcKqHWdkHuDjRJD5gfAEPD7MJ7oT5jR4szQoIUcP ++4C+NAoHBAPOLUwAwcY5zUBAZ7oZ8wRgnAFZjHdYYWDr04ahA1DpwPeX67MczdGud ++L7hUq3APa3qcj4hrDL2jkF6FkbURhtdguMccb4hBENyYr+qjoTAfYJIZwJ9akQ/j ++x8u+5kGsN+ozaKikHFsI2xXHJhbShICL3sIfNeqGFB2onp/dv8WdywTnSf2aXGjf ++NFvVJYnaEOGiTM7uIf/F0n8Iae8HSdPZXtDTXNjnLFzzHjvFe1mfyYO55BDkxmr2 ++PDnhVkbTvwKBwQCNPwQU16WNnwImQojTUP1ioXKBSjy/d8sM6BMobFdCzNL7WBTr ++6QFm+O681vyIQMWBtvjjtbe+hvZ3fbtdFaVdtXEiz1CCMMql8ZcwwICNbuyGrxGE ++dxZMXKQiRb9DEhHOcewpRExG/umh4FUvVgI0Z+D99csosEYm2kUYNa1rmvsC9fVk ++1cu+8u1tWYfH4cFM/FcoFS5revtQOVpctRMwpxlzMWhdyUaFtJbBv3YpcPFniQ/Z ++YvFpxLswc+Ysf+ECgcEAhEeMUXH+e6zOM7CiCZIBHykv2bwEHKEkawFO/6AWpZcJ ++R7y+loOwHDNIFAqJA1icvAAFRcc/KFGKvIw30+0tHBaAxkT/nzYX/nlAM2Wkywp/ ++3Vr3cJY0bDj/7/5D+i+cPyylD9PzQs7QkEeWvJajOV6/Ixjoo/UnP+SyI4rB+of2 ++GTe2zHPm9V8mhSqENReoS6Vnqo1VEiNUbYMYZqfCxbou8aWbrIQDaIj0RurAULGl ++NlLlOPfJfZc4pwdpYRbpAoHAJ7Vxdfn1ec+8xIpjn6dQzWDQWrOw+4pyi54sPlVb ++RUWC9nYDbTwEKkWdQ0FdyJkU7tiYIIFlVNfPAa1lkujIiC5zxe41VJ1598pXPEXn ++a6UB1yn2Ay7kmCq7/qOD6IRkAS8TKyzM6Z7nFgglMEPPdzYBkeKP/aWl75el1B4e ++mpGz7o6u6kSHXt0UWZ7VT9AspEw0oyHIoaXmYHvpXjGtWghn6MKPMngKIb87Xjvt ++bKvcUjDKJOb0BURXpKzS8Rf9 ++-----END PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem +new file mode 100644 +index 0000000..3fa0b9a +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/certs/srv01.crt02-expired.example.nil.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 6 20:34:09 2022 GMT ++ Not After : Sep 7 20:34:09 2022 GMT ++ Subject: CN=srv01.crt02-expired.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd: ++ 05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62: ++ 6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4: ++ fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14: ++ 9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65: ++ 38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b: ++ 59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df: ++ ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51: ++ 00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f: ++ c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93: ++ 4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b: ++ 7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5: ++ 88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01: ++ f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d: ++ f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70: ++ 57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5: ++ f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a: ++ ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61: ++ 99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c: ++ 92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8: ++ cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84: ++ 70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0: ++ 50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90: ++ d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47: ++ 5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed: ++ 76:74:77:ce:3d:4d:fe:02:b1:33 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c: ++ b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34: ++ cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45: ++ ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2: ++ 7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad: ++ 6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97: ++ bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49: ++ 7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86: ++ c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7: ++ b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc: ++ 42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68: ++ a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c: ++ db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c: ++ 8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9: ++ 73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d: ++ cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5: ++ e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56: ++ da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1: ++ a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb: ++ 30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba: ++ 9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a: ++ 1f:5c:c5:04:10:f6 ++-----BEGIN CERTIFICATE----- ++MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw ++MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p ++bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9 ++BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2 ++jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F ++LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts +++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2 ++HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a ++rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv ++F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib ++CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV ++HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G ++CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG ++MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31 ++CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+ ++ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn ++jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/ ++awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L ++hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq ++4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/ ++4N9ksrVfmKFFP0ofXMUEEPY= ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/index.txt b/bin/tests/system/nsupdate/CA/index.txt +new file mode 100644 +index 0000000..020155f +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/index.txt +@@ -0,0 +1,4 @@ ++V 20520830202803Z 70B9F4EB2FA19598 unknown /CN=srv01.crt01.example.nil ++V 220907203409Z 70B9F4EB2FA19599 unknown /CN=srv01.crt02-expired.example.nil ++V 20520831082017Z 70B9F4EB2FA1959A unknown /CN=srv01.client01.example.nil ++V 220908081418Z 70B9F4EB2FA1959B unknown /CN=srv01.client02-expired.example.nil +diff --git a/bin/tests/system/nsupdate/CA/index.txt.attr b/bin/tests/system/nsupdate/CA/index.txt.attr +new file mode 100644 +index 0000000..8f7e63a +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/index.txt.attr +@@ -0,0 +1 @@ ++unique_subject = yes +diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem +new file mode 100644 +index 0000000..4a4556c +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19598.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010840 (0x70b9f4eb2fa19598) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 7 20:28:03 2022 GMT ++ Not After : Aug 30 20:28:03 2052 GMT ++ Subject: CN=srv01.crt01.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:b4:9a:63:98:04:ad:bd:ab:29:bf:22:70:54:30: ++ df:c7:6b:77:5d:b8:5e:0b:cd:0e:a0:6c:74:37:e7: ++ 4b:78:d1:96:da:ca:99:7d:92:b1:e4:1a:0a:1e:b4: ++ 1c:be:ee:cc:95:8c:52:03:93:85:e1:40:43:68:86: ++ 86:bc:6a:62:6d:d6:0a:ca:ee:4f:93:2d:ee:6b:df: ++ 7a:f6:dc:fa:44:a6:39:80:2c:38:7c:89:cd:d9:a3: ++ 99:ec:e8:2b:48:6d:84:41:3d:0e:1a:1f:68:5e:17: ++ 88:8f:a5:da:4d:1c:36:26:ae:b4:7e:d2:fe:a2:59: ++ d5:67:3a:56:c2:21:65:0d:dd:97:6f:f0:e5:b4:1e: ++ 87:ae:97:35:0d:f4:9b:ae:dc:8a:3e:28:aa:b8:a2: ++ ab:ee:9d:b2:c5:91:f6:71:99:a5:86:cb:31:9c:05: ++ d6:9b:94:13:46:a9:9a:c9:a5:55:5f:6c:cc:d0:84: ++ 27:e2:b1:b5:73:39:08:7f:80:2f:04:26:96:0c:8d: ++ 29:9b:be:5e:cc:39:af:a2:db:82:82:57:07:e6:b2: ++ 4a:d9:3d:c8:79:6e:67:61:f3:48:37:a8:4f:9f:b3: ++ cf:84:b6:50:08:3d:e9:85:e9:a9:76:50:80:e7:2c: ++ 6f:65:95:cb:e2:23:41:58:39:70:e7:78:29:3d:c2: ++ d6:20:7c:2b:87:30:bd:98:87:63:ed:4a:ad:b9:ed: ++ 7a:4b:13:a1:3d:62:5e:b6:74:64:ef:25:a3:dd:93: ++ 47:aa:d3:25:7e:2a:d7:09:1b:5c:59:50:f1:d4:c6: ++ 9c:f2:64:8a:7c:cb:cc:52:37:50:88:4b:84:35:40: ++ 51:0e:a1:06:a2:60:b6:b0:e3:8f:f9:d8:8e:45:77: ++ 7d:0e:7d:11:92:22:15:0f:a3:37:84:c4:25:dc:14: ++ b4:20:7a:b7:16:96:72:d4:bf:4d:5d:d2:ab:71:43: ++ 44:be:87:44:d2:b8:74:f7:86:3f:d2:5d:dd:5e:e6: ++ 74:ab:fb:cc:a3:5d:a6:84:80:0b ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.crt01.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 94:15:c0:4a:f1:aa:15:30:f7:cb:fe:f9:fa:ba:5f:f0:18:1f: ++ 7e:44:9a:b1:d4:9c:f9:78:d3:a7:c7:65:f2:d1:48:62:f4:cb: ++ 2f:20:ea:7c:af:08:cf:db:e2:0f:ab:c0:22:38:16:c5:0c:e5: ++ c7:6e:34:b1:ed:f6:02:1a:69:c0:09:d1:43:b3:30:77:fc:00: ++ 07:1b:da:88:97:5b:28:4e:e6:92:ca:00:cc:86:66:a9:a9:0a: ++ 75:be:74:88:7d:09:52:e7:a9:82:8f:a9:62:5e:b3:19:64:14: ++ e5:54:9e:6d:9c:98:39:8b:1f:92:92:59:f9:a2:46:75:96:11: ++ 71:8a:c8:71:05:10:2a:b8:f3:a4:19:db:eb:05:17:0a:dd:98: ++ 2c:58:54:3a:7f:8c:c2:26:9e:62:ca:04:dd:3c:99:1f:a0:64: ++ 69:fb:d6:04:c1:0b:8c:62:f6:2d:ea:bc:6c:a9:39:7b:f1:20: ++ b8:b7:04:3c:a7:65:fa:1f:db:22:e2:5b:8b:91:75:60:be:e1: ++ 1e:50:13:23:d5:4b:93:87:20:ec:46:6f:5f:94:dc:b1:60:d1: ++ 79:4b:5e:76:c9:6d:0d:be:a6:9a:6b:67:8b:a7:48:7e:51:b5: ++ 9b:9d:ec:a6:0c:c1:b3:d9:0b:26:8b:f2:7c:cf:61:d0:a2:a0: ++ 90:90:18:6b:b4:ca:56:b8:5e:5a:8b:78:71:c4:d1:fc:15:30: ++ 0a:03:26:74:85:3d:6c:ed:d3:e1:c9:c1:b0:d4:0c:b9:f3:04: ++ 93:0d:e3:a6:2c:a7:ee:e0:24:0d:dd:37:fc:6b:09:d5:b5:55: ++ 33:12:82:cf:f2:ba:0f:b0:e2:ce:f7:c0:ac:2c:7f:ab:f9:dd: ++ 87:b1:9b:95:f2:d7:32:98:dd:4c:b3:28:b7:0d:2b:2f:62:65: ++ ce:59:fb:95:d4:5f:9d:fd:83:5a:01:3b:5f:48:5f:3c:fa:4b: ++ 52:91:66:e1:49:8e:cd:09:78:f5:ce:f8:cd:5c:85:3e:ad:bd: ++ 1c:4e:e0:3f:0a:8b ++-----BEGIN CERTIFICATE----- ++MIIETzCCAregAwIBAgIIcLn06y+hlZgwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwNzIwMjgwM1oYDzIwNTIwODMw ++MjAyODAzWjAiMSAwHgYDVQQDDBdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbDCCAaIw ++DQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBALSaY5gErb2rKb8icFQw38drd124 ++XgvNDqBsdDfnS3jRltrKmX2SseQaCh60HL7uzJWMUgOTheFAQ2iGhrxqYm3WCsru ++T5Mt7mvfevbc+kSmOYAsOHyJzdmjmezoK0hthEE9DhofaF4XiI+l2k0cNiautH7S ++/qJZ1Wc6VsIhZQ3dl2/w5bQeh66XNQ30m67cij4oqriiq+6dssWR9nGZpYbLMZwF ++1puUE0apmsmlVV9szNCEJ+KxtXM5CH+ALwQmlgyNKZu+Xsw5r6LbgoJXB+ayStk9 ++yHluZ2HzSDeoT5+zz4S2UAg96YXpqXZQgOcsb2WVy+IjQVg5cOd4KT3C1iB8K4cw ++vZiHY+1KrbnteksToT1iXrZ0ZO8lo92TR6rTJX4q1wkbXFlQ8dTGnPJkinzLzFI3 ++UIhLhDVAUQ6hBqJgtrDjj/nYjkV3fQ59EZIiFQ+jN4TEJdwUtCB6txaWctS/TV3S ++q3FDRL6HRNK4dPeGP9Jd3V7mdKv7zKNdpoSACwIDAQABoywwKjAoBgNVHREEITAf ++ghdzcnYwMS5jcnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0BAQsFAAOC ++AYEAlBXASvGqFTD3y/75+rpf8BgffkSasdSc+XjTp8dl8tFIYvTLLyDqfK8Iz9vi ++D6vAIjgWxQzlx240se32AhppwAnRQ7Mwd/wABxvaiJdbKE7mksoAzIZmqakKdb50 ++iH0JUuepgo+pYl6zGWQU5VSebZyYOYsfkpJZ+aJGdZYRcYrIcQUQKrjzpBnb6wUX ++Ct2YLFhUOn+MwiaeYsoE3TyZH6BkafvWBMELjGL2Leq8bKk5e/EguLcEPKdl+h/b ++IuJbi5F1YL7hHlATI9VLk4cg7EZvX5TcsWDReUtedsltDb6mmmtni6dIflG1m53s ++pgzBs9kLJovyfM9h0KKgkJAYa7TKVrheWot4ccTR/BUwCgMmdIU9bO3T4cnBsNQM ++ufMEkw3jpiyn7uAkDd03/GsJ1bVVMxKCz/K6D7DizvfArCx/q/ndh7GblfLXMpjd ++TLMotw0rL2Jlzln7ldRfnf2DWgE7X0hfPPpLUpFm4UmOzQl49c74zVyFPq29HE7g ++PwqL ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem +new file mode 100644 +index 0000000..3fa0b9a +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA19599.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010841 (0x70b9f4eb2fa19599) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 6 20:34:09 2022 GMT ++ Not After : Sep 7 20:34:09 2022 GMT ++ Subject: CN=srv01.crt02-expired.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:ec:2c:88:01:b5:8b:3a:74:56:0d:57:b3:75:fd: ++ 05:58:05:ed:8a:ab:e8:29:0e:f1:52:34:2e:22:62: ++ 6e:41:74:ff:78:33:b4:ff:15:73:fa:ce:90:10:a4: ++ fe:d2:66:14:7b:0b:79:7b:d6:20:88:f9:41:31:14: ++ 9a:49:36:8c:38:74:4b:f3:e2:51:e7:e5:6f:bd:65: ++ 38:e6:9c:30:80:3f:24:56:f6:68:9e:09:76:81:5b: ++ 59:81:44:56:9f:1c:3f:48:f0:95:bf:60:40:29:df: ++ ac:42:3d:c3:6f:85:2d:c3:0e:08:b6:f7:12:2a:51: ++ 00:bf:cf:fe:6c:ae:d7:7d:de:c1:72:f8:32:03:5f: ++ c9:3f:4a:de:e5:fa:24:90:46:f0:4a:5f:09:d8:93: ++ 4c:bf:1c:61:4c:d2:dc:db:6c:f8:af:73:5b:b7:3b: ++ 7a:e8:6d:1c:bb:26:23:47:87:fd:50:06:0f:f1:b5: ++ 88:8a:a8:25:69:57:e3:46:3b:d2:6b:52:fb:5a:01: ++ f6:96:e9:2a:cf:13:e7:16:4c:fd:5a:f6:1f:0b:8d: ++ f7:25:a3:68:d7:15:fc:5c:48:49:05:e2:85:24:70: ++ 57:b1:d8:05:24:ae:26:3a:00:9b:72:a8:47:05:c5: ++ f3:7c:2d:f2:58:72:37:fb:c1:8b:4f:42:8f:dd:9a: ++ ac:5b:ae:6f:21:62:ad:29:81:b9:8b:4b:6c:ff:61: ++ 99:0f:7c:09:d3:6d:00:20:2d:b1:0c:00:6c:99:4c: ++ 92:dc:0e:11:2d:e7:ba:7b:c7:c8:b1:a3:1a:61:f8: ++ cc:2c:af:17:b6:db:cc:36:02:fe:fb:66:15:77:84: ++ 70:cd:42:25:b7:16:64:28:ae:9d:8c:81:85:a0:e0: ++ 50:82:aa:e8:e9:ac:51:fc:2b:63:44:b1:08:b8:90: ++ d7:8c:1c:23:b2:1b:08:59:85:d5:dd:39:44:f7:47: ++ 5e:48:08:34:eb:2c:df:75:47:08:b6:b6:e6:32:ed: ++ 76:74:77:ce:3d:4d:fe:02:b1:33 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.crt02-expired.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 2a:52:c4:cb:a9:2f:f7:2b:ed:04:b5:03:d5:06:59:ed:5c:7c: ++ b7:00:9e:c4:33:90:fe:d0:b0:18:f3:f2:06:30:54:18:fe:34: ++ cb:ea:61:4f:9c:23:67:3c:ae:ed:20:df:82:52:ec:59:88:45: ++ ad:3c:6c:a7:34:24:1c:4d:66:ab:71:3d:59:8c:ef:cd:a0:e2: ++ 7b:59:2d:43:94:cd:f5:0a:3c:4e:81:24:e8:fd:c6:d0:fd:ad: ++ 6f:cc:29:5b:67:0b:b7:ee:43:38:a4:91:c2:d9:3b:f8:d6:97: ++ bc:92:dd:ec:a1:ab:85:35:44:f4:0a:df:ad:8d:8c:52:c3:49: ++ 7e:39:10:a1:13:43:78:71:e2:92:aa:31:3d:d9:94:15:7f:86: ++ c8:aa:b4:a1:6d:bf:eb:55:b1:d7:41:6f:c3:7d:88:5e:9c:b7: ++ b1:4b:0d:a7:17:4f:3e:4a:46:3f:6f:48:27:8c:d0:e5:51:fc: ++ 42:ba:c5:b9:4f:63:6f:2e:f2:fd:0c:c0:6e:23:b4:59:93:68: ++ a4:2d:16:ce:f4:7b:3a:45:1d:a0:6e:98:0b:f7:6a:e6:75:0c: ++ db:56:19:6b:88:f0:7f:6b:08:f8:fc:bb:d1:3f:25:25:1a:6c: ++ 8e:34:cb:91:18:54:d5:2d:ce:9c:d0:b7:c3:bc:b5:0a:e0:b9: ++ 73:6f:4d:ad:6b:3c:b6:49:ef:c0:10:13:c7:0a:78:4d:98:7d: ++ cb:84:a1:29:40:8c:dd:31:7d:ae:c4:f5:25:5d:b9:74:b2:f5: ++ e2:2b:e0:43:c8:50:61:a3:a8:26:1a:03:ab:1a:24:3b:13:56: ++ da:0d:ee:ff:2f:bd:d5:77:82:72:63:b8:aa:e1:18:f7:3b:c1: ++ a1:f8:51:b1:70:b9:25:39:df:a3:41:79:d7:2b:ec:32:f6:cb: ++ 30:28:d2:1e:f1:b4:e1:80:03:9f:c2:0f:36:85:82:5e:39:ba: ++ 9e:eb:67:76:42:93:bf:e0:df:64:b2:b5:5f:98:a1:45:3f:4a: ++ 1f:5c:c5:04:10:f6 ++-----BEGIN CERTIFICATE----- ++MIIEXTCCAsWgAwIBAgIIcLn06y+hlZkwDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNjIwMzQwOVoXDTIyMDkwNzIw ++MzQwOVowKjEoMCYGA1UEAwwfc3J2MDEuY3J0MDItZXhwaXJlZC5leGFtcGxlLm5p ++bDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAOwsiAG1izp0Vg1Xs3X9 ++BVgF7Yqr6CkO8VI0LiJibkF0/3gztP8Vc/rOkBCk/tJmFHsLeXvWIIj5QTEUmkk2 ++jDh0S/PiUeflb71lOOacMIA/JFb2aJ4JdoFbWYFEVp8cP0jwlb9gQCnfrEI9w2+F ++LcMOCLb3EipRAL/P/myu133ewXL4MgNfyT9K3uX6JJBG8EpfCdiTTL8cYUzS3Nts +++K9zW7c7euhtHLsmI0eH/VAGD/G1iIqoJWlX40Y70mtS+1oB9pbpKs8T5xZM/Vr2 ++HwuN9yWjaNcV/FxISQXihSRwV7HYBSSuJjoAm3KoRwXF83wt8lhyN/vBi09Cj92a ++rFuubyFirSmBuYtLbP9hmQ98CdNtACAtsQwAbJlMktwOES3nunvHyLGjGmH4zCyv ++F7bbzDYC/vtmFXeEcM1CJbcWZCiunYyBhaDgUIKq6OmsUfwrY0SxCLiQ14wcI7Ib ++CFmF1d05RPdHXkgINOss33VHCLa25jLtdnR3zj1N/gKxMwIDAQABozQwMjAwBgNV ++HREEKTAngh9zcnYwMS5jcnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQKNQABMA0G ++CSqGSIb3DQEBCwUAA4IBgQAqUsTLqS/3K+0EtQPVBlntXHy3AJ7EM5D+0LAY8/IG ++MFQY/jTL6mFPnCNnPK7tIN+CUuxZiEWtPGynNCQcTWarcT1ZjO/NoOJ7WS1DlM31 ++CjxOgSTo/cbQ/a1vzClbZwu37kM4pJHC2Tv41pe8kt3soauFNUT0Ct+tjYxSw0l+ ++ORChE0N4ceKSqjE92ZQVf4bIqrShbb/rVbHXQW/DfYhenLexSw2nF08+SkY/b0gn ++jNDlUfxCusW5T2NvLvL9DMBuI7RZk2ikLRbO9Hs6RR2gbpgL92rmdQzbVhlriPB/ ++awj4/LvRPyUlGmyONMuRGFTVLc6c0LfDvLUK4Llzb02tazy2Se/AEBPHCnhNmH3L ++hKEpQIzdMX2uxPUlXbl0svXiK+BDyFBho6gmGgOrGiQ7E1baDe7/L73Vd4JyY7iq ++4Rj3O8Gh+FGxcLklOd+jQXnXK+wy9sswKNIe8bThgAOfwg82hYJeObqe62d2QpO/ ++4N9ksrVfmKFFP0ofXMUEEPY= ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem +new file mode 100644 +index 0000000..f546d35 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959A.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010842 (0x70b9f4eb2fa1959a) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 8 08:20:17 2022 GMT ++ Not After : Aug 31 08:20:17 2052 GMT ++ Subject: CN=srv01.client01.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:ab:60:2e:9c:61:e3:89:c6:52:2b:bc:e9:e1:05: ++ fd:18:65:42:20:f6:56:16:40:33:d2:cb:9f:f7:ef: ++ 22:54:a7:c9:55:70:ca:52:f0:e2:a2:58:38:7f:10: ++ ad:2b:05:e0:11:b6:69:21:7f:2d:38:56:dd:d5:e4: ++ f3:de:a7:32:35:f7:33:2a:52:80:ae:b7:d6:7c:35: ++ 74:c3:0c:8a:c3:3a:18:61:68:73:62:58:56:ff:78: ++ 25:57:1c:7b:be:98:88:21:dd:1c:8a:13:a5:9a:52: ++ 48:98:d9:3d:c4:28:a6:7e:9b:11:56:7e:ce:09:bb: ++ 51:89:8a:a8:1b:00:b5:73:2b:41:93:b1:62:40:30: ++ 29:ea:f6:a3:e7:bc:f0:e9:9e:07:2b:ae:a9:a0:1d: ++ 4d:d9:f8:18:4d:83:47:4e:68:ee:57:c8:55:15:86: ++ 3c:6d:1e:f5:31:f1:de:cf:c2:7e:6b:8e:22:5a:c5: ++ 76:af:d0:01:de:ab:7a:03:b2:96:33:cc:a0:26:ae: ++ de:c4:bd:76:85:96:c7:88:e4:46:bc:3f:c6:54:c9: ++ 95:83:87:9c:49:0d:31:dd:c4:17:52:99:e4:65:49: ++ 9b:9d:f3:ad:ce:66:08:57:f4:83:be:5e:87:da:42: ++ 5a:01:2a:6d:68:d1:8d:38:d9:18:ae:5e:2e:54:72: ++ 8b:01:45:96:af:f5:a3:d0:29:5d:22:8b:b4:d4:30: ++ af:02:36:c5:2d:e9:29:eb:2c:ea:6a:7e:27:b3:70: ++ fc:87:1f:2b:c4:b1:3a:a6:c2:e9:b7:c2:6f:46:63: ++ b7:96:2e:53:d8:b7:cd:c3:f4:b5:6d:b2:fc:57:49: ++ ac:9f:98:c9:fe:b4:f5:7c:93:48:2e:93:dc:e9:18: ++ 54:63:5f:18:a3:e7:12:aa:fe:38:f0:73:e5:17:1e: ++ fe:40:65:81:a8:8f:60:46:c2:16:f2:a8:9d:b1:1b: ++ bc:ce:05:de:37:b2:a8:86:47:bd:8d:92:de:e0:e5: ++ 42:89:b8:e3:f8:b1:24:08:7e:99 ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.client01.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 07:97:69:51:12:50:6a:e1:02:a0:b0:dc:93:75:16:c4:38:0f: ++ 5c:b3:47:da:bf:fa:9c:b6:de:c0:ef:38:f7:cc:d9:8d:71:ba: ++ 51:89:e5:48:36:dd:e1:f8:73:9d:92:80:1c:42:30:69:4f:8c: ++ 19:5d:f7:1d:03:e4:f2:76:e0:58:7b:c2:76:c4:0a:7e:20:69: ++ 26:6c:3e:cb:31:45:93:1d:07:5f:45:44:8e:5a:fb:87:17:7b: ++ 4d:5c:bf:37:bd:5e:ba:5c:22:84:bf:26:21:4a:c4:e9:f9:cb: ++ 73:de:fc:62:04:96:ad:aa:fd:89:09:5c:74:d6:bd:5f:07:17: ++ ef:9c:3d:ee:b7:dc:08:11:7f:12:66:ab:c4:ff:43:6d:7f:1e: ++ 01:b6:d1:19:73:53:18:e4:02:b0:7c:9e:99:63:d8:57:dd:07: ++ 79:fb:83:39:09:de:76:6e:68:b7:87:81:13:b8:26:e5:1c:c9: ++ a0:23:e5:97:39:ff:93:c7:8d:08:d8:ce:97:34:fc:ad:22:14: ++ 89:c0:ae:83:7d:0a:3f:cf:a0:9b:b4:6a:5c:b3:6d:5d:3b:88: ++ ca:1e:9b:99:54:64:57:58:3c:4c:bd:26:ee:11:c3:13:0b:1d: ++ f5:fd:d9:37:b0:31:72:6f:1d:e8:ba:43:37:46:f7:71:fe:6d: ++ 4a:30:33:29:c5:7b:37:8b:7e:06:22:89:a4:46:36:f0:fe:c6: ++ f5:f0:53:04:c0:35:52:78:6e:10:24:3a:d8:bf:7b:13:2f:98: ++ bc:69:31:41:68:02:5a:c4:f9:11:a2:6b:3f:c8:e0:d4:b3:80: ++ af:d2:be:fe:28:70:61:18:ed:8a:de:c4:cb:da:c9:60:94:91: ++ 76:63:69:8c:6e:96:f5:ba:e7:be:1e:1c:c3:84:b1:8d:e8:31: ++ f7:66:8c:0d:da:a8:78:57:19:fd:a0:8d:fa:9a:7e:51:1c:d1: ++ d0:84:07:a2:45:40:2d:c4:6b:e9:9f:86:4a:08:20:8f:9c:79: ++ 97:e3:7f:2a:14:73 ++-----BEGIN CERTIFICATE----- ++MIIEVTCCAr2gAwIBAgIIcLn06y+hlZowDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMCAXDTIyMDkwODA4MjAxN1oYDzIwNTIwODMx ++MDgyMDE3WjAlMSMwIQYDVQQDDBpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbDCC ++AaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKtgLpxh44nGUiu86eEF/Rhl ++QiD2VhZAM9LLn/fvIlSnyVVwylLw4qJYOH8QrSsF4BG2aSF/LThW3dXk896nMjX3 ++MypSgK631nw1dMMMisM6GGFoc2JYVv94JVcce76YiCHdHIoTpZpSSJjZPcQopn6b ++EVZ+zgm7UYmKqBsAtXMrQZOxYkAwKer2o+e88OmeByuuqaAdTdn4GE2DR05o7lfI ++VRWGPG0e9THx3s/CfmuOIlrFdq/QAd6regOyljPMoCau3sS9doWWx4jkRrw/xlTJ ++lYOHnEkNMd3EF1KZ5GVJm53zrc5mCFf0g75eh9pCWgEqbWjRjTjZGK5eLlRyiwFF ++lq/1o9ApXSKLtNQwrwI2xS3pKess6mp+J7Nw/IcfK8SxOqbC6bfCb0Zjt5YuU9i3 ++zcP0tW2y/FdJrJ+Yyf609XyTSC6T3OkYVGNfGKPnEqr+OPBz5Rce/kBlgaiPYEbC ++FvKonbEbvM4F3jeyqIZHvY2S3uDlQom44/ixJAh+mQIDAQABoy8wLTArBgNVHREE ++JDAighpzcnYwMS5jbGllbnQwMS5leGFtcGxlLm5pbIcECjUAATANBgkqhkiG9w0B ++AQsFAAOCAYEAB5dpURJQauECoLDck3UWxDgPXLNH2r/6nLbewO8498zZjXG6UYnl ++SDbd4fhznZKAHEIwaU+MGV33HQPk8nbgWHvCdsQKfiBpJmw+yzFFkx0HX0VEjlr7 ++hxd7TVy/N71eulwihL8mIUrE6fnLc978YgSWrar9iQlcdNa9XwcX75w97rfcCBF/ ++EmarxP9DbX8eAbbRGXNTGOQCsHyemWPYV90HefuDOQnedm5ot4eBE7gm5RzJoCPl ++lzn/k8eNCNjOlzT8rSIUicCug30KP8+gm7RqXLNtXTuIyh6bmVRkV1g8TL0m7hHD ++Ewsd9f3ZN7Axcm8d6LpDN0b3cf5tSjAzKcV7N4t+BiKJpEY28P7G9fBTBMA1Unhu ++ECQ62L97Ey+YvGkxQWgCWsT5EaJrP8jg1LOAr9K+/ihwYRjtit7Ey9rJYJSRdmNp ++jG6W9brnvh4cw4Sxjegx92aMDdqoeFcZ/aCN+pp+URzR0IQHokVALcRr6Z+GSggg ++j5x5l+N/KhRz ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem +new file mode 100644 +index 0000000..365b493 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/newcerts/70B9F4EB2FA1959B.pem +@@ -0,0 +1,93 @@ ++Certificate: ++ Data: ++ Version: 3 (0x2) ++ Serial Number: 8122792693893010843 (0x70b9f4eb2fa1959b) ++ Signature Algorithm: sha256WithRSAEncryption ++ Issuer: C=UA, ST=Kharkiv Oblast', L=Kharkiv, O=Internet Systems Consortium, CN=ca.test.example.com ++ Validity ++ Not Before: Sep 7 08:14:18 2022 GMT ++ Not After : Sep 8 08:14:18 2022 GMT ++ Subject: CN=srv01.client02-expired.example.nil ++ Subject Public Key Info: ++ Public Key Algorithm: rsaEncryption ++ RSA Public-Key: (3072 bit) ++ Modulus: ++ 00:c0:11:27:17:25:3a:ad:85:a0:3b:59:0b:22:64: ++ 63:7d:bb:05:32:35:4f:68:d5:19:2b:cd:46:bd:e2: ++ b6:42:8c:08:cf:09:0d:a8:cd:58:d9:1b:77:db:17: ++ 8a:fc:f0:55:f2:e1:50:f4:fd:90:aa:49:15:5d:ea: ++ 9b:5a:47:c4:2f:82:07:46:87:f6:05:ef:15:02:a4: ++ 3c:a1:da:fc:5b:75:36:12:f7:12:50:55:f8:be:0c: ++ 7d:21:91:e2:92:d8:41:3f:71:fe:b2:17:c0:68:1d: ++ 09:be:fc:c4:24:ec:ef:d2:5c:52:a9:4f:d6:5d:30: ++ b8:ab:68:2e:39:e9:8b:5b:c6:f0:64:42:f7:b8:bd: ++ b2:90:32:22:68:bc:38:70:2f:14:ae:c8:7c:63:04: ++ d5:11:b2:0a:f1:8e:13:10:b2:3b:69:f4:fe:3a:e2: ++ f1:58:56:28:93:c1:28:aa:a7:19:c9:91:12:43:f8: ++ f5:1d:34:58:3d:32:9f:11:67:d1:1f:53:d4:e0:d5: ++ 0c:78:2c:6f:38:3f:e1:89:69:b5:09:3c:12:f4:a9: ++ ee:e5:2f:c5:47:65:a6:82:fa:ea:78:48:31:89:11: ++ b6:23:8a:27:ed:7c:1d:6d:e8:ab:a0:29:de:40:f4: ++ f2:9b:61:22:da:9c:22:32:f7:3d:f8:4c:e1:38:a7: ++ e2:c3:af:a4:67:7f:94:a4:fd:52:25:89:4d:f4:9a: ++ d6:35:ba:98:20:f1:4b:c9:a5:cf:ac:72:58:2a:cd: ++ 3b:4a:3e:e9:04:31:e2:9a:74:32:d5:52:60:34:ad: ++ 0c:85:02:65:58:41:74:2a:57:91:34:55:36:a9:14: ++ 5b:45:cc:28:27:d7:6d:ba:55:a3:dd:9f:00:04:a4: ++ 43:c2:af:5c:af:86:53:a6:d5:a7:49:aa:31:d6:5e: ++ 92:7d:26:dd:8d:f4:87:8a:9b:48:e8:25:f4:c7:34: ++ ca:cf:e3:f7:84:19:3b:43:c7:6a:b8:da:6e:6f:85: ++ af:8d:0c:fb:7c:ea:c7:73:9c:9b ++ Exponent: 65537 (0x10001) ++ X509v3 extensions: ++ X509v3 Subject Alternative Name: ++ DNS:srv01.client02-expired.example.nil, IP Address:10.53.0.1 ++ Signature Algorithm: sha256WithRSAEncryption ++ 18:f1:7c:24:5b:d2:03:b0:60:0e:60:e6:32:f9:a7:47:d1:e4: ++ bd:3f:a3:21:53:90:84:9a:c6:2c:87:b2:16:28:95:07:a3:2a: ++ c3:33:8f:60:70:3f:26:58:be:ec:a2:6c:44:89:d3:4e:ef:bb: ++ ce:af:9b:5f:15:06:03:21:74:e3:6f:2a:dc:5c:19:4e:d3:cb: ++ ba:c3:5f:d8:76:89:59:50:82:69:5f:a1:ac:9f:be:79:e1:22: ++ 12:37:f9:d3:2e:00:35:03:03:9d:08:24:45:65:7a:e9:72:31: ++ e1:67:44:32:17:25:dd:b9:72:eb:c6:40:d7:5d:8d:5f:00:48: ++ 07:09:0d:3c:4c:a1:f1:05:4b:05:9b:2b:5a:21:09:46:f4:17: ++ 7a:cf:34:87:ad:bf:ef:bd:56:74:d7:1a:8f:07:ce:70:b1:aa: ++ 4d:82:4f:08:dc:56:27:f9:21:20:b8:06:c7:29:b4:8e:36:82: ++ b8:43:85:1c:2d:9f:be:2d:b9:9d:40:de:52:55:6a:2e:0b:28: ++ 33:fc:f8:1b:70:e9:c5:46:50:f3:05:be:8d:ed:99:ec:f1:8c: ++ 51:8a:1c:4b:95:f4:c4:dd:cd:42:74:bc:6f:66:64:54:b8:c1: ++ 6e:c8:3d:e9:fe:10:02:61:50:77:38:b9:b0:b8:13:37:8f:0e: ++ 5b:49:92:3a:9d:9a:60:51:68:99:8a:d5:7e:92:71:7e:fa:db: ++ 52:37:4d:f9:0d:6c:3b:79:a3:b9:16:b7:95:00:ea:eb:17:54: ++ e2:50:d7:a5:08:54:58:2c:79:66:01:4b:95:65:ed:b8:81:f7: ++ 4c:fa:f8:89:37:ad:d9:dc:c9:75:9d:02:3e:e5:92:b3:03:ab: ++ 70:69:83:f5:6c:a6:27:7e:2e:fc:9d:b2:59:0a:43:ad:3f:55: ++ 2f:5d:ec:ef:52:f0:3e:be:b5:d6:e2:c3:91:9d:dd:5d:e1:9e: ++ e6:18:90:0b:6a:85:f8:e3:83:2a:7c:91:c3:52:1c:6d:aa:2b: ++ 44:b8:6f:2b:af:6e ++-----BEGIN CERTIFICATE----- ++MIIEYzCCAsugAwIBAgIIcLn06y+hlZswDQYJKoZIhvcNAQELBQAwfTELMAkGA1UE ++BhMCVUExGDAWBgNVBAgMD0toYXJraXYgT2JsYXN0JzEQMA4GA1UEBwwHS2hhcmtp ++djEkMCIGA1UECgwbSW50ZXJuZXQgU3lzdGVtcyBDb25zb3J0aXVtMRwwGgYDVQQD ++DBNjYS50ZXN0LmV4YW1wbGUuY29tMB4XDTIyMDkwNzA4MTQxOFoXDTIyMDkwODA4 ++MTQxOFowLTErMCkGA1UEAwwic3J2MDEuY2xpZW50MDItZXhwaXJlZC5leGFtcGxl ++Lm5pbDCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAMARJxclOq2FoDtZ ++CyJkY327BTI1T2jVGSvNRr3itkKMCM8JDajNWNkbd9sXivzwVfLhUPT9kKpJFV3q ++m1pHxC+CB0aH9gXvFQKkPKHa/Ft1NhL3ElBV+L4MfSGR4pLYQT9x/rIXwGgdCb78 ++xCTs79JcUqlP1l0wuKtoLjnpi1vG8GRC97i9spAyImi8OHAvFK7IfGME1RGyCvGO ++ExCyO2n0/jri8VhWKJPBKKqnGcmREkP49R00WD0ynxFn0R9T1ODVDHgsbzg/4Ylp ++tQk8EvSp7uUvxUdlpoL66nhIMYkRtiOKJ+18HW3oq6Ap3kD08pthItqcIjL3PfhM ++4Tin4sOvpGd/lKT9UiWJTfSa1jW6mCDxS8mlz6xyWCrNO0o+6QQx4pp0MtVSYDSt ++DIUCZVhBdCpXkTRVNqkUW0XMKCfXbbpVo92fAASkQ8KvXK+GU6bVp0mqMdZekn0m ++3Y30h4qbSOgl9Mc0ys/j94QZO0PHarjabm+Fr40M+3zqx3OcmwIDAQABozcwNTAz ++BgNVHREELDAqgiJzcnYwMS5jbGllbnQwMi1leHBpcmVkLmV4YW1wbGUubmlshwQK ++NQABMA0GCSqGSIb3DQEBCwUAA4IBgQAY8XwkW9IDsGAOYOYy+adH0eS9P6MhU5CE ++msYsh7IWKJUHoyrDM49gcD8mWL7somxEidNO77vOr5tfFQYDIXTjbyrcXBlO08u6 ++w1/YdolZUIJpX6Gsn7554SISN/nTLgA1AwOdCCRFZXrpcjHhZ0QyFyXduXLrxkDX ++XY1fAEgHCQ08TKHxBUsFmytaIQlG9Bd6zzSHrb/vvVZ01xqPB85wsapNgk8I3FYn +++SEguAbHKbSONoK4Q4UcLZ++LbmdQN5SVWouCygz/PgbcOnFRlDzBb6N7Zns8YxR ++ihxLlfTE3c1CdLxvZmRUuMFuyD3p/hACYVB3OLmwuBM3jw5bSZI6nZpgUWiZitV+ ++knF++ttSN035DWw7eaO5FreVAOrrF1TiUNelCFRYLHlmAUuVZe24gfdM+viJN63Z ++3Ml1nQI+5ZKzA6twaYP1bKYnfi78nbJZCkOtP1UvXezvUvA+vrXW4sORnd1d4Z7m ++GJALaoX444MqfJHDUhxtqitEuG8rr24= ++-----END CERTIFICATE----- +diff --git a/bin/tests/system/nsupdate/CA/private/CA-other.key b/bin/tests/system/nsupdate/CA/private/CA-other.key +new file mode 100644 +index 0000000..41818aa +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/private/CA-other.key +@@ -0,0 +1,39 @@ ++-----BEGIN RSA PRIVATE KEY----- ++MIIG5AIBAAKCAYEA10Xj8dH8/XCfUvhdL/S3E10TnrYY8IIDBmU0lkUR5IHwgP9I ++YVyR/0Mibg79FAs+rvuEDifUK+6wvkpj+BXNVZCspo9/u3cl7dqrLH+1SeUs50Oe ++QnbbTrBl0PuNwvzEkbk7xwLlVDOyRmmvY/EEu7WkitQZgXSAYgttrk62CuJUQUmw ++UTX5Jxndsjydk/zW/DiulTsX+zv8kG5NiwpXCfL6QxBoMZNI4fUmDL3bX1XfHaFA +++45GT2lHu07xc+cVeZIRCo0Nk+fIO53lDol8mmR8/5vna27gRnqEUSU7MZAMG6QB ++Xkotnq3rHnrI/ku6dCJW4tbWV/ANQ+TG17g2tygzC/smqTuLqavyP9V5cRrdU9aw ++Eqwvy8uVbGkTmUZdtjkGWCcmBSWJvkH3MRJmijS7rDcb8m/g9+xKe79V1c8durGW ++vcfMRZZhWaoHyhnHg9+JLUCC3EUCp/1206w5vTXEQNpqi9Z3AZfgboPzJyji4OeY ++fcQ5eaIZ3OuIpyQzAgMBAAECggGAD+vUWvsr2datgeZqhfR0YdM9czyGhasn7B4q ++EH8VPrA5iGDZCpJdHeLqNfeX0hau0SQ69Q0PDRy/J6O61wtNv2lOy5bLXKMIRBor ++FMRxNQDlHEmM999wgtZbAWTJbEVjiF+Jw0M8kMiuA7UnSp31uqhJfhcHt+JU6Gtt ++9jlOD2oDzzxS9P6n6bNpCRigkuRdRhQvHUxcjrE2EbyGsaTXIR4+Uh1xh1EcT9Hg ++uYqFIfzo3nkhpDk2jAL+UiUZiHfrpO6OfqpNQj27jju/35DT+2hgGuS2JApzpi91 ++gJSDXwsDQYdP2a2B0y3K0+HwC7/YovAzlXkfes06ebtsiG4Nzl15vnKaTbON0vZO ++7jMkedmstKaLGM5PlLW0afls5ahr0dtrhWFs+1QKcv1JahcfeEvggeH9/gtjpunM ++MT31VuYbwleWAsRxjGG3OWKLgst4cJXqGTdM21JzBDOP43/ZIaaedl43jJzIgIM5 ++b4ae9DrhsTNIboYO20XYdwtn9Q2pAoHBAPLO1xTWfqpCwZU6udtX73jMfpwhGlWW ++0jqg9gvxs9Neg4nfYMtiliBS5VT+6oID8YSKOSWXHWFGFkBN5hqfGbu5Nd94rY0J ++g6UYgGOAcNfoGOTpI2xljpEWJJfquTFgbajwFg+q3p6mL1zShkzvf6hzqENxbLxy ++OvEPkszN6cy16jgEUv5qK9qNf7ISB8Ki3yFSKAfuRlapny3TcRTYkJNZ0y398/sG ++E5vqrrYyjUWv5Uwz0mHmZpmZuZuaUJxtlwKBwQDi+BKnIiYYwdJPmCNCykRJB02Z ++QZlxtnrrajxZsXHysTopX5HkOQH80VSbH6fj287qX7vV0ux2maFLoszjM0wtfQhE ++8fsuKRPfzxR0cFtPFtncCHI5FVT2MOsdz5dZ8BsinCgsVlZ3SrUC9gxPKpVdRd21 ++OUC3r+tOPvM0gdfyT560GDLhaH12iOA5KtWnE3FIEpk6y95D1a4E7zu4ZaoI98UU ++F8ezSREzF9UzAcdVn8MA3v82nlGQS8iFI9mHicUCgcACWkS1O/rQNYNgqcgBOxHj ++7r9PTfbOW36/+K1JolbmtmS54kMy1Uq1F3iHYUzuY5Fkgl5ZYeRz+9TdXKPdICuE ++qR+/gZDU7AGtiNY9oJH3VZVgKm4gb7944mkKW8jdlJybZXAhSLuNd/i/gn6woiVv ++gWdg9+lgzg6KJWd7uocIZ77UOh5/vpGcNYDGPex7U06sKPqgUQu3bT9Ql1riI9MK ++ynUEXhCOHxnzicuVklnSEgk7usjQEAZweI/W1SDw0xMCgcEAm9BQBdsEqlRNDAVW ++l6CB9lyEIiUNsSnkAr9AxRZzMngGhKauYi3ctnICkifOOzgIOZAVRDpzyQu41lLi ++M0thDY1bYvF4TX03vprL4Q/NL2NxloNZ3uRNGmIE1sdPkRermTv4vE9dNrHbyDef ++xa1nMswm4yV1z2R+to2yqqZE2H1eZyaBr4rrLrfSroxAdl17lE3oUZvpb0o/F/Yg ++Wnu4mkV2T0/v8Z3Ep/3BiC29aYOu/Gcab6WKOvQ7qWMuD8U9AoHBAJslXJMsMZVc ++UIaxRbknRMEBRBJW6X6EPbV3zGa+R9e9XRSG7jYSOWB9Yb2AbwjsvF4Qq+8VQq+V ++Ksxs7XOuwR202oZFzQDMoVj1LL4Cn60rRWlI+p6Q5SB2DQVo2kulTv1NtvdVR+U0 ++ABa0xp5TKi7+jTY/e3CJGiT69sZc7v2VXptoiGytlUl9GVr0SImD1ZJdaJSJCPZX ++S+cEzfF6LVnnhlaq4puuv/vKjumNWDymv3zwZOy9D8nn/tMHqLKWSg== ++-----END RSA PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/private/CA.key b/bin/tests/system/nsupdate/CA/private/CA.key +new file mode 100644 +index 0000000..2d5419d +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/private/CA.key +@@ -0,0 +1,39 @@ ++-----BEGIN RSA PRIVATE KEY----- ++MIIG5AIBAAKCAYEAouoRHoAc6VCmxNTU6Ge7s+xDFGO0wXJJIsP+8nUyyjWvGCOC ++aQYLhb1kLA2NHRhSSKFcMh8jcd7Hlvy6CAec1j2dsWzryy3HgPrdjWaW3PfBO41D ++lUtdt8hA/p6pX2YwqvWbdK/3s8J0LY5xRZKNZnFOB/Sb4PGiIJ1NgMRO/M3IlPQm ++PO/faRRTU4SI26KCPKFW342826Zi88YwOd6w5mQU4fskk5TGtlNqE+Fj40ZbWVpy ++VXoEUS6RveRp020NX5CQG49SLtdF05AnnsATqmgNVCXptGuqW8uaHRONeGO3NBEy ++nJmibWBDUMjtCCcGVgyrVXuTkyAJJWpImnshUwgMNYebRwmC2iVv2LtsJS5eUTUH ++EWffnFl55XU2PkyNYgY35gA4y3SiWFJYV8+5FibU4ut0nb+lmHBF8WlqcU/kd3tp ++Gkf0exjqOIHZFqV9bIhpUbXhxx9v9+gkkGQ9nrXE1KRlvigxxUeIK5xHy9a7fVIL ++wo6WuCnLLJmbVkklAgMBAAECggGBAI5ZV3v/FUQIZK+4CBDKEwizeClotZgR9DWc ++bDgOj8KABe5hmKGL1qWVRuH3NUYm6j7sP1LMQnxM3LjhOuupOzE3xYIyWhW+eoQI ++r23OJiQNl5ohZNweblUXdTMGD5h8AipfUOY0m4tGbZ0gyXixBTxt5HCvG0UB3VgC ++GqZY4Wujo5ADhSXZsqxuRiDDvZGr/YBcuTu87Tg/ulam5ZyrKIcnC9gpSVxqsva9 ++DAMy/cSoxUjd7ukhJISK3G3AF3fV4GSslQcJTlyJ2D3+LnqPuHJKYTI4hc46lN3x ++E2g24GdSCPYf6SoEPwACXtbavV8TXwQPJrHN+f+0/ePCI4jkYe5NoA3gwVgMb/WB ++wFchxzVh3V4e8tPGiG+ofKl81DSAW8VZCJLUIbTEce9oxafPT78WJxdC0wWbh5S8 ++V/qN6sW/yWnK3oY9SilWhJGRwKOZ+8xtStaDeCzyCaOqEcWi8ZR0QfC33UozlhdC ++SrMKnOXmn/rUuXGrVR56IzIl0M7YAQKBwQDM3GJDdlFuHn6L0syKYdHDS8gXD9ke ++s+ochIP6jvkEPcayaEoZGl8s7RT3iztqXod7wLaZdotktxfDAZnJfeuOcVrCu+Bx ++HLytnBvV6czMfp3REGgQAJQeusSgtlBCTHHVOsDzIjdnkY3WBa7IiFYWO5wnYrGx ++r3ucnwnHaUVDMj1r4YI7mYIpCuYQl6eGyW7mhWewyhVwoQXKbifdrXxjvOigL0Cp ++tgsoU9pql3hpphOaYMX6hLOincTfaMxfnCECgcEAy5UXp3dA0OwK+4iDGKr+cUpk ++AtGTheiE+8zEVh2KYFLt921mW/QZiB1+xtnkknp3c7u07Ugk8jAEXzCkwMnN5ZCx ++LrJ72fC+cLIAbRm6/vMMP8iz83wyttao4qNMeoOBBfE9rEiP+lrugpv282V3ZHYa ++IUZWTeugJbckUHTbD3RZQExmQcRVG3m/TzonBfoZ8HoRj/n3d7V2T911cHUhi8Xn ++RQIi2m63VofOIep86LgartlKneMWnL0oOPq4RKyFAoHAZUzpDkD4nUJZAx025Yrf ++ZfoYNEcy7vq6XmWsuX5vZoiBs4DcezNOMvH9NzdTJxMdXbV61cIHxcK/7j7hZABv ++NZ2Z6sdqgaRbLGIQZaPaEJjfwxygyKDwnY1vY6UjZNVWSMFn3hJiYUVZZKakuiao ++ow/Q9KzZ/2ot7tG5zTCh/ktekfUOKBiNg2wPPc8wGPeMblMzZflXxrzpFyOHdRev ++dcZZJbSX/hO1yrhEPgculNd5xBHsdCegiF4JlwvEW9bhAoHAZQQiy5bx03j8bhkr ++q6bVQFPAUmG5iL16lxLg7TYVPnyH1bk0DDaQIKk6CeN+dmxML2IZgY/FvWK0GKOj ++bIH2J43nTRuFNvwtEvBQI9KbpfvlvRSSriOXaoATJvoObdAoylEM4BrVTk2mgapw ++HA/h8Thk+NPU6S8ctPouC7ogJIf/7Va7erC35j0//0kEqgOSsW9wnXdUItMo1LI3 ++nsiQD7Hwcp5/utErKcWTM+MNfdA0dUQesT9ILhfyCGvn2TOdAoHBAKldZkDyRcu9 ++r9uDF1bhUEnpV2k4hgvTuCvQ3rzyx3WrVT8ChEmePC8Ke5A54ffu/YdbpDLbdf2c ++j4n5CQhHbMIZs3P2hB3WqDCImApCfMbXaltfBbaT0j7uLJPMp+2+f/wWYpc3R+bn ++HVnaRI2PoXXmG9OjQSQdVZ5gNpkEuemAo3dJOSS6BMqQaSxUynGy7o/a/d4izBjd ++B58Fwq3sZI/Xv90Se9+b6ICST3YJ3p0vn8RKzmlCQjLg/xynpCByiw== ++-----END RSA PRIVATE KEY----- +diff --git a/bin/tests/system/nsupdate/CA/serial b/bin/tests/system/nsupdate/CA/serial +new file mode 100644 +index 0000000..0a263a5 +--- /dev/null ++++ b/bin/tests/system/nsupdate/CA/serial +@@ -0,0 +1 @@ ++70B9F4EB2FA1959C +diff --git a/bin/tests/system/nsupdate/dhparam3072.pem b/bin/tests/system/nsupdate/dhparam3072.pem +new file mode 100644 +index 0000000..9c2e0aa +--- /dev/null ++++ b/bin/tests/system/nsupdate/dhparam3072.pem +@@ -0,0 +1,11 @@ ++-----BEGIN DH PARAMETERS----- ++MIIBiAKCAYEA5D/Oioe+G+EMf/9RVxmcV4rZAtqZpVTFHcX0ZulvdiQGCQmopm6K ++3+0uoU2J6WVMjhna5nHD2NO9miRDI/jIxX9g9k6PedSB4o3fSTtkAnGtUbB8S+Ab ++EHtWfd7FTES8P1n16HN7BfPXVbP8zTcK+jO63KdQoxueYoETcrw0Myi9Lm8ri8os ++O4oQ+XAH7GzZ60bcYV9jge0XIRUGVnYZDjWMlnwMvZyjLivxKXTC9HPNA6FF1/0H ++0LPhsfjdoLNsVHFzfQz7QELMfHbTd0C8y0UMDQw9FqUp0esHZ5gsTlqnDHp2ZHoR ++JDfNl4yVO5Gv4HiFJ0NSdggefhESU3FRAOhMmUkctOCxk5hyPqGMsvofOajY2MBp ++eCffrKuAU6/dGUeq8inwrZlAMIZ20WyskHmbHnc4DXo2Uo6xSZo3xyEq1ofXXwTZ ++vPw4e12so3RJAT2a8UsHf7DG1tH+9ke7HCAJQWxUizRFRsMi1Nl/7ikS4f3zgIbX ++GKz9+uk5eS6jAgEC ++-----END DH PARAMETERS----- +diff --git a/bin/tests/system/nsupdate/ns1/named.conf.in b/bin/tests/system/nsupdate/ns1/named.conf.in +index 2c1899f..aaf1d9c 100644 +--- a/bin/tests/system/nsupdate/ns1/named.conf.in ++++ b/bin/tests/system/nsupdate/ns1/named.conf.in +@@ -11,14 +11,48 @@ + * information regarding copyright ownership. + */ + ++tls tls-forward-secrecy { ++ protocols { TLSv1.2; }; ++ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384"; ++ prefer-server-ciphers yes; ++ key-file "../CA/certs/srv01.crt01.example.nil.key"; ++ cert-file "../CA/certs/srv01.crt01.example.nil.pem"; ++ dhparam-file "../dhparam3072.pem"; ++}; ++ ++tls tls-forward-secrecy-mutual-tls { ++ protocols { TLSv1.2; }; ++ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384"; ++ prefer-server-ciphers yes; ++ key-file "../CA/certs/srv01.crt01.example.nil.key"; ++ cert-file "../CA/certs/srv01.crt01.example.nil.pem"; ++ dhparam-file "../dhparam3072.pem"; ++ ca-file "../CA/CA.pem"; ++}; ++ ++tls tls-expired { ++ protocols { TLSv1.2; }; ++ ciphers "HIGH:!kRSA:!aNULL:!eNULL:!RC4:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!SHA1:!SHA256:!SHA384"; ++ prefer-server-ciphers yes; ++ key-file "../CA/certs/srv01.crt02-expired.example.nil.key"; ++ cert-file "../CA/certs/srv01.crt02-expired.example.nil.pem"; ++ dhparam-file "../dhparam3072.pem"; ++}; ++ ++ + options { + query-source address 10.53.0.1; + notify-source 10.53.0.1; + transfer-source 10.53.0.1; + port @PORT@; ++ tls-port @TLSPORT@; + pid-file "named.pid"; + session-keyfile "session.key"; + listen-on { 10.53.0.1; 127.0.0.1; }; ++ listen-on tls ephemeral { 10.53.0.1; }; ++ listen-on port @EXTRAPORT1@ tls tls-forward-secrecy { 10.53.0.1; }; ++ listen-on port @EXTRAPORT2@ tls tls-forward-secrecy-mutual-tls { 10.53.0.1; }; ++ listen-on port @EXTRAPORT3@ tls tls-expired { 10.53.0.1; }; + listen-on-v6 { none; }; + recursion no; + notify yes; +diff --git a/bin/tests/system/nsupdate/ns10/named.conf.in b/bin/tests/system/nsupdate/ns10/named.conf.in +index 25ba141..51a0b4f 100644 +--- a/bin/tests/system/nsupdate/ns10/named.conf.in ++++ b/bin/tests/system/nsupdate/ns10/named.conf.in +@@ -16,9 +16,11 @@ options { + notify-source 10.53.0.10; + transfer-source 10.53.0.10; + port @PORT@; ++ tls-port @TLSPORT@; + pid-file "named.pid"; + session-keyfile "session.key"; + listen-on { 10.53.0.10; }; ++ listen-on tls ephemeral { 10.53.0.10; }; + listen-on-v6 { none; }; + recursion no; + notify yes; +diff --git a/bin/tests/system/nsupdate/tests.sh b/bin/tests/system/nsupdate/tests.sh +index 916f45b..735b659 100755 +--- a/bin/tests/system/nsupdate/tests.sh ++++ b/bin/tests/system/nsupdate/tests.sh +@@ -1145,7 +1145,182 @@ fi + + n=$((n + 1)) + ret=0 ++echo_i "check DoT (opportunistic-tls) ($n)" ++$NSUPDATE -D -S -O -k ns1/ddns.key <nsupdate.out.test$n 2>&1 || ret=1 ++server 10.53.0.1 ${TLSPORT} ++update add dot-non-auth-client-o.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client-o.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 || ret=1 ++server 10.53.0.1 ${EXTRAPORT1} ++update add dot-non-auth-client.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-non-auth-client.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (strict-tls) with an implicit hostname (by IP address) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 || ret=1 ++server 10.53.0.1 ${EXTRAPORT1} ++update add dot-fs.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fs.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (strict-tls) with a correct hostname ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.nil -k ns1/ddns.key <nsupdate.out.test$n 2>&1 || ret=1 ++server 10.53.0.1 ${EXTRAPORT1} ++update add dot-fs-h.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-h.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (strict-tls) with an incorrect hostname (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -H srv01.crt01.example.bad -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT1} ++update add dot-fs-h-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (strict-tls) with a wrong authority (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA-other.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT1} ++update add dot-fs-auth-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fs-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (mutual-tls) with a valid client certificate ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 || ret=1 ++server 10.53.0.1 ${EXTRAPORT2} ++update add dot-fsmt.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 || ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (mutual-tls) with a valid client certificate but with an incorrect hostname (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -H srv01.crt01.example.bad -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT2} ++update add dot-fsmt-h-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-h-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi + ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (mutual-tls) with a valid client certificate but with a wrong authority (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA-other.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/client01.crt01.example.nil.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT2} ++update add dot-fsmt-auth-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-auth-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (mutual-tls) with an expired client certificate (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client02-expired.example.nil.key -E CA/certs/srv01.client02-expired.example.nil.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT2} ++update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 ++echo_i "check DoT (mutual-tls) with a valid client certificate and an expired server certificate (failure expected) ($n)" ++$NSUPDATE -D -S -A CA/CA.pem -K CA/certs/srv01.client01.example.nil.key -E CA/certs/srv01.client01.example.nil.pem -k ns1/ddns.key <nsupdate.out.test$n 2>&1 && ret=1 ++server 10.53.0.1 ${EXTRAPORT3} ++update add dot-fsmt-exp-bad.example.nil. 600 A 10.10.10.3 ++send ++END ++sleep 2 ++$DIG $DIGOPTS +short @10.53.0.1 dot-fsmt-exp-bad.example.nil >dig.out.test$n 2>&1 || ret=1 ++grep -F "10.10.10.3" dig.out.test$n >/dev/null 2>&1 && ret=1 ++if [ $ret -ne 0 ]; then ++ echo_i "failed" ++ status=1 ++fi ++ ++n=$((n + 1)) ++ret=0 + echo_i "check TSIG key algorithms (nsupdate -k) ($n)" + if $FEATURETEST --md5; then + ALGS="md5 sha1 sha224 sha256 sha384 sha512" +@@ -1409,6 +1584,7 @@ send + END + t2=$($PERL -e 'print time()') + grep "; Communication with 10.53.0.4#${PORT} failed: timed out" nsupdate.out.test$n >/dev/null 2>&1 || ret=1 ++grep "not implemented" nsupdate.out.test$n > /dev/null 2>&1 && ret=1 + grep "not implemented" nsupdate.out.test$n >/dev/null 2>&1 && ret=1 + elapsed=$((t2 - t1)) + # Check that default timeout value is respected, there should be 4 tries with 3 seconds each. +@@ -2710,6 +2886,23 @@ EOF + status=1 + } + ++ n=$((n + 1)) ++ ret=0 ++ echo_i "check ms-selfsub match using DoT (opportunistic-tls) ($n)" ++ KRB5CCNAME="FILE:$(pwd)/ns10/machine.ccache" ++ export KRB5CCNAME ++ $NSUPDATE -d -S -O << EOF > nsupdate.out.test$n 2>&1 || ret=1 ++ gsstsig ++ realm EXAMPLE.COM ++ server 10.53.0.10 ${TLSPORT} ++ zone example.com ++ update add dot.machine.example.com 3600 IN A 10.53.0.10 ++ send ++EOF ++ $DIG $DIGOPTS +tcp @10.53.0.10 dot.machine.example.com A > dig.out.ns10.test$n ++ grep "status: NOERROR" dig.out.ns10.test$n > /dev/null || ret=1 ++ grep "dot.machine.example.com..*A.*10.53.0.10" dig.out.ns10.test$n > /dev/null || ret=1 ++ [ $ret = 0 ] || { echo_i "failed"; status=1; } + fi + + echo_i "exit status: $status" +-- +2.47.0 + diff --git a/bind.spec b/bind.spec index 09d3aed..d0e5381 100644 --- a/bind.spec +++ b/bind.spec @@ -135,6 +135,8 @@ Patch27: bind-9.20-openssl-no-engine.patch Patch28: bind-9.20-nsupdate-tls.patch # Man change for patch28 nsupdate Patch29: bind-9.20-nsupdate-tls-doc.patch +# Test suport for patch28 nsupdate +Patch30: bind-9.20-nsupdate-tls-test.patch %{?systemd_ordering} Requires: coreutils @@ -991,6 +993,7 @@ fi; %changelog * Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 - Add nsupdate TLS support (FREEIPA-11706) +- Include a test for nsupdate changes * Thu Nov 14 2024 Petr Menšík - 32:9.18.31-1 - Update to 9.18.31 (#2319214) From ca5d3f013159a8314cb6d6444ad00bead6b51efe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 11 Dec 2024 21:01:49 +0100 Subject: [PATCH 057/144] Disable PDF generation on s390x --- bind.spec | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index d0e5381..e885e89 100644 --- a/bind.spec +++ b/bind.spec @@ -24,9 +24,12 @@ # Because of issues with PDF rebuild, include only HTML pages # Current error: unable top find isc-logo.pdf %if 0%{?fedora} +# xindy fails on s390x now. Not sure why. +%ifnarch s390x # RHEL and ELN do not have all required packages %bcond_without DOCPDF %endif +%endif %bcond_with TSAN # Add experimental extra verbose logging of query processing %bcond_with QUERYTRACE @@ -87,7 +90,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.31 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -991,6 +994,9 @@ fi; %endif %changelog +* Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 +- Disable temporarily PDF generation on s390x + * Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 - Add nsupdate TLS support (FREEIPA-11706) - Include a test for nsupdate changes From ad87dca169121d88a5a6040e661799109e5f2f3a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 12 Dec 2024 20:00:58 +0100 Subject: [PATCH 058/144] Disable PDF for all platforms temproarily It fails only on s390x, but cannot be disabled just on one arch when the package is noarch. Disable it until resolved. Related: rhbz#2332076 --- bind.spec | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/bind.spec b/bind.spec index e885e89..7835e2f 100644 --- a/bind.spec +++ b/bind.spec @@ -24,11 +24,9 @@ # Because of issues with PDF rebuild, include only HTML pages # Current error: unable top find isc-logo.pdf %if 0%{?fedora} -# xindy fails on s390x now. Not sure why. -%ifnarch s390x # RHEL and ELN do not have all required packages -%bcond_without DOCPDF -%endif +# xindy fails on s390x now. Not sure why. rhbz#2332076 +%bcond_with DOCPDF %endif %bcond_with TSAN # Add experimental extra verbose logging of query processing @@ -995,7 +993,7 @@ fi; %changelog * Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 -- Disable temporarily PDF generation on s390x +- Disable temporarily PDF generation on all platforms * Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 - Add nsupdate TLS support (FREEIPA-11706) From 7d1027aabfe2bd483ad368b0dabd5341147f0047 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 12 Dec 2024 19:54:03 +0100 Subject: [PATCH 059/144] Update to 9.18.32 (rhbz#2331675) - Remove CHANGES file from package Removed Features: - Disable DLZ plugins, they are not shipped with bind anymore New Features: - new 2024 KSK root key Feature Changes: - max-records-per-type and max-types-per-name improved logging when reached over their value And NSEC3 and two dig bug fixes. https://downloads.isc.org/isc/bind9/9.18.32/doc/arm/html/notes.html#notes-for-bind-9-18-32 --- .gitignore | 2 ++ bind-9.20-nsupdate-tls.patch | 56 ++++++++++++++++++------------- bind-9.20-openssl-no-engine.patch | 47 -------------------------- bind-9.5-PIE.patch | 27 ++++++++++----- bind.spec | 17 +++++----- sources | 4 +-- 6 files changed, 64 insertions(+), 89 deletions(-) delete mode 100644 bind-9.20-openssl-no-engine.patch diff --git a/.gitignore b/.gitignore index 5e41d3f..65b7f81 100644 --- a/.gitignore +++ b/.gitignore @@ -232,3 +232,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.30.tar.xz.asc /bind-9.18.31.tar.xz /bind-9.18.31.tar.xz.asc +/bind-9.18.32.tar.xz +/bind-9.18.32.tar.xz.asc diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch index 183ff0b..51f1b1e 100644 --- a/bind-9.20-nsupdate-tls.patch +++ b/bind-9.20-nsupdate-tls.patch @@ -1,7 +1,7 @@ -From ec00ba4b215963af5e05892cf2ce1a62222ede46 Mon Sep 17 00:00:00 2001 +From 5536f80f32ad22160ab98acf31e49768d3cf76fc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 11 Nov 2024 18:09:07 +0100 -Subject: [PATCH 1/3] Backport nsupdate TLS support into 9.18 +Subject: [PATCH] Backport nsupdate TLS support into 9.18 Attempt to support TLS from nsupdate even in 9.18 release. @@ -40,9 +40,11 @@ implementation as a model for the newly added features. [pemensik] Adapted to previous 9.18 changes. Add usage and command line parsing + +Adapted to 9.18.32 --- bin/nsupdate/nsupdate.c | 192 ++++++++++++++++++++---- - lib/dns/dispatch.c | 107 ++++++++++++-- + lib/dns/dispatch.c | 113 ++++++++++++-- lib/dns/include/dns/dispatch.h | 22 +++ lib/dns/include/dns/request.h | 23 +++ lib/dns/include/dns/transport.h | 45 +++++- @@ -50,10 +52,10 @@ Add usage and command line parsing lib/dns/request.c | 63 ++++++-- lib/dns/transport.c | 253 ++++++++++++++++++++++++++++++++ lib/dns/xfrin.c | 232 +---------------------------- - 9 files changed, 649 insertions(+), 290 deletions(-) + 9 files changed, 652 insertions(+), 293 deletions(-) diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c -index 45ba90fba7b..93c7ea6cb17 100644 +index 293ed28..819925e 100644 --- a/bin/nsupdate/nsupdate.c +++ b/bin/nsupdate/nsupdate.c @@ -45,6 +45,7 @@ @@ -449,7 +451,7 @@ index 45ba90fba7b..93c7ea6cb17 100644 if (answer != NULL) { dns_message_detach(&answer); diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c -index d737363fea4..44a2896cb03 100644 +index eb37198..9b263db 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -30,6 +30,7 @@ @@ -497,7 +499,7 @@ index d737363fea4..44a2896cb03 100644 dns_dispatchstate_t state; isc_refcount_t references; -@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout); +@@ -220,16 +227,30 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout); static const char * socktype2str(dns_dispentry_t *resp) { @@ -517,17 +519,23 @@ index d737363fea4..44a2896cb03 100644 + + switch (transport_type) { + case DNS_TRANSPORT_UDP: - return ("UDP"); + return "UDP"; - case isc_socktype_tcp: + case DNS_TRANSPORT_TCP: - return ("TCP"); + return "TCP"; +- default: +- return ""; +- } + case DNS_TRANSPORT_TLS: + return "TLS"; + case DNS_TRANSPORT_HTTP: + return "HTTP"; - default: - return (""); - } ++ default: ++ return (""); ++ } + } + + static const char * @@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type, isc_result_t dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, @@ -627,7 +635,7 @@ index d737363fea4..44a2896cb03 100644 #if DNS_DISPATCH_TRACE fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n", @@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, - return (ISC_R_NOMORE); + return ISC_R_NOMORE; } + if (transport != NULL) { @@ -678,7 +686,7 @@ index d737363fea4..44a2896cb03 100644 LOCK(&disp->lock); switch (disp->state) { diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h -index ad377f078ed..cfdc37481ce 100644 +index ad377f0..cfdc374 100644 --- a/lib/dns/include/dns/dispatch.h +++ b/lib/dns/include/dns/dispatch.h @@ -56,6 +56,7 @@ @@ -739,7 +747,7 @@ index ad377f078ed..cfdc37481ce 100644 * Add a response entry for this dispatch. * diff --git a/lib/dns/include/dns/request.h b/lib/dns/include/dns/request.h -index d00574f9827..17bcbf68c3b 100644 +index d00574f..17bcbf6 100644 --- a/lib/dns/include/dns/request.h +++ b/lib/dns/include/dns/request.h @@ -44,6 +44,7 @@ @@ -787,7 +795,7 @@ index d00574f9827..17bcbf68c3b 100644 * \brief Create and send a request. * diff --git a/lib/dns/include/dns/transport.h b/lib/dns/include/dns/transport.h -index e74ccd7f970..e6499a97e73 100644 +index e74ccd7..e6499a9 100644 --- a/lib/dns/include/dns/transport.h +++ b/lib/dns/include/dns/transport.h @@ -13,7 +13,9 @@ @@ -874,7 +882,7 @@ index e74ccd7f970..e6499a97e73 100644 * Requires: *\li 'transport' is valid. diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h -index 6465962bd41..f0aaa24e936 100644 +index 6465962..f0aaa24 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h @@ -141,6 +141,8 @@ typedef struct dns_ssutable dns_ssutable_t; @@ -887,7 +895,7 @@ index 6465962bd41..f0aaa24e936 100644 typedef struct dns_tsec dns_tsec_t; typedef struct dns_tsig_keyring dns_tsig_keyring_t; diff --git a/lib/dns/request.c b/lib/dns/request.c -index fb17ed2262e..463a7ca6d63 100644 +index 8aaa29f..badedab 100644 --- a/lib/dns/request.c +++ b/lib/dns/request.c @@ -399,12 +399,12 @@ isblackholed(dns_dispatchmgr_t *dispatchmgr, const isc_sockaddr_t *destaddr) { @@ -914,7 +922,7 @@ index fb17ed2262e..463a7ca6d63 100644 - destaddr, dispatchp); + result = dns_dispatch_createtcp2(requestmgr->dispatchmgr, srcaddr, + destaddr, transport, 0, dispatchp); - return (result); + return result; } @@ -452,12 +452,12 @@ udp_dispatch(dns_requestmgr_t *requestmgr, const isc_sockaddr_t *srcaddr, @@ -1021,7 +1029,7 @@ index fb17ed2262e..463a7ca6d63 100644 goto detach; } diff --git a/lib/dns/transport.c b/lib/dns/transport.c -index ae1ab7415b1..59eba1db252 100644 +index 88a3df4..2a779ba 100644 --- a/lib/dns/transport.c +++ b/lib/dns/transport.c @@ -15,9 +15,11 @@ @@ -1302,7 +1310,7 @@ index ae1ab7415b1..59eba1db252 100644 transport_destroy(dns_transport_t *transport) { isc_refcount_destroy(&transport->references); diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c -index 72b24e15ac3..73bd834070c 100644 +index 3a4f761..3695815 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c @@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr, @@ -1516,7 +1524,7 @@ index 72b24e15ac3..73bd834070c 100644 - *pctx = found; - } - -- return (ISC_R_SUCCESS); +- return ISC_R_SUCCESS; - -failure: - if (tlsctx != NULL) { @@ -1534,7 +1542,7 @@ index 72b24e15ac3..73bd834070c 100644 - isc_tls_cert_store_free(&store); - } - -- return (result); +- return result; -} - static isc_result_t @@ -1552,5 +1560,5 @@ index 72b24e15ac3..73bd834070c 100644 goto failure; } -- -2.47.0 +2.47.1 diff --git a/bind-9.20-openssl-no-engine.patch b/bind-9.20-openssl-no-engine.patch deleted file mode 100644 index adb46aa..0000000 --- a/bind-9.20-openssl-no-engine.patch +++ /dev/null @@ -1,47 +0,0 @@ -From b487bd340ae1b635ce5cffe76f748ddc97f301f7 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Sat, 3 Aug 2024 01:28:36 +0200 -Subject: [PATCH] Remove unused headers from OpenSSL - shims - -The headers were unused and including the - header might cause build failure when OpenSSL -doesn't have Engines support enabled. - -See https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine ---- - lib/isc/openssl_shim.c | 2 -- - lib/isc/openssl_shim.h | 2 -- - 2 files changed, 4 deletions(-) - -diff --git a/lib/isc/openssl_shim.c b/lib/isc/openssl_shim.c -index c39ba8c6827..02d0105eb9e 100644 ---- a/lib/isc/openssl_shim.c -+++ b/lib/isc/openssl_shim.c -@@ -16,9 +16,7 @@ - #include - - #include --#include - #include --#include - #include - #include - -diff --git a/lib/isc/openssl_shim.h b/lib/isc/openssl_shim.h -index b2916e20a90..95b2f08e231 100644 ---- a/lib/isc/openssl_shim.h -+++ b/lib/isc/openssl_shim.h -@@ -14,9 +14,7 @@ - #pragma once - - #include --#include - #include --#include - #include - #include - --- -2.46.2 - diff --git a/bind-9.5-PIE.patch b/bind-9.5-PIE.patch index 1420cf3..9744f69 100644 --- a/bind-9.5-PIE.patch +++ b/bind-9.5-PIE.patch @@ -1,17 +1,28 @@ +From 13348a5fc64387bf53ef450688e181100d0ceddb Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Thu, 12 Dec 2024 15:56:13 +0100 +Subject: [PATCH] Harden named service build flags + +--- + bin/named/Makefile.am | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + diff --git a/bin/named/Makefile.am b/bin/named/Makefile.am -index 57a023b..085f2f7 100644 +index 57a023b..b832e9c 100644 --- a/bin/named/Makefile.am +++ b/bin/named/Makefile.am -@@ -32,9 +32,12 @@ AM_CPPFLAGS += \ - endif HAVE_LIBXML2 +@@ -33,7 +33,10 @@ endif HAVE_LIBXML2 AM_CPPFLAGS += \ -+ -fpie \ -DNAMED_LOCALSTATEDIR=\"${localstatedir}\" \ - -DNAMED_SYSCONFDIR=\"${sysconfdir}\" - -+AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack +- -DNAMED_SYSCONFDIR=\"${sysconfdir}\" ++ -DNAMED_SYSCONFDIR=\"${sysconfdir}\" \ ++ -fpie + ++AM_LDFLAGS += -pie -Wl,-z,relro,-z,now,-z,nodlopen,-z,noexecstack + sbin_PROGRAMS = named - nodist_named_SOURCES = xsl.c +-- +2.47.1 + diff --git a/bind.spec b/bind.spec index 7835e2f..7f2619d 100644 --- a/bind.spec +++ b/bind.spec @@ -10,7 +10,7 @@ %bcond_without JSON %if ! 0%{?rhel} # FIXME: Not ready. Should it be worked on? -%bcond_without DLZ +%bcond_with DLZ %endif # New MaxMind GeoLite support %bcond_without GEOIP2 @@ -87,8 +87,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.31 -Release: 3%{?dist} +Version: 9.18.32 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -125,10 +125,6 @@ Patch10: bind-9.5-PIE.patch Patch16: bind-9.16-redhat_doc.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2122010 Patch26: bind-9.18-unittest-netmgr-unstable.patch -# https://fedoraproject.org/wiki/Changes/OpensslDeprecateEngine -# Correct support for building without openssl/engine.h header -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9593 -Patch27: bind-9.20-openssl-no-engine.patch # Downstream backport from 9.20 # https://issues.redhat.com/browse/FREEIPA-11706 # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/6751 @@ -825,7 +821,7 @@ fi; %{_mandir}/man8/rndc-confgen.8* %{_mandir}/man1/named-journalprint.1* %{_mandir}/man8/filter-*.8.gz -%doc CHANGES README.md named.conf.default +%doc README.md named.conf.default %doc sample/ # Hide configuration @@ -992,6 +988,11 @@ fi; %endif %changelog +* Thu Dec 12 2024 Petr Menšík - 32:9.18.32-1 +- Update to 9.18.32 (#2331675) +- Remove CHANGES file from package +- Disable DLZ plugins, they are not shipped with bind anymore + * Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 - Disable temporarily PDF generation on all platforms diff --git a/sources b/sources index 42e8fc8..36b309b 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.31.tar.xz) = e51873484be3ee367eb1e601b8e0adc45abcdb16df04021ea42ffcc51b99821f8b30f67b2a693a90ad3efa51698a651c8da9d7947ee8fa19680f627afe1f7034 -SHA512 (bind-9.18.31.tar.xz.asc) = 2c17d9a9f153264ed18b287e081b432b5310746964be3e35dfd31597622182e822e62fc3cc4034c0e1c7041949e624c43ffb10d134145d6300f8135f86e38cc6 +SHA512 (bind-9.18.32.tar.xz) = fa01978ca44cb5d559d8675dda4272b1327aebc0dca68b2e7b948e8c1bbd82da74f6258d40896ddccf86711d554b7ed4c0df93143e78b663724466738ac1320d +SHA512 (bind-9.18.32.tar.xz.asc) = b1b15734a90ec2df2da4a9f881fd9f9ea217a12e521b01d2cb06ff0f3305c80c933309d2bddf926e0ab647f4b925b4950c25c5d464ed276727dfbf6824387830 From a3b1b4c6a279ec1c74cb61f0cea1de07c638b9de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 12 Dec 2024 21:25:14 +0100 Subject: [PATCH 060/144] Add new root key 38696 into package files too Add KSK 2024 into bind package files too. --- bind.spec | 1 + named.root.key | 5 +++++ trusted-key.key | 1 + 3 files changed, 7 insertions(+) diff --git a/bind.spec b/bind.spec index 7f2619d..3ed7306 100644 --- a/bind.spec +++ b/bind.spec @@ -992,6 +992,7 @@ fi; - Update to 9.18.32 (#2331675) - Remove CHANGES file from package - Disable DLZ plugins, they are not shipped with bind anymore +- Add new root key 38696 into package files too * Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 - Disable temporarily PDF generation on all platforms diff --git a/named.root.key b/named.root.key index fbcb5d3..b57e61d 100644 --- a/named.root.key +++ b/named.root.key @@ -10,4 +10,9 @@ trust-anchors { # managed key database will be trusted and maintained # automatically. . initial-ds 20326 8 2 "E06D44B80B8F1D39A95C0B0D7C65D08458E880409BBC683457104237C7F8EC8D"; + # This key (38696) will be pre-published in the root zone in 2025 + # and is scheduled to begin signing in late 2026. At that time, + # servers which were already using the old key (20326) should roll + # seamlessly to this new one via RFC 5011 rollover. + . initial-ds 38696 8 2 "683D2D0ACB8C9B712A1948B27F741219298D0A450D612C483AF444A4C0FB2B16"; }; diff --git a/trusted-key.key b/trusted-key.key index 7b845f3..2ef50c7 100644 --- a/trusted-key.key +++ b/trusted-key.key @@ -1 +1,2 @@ . 3600 IN DNSKEY 257 3 8 AwEAAaz/tAm8yTn4Mfeh5eyI96WSVexTBAvkMgJzkKTOiW1vkIbzxeF3+/4RgWOq7HrxRixHlFlExOLAJr5emLvN7SWXgnLh4+B5xQlNVz8Og8kvArMtNROxVQuCaSnIDdD5LKyWbRd2n9WGe2R8PzgCmr3EgVLrjyBxWezF0jLHwVN8efS3rCj/EWgvIWgb9tarpVUDK/b58Da+sqqls3eNbuv7pr+eoZG+SrDK6nWeL3c6H5Apxz7LjVc1uTIdsIXxuOLYA4/ilBmSVIzuDWfdRUfhHdY6+cn8HFRm+2hM8AnXGXws9555KrUB5qihylGa8subX2Nn6UwNR1AkUTV74bU= +. 3600 IN DNSKEY 257 3 8 AwEAAa96jeuknZlaeSrvyAJj6ZHv28hhOKkx3rLGXVaC6rXTsDc449/cidltpkyGwCJNnOAlFNKF2jBosZBU5eeHspaQWOmOElZsjICMQMC3aeHbGiShvZsx4wMYSjH8e7Vrhbu6irwCzVBApESjbUdpWWmEnhathWu1jo+siFUiRAAxm9qyJNg/wOZqqzL/dL/q8PkcRU5oUKEpUge71M3ej2/7CPqpdVwuMoTvoB+ZOT4YeGyxMvHmbrxlFzGOHOijtzN+u1TQNatX2XBuzZNQ1K+s2CXkPIZo7s6JgZyvaBevYtxPvYLw4z9mR7K2vaF18UYH9Z9GNUUeayffKC73PYc= From e4107d36cea603f8ef580a2ecbf0d59b122e6b25 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Fri, 20 Dec 2024 09:29:12 -0800 Subject: [PATCH 061/144] No change sidetag rebuild to include bind-dyndb-ldap --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 3ed7306..2f7f265 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -988,6 +988,9 @@ fi; %endif %changelog +* Fri Dec 20 2024 Adam Williamson - 32:9.18.32-2 +- No change sidetag rebuild to include bind-dyndb-ldap + * Thu Dec 12 2024 Petr Menšík - 32:9.18.32-1 - Update to 9.18.32 (#2331675) - Remove CHANGES file from package From 7ec2fb38cab2e019c74b83ad1a7901b5ade24e37 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Mon, 13 Jan 2025 09:48:53 +0100 Subject: [PATCH 062/144] Rebuilt for the bin-sbin merge (2nd attempt) https://fedoraproject.org/wiki/Changes/Unify_bin_and_sbin --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 2f7f265..691405c 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -988,6 +988,9 @@ fi; %endif %changelog +* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek - 32:9.18.32-3 +- Rebuilt for the bin-sbin merge (2nd attempt) + * Fri Dec 20 2024 Adam Williamson - 32:9.18.32-2 - No change sidetag rebuild to include bind-dyndb-ldap From a553c9e873cf59b79eecac0fcd4a3e9dd4032522 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Thu, 16 Jan 2025 12:29:30 +0000 Subject: [PATCH 063/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 691405c..10c18ea 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -988,6 +988,9 @@ fi; %endif %changelog +* Thu Jan 16 2025 Fedora Release Engineering - 32:9.18.32-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + * Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek - 32:9.18.32-3 - Rebuilt for the bin-sbin merge (2nd attempt) From 5b3a19a8c2e426d65ce248be02e74131c784f117 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 15 Jan 2025 17:01:58 -0800 Subject: [PATCH 064/144] Add named user and group provides Now https://src.fedoraproject.org/rpms/rpm/pull-request/61 has landed, packages that set up users and groups must have user(x) and group(x) provides. If bind used the mechanism recommended in the guidelines for creating users and groups, this would happen automatically, but it does not, so this just adds explicit Provides as a minimal short-term fix. Signed-off-by: Adam Williamson --- bind.spec | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/bind.spec b/bind.spec index 10c18ea..ea86812 100644 --- a/bind.spec +++ b/bind.spec @@ -208,6 +208,12 @@ BuildRequires: python3-sphinx-latex latexmk texlive-xetex texlive-xindy BuildRequires: libtsan %endif +# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers +# since we don't follow the guidelines on how users and groups should +# be created we must explicitly specify these provides +Provides: user(named) +Provides: group(named) + %description BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), From 0cd50aebbd4cf67c3b356be338d26e8bd6ef765b Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 16 Jan 2025 10:13:24 -0800 Subject: [PATCH 065/144] Bump to -5 --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index ea86812..8228f54 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -994,6 +994,9 @@ fi; %endif %changelog +* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-5 +- Provide user(named) and group(named) + * Thu Jan 16 2025 Fedora Release Engineering - 32:9.18.32-4 - Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild From 549048cb0ed341402173b81e15414f75f6b7d74c Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Thu, 16 Jan 2025 10:30:16 -0800 Subject: [PATCH 066/144] Bump to -6 and rebuild on mass rebuild tag --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 8228f54..a09cf38 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -994,6 +994,9 @@ fi; %endif %changelog +* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-6 +- Rebuild again on mass rebuild tag so -4 doesn't override -5 + * Thu Jan 16 2025 Adam Williamson - 32:9.18.32-5 - Provide user(named) and group(named) From 071ec07d27989a8d548834292fa46ca2312b4862 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 17 Jan 2025 14:51:23 +0100 Subject: [PATCH 067/144] Add sysusers named user creation (rhbz#2105415) Drop original user creating in favor of sysusers file definition. --- bind.spec | 24 ++++++++++++------------ named.sysusers | 3 +++ 2 files changed, 15 insertions(+), 12 deletions(-) create mode 100644 named.sysusers diff --git a/bind.spec b/bind.spec index a09cf38..f0a0750 100644 --- a/bind.spec +++ b/bind.spec @@ -36,8 +36,6 @@ %bcond_without OPENSSL_ENGINE %endif -%{?!bind_uid: %global bind_uid 25} -%{?!bind_gid: %global bind_gid 25} %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} %global bind_dir /var/named %global chroot_prefix %{bind_dir}/chroot @@ -88,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.32 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -118,6 +116,7 @@ Source44: named-chroot-setup.service Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh Source49: named-chroot.files +Source50: named.sysusers # Common patches # FIXME: Is this still required? @@ -136,8 +135,9 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch Patch30: bind-9.20-nsupdate-tls-test.patch %{?systemd_ordering} +# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers +%{?sysusers_requires_compat} Requires: coreutils -Requires(pre): shadow-utils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep @@ -208,12 +208,6 @@ BuildRequires: python3-sphinx-latex latexmk texlive-xetex texlive-xindy BuildRequires: libtsan %endif -# https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers -# since we don't follow the guidelines on how users and groups should -# be created we must explicitly specify these provides -Provides: user(named) -Provides: group(named) - %description BIND (Berkeley Internet Name Domain) is an implementation of the DNS (Domain Name System) protocols. BIND includes a DNS server (named), @@ -594,6 +588,9 @@ install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir} install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir} install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir} +mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir} +install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf + mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir} install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh @@ -706,8 +703,7 @@ install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named %pre if [ "$1" -eq 1 ]; then - /usr/sbin/groupadd -g %{bind_gid} -f -r named >/dev/null 2>&1 || :; - /usr/sbin/useradd -u %{bind_uid} -r -N -M -g named -s /sbin/nologin -d /var/named -c Named named >/dev/null 2>&1 || :; + %sysusers_create_compat %{SOURCE50} fi; :; @@ -806,6 +802,7 @@ fi; %{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service +%{_sysusersdir}/named.conf %{_bindir}/named-journalprint %{_bindir}/named-checkconf %{_bindir}/named-rrchecker @@ -994,6 +991,9 @@ fi; %endif %changelog +* Fri Jan 17 2025 Petr Menšík - 32:9.18.32-7 +- Add sysusers named user creation (rhbz#2105415) + * Thu Jan 16 2025 Adam Williamson - 32:9.18.32-6 - Rebuild again on mass rebuild tag so -4 doesn't override -5 diff --git a/named.sysusers b/named.sysusers new file mode 100644 index 0000000..f173c78 --- /dev/null +++ b/named.sysusers @@ -0,0 +1,3 @@ +#Type Name ID GECOS Home directory Shell +u named 25 "Named" /var/named /sbin/nologin +g named 25 From c72c74cce0cd07603de978d0b65b0b93e672ae18 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Sun, 2 Feb 2025 15:34:28 +0100 Subject: [PATCH 068/144] Update to 9.16.33 (rhbz#2342784) Security Fixes: - DNS-over-HTTPS flooding fixes. (CVE-2024-12705) - Limit additional section processing for large RDATA sets. (CVE-2024-11187) New Features: - Add a new option to configure the maximum number of outgoing queries per client request. Bug Fixes: - Fix nsupdate hang when processing a large update. - Fix possible assertion failure when reloading server while processing update policy rules. [GL #5006] - Fix dnssec-signzone signing non-DNSKEY RRsets with revoked keys. - Fix improper handling of unknown directives in resolv.conf. https://downloads.isc.org/isc/bind9/9.18.33/doc/arm/html/notes.html#notes-for-bind-9-18-33 --- .gitignore | 2 ++ bind.spec | 7 +++++-- sources | 4 ++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.gitignore b/.gitignore index 65b7f81..6abb2ea 100644 --- a/.gitignore +++ b/.gitignore @@ -234,3 +234,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.31.tar.xz.asc /bind-9.18.32.tar.xz /bind-9.18.32.tar.xz.asc +/bind-9.18.33.tar.xz +/bind-9.18.33.tar.xz.asc diff --git a/bind.spec b/bind.spec index f0a0750..b4c74a3 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.32 -Release: 7%{?dist} +Version: 9.18.33 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -991,6 +991,9 @@ fi; %endif %changelog +* Sun Feb 02 2025 Petr Menšík - 32:9.18.33-1 +- Update to 9.16.33 (rhbz#2342784) + * Fri Jan 17 2025 Petr Menšík - 32:9.18.32-7 - Add sysusers named user creation (rhbz#2105415) diff --git a/sources b/sources index 36b309b..b3d92ee 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.32.tar.xz) = fa01978ca44cb5d559d8675dda4272b1327aebc0dca68b2e7b948e8c1bbd82da74f6258d40896ddccf86711d554b7ed4c0df93143e78b663724466738ac1320d -SHA512 (bind-9.18.32.tar.xz.asc) = b1b15734a90ec2df2da4a9f881fd9f9ea217a12e521b01d2cb06ff0f3305c80c933309d2bddf926e0ab647f4b925b4950c25c5d464ed276727dfbf6824387830 +SHA512 (bind-9.18.33.tar.xz) = 874465ccc7af92561dccf2bd596e13513048c4f1da730a6f38103eeb1d5b67178c1e2e2a56612946eba6edb9dad34851b9826055bcb7c0dad7ec64f7df9c10b9 +SHA512 (bind-9.18.33.tar.xz.asc) = 248490e576b00672497be77e2aeaf47b2c6c2fc745c729d76521443ed7bbd9cd64447cf949aafb820f021653efda7fe77aff32e756d76115e5a3dcf69aadc0a3 From 201205375b809867017489ca19a717868c54386f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 10 Feb 2025 16:33:43 +0100 Subject: [PATCH 069/144] Use common pattern in gitignore for every minor update Do not need to update .gitignore on every update of version. Use wildcard for everything from now. --- .gitignore | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.gitignore b/.gitignore index 6abb2ea..eae2ca9 100644 --- a/.gitignore +++ b/.gitignore @@ -236,3 +236,5 @@ bind-9.7.2b1.tar.gz /bind-9.18.32.tar.xz.asc /bind-9.18.33.tar.xz /bind-9.18.33.tar.xz.asc +/bind-9.18.*.tar.xz +/bind-9.18.*.tar.xz.asc From a28c475b98edd0619f838061382372529094c05d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 10 Feb 2025 17:31:24 +0100 Subject: [PATCH 070/144] Updates to nsupdate TLS backport fixing memory Properly release memory when TLS is used. --- bind-9.20-nsupdate-tls.patch | 92 ++++++++++++++++++++++++++---------- 1 file changed, 66 insertions(+), 26 deletions(-) diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch index 51f1b1e..ccf46e4 100644 --- a/bind-9.20-nsupdate-tls.patch +++ b/bind-9.20-nsupdate-tls.patch @@ -1,4 +1,4 @@ -From 5536f80f32ad22160ab98acf31e49768d3cf76fc Mon Sep 17 00:00:00 2001 +From b44dc4ed5c34445511f06d4b972407d539f8e9da Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 11 Nov 2024 18:09:07 +0100 Subject: [PATCH] Backport nsupdate TLS support into 9.18 @@ -41,10 +41,14 @@ implementation as a model for the newly added features. [pemensik] Adapted to previous 9.18 changes. Add usage and command line parsing -Adapted to 9.18.32 +Fixup tls initialization from nsupdate + +Detach transport also on dispatch_destroy properly. + +Adapted to 9.18.33. --- bin/nsupdate/nsupdate.c | 192 ++++++++++++++++++++---- - lib/dns/dispatch.c | 113 ++++++++++++-- + lib/dns/dispatch.c | 128 ++++++++++++++-- lib/dns/include/dns/dispatch.h | 22 +++ lib/dns/include/dns/request.h | 23 +++ lib/dns/include/dns/transport.h | 45 +++++- @@ -52,7 +56,7 @@ Adapted to 9.18.32 lib/dns/request.c | 63 ++++++-- lib/dns/transport.c | 253 ++++++++++++++++++++++++++++++++ lib/dns/xfrin.c | 232 +---------------------------- - 9 files changed, 652 insertions(+), 293 deletions(-) + 9 files changed, 668 insertions(+), 292 deletions(-) diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 293ed28..819925e 100644 @@ -451,7 +455,7 @@ index 293ed28..819925e 100644 if (answer != NULL) { dns_message_detach(&answer); diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c -index eb37198..9b263db 100644 +index eb37198..8273c32 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -30,6 +30,7 @@ @@ -499,7 +503,7 @@ index eb37198..9b263db 100644 dns_dispatchstate_t state; isc_refcount_t references; -@@ -220,16 +227,30 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout); +@@ -220,13 +227,27 @@ udp_dispatch_getnext(dns_dispentry_t *resp, int32_t timeout); static const char * socktype2str(dns_dispentry_t *resp) { @@ -523,20 +527,29 @@ index eb37198..9b263db 100644 - case isc_socktype_tcp: + case DNS_TRANSPORT_TCP: return "TCP"; -- default: -- return ""; -- } + case DNS_TRANSPORT_TLS: + return "TLS"; + case DNS_TRANSPORT_HTTP: + return "HTTP"; -+ default: -+ return (""); -+ } - } + default: + return ""; + } +@@ -457,6 +478,14 @@ dispentry_destroy(dns_dispentry_t *resp) { + isc_nmhandle_detach(&resp->handle); + } - static const char * -@@ -1161,6 +1182,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type, ++ if (resp->tlsctx_cache != NULL) { ++ isc_tlsctx_cache_detach(&resp->tlsctx_cache); ++ } ++ ++ if (resp->transport != NULL) { ++ dns_transport_detach(&resp->transport); ++ } ++ + isc_mem_put(disp->mgr->mctx, resp, sizeof(*resp)); + + dns_dispatch_detach(&disp); /* DISPATCH001 */ +@@ -1161,6 +1190,15 @@ dispatch_allocate(dns_dispatchmgr_t *mgr, isc_socktype_t type, isc_result_t dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, const isc_sockaddr_t *destaddr, dns_dispatch_t **dispp) { @@ -552,7 +565,7 @@ index eb37198..9b263db 100644 dns_dispatch_t *disp = NULL; REQUIRE(VALID_DISPATCHMGR(mgr)); -@@ -1170,7 +1200,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, +@@ -1170,7 +1208,11 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, dispatch_allocate(mgr, isc_socktype_tcp, &disp); @@ -564,7 +577,7 @@ index eb37198..9b263db 100644 if (localaddr != NULL) { disp->local = *localaddr; -@@ -1185,6 +1219,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, +@@ -1185,6 +1227,7 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, * Append it to the dispatcher list. */ @@ -572,7 +585,7 @@ index eb37198..9b263db 100644 /* FIXME: There should be a lookup hashtable here */ ISC_LIST_APPEND(mgr->list, disp, link); UNLOCK(&mgr->lock); -@@ -1208,6 +1243,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, +@@ -1208,6 +1251,13 @@ dns_dispatch_createtcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *localaddr, isc_result_t dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, const isc_sockaddr_t *localaddr, dns_dispatch_t **dispp) { @@ -586,7 +599,7 @@ index eb37198..9b263db 100644 dns_dispatch_t *disp_connected = NULL; dns_dispatch_t *disp_fallback = NULL; isc_result_t result = ISC_R_NOTFOUND; -@@ -1248,8 +1290,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, +@@ -1248,8 +1298,10 @@ dns_dispatch_gettcp(dns_dispatchmgr_t *mgr, const isc_sockaddr_t *destaddr, if (disp->socktype != isc_socktype_tcp || !isc_sockaddr_equal(destaddr, &peeraddr) || (localaddr != NULL && @@ -598,7 +611,17 @@ index eb37198..9b263db 100644 UNLOCK(&disp->lock); continue; } -@@ -1426,7 +1470,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, +@@ -1403,6 +1455,9 @@ dispatch_destroy(dns_dispatch_t *disp) { + disp->handle, &disp->handle); + isc_nmhandle_detach(&disp->handle); + } ++ if (disp->transport != NULL) { ++ dns_transport_detach(&disp->transport); ++ } + + isc_mutex_destroy(&disp->lock); + +@@ -1426,7 +1481,18 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, unsigned int timeout, const isc_sockaddr_t *dest, dispatch_cb_t connected, dispatch_cb_t sent, dispatch_cb_t response, void *arg, dns_messageid_t *idp, @@ -618,7 +641,7 @@ index eb37198..9b263db 100644 dns_dispentry_t *resp = NULL; dns_qid_t *qid = NULL; in_port_t localport; -@@ -1444,6 +1499,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, +@@ -1444,6 +1510,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, REQUIRE(connected != NULL); REQUIRE(response != NULL); REQUIRE(sent != NULL); @@ -626,7 +649,7 @@ index eb37198..9b263db 100644 LOCK(&disp->lock); -@@ -1471,6 +1527,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, +@@ -1471,6 +1538,7 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, .rlink = ISC_LINK_INITIALIZER, .magic = RESPONSE_MAGIC, }; @@ -634,7 +657,7 @@ index eb37198..9b263db 100644 #if DNS_DISPATCH_TRACE fprintf(stderr, "dns_dispentry__init:%s:%s:%d:%p->references = 1\n", -@@ -1530,6 +1587,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, +@@ -1530,6 +1598,14 @@ dns_dispatch_add(dns_dispatch_t *disp, unsigned int options, return ISC_R_NOMORE; } @@ -649,7 +672,7 @@ index eb37198..9b263db 100644 dns_dispatch_attach(disp, &resp->disp); /* DISPATCH001 */ disp->requests++; -@@ -1779,6 +1844,7 @@ dns_dispatch_done(dns_dispentry_t **respp) { +@@ -1779,6 +1855,7 @@ dns_dispatch_done(dns_dispentry_t **respp) { *respp = NULL; dispentry_cancel(resp, ISC_R_CANCELED); @@ -657,7 +680,7 @@ index eb37198..9b263db 100644 dns_dispentry_detach(&resp); /* DISPENTRY000 */ } -@@ -1970,6 +2036,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { +@@ -1970,6 +2047,27 @@ udp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { static isc_result_t tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { @@ -685,6 +708,23 @@ index eb37198..9b263db 100644 /* Check whether the dispatch is already connecting or connected. */ LOCK(&disp->lock); switch (disp->state) { +@@ -1995,8 +2093,14 @@ tcp_dispatch_connect(dns_dispatch_t *disp, dns_dispentry_t *resp) { + "connecting from %s to %s, timeout %u", localbuf, + peerbuf, resp->timeout); + +- isc_nm_tcpdnsconnect(disp->mgr->nm, &disp->local, &disp->peer, +- tcp_connected, disp, resp->timeout, 0); ++ if (tlsctx != NULL) { ++ isc_nm_tlsdnsconnect(disp->mgr->nm, &disp->local, &disp->peer, ++ tcp_connected, disp, resp->timeout, 0, ++ tlsctx, sess_cache); ++ } else { ++ isc_nm_tcpdnsconnect(disp->mgr->nm, &disp->local, &disp->peer, ++ tcp_connected, disp, resp->timeout, 0); ++ } + break; + + case DNS_DISPATCHSTATE_CONNECTING: diff --git a/lib/dns/include/dns/dispatch.h b/lib/dns/include/dns/dispatch.h index ad377f0..cfdc374 100644 --- a/lib/dns/include/dns/dispatch.h @@ -1560,5 +1600,5 @@ index 3a4f761..3695815 100644 goto failure; } -- -2.47.1 +2.48.1 From c7c0f860f49a040c10b56ea650f42198f98e175a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 10 Feb 2025 20:08:55 +0100 Subject: [PATCH 071/144] Permanently remove DLZ parts build --- bind.spec | 98 +++---------------------------------------------------- 1 file changed, 4 insertions(+), 94 deletions(-) diff --git a/bind.spec b/bind.spec index b4c74a3..e51e9f9 100644 --- a/bind.spec +++ b/bind.spec @@ -8,10 +8,6 @@ %bcond_with SYSTEMTEST %bcond_without GSSTSIG %bcond_without JSON -%if ! 0%{?rhel} -# FIXME: Not ready. Should it be worked on? -%bcond_with DLZ -%endif # New MaxMind GeoLite support %bcond_without GEOIP2 # Disabled temporarily until kyua is fixed on rawhide, bug #1926779 @@ -86,7 +82,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.33 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -161,11 +157,6 @@ BuildRequires: jemalloc-devel BuildRequires: gnupg2 %endif BuildRequires: libuv-devel -%if %{with DLZ} -BuildRequires: openldap-devel -BuildRequires: sqlite-devel -BuildRequires: mariadb-connector-c-devel -%endif %if %{with UNITTEST} # make unit dependencies BuildRequires: libcmocka-devel @@ -306,40 +297,6 @@ This package contains a tree of files which can be used as a chroot(2) jail for the named(8) program from the BIND package. Based on the code from Jan "Yenya" Kasprzak - -%if %{with DLZ} -%package dlz-filesystem -Summary: BIND server filesystem DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-filesystem -Dynamic Loadable Zones filesystem module for BIND server. - -%package dlz-ldap -Summary: BIND server ldap DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-ldap -Dynamic Loadable Zones LDAP module for BIND server. - -%package dlz-mysql -Summary: BIND server mysql and mysqldyn DLZ modules -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} -Provides: %{name}-dlz-mysqldyn = %{epoch}:%{version}-%{release} -Obsoletes: %{name}-dlz-mysqldyn < 32:9.16.6-3 - -%description dlz-mysql -Dynamic Loadable Zones MySQL module for BIND server. -Contains also mysqldyn module with dynamic DNS updates (DDNS) support. - -%package dlz-sqlite3 -Summary: BIND server sqlite3 DLZ module -Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} - -%description dlz-sqlite3 -Dynamic Loadable Zones sqlite3 module for BIND server. -%endif - %if %{with DOC} %package doc Summary: BIND 9 Administrator Reference Manual @@ -412,12 +369,6 @@ autoreconf --force --install mkdir build -%if %{with DLZ} -# DLZ modules do not support oot builds. Copy files into build -mkdir -p build/contrib/dlz -cp -frp contrib/dlz/modules build/contrib/dlz/modules -%endif - pushd build LIBDIR_SUFFIX= export LIBDIR_SUFFIX @@ -473,13 +424,6 @@ fmtutil-user --missing || : make doc %endif -%if %{with DLZ} - pushd contrib/dlz/modules - for DIR in filesystem ldap mysql mysqldyn sqlite3; do - make -C $DIR CFLAGS="-fPIC -I../include $CFLAGS $LDFLAGS -DPTHREADS=1" LDFLAGS="$LDFLAGS" - done - popd -%endif popd # build %unit_prepare_build build @@ -607,23 +551,6 @@ install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_sbindir}/ %endif -%if %{with DLZ} - pushd build - pushd contrib/dlz/modules - for DIR in filesystem ldap mysql mysqldyn sqlite3; do - %make_install -C $DIR libdir=%{_libdir}/bind - done - pushd ${RPM_BUILD_ROOT}/%{_libdir}/named - cp -s ../bind/dlz_*.so . - popd - mkdir -p doc/{mysql,mysqldyn} - cp -p mysqldyn/testing/README doc/mysqldyn/README.testing - cp -p mysqldyn/testing/* doc/mysqldyn - cp -p mysql/testing/* doc/mysql - popd - popd -%endif - # Remove libtool .la files: find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; @@ -959,26 +886,6 @@ fi; %dir %{chroot_prefix}/run/named %{chroot_prefix}%{_localstatedir}/run -%if %{with DLZ} -%files dlz-filesystem -%{_libdir}/{named,bind}/dlz_filesystem_dynamic.so - -%files dlz-mysql -%{_libdir}/{named,bind}/dlz_mysql_dynamic.so -%doc build/contrib/dlz/modules/doc/mysql -%{_libdir}/{named,bind}/dlz_mysqldyn_mod.so -%doc build/contrib/dlz/modules/doc/mysqldyn - -%files dlz-ldap -%{_libdir}/{named,bind}/dlz_ldap_dynamic.so -%doc contrib/dlz/modules/ldap/testing/* - -%files dlz-sqlite3 -%{_libdir}/{named,bind}/dlz_sqlite3_dynamic.so -%doc contrib/dlz/modules/sqlite3/testing/* - -%endif - %if %{with DOC} %files doc %dir %{_pkgdocdir} @@ -991,6 +898,9 @@ fi; %endif %changelog +* Mon Feb 10 2025 Petr Menšík - 32:9.18.33-2 +- Permanently remove DLZ parts build + * Sun Feb 02 2025 Petr Menšík - 32:9.18.33-1 - Update to 9.16.33 (rhbz#2342784) From f2aec3c2c1bba29d3f53eed41c528f2779b4615c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 21 Mar 2025 20:31:43 +0100 Subject: [PATCH 072/144] Remove pre scriptlet It generates to empty if, which fails on invalid syntax. --- bind.spec | 11 ++++------- 1 file changed, 4 insertions(+), 7 deletions(-) diff --git a/bind.spec b/bind.spec index e51e9f9..c78dd93 100644 --- a/bind.spec +++ b/bind.spec @@ -82,7 +82,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.33 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -628,12 +628,6 @@ install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named -%pre -if [ "$1" -eq 1 ]; then - %sysusers_create_compat %{SOURCE50} -fi; -:; - %post %?ldconfig if [ "$1" -eq 1 ]; then @@ -898,6 +892,9 @@ fi; %endif %changelog +* Thu Mar 20 2025 Petr Menšík - 32:9.18.33-3 +- Remove pre scriptlet + * Mon Feb 10 2025 Petr Menšík - 32:9.18.33-2 - Permanently remove DLZ parts build From 0b6554ff3d27a6c970d05b3522785e5e7ad43c95 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 26 Mar 2025 13:08:21 +0100 Subject: [PATCH 073/144] Update to 9.18.35 (rhbz#2346607) --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index c78dd93..b7e4a33 100644 --- a/bind.spec +++ b/bind.spec @@ -81,8 +81,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.33 -Release: 3%{?dist} +Version: 9.18.35 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -892,6 +892,9 @@ fi; %endif %changelog +* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-1 +- Update to 9.18.35 (rhbz#2346607) + * Thu Mar 20 2025 Petr Menšík - 32:9.18.33-3 - Remove pre scriptlet diff --git a/sources b/sources index b3d92ee..988458c 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.33.tar.xz) = 874465ccc7af92561dccf2bd596e13513048c4f1da730a6f38103eeb1d5b67178c1e2e2a56612946eba6edb9dad34851b9826055bcb7c0dad7ec64f7df9c10b9 -SHA512 (bind-9.18.33.tar.xz.asc) = 248490e576b00672497be77e2aeaf47b2c6c2fc745c729d76521443ed7bbd9cd64447cf949aafb820f021653efda7fe77aff32e756d76115e5a3dcf69aadc0a3 +SHA512 (bind-9.18.35.tar.xz) = 81764e1e4acb87e498cfce9e683dbdcadac13a5a5f2a517c988ff17967b34efb312ec0a9e94d7f9261e1e9bebbcfa295da6e37985c69961ef43031a8b99e8fc9 +SHA512 (bind-9.18.35.tar.xz.asc) = f2a237dda1f1f828bdc6c4b13f190c316fc26381ab7baf8f0101680898eb0a1a6518a7bc8baac0cf8c52356c6032e5d3c2c66d50e28b91054ee7066f76cd9009 From 273ea431d5c8738219294a96d2fe5e25d421a87e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 13 Feb 2025 16:08:50 +0100 Subject: [PATCH 074/144] Attempt to backport OpenSSL provider support with labels Should allow PKCS11 provider used from dnssec-keyfromlabel and then from signing tools or named daemon. Resolves: rhbz#2123076 --- bind-9.18-pkcs11-provider.patch | 870 ++++++++++++++++++++++++++++++++ bind.spec | 9 +- 2 files changed, 877 insertions(+), 2 deletions(-) create mode 100644 bind-9.18-pkcs11-provider.patch diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch new file mode 100644 index 0000000..256980a --- /dev/null +++ b/bind-9.18-pkcs11-provider.patch @@ -0,0 +1,870 @@ +From 099621c2769b934d0e1b02c0b085df86ae951780 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 13 Feb 2025 13:20:28 +0100 +Subject: [PATCH] Backport OpenSSL 3 provider support + +Use gist of 451edf324281d30fbbe5669223dcea331670847c and +5fd6cfc625aa84005618236f4cd699c07367a3dc upstream commits, but do not do +significant rebase together. Move engine loading of EVP_PKEY from label to +openssl_link and copy provider variant from newer. + +Remove legacy RSA calls from _fromlabel to separate engine handling +code. Make rsa_check accepting EVP_PKEY pair only and use conditional +compilation to verify them. Move checking of max exponent bits to +rsa_check too, because it is done from all usages anyway. + +Use rsa_check_legacy in places where bit checking is not necessary. + +Fix keyfromlabel to not use engine parameter for provider keys + +- Rework key checks to not require 'engine' tag, private key + is valid with 'label' tag alone + +- Fix _fromlabel() functions to work with engine == NULL + +- Update dst__openssl_fromlabel_engine() to do provider lookup + only when engine is not set + +(cherry picked from commit de486d0ec5d5642ddb1820a1269f5406a2bb1c64) + +Use dst_key_t label to signal isprivate property as a downstream +alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd. +That would require additional heavier changes. +--- + lib/dns/dst_openssl.h | 4 + + lib/dns/dst_parse.c | 21 ++--- + lib/dns/openssl_link.c | 160 ++++++++++++++++++++++++++++----- + lib/dns/openssldh_link.c | 5 ++ + lib/dns/opensslecdsa_link.c | 110 ++++++++++++----------- + lib/dns/openssleddsa_link.c | 40 +++------ + lib/dns/opensslrsa_link.c | 173 ++++++++++++++---------------------- + 7 files changed, 294 insertions(+), 219 deletions(-) + +diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h +index 819af0fee1..cd386c0019 100644 +--- a/lib/dns/dst_openssl.h ++++ b/lib/dns/dst_openssl.h +@@ -64,4 +64,8 @@ ENGINE * + dst__openssl_getengine(const char *engine); + #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + ++isc_result_t ++dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label, ++ const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv); ++ + ISC_LANG_ENDDECLS +diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c +index d5ea0e418b..addb65ec5a 100644 +--- a/lib/dns/dst_parse.c ++++ b/lib/dns/dst_parse.c +@@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) { + + mask = (1ULL << TAG_SHIFT) - 1; + +- if (have[TAG_RSA_ENGINE & mask]) { ++ if (have[TAG_RSA_LABEL & mask]) { + ok = have[TAG_RSA_MODULUS & mask] && +- have[TAG_RSA_PUBLICEXPONENT & mask] && +- have[TAG_RSA_LABEL & mask]; ++ have[TAG_RSA_PUBLICEXPONENT & mask]; + } else { + ok = have[TAG_RSA_MODULUS & mask] && + have[TAG_RSA_PUBLICEXPONENT & mask] && +@@ -259,11 +258,9 @@ check_ecdsa(const dst_private_t *priv, bool external) { + + mask = (1ULL << TAG_SHIFT) - 1; + +- if (have[TAG_ECDSA_ENGINE & mask]) { +- ok = have[TAG_ECDSA_LABEL & mask]; +- } else { +- ok = have[TAG_ECDSA_PRIVATEKEY & mask]; +- } ++ ok = have[TAG_ECDSA_LABEL & mask] || ++ have[TAG_ECDSA_PRIVATEKEY & mask]; ++ + return ok ? 0 : -1; + } + +@@ -295,11 +292,9 @@ check_eddsa(const dst_private_t *priv, bool external) { + + mask = (1ULL << TAG_SHIFT) - 1; + +- if (have[TAG_EDDSA_ENGINE & mask]) { +- ok = have[TAG_EDDSA_LABEL & mask]; +- } else { +- ok = have[TAG_EDDSA_PRIVATEKEY & mask]; +- } ++ ok = have[TAG_EDDSA_LABEL & mask] || ++ have[TAG_EDDSA_PRIVATEKEY & mask]; ++ + return ok ? 0 : -1; + } + +diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c +index e3a89f4406..5be6116985 100644 +--- a/lib/dns/openssl_link.c ++++ b/lib/dns/openssl_link.c +@@ -44,6 +44,9 @@ + #if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + #include + #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++#include ++#endif + + #include "openssl_shim.h" + +@@ -51,6 +54,12 @@ + static ENGINE *e = NULL; + #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + ++#define DST_RET(a) \ ++ { \ ++ ret = a; \ ++ goto err; \ ++ } ++ + static void + enable_fips_mode(void) { + #ifdef HAVE_FIPS_MODE +@@ -70,32 +79,28 @@ enable_fips_mode(void) { + + isc_result_t + dst__openssl_init(const char *engine) { +- isc_result_t result = ISC_R_SUCCESS; +- + enable_fips_mode(); + +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + if (engine != NULL && *engine == '\0') { + engine = NULL; + } + +- if (engine != NULL) { +- e = ENGINE_by_id(engine); +- if (e == NULL) { +- result = DST_R_NOENGINE; +- goto cleanup_rm; +- } +- if (!ENGINE_init(e)) { +- result = DST_R_NOENGINE; +- goto cleanup_rm; +- } +- /* This will init the engine. */ +- if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { +- result = DST_R_NOENGINE; +- goto cleanup_init; +- } ++ if (engine == NULL) { ++ return (ISC_R_SUCCESS); + } + ++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 ++ e = ENGINE_by_id(engine); ++ if (e == NULL) { ++ goto cleanup_rm; ++ } ++ if (!ENGINE_init(e)) { ++ goto cleanup_rm; ++ } ++ /* This will init the engine. */ ++ if (!ENGINE_set_default(e, ENGINE_METHOD_ALL)) { ++ goto cleanup_init; ++ } + return ISC_R_SUCCESS; + cleanup_init: + ENGINE_finish(e); +@@ -105,10 +110,8 @@ cleanup_rm: + } + e = NULL; + ERR_clear_error(); +-#else +- UNUSED(engine); + #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ +- return result; ++ return (DST_R_NOENGINE); + } + + void +@@ -220,4 +223,119 @@ dst__openssl_getengine(const char *engine) { + } + #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + ++static isc_result_t ++dst__openssl_fromlabel_engine(int key_base_id, const char *engine, ++ const char *label, ++ EVP_PKEY **ppub, EVP_PKEY **ppriv) { ++#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 ++ isc_result_t ret = ISC_R_SUCCESS; ++ ENGINE *e = NULL; ++ EVP_PKEY *pkey = NULL, *pubpkey = NULL; ++ ++ UNUSED(key_base_id); ++ ++ e = dst__openssl_getengine(engine); ++ if (e == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_NOENGINE)); ++ } ++ ++ pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); ++ if (pubpkey == NULL) { ++ DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", ++ DST_R_OPENSSLFAILURE)); ++ } ++ if (EVP_PKEY_get_base_id(pubpkey) != key_base_id) { ++ DST_RET(DST_R_BADKEYTYPE); ++ } ++ pkey = ENGINE_load_private_key(e, label, NULL, NULL); ++ if (pkey == NULL) { ++ DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", ++ DST_R_OPENSSLFAILURE)); ++ } ++ if (EVP_PKEY_base_id(pkey) != key_base_id) { ++ DST_RET(DST_R_INVALIDPRIVATEKEY); ++ } ++ *ppub = pubpkey; ++ *ppriv = pkey; ++err: ++ return ret; ++#else ++ UNUSED(key_base_id); ++ UNUSED(engine); ++ UNUSED(label); ++ UNUSED(ppub); ++ UNUSED(ppriv); ++ return DST_R_NOENGINE; ++#endif ++} ++ ++ ++static isc_result_t ++dst__openssl_fromlabel_provider(int key_base_id, const char *label, const char *pin, ++ EVP_PKEY **ppub, EVP_PKEY **ppriv) { ++#if OPENSSL_VERSION_NUMBER >= 0x30000000L ++ isc_result_t ret = DST_R_OPENSSLFAILURE; ++ OSSL_STORE_CTX *ctx = NULL; ++ ++ ++ ctx = OSSL_STORE_open(label, NULL, NULL, NULL, NULL); ++ if (!ctx) { ++ DST_RET(dst__openssl_toresult2("OSSL_STORE_open_ex", ++ DST_R_OPENSSLFAILURE)); ++ } ++ ++ while (!OSSL_STORE_eof(ctx)) { ++ OSSL_STORE_INFO *info = OSSL_STORE_load(ctx); ++ if (info == NULL) { ++ continue; ++ } ++ switch (OSSL_STORE_INFO_get_type(info)) { ++ case OSSL_STORE_INFO_PKEY: ++ if (*ppriv != NULL) { ++ DST_RET(DST_R_INVALIDPRIVATEKEY); ++ } ++ *ppriv = OSSL_STORE_INFO_get1_PKEY(info); ++ if (EVP_PKEY_get_base_id(*ppriv) != key_base_id) { ++ DST_RET(DST_R_BADKEYTYPE); ++ } ++ break; ++ case OSSL_STORE_INFO_PUBKEY: ++ if (*ppub != NULL) { ++ DST_RET(DST_R_INVALIDPUBLICKEY); ++ } ++ *ppub = OSSL_STORE_INFO_get1_PUBKEY(info); ++ if (EVP_PKEY_get_base_id(*ppub) != key_base_id) { ++ DST_RET(DST_R_BADKEYTYPE); ++ } ++ break; ++ } ++ OSSL_STORE_INFO_free(info); ++ } ++ if (*ppriv != NULL && *ppub != NULL) { ++ ret = ISC_R_SUCCESS; ++ } ++err: ++ OSSL_STORE_close(ctx); ++ return (ret); ++#else ++ UNUSED(key_base_id); ++ UNUSED(label); ++ UNUSED(ppub); ++ UNUSED(ppriv); ++ return (DST_R_OPENSSLFAILURE); ++#endif ++} ++ ++isc_result_t ++dst__openssl_fromlabel(int key_base_id, const char *engine, const char *label, ++ const char *pin, EVP_PKEY **ppub, EVP_PKEY **ppriv) { ++ if (engine == NULL) { ++ return (dst__openssl_fromlabel_provider(key_base_id, label, ++ pin, ppub, ppriv)); ++ } ++ ++ return (dst__openssl_fromlabel_engine(key_base_id, engine, label, ++ ppub, ppriv)); ++} ++ + /*! \file */ +diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c +index a4ba0f78d3..38345e6bfd 100644 +--- a/lib/dns/openssldh_link.c ++++ b/lib/dns/openssldh_link.c +@@ -610,6 +610,11 @@ err: + + static bool + openssldh_isprivate(const dst_key_t *key) { ++ if (key->label != NULL) { ++ /* assume that _fromlabel will not pass without loading private key, ++ * but for non-exportable key cannot get d value on the object. */ ++ return true; ++ } + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + DH *dh = key->keydata.dh; + const BIGNUM *priv_key = NULL; +diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c +index ca12bb5620..5d070140c5 100644 +--- a/lib/dns/opensslecdsa_link.c ++++ b/lib/dns/opensslecdsa_link.c +@@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) { + return false; + } + ++ if (key->label != NULL) { ++ /* assume that _fromlabel will not pass without loading private key, ++ * but for non-exportable key cannot get d value on the object. */ ++ return true; ++ } ++ + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + eckey = EVP_PKEY_get1_EC_KEY(pkey); + +@@ -916,7 +922,7 @@ err: + + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + static isc_result_t +-ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) { ++ecdsa_check_legacy(EC_KEY *eckey, EC_KEY *pubeckey) { + const EC_POINT *pubkey; + + pubkey = EC_KEY_get0_public_key(eckey); +@@ -937,9 +943,42 @@ ecdsa_check(EC_KEY *eckey, EC_KEY *pubeckey) { + + return ISC_R_FAILURE; + } ++ ++static isc_result_t ++ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) { ++ isc_result_t ret = ISC_R_FAILURE; ++ EC_KEY *eckey; ++ EC_KEY *pubeckey; ++ ++ eckey = EVP_PKEY_get1_EC_KEY(*pkey); ++ if (eckey == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); ++ } ++ if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) { ++ DST_RET(DST_R_INVALIDPRIVATEKEY); ++ } ++ ++ pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey); ++ if (pubeckey == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); ++ } ++ if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) { ++ DST_RET(DST_R_INVALIDPUBLICKEY); ++ } ++ ++ ret = ecdsa_check_legacy(eckey, pubeckey); ++err: ++ if (pubeckey != NULL) { ++ EC_KEY_free(pubeckey); ++ } ++ if (eckey != NULL) { ++ EC_KEY_free(eckey); ++ } ++ return ret; ++} + #else + static isc_result_t +-ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) { ++ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) { + isc_result_t ret = ISC_R_FAILURE; + int status; + size_t pkey_len = 0; +@@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) { + EVP_PKEY_CTX *ctx = NULL; + EVP_PKEY *pkey_new = NULL; + ++ UNUSED(group_nid); ++ + /* Check if `pkey` has a public key. */ + status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY, + NULL, 0, &pkey_len); +@@ -1279,7 +1320,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey); + } + +- if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) { ++ if (ecdsa_check_legacy(eckey, pubeckey) != ISC_R_SUCCESS) { + DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); + } + +@@ -1288,7 +1329,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + } + #else + if (ecdsa_check(&key->keydata.pkey, +- pub == NULL ? NULL : pub->keydata.pkey) != ++ pub == NULL ? NULL : pub->keydata.pkey, NID_undef) != + ISC_R_SUCCESS) + { + DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); +@@ -1321,11 +1362,7 @@ err: + static isc_result_t + opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + const char *pin) { +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + isc_result_t ret = ISC_R_SUCCESS; +- ENGINE *e; +- EC_KEY *eckey = NULL; +- EC_KEY *pubeckey = NULL; + int group_nid; + EVP_PKEY *pkey = NULL; + EVP_PKEY *pubpkey = NULL; +@@ -1335,13 +1372,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + + UNUSED(pin); + +- if (engine == NULL || label == NULL) { ++ if (label == NULL) { + return DST_R_NOENGINE; + } +- e = dst__openssl_getengine(engine); +- if (e == NULL) { +- DST_RET(DST_R_NOENGINE); +- } + + if (key->key_alg == DST_ALG_ECDSA256) { + group_nid = NID_X9_62_prime256v1; +@@ -1349,48 +1382,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + group_nid = NID_secp384r1; + } + +- /* Load private key. */ +- pkey = ENGINE_load_private_key(e, label, NULL, NULL); +- if (pkey == NULL) { +- DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", +- DST_R_OPENSSLFAILURE)); ++ ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin, ++ &pubpkey, &pkey); ++ if (ret != ISC_R_SUCCESS) { ++ goto err; + } ++ + /* Check base id, group nid */ + if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) { + DST_RET(DST_R_INVALIDPRIVATEKEY); + } +- eckey = EVP_PKEY_get1_EC_KEY(pkey); +- if (eckey == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); +- } +- if (EC_GROUP_get_curve_name(EC_KEY_get0_group(eckey)) != group_nid) { +- DST_RET(DST_R_INVALIDPRIVATEKEY); +- } +- +- /* Load public key. */ +- pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); +- if (pubpkey == NULL) { +- DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", +- DST_R_OPENSSLFAILURE)); +- } + /* Check base id, group nid */ + if (EVP_PKEY_base_id(pubpkey) != EVP_PKEY_EC) { + DST_RET(DST_R_INVALIDPUBLICKEY); + } +- pubeckey = EVP_PKEY_get1_EC_KEY(pubpkey); +- if (pubeckey == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); +- } +- if (EC_GROUP_get_curve_name(EC_KEY_get0_group(pubeckey)) != group_nid) { +- DST_RET(DST_R_INVALIDPUBLICKEY); +- } + +- if (ecdsa_check(eckey, pubeckey) != ISC_R_SUCCESS) { ++ if (ecdsa_check(&pkey, pubpkey, group_nid) != ISC_R_SUCCESS) { + DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); + } + ++ if (engine != NULL) ++ key->engine = isc_mem_strdup(key->mctx, engine); ++ else ++ key->engine = NULL; + key->label = isc_mem_strdup(key->mctx, label); +- key->engine = isc_mem_strdup(key->mctx, engine); + key->key_size = EVP_PKEY_bits(pkey); + key->keydata.pkey = pkey; + pkey = NULL; +@@ -1402,21 +1417,8 @@ err: + if (pkey != NULL) { + EVP_PKEY_free(pkey); + } +- if (pubeckey != NULL) { +- EC_KEY_free(pubeckey); +- } +- if (eckey != NULL) { +- EC_KEY_free(eckey); +- } + + return ret; +-#else +- UNUSED(key); +- UNUSED(engine); +- UNUSED(label); +- UNUSED(pin); +- return DST_R_NOENGINE; +-#endif /* !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + } + + static dst_func_t opensslecdsa_functions = { +diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c +index 74dac17bc6..04457fbfc3 100644 +--- a/lib/dns/openssleddsa_link.c ++++ b/lib/dns/openssleddsa_link.c +@@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) { + return false; + } + ++ if (key->label != NULL) { ++ /* assume that _fromlabel will not pass without loading private key, ++ * but for non-exportable key cannot get d value on the object. */ ++ return true; ++ } ++ + /* Must have a buffer to actually check if there is a private key. */ + if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) { + return true; +@@ -603,9 +609,7 @@ err: + static isc_result_t + openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + const char *pin) { +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 + isc_result_t ret; +- ENGINE *e; + EVP_PKEY *pkey = NULL, *pubpkey = NULL; + int baseid = EVP_PKEY_NONE; + +@@ -628,28 +632,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + return ISC_R_NOTIMPLEMENTED; + } + +- if (engine == NULL) { +- return DST_R_NOENGINE; +- } +- e = dst__openssl_getengine(engine); +- if (e == NULL) { +- return DST_R_NOENGINE; +- } +- pkey = ENGINE_load_private_key(e, label, NULL, NULL); +- if (pkey == NULL) { +- return dst__openssl_toresult2("ENGINE_load_private_key", +- ISC_R_NOTFOUND); +- } +- if (EVP_PKEY_base_id(pkey) != baseid) { +- DST_RET(DST_R_INVALIDPRIVATEKEY); +- } ++ DST_RET(dst__openssl_fromlabel(baseid, engine, label, pin, ++ &pubpkey, &pkey)); + +- pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); +- if (eddsa_check(pkey, pubpkey) != ISC_R_SUCCESS) { ++ if (EVP_PKEY_base_id(pkey) != baseid) { + DST_RET(DST_R_INVALIDPRIVATEKEY); + } + +- key->engine = isc_mem_strdup(key->mctx, engine); ++ if (engine != NULL) ++ key->engine = isc_mem_strdup(key->mctx, engine); ++ else ++ key->engine = NULL; + key->label = isc_mem_strdup(key->mctx, label); + key->key_size = EVP_PKEY_bits(pkey); + key->keydata.pkey = pkey; +@@ -664,13 +657,6 @@ err: + EVP_PKEY_free(pkey); + } + return ret; +-#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ +- UNUSED(key); +- UNUSED(engine); +- UNUSED(label); +- UNUSED(pin); +- return DST_R_NOENGINE; +-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + } + + static dst_func_t openssleddsa_functions = { +diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c +index 37e8a63a61..1ffae888e1 100644 +--- a/lib/dns/opensslrsa_link.c ++++ b/lib/dns/opensslrsa_link.c +@@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) { + return false; + } + ++ if (key->label != NULL) { ++ /* assume that _fromlabel will not pass without loading private key, ++ * but for non-exportable key cannot get d value on the object. */ ++ return true; ++ } ++ + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + rsa = EVP_PKEY_get1_RSA(pkey); + INSIST(rsa != NULL); +@@ -995,7 +1001,7 @@ err: + + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + static isc_result_t +-rsa_check(RSA *rsa, RSA *pub) { ++rsa_check_legacy(RSA *rsa, RSA *pub) { + const BIGNUM *n1 = NULL, *n2 = NULL; + const BIGNUM *e1 = NULL, *e2 = NULL; + BIGNUM *n = NULL, *e = NULL; +@@ -1050,6 +1056,46 @@ rsa_check(RSA *rsa, RSA *pub) { + + return ISC_R_SUCCESS; + } ++ ++static isc_result_t ++rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) { ++ isc_result_t ret = ISC_R_FAILURE; ++ RSA *rsa = NULL, *pubrsa = NULL; ++ const BIGNUM *ex = NULL; ++ ++ pubrsa = EVP_PKEY_get1_RSA(pubpkey); ++ if (pubrsa == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); ++ } ++ ++ rsa = EVP_PKEY_get1_RSA(pkey); ++ if (rsa == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); ++ } ++ ++ ret = rsa_check_legacy(rsa, pubrsa); ++ if (ret != ISC_R_SUCCESS) { ++ DST_RET(ret); ++ } ++ ++ RSA_get0_key(rsa, NULL, &ex, NULL); ++ ++ if (ex == NULL) { ++ DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); ++ } ++ if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) { ++ DST_RET(ISC_R_RANGE); ++ } ++ ++err: ++ if (rsa != NULL) { ++ RSA_free(rsa); ++ } ++ if (pubrsa != NULL) { ++ RSA_free(pubrsa); ++ } ++ return ret; ++} + #else + static isc_result_t + rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) { +@@ -1097,6 +1143,10 @@ rsa_check(EVP_PKEY *pkey, EVP_PKEY *pubpkey) { + } + } + ++ if (BN_num_bits(e1) > RSA_MAX_PUBEXP_BITS) { ++ DST_RET(ISC_R_RANGE); ++ } ++ + if (EVP_PKEY_eq(pkey, pubpkey) == 1) { + DST_RET(ISC_R_SUCCESS); + } +@@ -1119,6 +1169,10 @@ err: + } + #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ + ++static isc_result_t ++opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, ++ const char *pin); ++ + static isc_result_t + opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + dst_private_t priv; +@@ -1131,12 +1185,8 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + OSSL_PARAM *params = NULL; + EVP_PKEY_CTX *ctx = NULL; + #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 +- const BIGNUM *ex = NULL; +- ENGINE *ep = NULL; +- const char *engine = NULL; +-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + isc_mem_t *mctx = NULL; ++ const char *engine = NULL; + const char *label = NULL; + EVP_PKEY *pkey = NULL; + BIGNUM *n = NULL, *e = NULL, *d = NULL; +@@ -1193,46 +1243,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + * See if we can fetch it. + */ + if (label != NULL) { +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 +- if (engine == NULL) { +- DST_RET(DST_R_NOENGINE); +- } +- ep = dst__openssl_getengine(engine); +- if (ep == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_NOENGINE)); +- } +- pkey = ENGINE_load_private_key(ep, label, NULL, NULL); +- if (pkey == NULL) { +- DST_RET(dst__openssl_toresult2("ENGINE_load_private_" +- "key", +- ISC_R_NOTFOUND)); +- } +- key->engine = isc_mem_strdup(key->mctx, engine); +- key->label = isc_mem_strdup(key->mctx, label); +- +- rsa = EVP_PKEY_get1_RSA(pkey); +- if (rsa == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); +- } +- if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) { +- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); +- } +- RSA_get0_key(rsa, NULL, &ex, NULL); +- +- if (ex == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); +- } +- if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) { +- DST_RET(ISC_R_RANGE); +- } +- +- key->key_size = EVP_PKEY_bits(pkey); +- key->keydata.pkey = pkey; +- pkey = NULL; +- DST_RET(ISC_R_SUCCESS); +-#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ +- DST_RET(DST_R_NOENGINE); +-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ ++ DST_RET(opensslrsa_fromlabel(key, engine, label, NULL)); + } + + for (i = 0; i < priv.nelements; i++) { +@@ -1321,7 +1332,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + BN_clear_free(iqmp); + } + } +- if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) { ++ if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) { + DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); + } + #else +@@ -1464,69 +1475,30 @@ err: + static isc_result_t + opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, + const char *pin) { +-#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 +- ENGINE *e = NULL; + isc_result_t ret = ISC_R_SUCCESS; + EVP_PKEY *pkey = NULL, *pubpkey = NULL; +- RSA *rsa = NULL, *pubrsa = NULL; +- const BIGNUM *ex = NULL; + + UNUSED(pin); + +- if (engine == NULL) { +- DST_RET(DST_R_NOENGINE); +- } +- e = dst__openssl_getengine(engine); +- if (e == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_NOENGINE)); +- } ++ ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, ++ &pubpkey, &pkey); ++ if (ret != ISC_R_SUCCESS) ++ DST_RET(ret); + +- pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); +- if (pubpkey == NULL) { +- DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", +- DST_R_OPENSSLFAILURE)); +- } +- pubrsa = EVP_PKEY_get1_RSA(pubpkey); +- if (pubrsa == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); +- } +- +- pkey = ENGINE_load_private_key(e, label, NULL, NULL); +- if (pkey == NULL) { +- DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", +- DST_R_OPENSSLFAILURE)); +- } ++ ret = rsa_check(pkey, pubpkey); ++ if (ret != ISC_R_SUCCESS) ++ DST_RET(ret); + +- key->engine = isc_mem_strdup(key->mctx, engine); ++ if (engine != NULL) ++ key->engine = isc_mem_strdup(key->mctx, engine); ++ else ++ key->engine = NULL; + key->label = isc_mem_strdup(key->mctx, label); +- +- rsa = EVP_PKEY_get1_RSA(pkey); +- if (rsa == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); +- } +- if (rsa_check(rsa, pubrsa) != ISC_R_SUCCESS) { +- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); +- } +- RSA_get0_key(rsa, NULL, &ex, NULL); +- +- if (ex == NULL) { +- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); +- } +- if (BN_num_bits(ex) > RSA_MAX_PUBEXP_BITS) { +- DST_RET(ISC_R_RANGE); +- } +- + key->key_size = EVP_PKEY_bits(pkey); + key->keydata.pkey = pkey; + pkey = NULL; + + err: +- if (rsa != NULL) { +- RSA_free(rsa); +- } +- if (pubrsa != NULL) { +- RSA_free(pubrsa); +- } + if (pkey != NULL) { + EVP_PKEY_free(pkey); + } +@@ -1534,13 +1506,6 @@ err: + EVP_PKEY_free(pubpkey); + } + return ret; +-#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ +- UNUSED(key); +- UNUSED(engine); +- UNUSED(label); +- UNUSED(pin); +- return DST_R_NOENGINE; +-#endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ + } + + static dst_func_t opensslrsa_functions = { +-- +2.49.0 + diff --git a/bind.spec b/bind.spec index b7e4a33..d80916d 100644 --- a/bind.spec +++ b/bind.spec @@ -29,7 +29,7 @@ %bcond_with QUERYTRACE %if 0%{?fedora} >= 41 && ! 0%{?rhel} # Make this enabled on recent Fedora, but not in ELN or RHEL - %bcond_without OPENSSL_ENGINE + %bcond_with OPENSSL_ENGINE %endif %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} @@ -82,7 +82,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.35 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -129,6 +129,8 @@ Patch28: bind-9.20-nsupdate-tls.patch Patch29: bind-9.20-nsupdate-tls-doc.patch # Test suport for patch28 nsupdate Patch30: bind-9.20-nsupdate-tls-test.patch +# https://bugzilla.redhat.com/show_bug.cgi?id=2123076 +Patch31: bind-9.18-pkcs11-provider.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -892,6 +894,9 @@ fi; %endif %changelog +* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-2 +- Backport support for OpenSSL provider required for PKCS11 labels + * Wed Mar 26 2025 Petr Menšík - 32:9.18.35-1 - Update to 9.18.35 (rhbz#2346607) From 8bc9ab3888f8b059c85a094f1bbaa3d21f1fcf9f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 14 Feb 2025 21:16:11 +0100 Subject: [PATCH 075/144] Improve a bit ability to run testsuite from mockbuild Intended to be run like: centpkg mockbuild --with SYSTEMTEST -N --enable-network Do fail when it does not pass. But allow running tests as root. --- bind.spec | 23 ++++++++++++++++++++++- 1 file changed, 22 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index d80916d..c5b48bb 100644 --- a/bind.spec +++ b/bind.spec @@ -6,6 +6,8 @@ # bcond_without is built by default, unless --without X is passed # bcond_with is built only when --with X is passed to build %bcond_with SYSTEMTEST +# enable RSA1 during SYSTEMTEST +%bcond_with CRYPTO_POLICY_RSA1 %bcond_without GSSTSIG %bcond_without JSON # New MaxMind GeoLite support @@ -169,6 +171,7 @@ BuildRequires: softhsm %if %{with SYSTEMTEST} # bin/tests/system dependencies BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) +BuildRequires: perl(English) BuildRequires: python3-dns # manual configuration requires this tool BuildRequires: iproute @@ -332,6 +335,10 @@ for i in bin/named/Makefile.am; do done %endif +# allow running as root from mock or test machines +sed -e 's, "enable-developer",& \&\& systemctl is-system-running \&>/dev/null \&\& ! [ -e /mnt/tests ],' \ + -i bin/tests/system/run.sh + :; @@ -477,15 +484,29 @@ else sh bin/tests/system/ifconfig.sh up perl bin/tests/system/testsock.pl && CONFIGURED=build fi + if [ -n "$CONFIGURED" ] then set -e + %if %{with CRYPTO_POLICY_RSA1} + # Override crypto-policy to allow RSASHA1 key operations + OPENSSL_CONF="$(mktemp openssl-XXXXXX.cnf)" + cat > "$OPENSSL_CONF" << 'EOF' +.include = /etc/ssl/openssl.cnf +[evp_properties] +rh-allow-sha1-signatures = yes +EOF + export OPENSSL_CONF + %endif pushd build/bin/tests chown -R ${USER} . # Can be unknown user - %make_build test 2>&1 | tee test.log + %make_build test e=$? popd [ "$CONFIGURED" = build ] && sh bin/tests/system/ifconfig.sh down + %if %{with CRYPTO_POLICY_RSA1} + export -b OPENSSL_CONF + %endif if [ "$e" -ne 0 ]; then echo "ERROR: this build of BIND failed 'make test'. Aborting." exit $e; From feddafc9cfb7d67c816c375db4b64e4f2a5783de Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 26 Mar 2025 21:20:00 +0100 Subject: [PATCH 076/144] Deactivate jemalloc linking --- bind.spec | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index c5b48bb..e0464e2 100644 --- a/bind.spec +++ b/bind.spec @@ -12,6 +12,8 @@ %bcond_without JSON # New MaxMind GeoLite support %bcond_without GEOIP2 +# Jemalloc linked together +%bcond_with JEMALLOC # Disabled temporarily until kyua is fixed on rawhide, bug #1926779 %bcond_without UNITTEST # Do not set CI environment, include more unit tests, even less stable @@ -156,8 +158,10 @@ BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy BuildRequires: findutils sed BuildRequires: libnghttp2-devel -%if 0%{?fedora} +%if %{with JEMALLOC} && 0%{?fedora} BuildRequires: jemalloc-devel +%endif +%if 0%{?fedora} BuildRequires: gnupg2 %endif BuildRequires: libuv-devel @@ -407,6 +411,9 @@ export LIBDIR_SUFFIX %endif %if %{with UNITTEST} --with-cmocka \ +%endif +%if %{without JEMALLOC} + --without-jemalloc \ %endif --enable-fixed-rrset \ --enable-full-report \ @@ -917,6 +924,7 @@ fi; %changelog * Wed Mar 26 2025 Petr Menšík - 32:9.18.35-2 - Backport support for OpenSSL provider required for PKCS11 labels +- Deactivate jemalloc default linking * Wed Mar 26 2025 Petr Menšík - 32:9.18.35-1 - Update to 9.18.35 (rhbz#2346607) From 0f0106cb47a89057b3bf5cdac3ea78ff804f74e8 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Fri, 25 Apr 2025 14:17:41 +0200 Subject: [PATCH 077/144] Update to 9.18.36 (rhbz#2346607) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Feature Changes: - Make TLS data processing more reliable in various network conditions. Bug Fixes: - Stop caching lack of EDNS support - Fix resolver statistics counters for timed-out responses. - Don’t enforce NOAUTH/NOCONF flags in DNSKEYs. - Fix inconsistency in CNAME/DNAME handling during resolution. https://downloads.isc.org/isc/bind9/9.18.36/doc/arm/html/notes.html#notes-for-bind-9-18-36 --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index e0464e2..bc465bc 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.35 -Release: 2%{?dist} +Version: 9.18.36 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -922,6 +922,9 @@ fi; %endif %changelog +* Fri Apr 25 2025 Petr Mensik - 32:9.18.36-1 +- Update to 9.18.36 (rhbz#2346607) + * Wed Mar 26 2025 Petr Menšík - 32:9.18.35-2 - Backport support for OpenSSL provider required for PKCS11 labels - Deactivate jemalloc default linking diff --git a/sources b/sources index 988458c..86507ea 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.35.tar.xz) = 81764e1e4acb87e498cfce9e683dbdcadac13a5a5f2a517c988ff17967b34efb312ec0a9e94d7f9261e1e9bebbcfa295da6e37985c69961ef43031a8b99e8fc9 -SHA512 (bind-9.18.35.tar.xz.asc) = f2a237dda1f1f828bdc6c4b13f190c316fc26381ab7baf8f0101680898eb0a1a6518a7bc8baac0cf8c52356c6032e5d3c2c66d50e28b91054ee7066f76cd9009 +SHA512 (bind-9.18.36.tar.xz) = a95af586ee752705fa164c4d2f41b988e044a86ba9f078d1647d10025ca8f2872c95544dc5515717862b8fcb46b24e9cf6669d719196b6734a50d7a4c16a1288 +SHA512 (bind-9.18.36.tar.xz.asc) = a5d76c060d088ac53b9fdde00eb44c09acaf12a2e25cb5e39281062fdfd5128a5665b771f424159938c284bc888b78575d9757f4b44e8518e446b45a8c889e5a From ea2fc21f015a0ba2db470fb774d8d387e59eab04 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Wed, 30 Apr 2025 12:57:07 +0200 Subject: [PATCH 078/144] Hide warning about unused pin variable Created by downstream backport of openssl provider support. --- bind-9.18-pkcs11-provider.patch | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch index 256980a..24a216b 100644 --- a/bind-9.18-pkcs11-provider.patch +++ b/bind-9.18-pkcs11-provider.patch @@ -1,4 +1,4 @@ -From 099621c2769b934d0e1b02c0b085df86ae951780 Mon Sep 17 00:00:00 2001 +From 0869590a0c182cbf546df190616f56f790fa32aa Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 13 Feb 2025 13:20:28 +0100 Subject: [PATCH] Backport OpenSSL 3 provider support @@ -33,12 +33,12 @@ That would require additional heavier changes. --- lib/dns/dst_openssl.h | 4 + lib/dns/dst_parse.c | 21 ++--- - lib/dns/openssl_link.c | 160 ++++++++++++++++++++++++++++----- + lib/dns/openssl_link.c | 161 ++++++++++++++++++++++++++++----- lib/dns/openssldh_link.c | 5 ++ lib/dns/opensslecdsa_link.c | 110 ++++++++++++----------- lib/dns/openssleddsa_link.c | 40 +++------ lib/dns/opensslrsa_link.c | 173 ++++++++++++++---------------------- - 7 files changed, 294 insertions(+), 219 deletions(-) + 7 files changed, 295 insertions(+), 219 deletions(-) diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h index 819af0fee1..cd386c0019 100644 @@ -101,7 +101,7 @@ index d5ea0e418b..addb65ec5a 100644 } diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c -index e3a89f4406..5be6116985 100644 +index e3a89f4406..62077b6f81 100644 --- a/lib/dns/openssl_link.c +++ b/lib/dns/openssl_link.c @@ -44,6 +44,9 @@ @@ -186,7 +186,7 @@ index e3a89f4406..5be6116985 100644 } void -@@ -220,4 +223,119 @@ dst__openssl_getengine(const char *engine) { +@@ -220,4 +223,120 @@ dst__openssl_getengine(const char *engine) { } #endif /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ @@ -240,6 +240,7 @@ index e3a89f4406..5be6116985 100644 +static isc_result_t +dst__openssl_fromlabel_provider(int key_base_id, const char *label, const char *pin, + EVP_PKEY **ppub, EVP_PKEY **ppriv) { ++ UNUSED(pin); +#if OPENSSL_VERSION_NUMBER >= 0x30000000L + isc_result_t ret = DST_R_OPENSSLFAILURE; + OSSL_STORE_CTX *ctx = NULL; From 988c021cf383f5db28c6d05f617b65f8345f44a7 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Tue, 10 Jun 2025 15:34:02 +0200 Subject: [PATCH 079/144] Prevent name.c:670: REQUIRE((name1->attributes & 0x00000001) == (name2->attributes & 0x00000001)) failed resume_qmin did not handle special case of recursing query hit unexpected DNS_R_CNAME result. Change result to SERVFAIL in case of a zone loaded after the recursion started. That prevents crashing later in query_setorder, where there is uninitialized foundname compared with absolute order names. https://gitlab.isc.org/isc-projects/bind9/-/issues/5357 Related: RHEL-30407 --- bind-9.21-resume-qmin-cname.patch | 44 +++++++++++++++++++++++++++++++ bind.spec | 4 +++ 2 files changed, 48 insertions(+) create mode 100644 bind-9.21-resume-qmin-cname.patch diff --git a/bind-9.21-resume-qmin-cname.patch b/bind-9.21-resume-qmin-cname.patch new file mode 100644 index 0000000..05fd4b4 --- /dev/null +++ b/bind-9.21-resume-qmin-cname.patch @@ -0,0 +1,44 @@ +From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Tue, 3 Jun 2025 21:00:58 +0200 +Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way + +When authoritative zone is loaded when query minimization query for the +same zone is already pending, it might receive unexpected result codes. + +Normally DNS_R_CNAME would follow to query_cname after processing sent +events, but dns_view_findzonecut does not fill CNAME target into +event->foundevent. Usual lookup via query_lookup would always have that +filled. + +Ideally we would restart the query with unmodified search name, if +unexpected change from recursing to local zone cut were detected. Until +dns_view_findzonecut is modified to export zone/cache source of the cut, +at least fail queries which went into unexpected state. +--- + lib/dns/resolver.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index 795791246b..39a294437e 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) { + if (result == DNS_R_NXDOMAIN) { + result = DNS_R_SERVFAIL; + } ++ /* ++ * CNAME or DNAME means zone were added with that record ++ * after the start of query minimization queries. It means ++ * we do not have initialized correct hevent->foundname ++ * and have to fail. ++ */ ++ if (result == DNS_R_CNAME || result == DNS_R_DNAME) { ++ result = DNS_R_SERVFAIL; ++ } + + if (result != ISC_R_SUCCESS) { + goto cleanup; +-- +2.49.0 + diff --git a/bind.spec b/bind.spec index bc465bc..71dd56f 100644 --- a/bind.spec +++ b/bind.spec @@ -135,6 +135,10 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch Patch30: bind-9.20-nsupdate-tls-test.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2123076 Patch31: bind-9.18-pkcs11-provider.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562 +# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357 +# downstream patch fixing bind-dyndb-ldap causing issue +Patch32: bind-9.21-resume-qmin-cname.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 21cc8ba4e6c8be585eacfe639afbb649dd763c4b Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Tue, 10 Jun 2025 16:12:23 +0200 Subject: [PATCH 080/144] Prevent name.c:670 attributes assertion failed Bump changelog. --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 71dd56f..ecd6bdd 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.36 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -926,6 +926,9 @@ fi; %endif %changelog +* Tue Jun 10 2025 'Petr Mensik' <> - 32:9.18.36-2 +- Prevent name.c:670 attributes assertion failed + * Fri Apr 25 2025 Petr Mensik - 32:9.18.36-1 - Update to 9.18.36 (rhbz#2346607) From 0b246d18dfa60bac2c46da88832f61cd58093f73 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Tue, 10 Jun 2025 18:52:35 +0200 Subject: [PATCH 081/144] Add extra protections to places needing absolute names Insert just potential protection in case Patch32 does not cover all possible cases. --- bind-9.18-query-fname-relative.patch | 90 ++++++++++++++++++++++++++++ bind.spec | 3 + 2 files changed, 93 insertions(+) create mode 100644 bind-9.18-query-fname-relative.patch diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch new file mode 100644 index 0000000..f29d501 --- /dev/null +++ b/bind-9.18-query-fname-relative.patch @@ -0,0 +1,90 @@ +From 12c16aac02a4f58575eb125cbd37a7f05d7cc245 Mon Sep 17 00:00:00 2001 +From: Petr Mensik +Date: Fri, 25 Apr 2025 02:00:00 +0200 +Subject: [PATCH] Insert additional checks ensuring name is not relative + +Mitigation for crashes put in various places, where obviously relative +uninitialized name must not appear. This seems unnecessary once true +cause were identified, but may prevent similar places. +--- + lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++ + 1 file changed, 35 insertions(+) + +diff --git a/lib/ns/query.c b/lib/ns/query.c +index 5a75601160..44adb220e3 100644 +--- a/lib/ns/query.c ++++ b/lib/ns/query.c +@@ -2203,6 +2203,20 @@ regular: + CTRACE(ISC_LOG_DEBUG(3), "query_additional: done"); + } + ++static isc_result_t ++log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) { ++ if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) { ++ char namebuf[DNS_NAME_FORMATSIZE] = "!"; ++ dns_name_format(name, namebuf, sizeof(namebuf)); ++ ns_client_log( ++ qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY, ++ ISC_LOG_DEBUG(1), ++ "%s: fname=%s leading to relative name, aborting query.", ++ func, namebuf ++ ); ++ } ++} ++ + static void + query_addrrset(query_ctx_t *qctx, dns_name_t **namep, + dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp, +@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep, + client->query.attributes &= ~NS_QUERYATTR_SECURE; + } + ++ if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) { ++ log_query_relative(qctx, "query_addrrset", mname); ++ QUERY_ERROR(qctx, DNS_R_SERVFAIL); ++ return; ++ } + /* + * Update message name, set rdataset order, and do additional + * section processing if needed. +@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) { + : qctx->tname; + query_prefetch(qctx->client, name, + qctx->rdataset); ++ if (name && !dns_name_isabsolute(name)) { ++ log_query_relative(qctx, "query_respond_any", name); ++ result = DNS_R_DROP; ++ break; ++ } + } + + /* +@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) { + + if (!qctx->is_zone && RECURSIONOK(qctx->client)) { + query_prefetch(qctx->client, qctx->fname, qctx->rdataset); ++ if (qctx->fname && !dns_name_isabsolute(qctx->fname)) { ++ log_query_relative(qctx, "query_cname", qctx->fname); ++ QUERY_ERROR(qctx, DNS_R_SERVFAIL); ++ return (ns_query_done(qctx)); ++ } + } + + query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp, +@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) { + + if (!qctx->is_zone && RECURSIONOK(qctx->client)) { + query_prefetch(qctx->client, qctx->fname, qctx->rdataset); ++ if (qctx->fname && !dns_name_isabsolute(qctx->fname)) { ++ log_query_relative(qctx, "query_dname", qctx->fname); ++ QUERY_ERROR(qctx, DNS_R_SERVFAIL); ++ return (ns_query_done(qctx)); ++ } + } ++ + query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp, + qctx->dbuf, DNS_SECTION_ANSWER); + +-- +2.49.0 + diff --git a/bind.spec b/bind.spec index ecd6bdd..b0e195f 100644 --- a/bind.spec +++ b/bind.spec @@ -139,6 +139,8 @@ Patch31: bind-9.18-pkcs11-provider.patch # https://gitlab.isc.org/isc-projects/bind9/-/issues/5357 # downstream patch fixing bind-dyndb-ldap causing issue Patch32: bind-9.21-resume-qmin-cname.patch +# downstream only, extra check for above change, RHEL-30407 +Patch33: bind-9.18-query-fname-relative.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -928,6 +930,7 @@ fi; %changelog * Tue Jun 10 2025 'Petr Mensik' <> - 32:9.18.36-2 - Prevent name.c:670 attributes assertion failed +- Add extra checks for relative names * Fri Apr 25 2025 Petr Mensik - 32:9.18.36-1 - Update to 9.18.36 (rhbz#2346607) From ed27e3714ce83b5c3c7f90d044d0697a41f664d5 Mon Sep 17 00:00:00 2001 From: "psklenar@redhat.com" Date: Mon, 9 Jun 2025 16:52:26 +0200 Subject: [PATCH 082/144] fedora CI plans move to gitlab for centos-stream test space https://issues.redhat.com/browse/RHELMISC-13073 --- plans/all.fmf | 2 +- plans/tier1-public.fmf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/plans/all.fmf b/plans/all.fmf index 03bf500..a798d87 100644 --- a/plans/all.fmf +++ b/plans/all.fmf @@ -3,7 +3,7 @@ environment+: PACKAGE: bind discover: how: fmf - url: https://src.fedoraproject.org/tests/bind.git + url: https://gitlab.com/redhat/centos-stream/tests/bind.git execute: how: tmt context: diff --git a/plans/tier1-public.fmf b/plans/tier1-public.fmf index e5b273a..4970855 100644 --- a/plans/tier1-public.fmf +++ b/plans/tier1-public.fmf @@ -3,7 +3,7 @@ environment+: PACKAGE: bind discover: how: fmf - url: https://src.fedoraproject.org/tests/bind.git + url: https://gitlab.com/redhat/centos-stream/tests/bind.git filter: 'tier: 1' execute: how: tmt From 2e5ec7e2b88b6f012bd68fecf5c607cf11eb1269 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 23 Jul 2025 17:41:39 +0000 Subject: [PATCH 083/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index b0e195f..58c7267 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.36 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -928,6 +928,9 @@ fi; %endif %changelog +* Wed Jul 23 2025 Fedora Release Engineering - 32:9.18.36-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + * Tue Jun 10 2025 'Petr Mensik' <> - 32:9.18.36-2 - Prevent name.c:670 attributes assertion failed - Add extra checks for relative names From 3088af74e3484ca80f36d1677eabc06dc4636154 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Tue, 10 Jun 2025 19:26:28 +0200 Subject: [PATCH 084/144] Fix new added warning --- bind-9.18-query-fname-relative.patch | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch index f29d501..43fea36 100644 --- a/bind-9.18-query-fname-relative.patch +++ b/bind-9.18-query-fname-relative.patch @@ -1,4 +1,4 @@ -From 12c16aac02a4f58575eb125cbd37a7f05d7cc245 Mon Sep 17 00:00:00 2001 +From 4ac85ace54798ba8ea0d3ef12926730ed4f55fac Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Fri, 25 Apr 2025 02:00:00 +0200 Subject: [PATCH] Insert additional checks ensuring name is not relative @@ -11,14 +11,14 @@ cause were identified, but may prevent similar places. 1 file changed, 35 insertions(+) diff --git a/lib/ns/query.c b/lib/ns/query.c -index 5a75601160..44adb220e3 100644 +index 5a75601160..d45c66c86d 100644 --- a/lib/ns/query.c +++ b/lib/ns/query.c @@ -2203,6 +2203,20 @@ regular: CTRACE(ISC_LOG_DEBUG(3), "query_additional: done"); } -+static isc_result_t ++static void +log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) { + if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) { + char namebuf[DNS_NAME_FORMATSIZE] = "!"; From c5b2e69f0c55061a822be262e4476294a8842f9b Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Wed, 30 Jul 2025 12:20:02 +0200 Subject: [PATCH 085/144] Update to 9.18.38 (rhbz#2367771) Security Fixes: - Fix an issue when some specific queries could remain unanswered with serve-stale enabled. New Features: - Add support for the CO flag to dig. Bug fixes: - Correct the default interface-interval from 60s to 60m. - Fix a purge-keys bug when using multiple views of a zone. --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index 58c7267..705a8c9 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.36 -Release: 3%{?dist} +Version: 9.18.38 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -928,6 +928,9 @@ fi; %endif %changelog +* Wed Jul 30 2025 'Petr Mensik' <> - 32:9.18.38-1 +- Update to 9.18.38 (rhbz#2367771) + * Wed Jul 23 2025 Fedora Release Engineering - 32:9.18.36-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild diff --git a/sources b/sources index 86507ea..5c4fb7d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.36.tar.xz) = a95af586ee752705fa164c4d2f41b988e044a86ba9f078d1647d10025ca8f2872c95544dc5515717862b8fcb46b24e9cf6669d719196b6734a50d7a4c16a1288 -SHA512 (bind-9.18.36.tar.xz.asc) = a5d76c060d088ac53b9fdde00eb44c09acaf12a2e25cb5e39281062fdfd5128a5665b771f424159938c284bc888b78575d9757f4b44e8518e446b45a8c889e5a +SHA512 (bind-9.18.38.tar.xz) = 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c +SHA512 (bind-9.18.38.tar.xz.asc) = 52a06f8357aab7a4a100e17ae3168b368b7e8c623c47ddd90b605ab4175fa9a182bedca8aebaebce1aa6d013b32bec5651fdd4f38be99225c0716c6dddea3fa9 From a324aa90fddebd318f4368c244d9bcb0462dce75 Mon Sep 17 00:00:00 2001 From: Petr Mensik Date: Thu, 14 Aug 2025 16:02:17 +0200 Subject: [PATCH 086/144] Fix rsabigexponent upstream test after pkcs11 provider support Related: https://issues.redhat.com/browse/RHEL-33729 --- bind-9.18-pkcs11-provider.patch | 79 +++++++++++++++++++++++---------- 1 file changed, 56 insertions(+), 23 deletions(-) diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch index 24a216b..4a48182 100644 --- a/bind-9.18-pkcs11-provider.patch +++ b/bind-9.18-pkcs11-provider.patch @@ -1,4 +1,4 @@ -From 0869590a0c182cbf546df190616f56f790fa32aa Mon Sep 17 00:00:00 2001 +From ec38a39feabea02eb75f257e8b81cf16aac9d184 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 13 Feb 2025 13:20:28 +0100 Subject: [PATCH] Backport OpenSSL 3 provider support @@ -30,18 +30,23 @@ Fix keyfromlabel to not use engine parameter for provider keys Use dst_key_t label to signal isprivate property as a downstream alternative to upstream commit 74361b0b6e5a6b17ebeea6afe1ca990395d7a6dd. That would require additional heavier changes. + +Downstream change: +Move RSA bits check to legacy, let it use rsa_check for newer + +rsabigexponent tests got broken by this change. --- lib/dns/dst_openssl.h | 4 + - lib/dns/dst_parse.c | 21 ++--- - lib/dns/openssl_link.c | 161 ++++++++++++++++++++++++++++----- - lib/dns/openssldh_link.c | 5 ++ - lib/dns/opensslecdsa_link.c | 110 ++++++++++++----------- - lib/dns/openssleddsa_link.c | 40 +++------ - lib/dns/opensslrsa_link.c | 173 ++++++++++++++---------------------- - 7 files changed, 295 insertions(+), 219 deletions(-) + lib/dns/dst_parse.c | 21 ++-- + lib/dns/openssl_link.c | 161 ++++++++++++++++++++++++++---- + lib/dns/openssldh_link.c | 5 + + lib/dns/opensslecdsa_link.c | 110 ++++++++++----------- + lib/dns/openssleddsa_link.c | 40 +++----- + lib/dns/opensslrsa_link.c | 189 +++++++++++++++--------------------- + 7 files changed, 303 insertions(+), 227 deletions(-) diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h -index 819af0fee1..cd386c0019 100644 +index 819af0f..cd386c0 100644 --- a/lib/dns/dst_openssl.h +++ b/lib/dns/dst_openssl.h @@ -64,4 +64,8 @@ ENGINE * @@ -54,7 +59,7 @@ index 819af0fee1..cd386c0019 100644 + ISC_LANG_ENDDECLS diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c -index d5ea0e418b..addb65ec5a 100644 +index d5ea0e4..addb65e 100644 --- a/lib/dns/dst_parse.c +++ b/lib/dns/dst_parse.c @@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) { @@ -101,7 +106,7 @@ index d5ea0e418b..addb65ec5a 100644 } diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c -index e3a89f4406..62077b6f81 100644 +index e3a89f4..62077b6 100644 --- a/lib/dns/openssl_link.c +++ b/lib/dns/openssl_link.c @@ -44,6 +44,9 @@ @@ -308,7 +313,7 @@ index e3a89f4406..62077b6f81 100644 + /*! \file */ diff --git a/lib/dns/openssldh_link.c b/lib/dns/openssldh_link.c -index a4ba0f78d3..38345e6bfd 100644 +index a4ba0f7..38345e6 100644 --- a/lib/dns/openssldh_link.c +++ b/lib/dns/openssldh_link.c @@ -610,6 +610,11 @@ err: @@ -324,7 +329,7 @@ index a4ba0f78d3..38345e6bfd 100644 DH *dh = key->keydata.dh; const BIGNUM *priv_key = NULL; diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c -index ca12bb5620..5d070140c5 100644 +index ca12bb5..5d07014 100644 --- a/lib/dns/opensslecdsa_link.c +++ b/lib/dns/opensslecdsa_link.c @@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) { @@ -529,7 +534,7 @@ index ca12bb5620..5d070140c5 100644 static dst_func_t opensslecdsa_functions = { diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c -index 74dac17bc6..04457fbfc3 100644 +index 74dac17..04457fb 100644 --- a/lib/dns/openssleddsa_link.c +++ b/lib/dns/openssleddsa_link.c @@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) { @@ -606,7 +611,7 @@ index 74dac17bc6..04457fbfc3 100644 static dst_func_t openssleddsa_functions = { diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c -index 37e8a63a61..1ffae888e1 100644 +index 37e8a63..d4fbe97 100644 --- a/lib/dns/opensslrsa_link.c +++ b/lib/dns/opensslrsa_link.c @@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) { @@ -762,7 +767,7 @@ index 37e8a63a61..1ffae888e1 100644 } for (i = 0; i < priv.nelements; i++) { -@@ -1321,7 +1332,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1321,9 +1332,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { BN_clear_free(iqmp); } } @@ -770,7 +775,35 @@ index 37e8a63a61..1ffae888e1 100644 + if (rsa_check_legacy(rsa, pubrsa) != ISC_R_SUCCESS) { DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); } ++ ++ if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) { ++ DST_RET(ISC_R_RANGE); ++ } ++ #else + bld = OSSL_PARAM_BLD_new(); + if (bld == NULL) { +@@ -1390,17 +1406,12 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { + DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); + } + +- if (rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL) != +- ISC_R_SUCCESS) +- { +- DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); ++ ret = rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL); ++ if (ret != ISC_R_SUCCESS) { ++ DST_RET(ret); + } + #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ + +- if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) { +- DST_RET(ISC_R_RANGE); +- } +- + key->key_size = BN_num_bits(n); + key->keydata.pkey = pkey; + pkey = NULL; @@ -1464,69 +1475,30 @@ err: static isc_result_t opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, @@ -791,11 +824,7 @@ index 37e8a63a61..1ffae888e1 100644 - if (e == NULL) { - DST_RET(dst__openssl_toresult(DST_R_NOENGINE)); - } -+ ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, -+ &pubpkey, &pkey); -+ if (ret != ISC_R_SUCCESS) -+ DST_RET(ret); - +- - pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); - if (pubpkey == NULL) { - DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", @@ -805,7 +834,11 @@ index 37e8a63a61..1ffae888e1 100644 - if (pubrsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } -- ++ ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, ++ &pubpkey, &pkey); ++ if (ret != ISC_R_SUCCESS) ++ DST_RET(ret); + - pkey = ENGINE_load_private_key(e, label, NULL, NULL); - if (pkey == NULL) { - DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", @@ -867,5 +900,5 @@ index 37e8a63a61..1ffae888e1 100644 static dst_func_t opensslrsa_functions = { -- -2.49.0 +2.50.1 From 4cc7c36636962199fb37fcbbd4b1c8b8614b60ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 21 Aug 2025 11:39:44 +0200 Subject: [PATCH 087/144] Update to 9.18.39 (rhbz#2389765) New Features: - Support for parsing the DSYNC record has been added. Feature Changes: - Add deprecation warnings for RSASHA1, RSASHA1-NSEC3SHA1, and DS digest type 1. Bug Fixes: - Clean enough memory when adding new ADB names/entries under memory pressure. - Rescan the interfaces again when reconfiguring the server. https://downloads.isc.org/isc/bind9/9.18.39/doc/arm/html/notes.html#notes-for-bind-9-18-39 --- bind-9.18-query-fname-relative.patch | 90 ---------------------------- bind-9.21-resume-qmin-cname.patch | 44 -------------- bind.spec | 11 ++-- sources | 4 +- 4 files changed, 6 insertions(+), 143 deletions(-) delete mode 100644 bind-9.18-query-fname-relative.patch delete mode 100644 bind-9.21-resume-qmin-cname.patch diff --git a/bind-9.18-query-fname-relative.patch b/bind-9.18-query-fname-relative.patch deleted file mode 100644 index 43fea36..0000000 --- a/bind-9.18-query-fname-relative.patch +++ /dev/null @@ -1,90 +0,0 @@ -From 4ac85ace54798ba8ea0d3ef12926730ed4f55fac Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Fri, 25 Apr 2025 02:00:00 +0200 -Subject: [PATCH] Insert additional checks ensuring name is not relative - -Mitigation for crashes put in various places, where obviously relative -uninitialized name must not appear. This seems unnecessary once true -cause were identified, but may prevent similar places. ---- - lib/ns/query.c | 35 +++++++++++++++++++++++++++++++++++ - 1 file changed, 35 insertions(+) - -diff --git a/lib/ns/query.c b/lib/ns/query.c -index 5a75601160..d45c66c86d 100644 ---- a/lib/ns/query.c -+++ b/lib/ns/query.c -@@ -2203,6 +2203,20 @@ regular: - CTRACE(ISC_LOG_DEBUG(3), "query_additional: done"); - } - -+static void -+log_query_relative(query_ctx_t *qctx, const char *func, const dns_name_t *name) { -+ if (isc_log_wouldlog(ns_lctx, ISC_LOG_DEBUG(1))) { -+ char namebuf[DNS_NAME_FORMATSIZE] = "!"; -+ dns_name_format(name, namebuf, sizeof(namebuf)); -+ ns_client_log( -+ qctx->client, NS_LOGCATEGORY_CLIENT, NS_LOGMODULE_QUERY, -+ ISC_LOG_DEBUG(1), -+ "%s: fname=%s leading to relative name, aborting query.", -+ func, namebuf -+ ); -+ } -+} -+ - static void - query_addrrset(query_ctx_t *qctx, dns_name_t **namep, - dns_rdataset_t **rdatasetp, dns_rdataset_t **sigrdatasetp, -@@ -2275,6 +2289,11 @@ query_addrrset(query_ctx_t *qctx, dns_name_t **namep, - client->query.attributes &= ~NS_QUERYATTR_SECURE; - } - -+ if (!qctx->is_zone && mname && !dns_name_isabsolute(mname)) { -+ log_query_relative(qctx, "query_addrrset", mname); -+ QUERY_ERROR(qctx, DNS_R_SERVFAIL); -+ return; -+ } - /* - * Update message name, set rdataset order, and do additional - * section processing if needed. -@@ -8079,6 +8098,11 @@ query_respond_any(query_ctx_t *qctx) { - : qctx->tname; - query_prefetch(qctx->client, name, - qctx->rdataset); -+ if (name && !dns_name_isabsolute(name)) { -+ log_query_relative(qctx, "query_respond_any", name); -+ result = DNS_R_DROP; -+ break; -+ } - } - - /* -@@ -10701,6 +10725,11 @@ query_cname(query_ctx_t *qctx) { - - if (!qctx->is_zone && RECURSIONOK(qctx->client)) { - query_prefetch(qctx->client, qctx->fname, qctx->rdataset); -+ if (qctx->fname && !dns_name_isabsolute(qctx->fname)) { -+ log_query_relative(qctx, "query_cname", qctx->fname); -+ QUERY_ERROR(qctx, DNS_R_SERVFAIL); -+ return (ns_query_done(qctx)); -+ } - } - - query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp, -@@ -10806,7 +10835,13 @@ query_dname(query_ctx_t *qctx) { - - if (!qctx->is_zone && RECURSIONOK(qctx->client)) { - query_prefetch(qctx->client, qctx->fname, qctx->rdataset); -+ if (qctx->fname && !dns_name_isabsolute(qctx->fname)) { -+ log_query_relative(qctx, "query_dname", qctx->fname); -+ QUERY_ERROR(qctx, DNS_R_SERVFAIL); -+ return (ns_query_done(qctx)); -+ } - } -+ - query_addrrset(qctx, &qctx->fname, &qctx->rdataset, sigrdatasetp, - qctx->dbuf, DNS_SECTION_ANSWER); - --- -2.49.0 - diff --git a/bind-9.21-resume-qmin-cname.patch b/bind-9.21-resume-qmin-cname.patch deleted file mode 100644 index 05fd4b4..0000000 --- a/bind-9.21-resume-qmin-cname.patch +++ /dev/null @@ -1,44 +0,0 @@ -From ac0c3b0477d97fe5c968910f603bb8d04c740da7 Mon Sep 17 00:00:00 2001 -From: Petr Mensik -Date: Tue, 3 Jun 2025 21:00:58 +0200 -Subject: [PATCH] Handle CNAME and DNAME in resume_min in a special way - -When authoritative zone is loaded when query minimization query for the -same zone is already pending, it might receive unexpected result codes. - -Normally DNS_R_CNAME would follow to query_cname after processing sent -events, but dns_view_findzonecut does not fill CNAME target into -event->foundevent. Usual lookup via query_lookup would always have that -filled. - -Ideally we would restart the query with unmodified search name, if -unexpected change from recursing to local zone cut were detected. Until -dns_view_findzonecut is modified to export zone/cache source of the cut, -at least fail queries which went into unexpected state. ---- - lib/dns/resolver.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - -diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c -index 795791246b..39a294437e 100644 ---- a/lib/dns/resolver.c -+++ b/lib/dns/resolver.c -@@ -4497,6 +4497,15 @@ resume_qmin(isc_task_t *task, isc_event_t *event) { - if (result == DNS_R_NXDOMAIN) { - result = DNS_R_SERVFAIL; - } -+ /* -+ * CNAME or DNAME means zone were added with that record -+ * after the start of query minimization queries. It means -+ * we do not have initialized correct hevent->foundname -+ * and have to fail. -+ */ -+ if (result == DNS_R_CNAME || result == DNS_R_DNAME) { -+ result = DNS_R_SERVFAIL; -+ } - - if (result != ISC_R_SUCCESS) { - goto cleanup; --- -2.49.0 - diff --git a/bind.spec b/bind.spec index 705a8c9..89a6ab5 100644 --- a/bind.spec +++ b/bind.spec @@ -85,7 +85,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.38 +Version: 9.18.39 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -135,12 +135,6 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch Patch30: bind-9.20-nsupdate-tls-test.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2123076 Patch31: bind-9.18-pkcs11-provider.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10562 -# https://gitlab.isc.org/isc-projects/bind9/-/issues/5357 -# downstream patch fixing bind-dyndb-ldap causing issue -Patch32: bind-9.21-resume-qmin-cname.patch -# downstream only, extra check for above change, RHEL-30407 -Patch33: bind-9.18-query-fname-relative.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -928,6 +922,9 @@ fi; %endif %changelog +* Thu Aug 21 2025 Petr Menšík - 32:9.18.39-1 +- Update to 9.18.39 (rhbz#2389765) + * Wed Jul 30 2025 'Petr Mensik' <> - 32:9.18.38-1 - Update to 9.18.38 (rhbz#2367771) diff --git a/sources b/sources index 5c4fb7d..aa55f1d 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.38.tar.xz) = 38710646a817dca0df6247b660cd244c79da13d0fed2898da139ae206bc8732fddd93af6fc2cbeca805c0c0d0789ec22eacf26789db288154581478ab2eaf44c -SHA512 (bind-9.18.38.tar.xz.asc) = 52a06f8357aab7a4a100e17ae3168b368b7e8c623c47ddd90b605ab4175fa9a182bedca8aebaebce1aa6d013b32bec5651fdd4f38be99225c0716c6dddea3fa9 +SHA512 (bind-9.18.39.tar.xz) = fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07 +SHA512 (bind-9.18.39.tar.xz.asc) = 17e8aad74f1eaa42119f84ab3df05e85a1775f97c628259e00f7224d4f0d250050d022db670bc036b0ba05a3cd586de331da0b77c42ab58307711fed36c7ee9e From a5e89554c928a1caa090faf9424ebe6101d17768 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 1 Sep 2025 16:58:27 +0200 Subject: [PATCH 088/144] Offer up to 13 additional servers records Downstream only patch for now. Required to work together with Microsoft DNS server Stub zone entry. Related: RHEL-84006 Resolves: rhbz#2392413 --- bind-9.18-partial-additional-records.patch | 54 ++++++++++++++++++++++ bind.spec | 7 ++- 2 files changed, 60 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-partial-additional-records.patch diff --git a/bind-9.18-partial-additional-records.patch b/bind-9.18-partial-additional-records.patch new file mode 100644 index 0000000..6834616 --- /dev/null +++ b/bind-9.18-partial-additional-records.patch @@ -0,0 +1,54 @@ +From 3f686891729c7d39d879e8b5bb1aa17d874d265d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 19 Jun 2025 19:51:43 +0200 +Subject: [PATCH] Limit number of additional records fetched + +Limit number of started fetches for additional zone instead of doing +none. Keep limit of NS filled with additional records, but present at +least some if possible. + +Might help broken implementations relying on receiving addresses in the +response for NS query in authoritative zone. +--- + lib/dns/rdataset.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/lib/dns/rdataset.c b/lib/dns/rdataset.c +index 532e49a..bfa8e37 100644 +--- a/lib/dns/rdataset.c ++++ b/lib/dns/rdataset.c +@@ -581,6 +581,7 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + size_t limit) { + dns_rdata_t rdata = DNS_RDATA_INIT; + isc_result_t result; ++ size_t n = 0; + + /* + * For each rdata in rdataset, call 'add' for each name and type in the +@@ -590,10 +591,6 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + REQUIRE(DNS_RDATASET_VALID(rdataset)); + REQUIRE((rdataset->attributes & DNS_RDATASETATTR_QUESTION) == 0); + +- if (limit != 0 && dns_rdataset_count(rdataset) > limit) { +- return DNS_R_TOOMANYRECORDS; +- } +- + result = dns_rdataset_first(rdataset); + if (result != ISC_R_SUCCESS) { + return result; +@@ -603,7 +600,11 @@ dns_rdataset_additionaldata(dns_rdataset_t *rdataset, + dns_rdataset_current(rdataset, &rdata); + result = dns_rdata_additionaldata(&rdata, owner_name, add, arg); + if (result == ISC_R_SUCCESS) { +- result = dns_rdataset_next(rdataset); ++ if (limit != 0 && ++n >= limit) { ++ result = DNS_R_TOOMANYRECORDS; ++ } else { ++ result = dns_rdataset_next(rdataset); ++ } + } + dns_rdata_reset(&rdata); + } while (result == ISC_R_SUCCESS); +-- +2.50.1 + diff --git a/bind.spec b/bind.spec index 89a6ab5..7c00b54 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -135,6 +135,8 @@ Patch29: bind-9.20-nsupdate-tls-doc.patch Patch30: bind-9.20-nsupdate-tls-test.patch # https://bugzilla.redhat.com/show_bug.cgi?id=2123076 Patch31: bind-9.18-pkcs11-provider.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611 +Patch32: bind-9.18-partial-additional-records.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -922,6 +924,9 @@ fi; %endif %changelog +* Mon Sep 01 2025 Petr Menšík - 32:9.18.39-2 +- Offer up to 13 additional servers records if there are more servers + * Thu Aug 21 2025 Petr Menšík - 32:9.18.39-1 - Update to 9.18.39 (rhbz#2389765) From 3f3e0c1c5858153db61418017e697bd7535aa895 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 3 Sep 2025 18:33:35 +0200 Subject: [PATCH 089/144] Decode IDN names on input in all situations in utilities (rhbz#2324186) Use the same name in dig or host utilities when stdout is not a terminal. Until now it disabled IDN processing when stdout were not a terminal. Disable just IDN output in that case and try to decode input name with IDN. Keep failing in interactive sessions, but send even undecoded name query when output is redirected. That should limit new surprises and keep most of behaviour without changes. But do not break in when input name failed to decode and it were not trying to decode it before. Related: RHEL-66172 --- bind-9.18-dig-idn-input-always.patch | 98 ++++++++++++++++++++++++++++ bind.spec | 8 ++- 2 files changed, 105 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-dig-idn-input-always.patch diff --git a/bind-9.18-dig-idn-input-always.patch b/bind-9.18-dig-idn-input-always.patch new file mode 100644 index 0000000..7c72269 --- /dev/null +++ b/bind-9.18-dig-idn-input-always.patch @@ -0,0 +1,98 @@ +From fcc50604359a05e24003f3ff51c3812d8f307814 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Wed, 6 Nov 2024 21:29:47 +0100 +Subject: [PATCH] Allow always IDN input in dig +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Even when stdout is non-interactive terminal, allow unicode characters +to be encoded into ACE form. Still disable IDN output, but unless ++noidnin or IDN_DISABLE=1 env is detected, consider input as locale +defined name. + +Provides more isolated change, which issue #3527 introduced similar +behavior into 9.19 with more changes. + +Ignore input IDN errors when stdout is not terminal + +Attempt to prevent visible regressions when enabling IDN on input +always. Instead of new hard failures preventing IDN decoding of input +name just use original input. + +Should make the change backward compatible. When on interactive terminal +behave the same way as before and emit hard errors. Become more +forgiving in scripts where stdout leads to script. Decoding output is +not enabled there and if input decoding fails, just use input as it was. + +Change dig manual +idnin + +Note in manual IDN input is always enabled. But it silently ignores +errors when stdout is not a terminal to prevent regressions. + +Signed-off-by: Petr Menšík +--- + bin/dig/dig.rst | 5 ++--- + bin/dig/dighost.c | 16 ++++++++++++---- + 2 files changed, 14 insertions(+), 7 deletions(-) + +diff --git a/bin/dig/dig.rst b/bin/dig/dig.rst +index 88b0a40307..e2bf3764d3 100644 +--- a/bin/dig/dig.rst ++++ b/bin/dig/dig.rst +@@ -453,9 +453,8 @@ abbreviation is unambiguous; for example, :option:`+cd` is equivalent to + This option processes [or does not process] IDN domain names on input. This requires + ``IDN SUPPORT`` to have been enabled at compile time. + +- The default is to process IDN input when standard output is a tty. +- The IDN processing on input is disabled when :program:`dig` output is redirected +- to files, pipes, and other non-tty file descriptors. ++ The default is to process IDN input. The input IDN processing errors are ignored ++ when :program:`dig` output is redirected to files, pipes, and other non-tty file descriptors. + + .. option:: +idnout, +noidnout + +diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c +index 0f8ac1335c..1307346192 100644 +--- a/bin/dig/dighost.c ++++ b/bin/dig/dighost.c +@@ -604,7 +604,7 @@ dig_lookup_t * + make_empty_lookup(void) { + dig_lookup_t *looknew; + #ifdef HAVE_LIBIDN2 +- bool idn_allowed = isatty(1) ? (getenv("IDN_DISABLE") == NULL) : false; ++ bool idn_allowed = (getenv("IDN_DISABLE") == NULL); + #endif /* HAVE_LIBIDN2 */ + + debug("make_empty_lookup()"); +@@ -623,7 +623,7 @@ make_empty_lookup(void) { + .badcookie = true, + #ifdef HAVE_LIBIDN2 + .idnin = idn_allowed, +- .idnout = idn_allowed, ++ .idnout = isatty(1) && idn_allowed, + #endif /* HAVE_LIBIDN2 */ + .udpsize = -1, + .edns = -1, +@@ -4871,8 +4871,16 @@ idn_locale_to_ace(const char *src, char *dst, size_t dstlen) { + res = idn2_to_ascii_lz(src, &ascii_src, IDN2_TRANSITIONAL); + } + if (res != IDN2_OK) { +- fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin", +- src, idn2_strerror(res)); ++ if (isatty(1)) { ++ fatal("'%s' is not a legal IDNA2008 name (%s), use +noidnin", ++ src, idn2_strerror(res)); ++ } else { ++ /* In case of non-terminal output silently ignore errors ++ * in IDN input decoding. */ ++ (void)strlcpy(dst, src, dstlen); ++ resetlocale(LC_ALL); ++ return; ++ } + } + + /* +-- +2.50.1 + diff --git a/bind.spec b/bind.spec index 7c00b54..07578c3 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -137,6 +137,9 @@ Patch30: bind-9.20-nsupdate-tls-test.patch Patch31: bind-9.18-pkcs11-provider.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/10611 Patch32: bind-9.18-partial-additional-records.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723 +# downstream only +Patch33: bind-9.18-dig-idn-input-always.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -924,6 +927,9 @@ fi; %endif %changelog +* Wed Sep 03 2025 Petr Menšík - 32:9.18.39-3 +- Decode IDN names on input in all situations in utilities (rhbz#2324186) + * Mon Sep 01 2025 Petr Menšík - 32:9.18.39-2 - Offer up to 13 additional servers records if there are more servers From 4d97d1689acf5a94f81751b21909c8735e4540ee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 5 Sep 2025 15:21:19 +0200 Subject: [PATCH 090/144] logrotate: skip if empty and remove old variants Many variants are never built anymore. Clean actions to just those still shipped. But do not trigger named reload when named.run file is empty. That is common on freeipa installation, where configuration changes logging to put it elsewhere. named reload is disruptive because how bind-dyndb-ldap behaves during reloads. Avoid unnecessary reloads with visible service disruption. --- named.logrotate | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/named.logrotate b/named.logrotate index 5df448f..5934e52 100644 --- a/named.logrotate +++ b/named.logrotate @@ -2,11 +2,9 @@ missingok su named named create 0644 named named + notifempty postrotate /usr/bin/systemctl reload named.service > /dev/null 2>&1 || true /usr/bin/systemctl reload named-chroot.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-sdb.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-sdb-chroot.service > /dev/null 2>&1 || true - /usr/bin/systemctl reload named-pkcs11.service > /dev/null 2>&1 || true endscript } From 8b224f4fa80997db130645b151ca4330eecb3e66 Mon Sep 17 00:00:00 2001 From: Adam Williamson Date: Wed, 10 Sep 2025 17:39:08 -0700 Subject: [PATCH 091/144] No-change rebuild to fix F43 update --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 07578c3..56753e1 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 3%{?dist} +Release: 4%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -927,6 +927,9 @@ fi; %endif %changelog +* Wed Sep 10 2025 Adam Williamson - 32:9.18.39-4 +- No-change rebuild to fix F43 update + * Wed Sep 03 2025 Petr Menšík - 32:9.18.39-3 - Decode IDN names on input in all situations in utilities (rhbz#2324186) From 6800e4413458b892130fef685adfe19479eca0bf Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 12 Sep 2025 11:02:37 +0200 Subject: [PATCH 092/144] Remove permanently removed parts from README [skip changelog] --- README.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/README.md b/README.md index 773d2cb..cf33403 100644 --- a/README.md +++ b/README.md @@ -28,7 +28,6 @@ The package contains several subpackages, some of them can be disabled on rebuil * **bind** -- *named* daemon providing DNS server * **bind-utils** -- set of tools to analyse DNS responses or update entries (dig, host) * **bind-doc** -- documentation for current bind, *BIND 9 Administrator Reference Manual*. -* **bind-license** -- Shared license for all packages but bind-export-libs. * **bind-libs** -- Shared libraries used by some others programs * **bind-devel** -- Development headers for libs. Can be disabled by `--without DEVEL` @@ -37,4 +36,3 @@ The package contains several subpackages, some of them can be disabled on rebuil * *GSSTSIG* -- Support for Kerberos authentication in BIND. * *LMDB* -- Support for dynamic database for managing runtime added zones. Provides faster removal of added zone with much less overhead. But requires lmdb linked to base libs. -* *DLZ* -- Support for dynamic loaded modules providing support for features *bind-sdb* provides, but only small module is required. From 4a8dd5ccc3d2c27de11473afd9062e064e867f55 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 16 Sep 2025 12:03:49 +0200 Subject: [PATCH 093/144] Fix expectations on idna system test IDNA tests always redirect output into the file. That means its behaviour has changed and is now processing IDN input by default and just disables IDN output by default. New behaviour when redirected is the same as +idnin +noidnout, but does not fail hard on input errors. Related: RHEL-112765 Resolves: rhbz#2324186 --- bind-9.18-dig-idn-input-always-test.patch | 76 +++++++++++++++++++++++ bind.spec | 7 ++- 2 files changed, 82 insertions(+), 1 deletion(-) create mode 100644 bind-9.18-dig-idn-input-always-test.patch diff --git a/bind-9.18-dig-idn-input-always-test.patch b/bind-9.18-dig-idn-input-always-test.patch new file mode 100644 index 0000000..c2a287b --- /dev/null +++ b/bind-9.18-dig-idn-input-always-test.patch @@ -0,0 +1,76 @@ +From 12f50726b6bd8f6b3ed6709695e0f6893bc865c6 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Tue, 16 Sep 2025 11:46:03 +0200 +Subject: [PATCH] Fix expectations on idna system test + +IDNA tests always redirect output into the file. That means its +behaviour has changed and is now processing IDN input by default and +just disables IDN output by default. + +New behaviour when redirected is the same as +idnin +noidnout, but does +not fail hard on input errors. +--- + bin/tests/system/idna/tests.sh | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/bin/tests/system/idna/tests.sh b/bin/tests/system/idna/tests.sh +index 398b7e1..37f02b1 100644 +--- a/bin/tests/system/idna/tests.sh ++++ b/bin/tests/system/idna/tests.sh +@@ -194,7 +194,7 @@ idna_enabled_test() { + # Note that ASCII characters are converted to lower-case. + + text="Checking valid non-ASCII label" +- idna_test "$text" "" "München" "M\195\188nchen." ++ idna_test "$text" "" "München" "xn--mnchen-3ya." + idna_test "$text" "+noidnin +noidnout" "München" "M\195\188nchen." + idna_test "$text" "+noidnin +idnout" "München" "M\195\188nchen." + idna_test "$text" "+idnin +noidnout" "München" "xn--mnchen-3ya." +@@ -218,7 +218,7 @@ idna_enabled_test() { + # for the valid U-label. + + text="Checking that non-transitional IDNA processing is used" +- idna_test "$text" "" "faß.de" "fa\195\159.de." ++ idna_test "$text" "" "faß.de" "xn--fa-hia.de." + idna_test "$text" "+noidnin +noidnout" "faß.de" "fa\195\159.de." + idna_test "$text" "+noidnin +idnout" "faß.de" "fa\195\159.de." + idna_test "$text" "+idnin +noidnout" "faß.de" "xn--fa-hia.de." +@@ -228,7 +228,7 @@ idna_enabled_test() { + # onto the Greek sigma character ("σ") in IDNA2003. + + text="Second check that non-transitional IDNA processing is used" +- idna_test "$text" "" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com." ++ idna_test "$text" "" "βόλος.com" "xn--nxasmm1c.com." + idna_test "$text" "+noidnin +noidnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com." + idna_test "$text" "+noidnin +idnout" "βόλος.com" "\206\178\207\140\206\187\206\191\207\130.com." + idna_test "$text" "+idnin +noidnout" "βόλος.com" "xn--nxasmm1c.com." +@@ -288,7 +288,7 @@ idna_enabled_test() { + idna_test "$text" "" "xn--xx" "xn--xx." + idna_test "$text" "+noidnin +noidnout" "xn--xx" "xn--xx." + idna_fail "$text" "+noidnin +idnout" "xn--xx" +- idna_fail "$text" "+idnin +noidnout" "xn--xx" ++ idna_test "$text" "+idnin +noidnout" "xn--xx" "xn--xx." + idna_fail "$text" "+idnin +idnout" "xn--xx" + + # Fake A-label - the string does not translate to anything. +@@ -297,7 +297,7 @@ idna_enabled_test() { + idna_test "$text" "" "xn--ahahah" "xn--ahahah." + idna_test "$text" "+noidnin +noidnout" "xn--ahahah" "xn--ahahah." + idna_fail "$text" "+noidnin +idnout" "xn--ahahah" +- idna_fail "$text" "+idnin +noidnout" "xn--ahahah" ++ idna_test "$text" "+idnin +noidnout" "xn--ahahah" "xn--ahahah." + idna_fail "$text" "+idnin +idnout" "xn--ahahah" + + # Too long a label. The punycode string is too long (at 64 characters). +@@ -324,7 +324,7 @@ idna_enabled_test() { + # The +[no]idnout options should not have any effect on the test. + + text="Checking invalid input U-label" +- idna_test "$text" "" "√.com" "\226\136\154.com." ++ idna_test "$text" "" "√.com" "xn--19g.com." + idna_test "$text" "+noidnin +noidnout" "√.com" "\226\136\154.com." + idna_test "$text" "+noidnin +idnout" "√.com" "\226\136\154.com." + idna_test "$text" "+idnin +noidnout" "√.com" "xn--19g.com." +-- +2.51.0 + diff --git a/bind.spec b/bind.spec index 56753e1..3741c7a 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 4%{?dist} +Release: 5%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -140,6 +140,8 @@ Patch32: bind-9.18-partial-additional-records.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/9723 # downstream only Patch33: bind-9.18-dig-idn-input-always.patch +# downstream only too +Patch34: bind-9.18-dig-idn-input-always-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -927,6 +929,9 @@ fi; %endif %changelog +* Tue Sep 16 2025 Petr Menšík - 32:9.18.39-5 +- Fix failures in idna system test (rhbz#2324186) + * Wed Sep 10 2025 Adam Williamson - 32:9.18.39-4 - No-change rebuild to fix F43 update From 54750e536007a5b744f7c516b032276f77b12a81 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 3 Oct 2025 15:43:05 +0200 Subject: [PATCH 094/144] Move named.local* and named.empty into /usr/share/named Imagemode might have separate /var partition not properly initialized by package installation. Add creation of compat files into tmpfiles.d definition. Move primary place of those files from /var/named to /usr/shared/named, so we even have some place to symlink them from. Originally it had only copy in sample documentation, which may not be installed. These source file should be read-only from named and not modified anyway. Move them to /usr/share/named as read-only, always present sources. Change compat symlinks in /var/named to point to them instead of /etc. Make the doc files only symlinks to those files too, have them there just once. Keep named.ca config file in /etc/named.ca The rest can stay in _datadir, but named.ca can be potentially updated and as such should remain in /etc and its modification kept. Move primary copy into /etc and keep just legacy symlink inside /var/named. Configuration should stay working if the file were modified. Related: RHEL-97443 --- bind.spec | 42 ++++++++++++++++++++++++++++++------------ bind.tmpfiles.d | 9 +++++++++ named-chroot.files | 2 ++ 3 files changed, 41 insertions(+), 12 deletions(-) diff --git a/bind.spec b/bind.spec index 3741c7a..2a2d029 100644 --- a/bind.spec +++ b/bind.spec @@ -41,7 +41,7 @@ %global chroot_prefix %{bind_dir}/chroot %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\ - %{_libdir}/bind %{_libdir}/named %{_datadir}/GeoIP /proc/sys/net/ipv4 + %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,named} /proc/sys/net/ipv4 ## The order of libs is important. See lib/Makefile.in for details %define bind_export_libs isc dns isccfg irs @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 5%{?dist} +Release: 6%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -636,23 +636,33 @@ touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/named +install -p -m 644 %{SOURCE17} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.ca +ln -sr ${RPM_BUILD_ROOT}%{_sysconfdir}/named.ca \ + ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca +mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/named +install -p -m 644 %{SOURCE18} ${RPM_BUILD_ROOT}%{_datadir}/named/named.localhost +install -p -m 644 %{SOURCE19} ${RPM_BUILD_ROOT}%{_datadir}/named/named.loopback +install -p -m 644 %{SOURCE20} ${RPM_BUILD_ROOT}%{_datadir}/named/named.empty # data files: mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/named -install -m 640 %{SOURCE17} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.ca -install -m 640 %{SOURCE18} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.localhost -install -m 640 %{SOURCE19} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.loopback -install -m 640 %{SOURCE20} ${RPM_BUILD_ROOT}%{_localstatedir}/named/named.empty -install -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones +for FILE in named.{localhost,loopback,empty} +do + ln -sr "${RPM_BUILD_ROOT}%{_datadir}/named/$FILE" \ + "${RPM_BUILD_ROOT}%{_localstatedir}/named/$FILE" +done +install -p -m 640 %{SOURCE23} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.rfc1912.zones # sample bind configuration files for %%doc: mkdir -p sample/etc sample/var/named/{data,slaves} install -m 644 %{SOURCE25} sample/etc/named.conf -# Copy default configuration to %%doc to make it usable from system-config-bind +# Copy default configuration to %%doc install -m 644 %{SOURCE16} named.conf.default install -m 644 %{SOURCE23} sample/etc/named.rfc1912.zones -install -m 644 %{SOURCE18} %{SOURCE19} %{SOURCE20} sample/var/named -install -m 644 %{SOURCE17} sample/var/named/named.ca +ln -s %{_sysconfdir}/named.ca sample/var/named/named.ca +for FILE in named.{localhost,loopback,empty}; do + ln -s %{_datadir}/named/$FILE sample/var/named/$FILE +done for f in my.internal.zone.db slaves/my.slave.internal.zone.db slaves/my.ddns.internal.zone.db my.external.zone.db; do echo '@ in soa localhost. root 1 3H 15M 1W 1D ns localhost.' > sample/var/named/$f; @@ -660,10 +670,10 @@ done :; mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} -install -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf +install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d -install -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named +install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named %post %?ldconfig @@ -755,6 +765,7 @@ fi; %dir %{_libdir}/named %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key +%config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf %{_sysconfdir}/rwtab.d/named @@ -798,7 +809,9 @@ fi; %dir %{_localstatedir}/named/dynamic %ghost %{_localstatedir}/log/named.log %defattr(0640,root,named,0750) +%{_datadir}/named/ %config %verify(not link) %{_localstatedir}/named/named.ca +# Moved to %%_datadir/named, keep compat symlinks %config %verify(not link) %{_localstatedir}/named/named.localhost %config %verify(not link) %{_localstatedir}/named/named.loopback %config %verify(not link) %{_localstatedir}/named/named.empty @@ -907,6 +920,7 @@ fi; %dir %{chroot_prefix}/%{_libdir} %dir %{chroot_prefix}/%{_libdir}/bind %dir %{chroot_prefix}/%{_datadir}/GeoIP +%dir %{chroot_prefix}/%{_datadir}/named %{chroot_prefix}/proc %defattr(0660,root,named,01770) %dir %{chroot_prefix}%{_localstatedir}/named @@ -929,6 +943,10 @@ fi; %endif %changelog +* Fri Oct 03 2025 Petr Menšík - 32:9.18.39-6 +- Move named.* files from /var/named into /usr/share/named +- Move named.ca into /etc/named.ca + * Tue Sep 16 2025 Petr Menšík - 32:9.18.39-5 - Fix failures in idna system test (rhbz#2324186) diff --git a/bind.tmpfiles.d b/bind.tmpfiles.d index 640a656..dc0b555 100644 --- a/bind.tmpfiles.d +++ b/bind.tmpfiles.d @@ -1 +1,10 @@ +# vim: ft=conf: d /run/named 0755 named named - +d /var/named 01770 root named - +d /var/named/slaves 0770 named named - +d /var/named/data 0770 named named - +d /var/named/dynamic 0770 named named - +L /var/named/named.ca 0640 named named - ../../../etc/named.ca +L /var/named/named.localhost 0640 named named - ../../../usr/share/named/named.localhost +L /var/named/named.loopback 0640 named named - ../../../usr/share/named/named.loopback +L /var/named/named.empty 0640 named named - ../../../usr/share/named/named.empty diff --git a/named-chroot.files b/named-chroot.files index 08c21b2..10f04b6 100644 --- a/named-chroot.files +++ b/named-chroot.files @@ -3,6 +3,7 @@ # if they are missing or empty in target directory. /etc/localtime /etc/named.root.key +/etc/named.ca /etc/named.conf /etc/named.rfc1912.zones /etc/rndc.conf @@ -17,6 +18,7 @@ /usr/lib64/bind /usr/lib/bind /usr/share/GeoIP +/usr/share/named /run/named /proc/sys/net/ipv4/ip_local_port_range # Warning: the order is important From 666db3a14e01939dcbb331952069db339921039b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 3 Oct 2025 17:18:55 +0200 Subject: [PATCH 095/144] Reference to absolute config names from named.rfc1912.zones Make the reference to primary source in absolute path, rather than relative to working directory. Potentially could start using different files than it used before. Dot not cherry-pick this into stable branches. Could be considered breaking change, keep it just in rawhide only. --- bind.spec | 5 ++++- named.conf | 2 +- named.rfc1912.zones | 11 ++++++----- 3 files changed, 11 insertions(+), 7 deletions(-) diff --git a/bind.spec b/bind.spec index 2a2d029..9e8222a 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.39 -Release: 6%{?dist} +Release: 7%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -943,6 +943,9 @@ fi; %endif %changelog +* Fri Oct 10 2025 Petr Menšík - 32:9.18.39-7 +- Reference to absolute config names from named.rfc1912.zones + * Fri Oct 03 2025 Petr Menšík - 32:9.18.39-6 - Move named.* files from /var/named into /usr/share/named - Move named.ca into /etc/named.ca diff --git a/named.conf b/named.conf index c906875..30fb249 100644 --- a/named.conf +++ b/named.conf @@ -51,7 +51,7 @@ logging { zone "." IN { type hint; - file "named.ca"; + file "/etc/named.ca"; }; include "/etc/named.rfc1912.zones"; diff --git a/named.rfc1912.zones b/named.rfc1912.zones index 2c3c2a8..d04510d 100644 --- a/named.rfc1912.zones +++ b/named.rfc1912.zones @@ -1,4 +1,5 @@ // named.rfc1912.zones: +// vim: ft=named: // // Provided by Red Hat caching-nameserver package // @@ -16,30 +17,30 @@ zone "localhost.localdomain" IN { type primary; - file "named.localhost"; + file "/usr/share/named/named.localhost"; allow-update { none; }; }; zone "localhost" IN { type primary; - file "named.localhost"; + file "/usr/share/named/named.localhost"; allow-update { none; }; }; zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.ip6.arpa" IN { type primary; - file "named.loopback"; + file "/usr/share/named/named.loopback"; allow-update { none; }; }; zone "1.0.0.127.in-addr.arpa" IN { type primary; - file "named.loopback"; + file "/usr/share/named/named.loopback"; allow-update { none; }; }; zone "0.in-addr.arpa" IN { type primary; - file "named.empty"; + file "/usr/share/named/named.empty"; allow-update { none; }; }; From 6853a348fc37c57a0e7960f64ee052e2f8a34fe8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 24 Oct 2025 15:15:56 +0200 Subject: [PATCH 096/144] Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) Security fixes: - DNSSEC validation fails if matching but invalid DNSKEY is found. (CVE-2025-8677) - Address various spoofing attacks. (CVE-2025-40778) - Cache-poisoning due to weak pseudo-random number generator. (CVE-2025-40780) New Features: - Support for parsing HHIT and BRID records has been added. Removed Features: - Deprecate the "tkey-domain" statement. - Deprecate the "tkey-gssapi-credential" statement. Bug Fixes: - Prevent spurious SERVFAILs for certain 0-TTL resource records. - Missing DNSSEC information when CD bit is set in query. https://downloads.isc.org/isc/bind9/9.18.41/doc/arm/html/notes.html#notes-for-bind-9-18-41 --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index 9e8222a..62b1925 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.39 -Release: 7%{?dist} +Version: 9.18.41 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -943,6 +943,9 @@ fi; %endif %changelog +* Fri Oct 24 2025 Petr Menšík - 32:9.18.41-1 +- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) + * Fri Oct 10 2025 Petr Menšík - 32:9.18.39-7 - Reference to absolute config names from named.rfc1912.zones diff --git a/sources b/sources index aa55f1d..df9609f 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.39.tar.xz) = fd6d45c9cb9c599d8770c18801fad2f177faf3a8af82948800d186ae6dc9eb2c894b61802def0841eb722c615c93c077b55368204f0cf2737a3c50d949efca07 -SHA512 (bind-9.18.39.tar.xz.asc) = 17e8aad74f1eaa42119f84ab3df05e85a1775f97c628259e00f7224d4f0d250050d022db670bc036b0ba05a3cd586de331da0b77c42ab58307711fed36c7ee9e +SHA512 (bind-9.18.41.tar.xz) = aba4a0add07f1feb2825852faeed14bc946628b818adac93401890cd67ead17c2fd8d820bca70ba7f8c2788dc65195baccc93f87249fb7e47077354341ff0839 +SHA512 (bind-9.18.41.tar.xz.asc) = 5b5a2f969e6da6a64908dba7f94f9877ce2d729e59c3b9c23fa3459cc74059b10479df63b3223c738b4fbfecde5e51dd9906fb34e6763c0b5909dda195afb71b From d7ce29383b5197319a9d7154ae315dc1fd271034 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 31 Oct 2025 17:47:07 +0100 Subject: [PATCH 097/144] Fix regression in upstream CVE-2025-8677 fix https://gitlab.isc.org/isc-projects/bind9/-/issues/5570 Related: rhbz#2405830 --- bind-9.20-CVE-2025-8677-dual-signing.patch | 36 ++++++++++++++++++++++ bind.spec | 7 ++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 bind-9.20-CVE-2025-8677-dual-signing.patch diff --git a/bind-9.20-CVE-2025-8677-dual-signing.patch b/bind-9.20-CVE-2025-8677-dual-signing.patch new file mode 100644 index 0000000..40ad87e --- /dev/null +++ b/bind-9.20-CVE-2025-8677-dual-signing.patch @@ -0,0 +1,36 @@ +From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Mon, 3 Nov 2025 22:03:54 +0100 +Subject: [PATCH] Do not abort key search on unsupported algorithm + +When supported and unsupported algorithm rrsig is present, some keys may +return unsupported algorithm error. Continue to next key without +counting this to validation failures. + +(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81) +--- + lib/dns/validator.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/lib/dns/validator.c b/lib/dns/validator.c +index 15e177e4d7..a9db844c27 100644 +--- a/lib/dns/validator.c ++++ b/lib/dns/validator.c +@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) { + goto done; + } + dst_key_free(&val->key); +- } else { ++ } else if (result != DST_R_UNSUPPORTEDALG) { ++ /* Unsupported alg happens when RRset is signed by both ++ * supported and unsupported alg. */ ++ validator_log(val, ISC_LOG_DEBUG(3), ++ "select_signing_key alg %d keyid %d: %s", ++ siginfo->algorithm, siginfo->keyid, ++ isc_result_totext(result)); + break; + } + dns_rdata_reset(&rdata); +-- +2.51.1 + diff --git a/bind.spec b/bind.spec index 62b1925..793cad2 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.41 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -142,6 +142,8 @@ Patch32: bind-9.18-partial-additional-records.patch Patch33: bind-9.18-dig-idn-input-always.patch # downstream only too Patch34: bind-9.18-dig-idn-input-always-test.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194 +Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -943,6 +945,9 @@ fi; %endif %changelog +* Fri Oct 31 2025 Petr Menšík - 32:9.18.41-2 +- Fix upstream reported regression in recent CVE fix (CVE-2025-8677) + * Fri Oct 24 2025 Petr Menšík - 32:9.18.41-1 - Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) From 9f78615eb41d60ffa2bda4b7fecf979e5f45a43c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 4 Nov 2025 14:24:41 +0100 Subject: [PATCH 098/144] Add test case into dnssec system test for new regression https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195 Related: rhbz#2405830 --- ...9.20-CVE-2025-8677-dual-signing-test.patch | 172 ++++++++++++++++++ bind.spec | 3 + 2 files changed, 175 insertions(+) create mode 100644 bind-9.20-CVE-2025-8677-dual-signing-test.patch diff --git a/bind-9.20-CVE-2025-8677-dual-signing-test.patch b/bind-9.20-CVE-2025-8677-dual-signing-test.patch new file mode 100644 index 0000000..19740a2 --- /dev/null +++ b/bind-9.20-CVE-2025-8677-dual-signing-test.patch @@ -0,0 +1,172 @@ +From 1cbe670c421ca866fe8cbde661801e89e254a46d Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Sat, 1 Nov 2025 12:00:59 +0100 +Subject: [PATCH] Add a system test with one good and one bad algorithm + +The case where there would be one supported algorithm and one already +unsupported (like RSAMD5 or RSASHA1) was missing. + +(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd) +--- + bin/tests/system/dnssec/ns2/example.db.in | 4 +++ + bin/tests/system/dnssec/ns2/sign.sh | 3 ++- + bin/tests/system/dnssec/ns3/named.conf.in | 6 +++++ + bin/tests/system/dnssec/ns3/sign.sh | 31 ++++++++++++++++++++++ + bin/tests/system/dnssec/ns3/template.db.in | 27 +++++++++++++++++++ + bin/tests/system/dnssec/tests.sh | 11 ++++++++ + bin/tests/system/dnssec/tests_sh_dnssec.py | 1 + + 7 files changed, 82 insertions(+), 1 deletion(-) + create mode 100644 bin/tests/system/dnssec/ns3/template.db.in + +diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in +index f711f5823f..63d41e5e00 100644 +--- a/bin/tests/system/dnssec/ns2/example.db.in ++++ b/bin/tests/system/dnssec/ns2/example.db.in +@@ -168,4 +168,8 @@ ns.managed-future A 10.53.0.3 + revkey NS ns.revkey + ns.revkey A 10.53.0.3 + ++; A secure subdomain with extra bad key ++extrabadkey NS ns3.extrabadkey ++ns3.extrabadkey A 10.53.0.3 ++ + dname-at-apex-nsec3 NS ns3 +diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh +index b60e82a631..eb008067a4 100644 +--- a/bin/tests/system/dnssec/ns2/sign.sh ++++ b/bin/tests/system/dnssec/ns2/sign.sh +@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \ + ttlpatch split-dnssec split-smart expired expiring upper lower \ + dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \ + dnskey-nsec3-unknown managed-future revkey \ +- dname-at-apex-nsec3 occluded; do ++ dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ ++ extrabadkey; do + cp "../ns3/dsset-$subdomain.example." . + done + +diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in +index 680cff58d5..3536046319 100644 +--- a/bin/tests/system/dnssec/ns3/named.conf.in ++++ b/bin/tests/system/dnssec/ns3/named.conf.in +@@ -84,6 +84,12 @@ zone "insecure2.example" { + allow-update { any; }; + }; + ++zone "extrabadkey.example" { ++ type primary; ++ file "extrabadkey.example.db.signed"; ++ allow-update { any; }; ++}; ++ + zone "insecure.nsec3.example" { + type primary; + file "insecure.nsec3.example.db"; +diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh +index 14fc709bfb..743a0e4121 100644 +--- a/bin/tests/system/dnssec/ns3/sign.sh ++++ b/bin/tests/system/dnssec/ns3/sign.sh +@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}." + cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \ + "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile" + "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null ++ ++# ++# ++# ++zone=extrabadkey.example. ++infile=template.db.in ++zonefile=extrabadkey.example.db ++ ++# Add KSK and ZSK that we will mangle to RSAMD5 ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" ++"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Mangle the signatures to RSAMD5 and save them for future use ++sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5" ++ ++# Now add normal KSK and ZSK to the zone file ++ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") ++zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") ++cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" ++ ++# Mangle the DNSKEY algorithm numbers and add them to the signed zone file ++cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile" ++ ++# Sign normally ++"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 ++ ++# Add the mangled signatures to signed zone file ++cat "$zonefile.signed.rsamd5" >> "$zonefile.signed" ++rm "$zonefile.signed.rsamd5" +diff --git a/bin/tests/system/dnssec/ns3/template.db.in b/bin/tests/system/dnssec/ns3/template.db.in +new file mode 100644 +index 0000000000..f603e448ff +--- /dev/null ++++ b/bin/tests/system/dnssec/ns3/template.db.in +@@ -0,0 +1,27 @@ ++; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++; ++; SPDX-License-Identifier: MPL-2.0 ++; ++; This Source Code Form is subject to the terms of the Mozilla Public ++; License, v. 2.0. If a copy of the MPL was not distributed with this ++; file, you can obtain one at https://mozilla.org/MPL/2.0/. ++; ++; See the COPYRIGHT file distributed with this work for additional ++; information regarding copyright ownership. ++ ++$TTL 300 ; 5 minutes ++@ IN SOA mname1. . ( ++ 2000042407 ; serial ++ 20 ; refresh (20 seconds) ++ 20 ; retry (20 seconds) ++ 1814400 ; expire (3 weeks) ++ 3600 ; minimum (1 hour) ++ ) ++ NS ns3 ++ns3 A 10.53.0.3 ++ ++a A 10.0.0.1 ++a.b A 10.0.0.1 ++b A 10.0.0.2 ++d A 10.0.0.4 ++z A 10.0.0.26 +diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh +index b58b11a5c7..d3690eee6b 100644 +--- a/bin/tests/system/dnssec/tests.sh ++++ b/bin/tests/system/dnssec/tests.sh +@@ -4497,5 +4497,16 @@ n=$((n + 1)) + if [ "$ret" -ne 0 ]; then echo_i "failed"; fi + status=$((status + ret)) + ++echo_i "checking extra-bad-algorithm positive validation ($n)" ++ret=0 ++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1 ++dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1 ++digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 ++grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1 ++grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1 ++n=$((n + 1)) ++test "$ret" -eq 0 || echo_i "failed" ++status=$((status + ret)) ++ + echo_i "exit status: $status" + [ $status -eq 0 ] || exit 1 +diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py +index 529a4a0e10..f731ea2ab4 100644 +--- a/bin/tests/system/dnssec/tests_sh_dnssec.py ++++ b/bin/tests/system/dnssec/tests_sh_dnssec.py +@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts( + "ns3/example.bk", + "ns3/expired.example.db", + "ns3/expiring.example.db", ++ "ns3/extrabadkey.example.db", + "ns3/future.example.db", + "ns3/keyless.example.db", + "ns3/kskonly.example.db", +-- +2.51.1 + diff --git a/bind.spec b/bind.spec index 793cad2..9079b37 100644 --- a/bind.spec +++ b/bind.spec @@ -144,6 +144,8 @@ Patch33: bind-9.18-dig-idn-input-always.patch Patch34: bind-9.18-dig-idn-input-always-test.patch # https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194 Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195 +Patch36: bind-9.20-CVE-2025-8677-dual-signing-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -947,6 +949,7 @@ fi; %changelog * Fri Oct 31 2025 Petr Menšík - 32:9.18.41-2 - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) +- Add upstream dnssec system test testcase for this problem * Fri Oct 24 2025 Petr Menšík - 32:9.18.41-1 - Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) From aef7570bb8ae32ef253dd27a3ee7818bdf8cd853 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 17 Dec 2025 19:05:30 +0100 Subject: [PATCH 099/144] Update to 9.18.43 (rhbz#2415842) Bug fixes: - Adding NSEC3 opt-out records could leave invalid records in chain. - AMTRELAY type 0 presentation format handling was wrong. Release 9.18.42 bug fixes: - Skip unsupported algorithms when looking for a signing key. https://downloads.isc.org/isc/bind9/9.18.43/doc/arm/html/notes.html#notes-for-bind-9-18-43 --- bind-9.18-pkcs11-provider.patch | 139 +++++---- ...9.20-CVE-2025-8677-dual-signing-test.patch | 172 ----------- bind-9.20-CVE-2025-8677-dual-signing.patch | 36 --- bind-9.20-nsupdate-tls.patch | 272 ++---------------- bind.spec | 11 +- sources | 4 +- 6 files changed, 100 insertions(+), 534 deletions(-) delete mode 100644 bind-9.20-CVE-2025-8677-dual-signing-test.patch delete mode 100644 bind-9.20-CVE-2025-8677-dual-signing.patch diff --git a/bind-9.18-pkcs11-provider.patch b/bind-9.18-pkcs11-provider.patch index 4a48182..57463b0 100644 --- a/bind-9.18-pkcs11-provider.patch +++ b/bind-9.18-pkcs11-provider.patch @@ -1,4 +1,4 @@ -From ec38a39feabea02eb75f257e8b81cf16aac9d184 Mon Sep 17 00:00:00 2001 +From 5bd1369eb7781ad2b349b99f783a7ed07fb7d6ac Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 13 Feb 2025 13:20:28 +0100 Subject: [PATCH] Backport OpenSSL 3 provider support @@ -37,13 +37,13 @@ Move RSA bits check to legacy, let it use rsa_check for newer rsabigexponent tests got broken by this change. --- lib/dns/dst_openssl.h | 4 + - lib/dns/dst_parse.c | 21 ++-- - lib/dns/openssl_link.c | 161 ++++++++++++++++++++++++++---- + lib/dns/dst_parse.c | 21 ++--- + lib/dns/openssl_link.c | 161 +++++++++++++++++++++++++++----- lib/dns/openssldh_link.c | 5 + - lib/dns/opensslecdsa_link.c | 110 ++++++++++----------- + lib/dns/opensslecdsa_link.c | 109 +++++++++++----------- lib/dns/openssleddsa_link.c | 40 +++----- - lib/dns/opensslrsa_link.c | 189 +++++++++++++++--------------------- - 7 files changed, 303 insertions(+), 227 deletions(-) + lib/dns/opensslrsa_link.c | 181 ++++++++++++++---------------------- + 7 files changed, 296 insertions(+), 225 deletions(-) diff --git a/lib/dns/dst_openssl.h b/lib/dns/dst_openssl.h index 819af0f..cd386c0 100644 @@ -59,7 +59,7 @@ index 819af0f..cd386c0 100644 + ISC_LANG_ENDDECLS diff --git a/lib/dns/dst_parse.c b/lib/dns/dst_parse.c -index d5ea0e4..addb65e 100644 +index a353b86..7f3fe51 100644 --- a/lib/dns/dst_parse.c +++ b/lib/dns/dst_parse.c @@ -195,10 +195,9 @@ check_rsa(const dst_private_t *priv, bool external) { @@ -106,7 +106,7 @@ index d5ea0e4..addb65e 100644 } diff --git a/lib/dns/openssl_link.c b/lib/dns/openssl_link.c -index e3a89f4..62077b6 100644 +index e3a89f4..2495be4 100644 --- a/lib/dns/openssl_link.c +++ b/lib/dns/openssl_link.c @@ -44,6 +44,9 @@ @@ -125,8 +125,8 @@ index e3a89f4..62077b6 100644 +#define DST_RET(a) \ + { \ -+ ret = a; \ -+ goto err; \ ++ result = a; \ ++ goto cleanup; \ + } + static void @@ -200,7 +200,7 @@ index e3a89f4..62077b6 100644 + const char *label, + EVP_PKEY **ppub, EVP_PKEY **ppriv) { +#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 -+ isc_result_t ret = ISC_R_SUCCESS; ++ isc_result_t result = ISC_R_SUCCESS; + ENGINE *e = NULL; + EVP_PKEY *pkey = NULL, *pubpkey = NULL; + @@ -229,8 +229,8 @@ index e3a89f4..62077b6 100644 + } + *ppub = pubpkey; + *ppriv = pkey; -+err: -+ return ret; ++cleanup: ++ return result; +#else + UNUSED(key_base_id); + UNUSED(engine); @@ -247,7 +247,7 @@ index e3a89f4..62077b6 100644 + EVP_PKEY **ppub, EVP_PKEY **ppriv) { + UNUSED(pin); +#if OPENSSL_VERSION_NUMBER >= 0x30000000L -+ isc_result_t ret = DST_R_OPENSSLFAILURE; ++ isc_result_t result = DST_R_OPENSSLFAILURE; + OSSL_STORE_CTX *ctx = NULL; + + @@ -285,11 +285,11 @@ index e3a89f4..62077b6 100644 + OSSL_STORE_INFO_free(info); + } + if (*ppriv != NULL && *ppub != NULL) { -+ ret = ISC_R_SUCCESS; ++ result = ISC_R_SUCCESS; + } -+err: ++cleanup: + OSSL_STORE_close(ctx); -+ return (ret); ++ return result; +#else + UNUSED(key_base_id); + UNUSED(label); @@ -329,7 +329,7 @@ index a4ba0f7..38345e6 100644 DH *dh = key->keydata.dh; const BIGNUM *priv_key = NULL; diff --git a/lib/dns/opensslecdsa_link.c b/lib/dns/opensslecdsa_link.c -index ca12bb5..5d07014 100644 +index af45fdc..8b49b5d 100644 --- a/lib/dns/opensslecdsa_link.c +++ b/lib/dns/opensslecdsa_link.c @@ -617,6 +617,12 @@ opensslecdsa_isprivate(const dst_key_t *key) { @@ -345,7 +345,7 @@ index ca12bb5..5d07014 100644 #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 eckey = EVP_PKEY_get1_EC_KEY(pkey); -@@ -916,7 +922,7 @@ err: +@@ -916,7 +922,7 @@ cleanup: #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 static isc_result_t @@ -361,7 +361,7 @@ index ca12bb5..5d07014 100644 + +static isc_result_t +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) { -+ isc_result_t ret = ISC_R_FAILURE; ++ isc_result_t result = ISC_R_FAILURE; + EC_KEY *eckey; + EC_KEY *pubeckey; + @@ -381,21 +381,21 @@ index ca12bb5..5d07014 100644 + DST_RET(DST_R_INVALIDPUBLICKEY); + } + -+ ret = ecdsa_check_legacy(eckey, pubeckey); -+err: ++ CHECK(ecdsa_check_legacy(eckey, pubeckey)); ++cleanup: + if (pubeckey != NULL) { + EC_KEY_free(pubeckey); + } + if (eckey != NULL) { + EC_KEY_free(eckey); + } -+ return ret; ++ return result; +} #else static isc_result_t -ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) { +ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey, int group_nid) { - isc_result_t ret = ISC_R_FAILURE; + isc_result_t result = ISC_R_FAILURE; int status; size_t pkey_len = 0; @@ -954,6 +993,8 @@ ecdsa_check(EVP_PKEY **pkey, EVP_PKEY *pubpkey) { @@ -407,7 +407,7 @@ index ca12bb5..5d07014 100644 /* Check if `pkey` has a public key. */ status = EVP_PKEY_get_octet_string_param(*pkey, OSSL_PKEY_PARAM_PUB_KEY, NULL, 0, &pkey_len); -@@ -1279,7 +1320,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1267,7 +1308,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { pubeckey = EVP_PKEY_get1_EC_KEY(pub->keydata.pkey); } @@ -416,7 +416,7 @@ index ca12bb5..5d07014 100644 DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); } -@@ -1288,7 +1329,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1276,7 +1317,7 @@ opensslecdsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { } #else if (ecdsa_check(&key->keydata.pkey, @@ -425,19 +425,19 @@ index ca12bb5..5d07014 100644 ISC_R_SUCCESS) { DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -@@ -1321,11 +1362,7 @@ err: +@@ -1309,11 +1350,7 @@ cleanup: static isc_result_t opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, const char *pin) { -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - isc_result_t ret = ISC_R_SUCCESS; + isc_result_t result = ISC_R_SUCCESS; - ENGINE *e; - EC_KEY *eckey = NULL; - EC_KEY *pubeckey = NULL; int group_nid; EVP_PKEY *pkey = NULL; EVP_PKEY *pubpkey = NULL; -@@ -1335,13 +1372,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, +@@ -1323,13 +1360,9 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, UNUSED(pin); @@ -452,7 +452,7 @@ index ca12bb5..5d07014 100644 if (key->key_alg == DST_ALG_ECDSA256) { group_nid = NID_X9_62_prime256v1; -@@ -1349,48 +1382,30 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, +@@ -1337,48 +1370,27 @@ opensslecdsa_fromlabel(dst_key_t *key, const char *engine, const char *label, group_nid = NID_secp384r1; } @@ -461,11 +461,9 @@ index ca12bb5..5d07014 100644 - if (pkey == NULL) { - DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", - DST_R_OPENSSLFAILURE)); -+ ret = dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin, -+ &pubpkey, &pkey); -+ if (ret != ISC_R_SUCCESS) { -+ goto err; - } +- } ++ CHECK(dst__openssl_fromlabel(EVP_PKEY_EC, engine, label, pin, ++ &pubpkey, &pkey)); + /* Check base id, group nid */ if (EVP_PKEY_base_id(pkey) != EVP_PKEY_EC) { @@ -511,7 +509,7 @@ index ca12bb5..5d07014 100644 key->key_size = EVP_PKEY_bits(pkey); key->keydata.pkey = pkey; pkey = NULL; -@@ -1402,21 +1417,8 @@ err: +@@ -1390,21 +1402,8 @@ cleanup: if (pkey != NULL) { EVP_PKEY_free(pkey); } @@ -522,7 +520,7 @@ index ca12bb5..5d07014 100644 - EC_KEY_free(eckey); - } - return ret; + return result; -#else - UNUSED(key); - UNUSED(engine); @@ -534,10 +532,10 @@ index ca12bb5..5d07014 100644 static dst_func_t opensslecdsa_functions = { diff --git a/lib/dns/openssleddsa_link.c b/lib/dns/openssleddsa_link.c -index 74dac17..04457fb 100644 +index 6301db4..08d505b 100644 --- a/lib/dns/openssleddsa_link.c +++ b/lib/dns/openssleddsa_link.c -@@ -361,6 +361,12 @@ openssleddsa_isprivate(const dst_key_t *key) { +@@ -362,6 +362,12 @@ openssleddsa_isprivate(const dst_key_t *key) { return false; } @@ -550,17 +548,17 @@ index 74dac17..04457fb 100644 /* Must have a buffer to actually check if there is a private key. */ if (EVP_PKEY_get_raw_private_key(pkey, buf, &len) == 1) { return true; -@@ -603,9 +609,7 @@ err: +@@ -591,9 +597,7 @@ cleanup: static isc_result_t openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, const char *pin) { -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - isc_result_t ret; + isc_result_t result; - ENGINE *e; EVP_PKEY *pkey = NULL, *pubpkey = NULL; int baseid = EVP_PKEY_NONE; -@@ -628,28 +632,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, +@@ -616,28 +620,17 @@ openssleddsa_fromlabel(dst_key_t *key, const char *engine, const char *label, return ISC_R_NOTIMPLEMENTED; } @@ -596,10 +594,10 @@ index 74dac17..04457fb 100644 key->label = isc_mem_strdup(key->mctx, label); key->key_size = EVP_PKEY_bits(pkey); key->keydata.pkey = pkey; -@@ -664,13 +657,6 @@ err: +@@ -652,13 +645,6 @@ cleanup: EVP_PKEY_free(pkey); } - return ret; + return result; -#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ - UNUSED(key); - UNUSED(engine); @@ -611,7 +609,7 @@ index 74dac17..04457fb 100644 static dst_func_t openssleddsa_functions = { diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c -index 37e8a63..d4fbe97 100644 +index b92e1bf..12210e8 100644 --- a/lib/dns/opensslrsa_link.c +++ b/lib/dns/opensslrsa_link.c @@ -545,6 +545,12 @@ opensslrsa_isprivate(const dst_key_t *key) { @@ -627,7 +625,7 @@ index 37e8a63..d4fbe97 100644 #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 rsa = EVP_PKEY_get1_RSA(pkey); INSIST(rsa != NULL); -@@ -995,7 +1001,7 @@ err: +@@ -995,7 +1001,7 @@ cleanup: #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 static isc_result_t @@ -694,7 +692,7 @@ index 37e8a63..d4fbe97 100644 if (EVP_PKEY_eq(pkey, pubpkey) == 1) { DST_RET(ISC_R_SUCCESS); } -@@ -1119,6 +1169,10 @@ err: +@@ -1119,6 +1169,10 @@ cleanup: } #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ @@ -719,7 +717,7 @@ index 37e8a63..d4fbe97 100644 const char *label = NULL; EVP_PKEY *pkey = NULL; BIGNUM *n = NULL, *e = NULL, *d = NULL; -@@ -1193,46 +1243,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1190,46 +1240,7 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { * See if we can fetch it. */ if (label != NULL) { @@ -767,7 +765,7 @@ index 37e8a63..d4fbe97 100644 } for (i = 0; i < priv.nelements; i++) { -@@ -1321,9 +1332,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1318,9 +1329,14 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { BN_clear_free(iqmp); } } @@ -783,7 +781,7 @@ index 37e8a63..d4fbe97 100644 #else bld = OSSL_PARAM_BLD_new(); if (bld == NULL) { -@@ -1390,17 +1406,12 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { +@@ -1387,17 +1403,9 @@ opensslrsa_parse(dst_key_t *key, isc_lex_t *lexer, dst_key_t *pub) { DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); } @@ -791,10 +789,8 @@ index 37e8a63..d4fbe97 100644 - ISC_R_SUCCESS) - { - DST_RET(dst__openssl_toresult(DST_R_INVALIDPRIVATEKEY)); -+ ret = rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL); -+ if (ret != ISC_R_SUCCESS) { -+ DST_RET(ret); - } +- } ++ CHECK(rsa_check(pkey, pub != NULL ? pub->keydata.pkey : NULL)); #endif /* OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 */ - if (BN_num_bits(e) > RSA_MAX_PUBEXP_BITS) { @@ -804,13 +800,13 @@ index 37e8a63..d4fbe97 100644 key->key_size = BN_num_bits(n); key->keydata.pkey = pkey; pkey = NULL; -@@ -1464,69 +1475,30 @@ err: +@@ -1461,69 +1469,31 @@ cleanup: static isc_result_t opensslrsa_fromlabel(dst_key_t *key, const char *engine, const char *label, const char *pin) { -#if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 - ENGINE *e = NULL; - isc_result_t ret = ISC_R_SUCCESS; + isc_result_t result = ISC_R_SUCCESS; EVP_PKEY *pkey = NULL, *pubpkey = NULL; - RSA *rsa = NULL, *pubrsa = NULL; - const BIGNUM *ex = NULL; @@ -824,7 +820,10 @@ index 37e8a63..d4fbe97 100644 - if (e == NULL) { - DST_RET(dst__openssl_toresult(DST_R_NOENGINE)); - } -- ++ CHECK(dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, ++ &pubpkey, &pkey)); ++ CHECK(rsa_check(pkey, pubpkey)); + - pubpkey = ENGINE_load_public_key(e, label, NULL, NULL); - if (pubpkey == NULL) { - DST_RET(dst__openssl_toresult2("ENGINE_load_public_key", @@ -834,19 +833,13 @@ index 37e8a63..d4fbe97 100644 - if (pubrsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); - } -+ ret = dst__openssl_fromlabel(EVP_PKEY_RSA, engine, label, pin, -+ &pubpkey, &pkey); -+ if (ret != ISC_R_SUCCESS) -+ DST_RET(ret); - +- - pkey = ENGINE_load_private_key(e, label, NULL, NULL); -- if (pkey == NULL) { + if (pkey == NULL) { - DST_RET(dst__openssl_toresult2("ENGINE_load_private_key", -- DST_R_OPENSSLFAILURE)); -- } -+ ret = rsa_check(pkey, pubpkey); -+ if (ret != ISC_R_SUCCESS) -+ DST_RET(ret); ++ DST_RET(dst__openssl_toresult2("dst__openssl_fromlabel", + DST_R_OPENSSLFAILURE)); + } - key->engine = isc_mem_strdup(key->mctx, engine); + if (engine != NULL) @@ -854,7 +847,7 @@ index 37e8a63..d4fbe97 100644 + else + key->engine = NULL; key->label = isc_mem_strdup(key->mctx, label); -- + - rsa = EVP_PKEY_get1_RSA(pkey); - if (rsa == NULL) { - DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); @@ -875,7 +868,7 @@ index 37e8a63..d4fbe97 100644 key->keydata.pkey = pkey; pkey = NULL; - err: + cleanup: - if (rsa != NULL) { - RSA_free(rsa); - } @@ -885,10 +878,10 @@ index 37e8a63..d4fbe97 100644 if (pkey != NULL) { EVP_PKEY_free(pkey); } -@@ -1534,13 +1506,6 @@ err: +@@ -1531,13 +1501,6 @@ cleanup: EVP_PKEY_free(pubpkey); } - return ret; + return result; -#else /* if !defined(OPENSSL_NO_ENGINE) && OPENSSL_API_LEVEL < 30000 */ - UNUSED(key); - UNUSED(engine); @@ -900,5 +893,5 @@ index 37e8a63..d4fbe97 100644 static dst_func_t opensslrsa_functions = { -- -2.50.1 +2.52.0 diff --git a/bind-9.20-CVE-2025-8677-dual-signing-test.patch b/bind-9.20-CVE-2025-8677-dual-signing-test.patch deleted file mode 100644 index 19740a2..0000000 --- a/bind-9.20-CVE-2025-8677-dual-signing-test.patch +++ /dev/null @@ -1,172 +0,0 @@ -From 1cbe670c421ca866fe8cbde661801e89e254a46d Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= -Date: Sat, 1 Nov 2025 12:00:59 +0100 -Subject: [PATCH] Add a system test with one good and one bad algorithm - -The case where there would be one supported algorithm and one already -unsupported (like RSAMD5 or RSASHA1) was missing. - -(cherry picked from commit 3aa6f585e0466700e5d4b64fffccf883bb1c21dd) ---- - bin/tests/system/dnssec/ns2/example.db.in | 4 +++ - bin/tests/system/dnssec/ns2/sign.sh | 3 ++- - bin/tests/system/dnssec/ns3/named.conf.in | 6 +++++ - bin/tests/system/dnssec/ns3/sign.sh | 31 ++++++++++++++++++++++ - bin/tests/system/dnssec/ns3/template.db.in | 27 +++++++++++++++++++ - bin/tests/system/dnssec/tests.sh | 11 ++++++++ - bin/tests/system/dnssec/tests_sh_dnssec.py | 1 + - 7 files changed, 82 insertions(+), 1 deletion(-) - create mode 100644 bin/tests/system/dnssec/ns3/template.db.in - -diff --git a/bin/tests/system/dnssec/ns2/example.db.in b/bin/tests/system/dnssec/ns2/example.db.in -index f711f5823f..63d41e5e00 100644 ---- a/bin/tests/system/dnssec/ns2/example.db.in -+++ b/bin/tests/system/dnssec/ns2/example.db.in -@@ -168,4 +168,8 @@ ns.managed-future A 10.53.0.3 - revkey NS ns.revkey - ns.revkey A 10.53.0.3 - -+; A secure subdomain with extra bad key -+extrabadkey NS ns3.extrabadkey -+ns3.extrabadkey A 10.53.0.3 -+ - dname-at-apex-nsec3 NS ns3 -diff --git a/bin/tests/system/dnssec/ns2/sign.sh b/bin/tests/system/dnssec/ns2/sign.sh -index b60e82a631..eb008067a4 100644 ---- a/bin/tests/system/dnssec/ns2/sign.sh -+++ b/bin/tests/system/dnssec/ns2/sign.sh -@@ -62,7 +62,8 @@ for subdomain in secure badds bogus dynamic keyless nsec3 optout \ - ttlpatch split-dnssec split-smart expired expiring upper lower \ - dnskey-unknown dnskey-unsupported dnskey-unsupported-2 \ - dnskey-nsec3-unknown managed-future revkey \ -- dname-at-apex-nsec3 occluded; do -+ dname-at-apex-nsec3 occluded rsasha1 rsasha1-1024 \ -+ extrabadkey; do - cp "../ns3/dsset-$subdomain.example." . - done - -diff --git a/bin/tests/system/dnssec/ns3/named.conf.in b/bin/tests/system/dnssec/ns3/named.conf.in -index 680cff58d5..3536046319 100644 ---- a/bin/tests/system/dnssec/ns3/named.conf.in -+++ b/bin/tests/system/dnssec/ns3/named.conf.in -@@ -84,6 +84,12 @@ zone "insecure2.example" { - allow-update { any; }; - }; - -+zone "extrabadkey.example" { -+ type primary; -+ file "extrabadkey.example.db.signed"; -+ allow-update { any; }; -+}; -+ - zone "insecure.nsec3.example" { - type primary; - file "insecure.nsec3.example.db"; -diff --git a/bin/tests/system/dnssec/ns3/sign.sh b/bin/tests/system/dnssec/ns3/sign.sh -index 14fc709bfb..743a0e4121 100644 ---- a/bin/tests/system/dnssec/ns3/sign.sh -+++ b/bin/tests/system/dnssec/ns3/sign.sh -@@ -673,3 +673,34 @@ $DSFROMKEY "$dnskeyname.key" >"dsset-delegation.${zone}." - cat "$infile" "${kskname}.key" "${zskname}.key" "${keyname}.key" \ - "${dnskeyname}.key" "dsset-delegation.${zone}." >"$zonefile" - "$SIGNER" -P -o "$zone" "$zonefile" >/dev/null -+ -+# -+# -+# -+zone=extrabadkey.example. -+infile=template.db.in -+zonefile=extrabadkey.example.db -+ -+# Add KSK and ZSK that we will mangle to RSAMD5 -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" -+"$SIGNER" -g -O full -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Mangle the signatures to RSAMD5 and save them for future use -+sed -ne "s/\(IN[[:space:]]*RRSIG[[:space:]]*[A-Z]*\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /p" < "$zonefile.signed" > "$zonefile.signed.rsamd5" -+ -+# Now add normal KSK and ZSK to the zone file -+ksk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" -f KSK "$zone") -+zsk=$("$KEYGEN" -q -a "$DEFAULT_ALGORITHM" -b "$DEFAULT_BITS" "$zone") -+cat "$infile" "$ksk.key" "$zsk.key" > "$zonefile" -+ -+# Mangle the DNSKEY algorithm numbers and add them to the signed zone file -+cat "$ksk.key" "$zsk.key" | sed -e "s/\(IN[[:space:]]*DNSKEY[[:space:]]*[0-9]* 3\) $DEFAULT_ALGORITHM_NUMBER /\1 1 /" >> "$zonefile" -+ -+# Sign normally -+"$SIGNER" -g -o "$zone" "$zonefile" >/dev/null 2>&1 -+ -+# Add the mangled signatures to signed zone file -+cat "$zonefile.signed.rsamd5" >> "$zonefile.signed" -+rm "$zonefile.signed.rsamd5" -diff --git a/bin/tests/system/dnssec/ns3/template.db.in b/bin/tests/system/dnssec/ns3/template.db.in -new file mode 100644 -index 0000000000..f603e448ff ---- /dev/null -+++ b/bin/tests/system/dnssec/ns3/template.db.in -@@ -0,0 +1,27 @@ -+; Copyright (C) Internet Systems Consortium, Inc. ("ISC") -+; -+; SPDX-License-Identifier: MPL-2.0 -+; -+; This Source Code Form is subject to the terms of the Mozilla Public -+; License, v. 2.0. If a copy of the MPL was not distributed with this -+; file, you can obtain one at https://mozilla.org/MPL/2.0/. -+; -+; See the COPYRIGHT file distributed with this work for additional -+; information regarding copyright ownership. -+ -+$TTL 300 ; 5 minutes -+@ IN SOA mname1. . ( -+ 2000042407 ; serial -+ 20 ; refresh (20 seconds) -+ 20 ; retry (20 seconds) -+ 1814400 ; expire (3 weeks) -+ 3600 ; minimum (1 hour) -+ ) -+ NS ns3 -+ns3 A 10.53.0.3 -+ -+a A 10.0.0.1 -+a.b A 10.0.0.1 -+b A 10.0.0.2 -+d A 10.0.0.4 -+z A 10.0.0.26 -diff --git a/bin/tests/system/dnssec/tests.sh b/bin/tests/system/dnssec/tests.sh -index b58b11a5c7..d3690eee6b 100644 ---- a/bin/tests/system/dnssec/tests.sh -+++ b/bin/tests/system/dnssec/tests.sh -@@ -4497,5 +4497,16 @@ n=$((n + 1)) - if [ "$ret" -ne 0 ]; then echo_i "failed"; fi - status=$((status + ret)) - -+echo_i "checking extra-bad-algorithm positive validation ($n)" -+ret=0 -+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.3 A >dig.out.ns3.test$n || ret=1 -+dig_with_opts +noauth a.extrabadkey.example. @10.53.0.4 A >dig.out.ns4.test$n || ret=1 -+digcomp --lc dig.out.ns3.test$n dig.out.ns4.test$n || ret=1 -+grep "status: NOERROR" dig.out.ns4.test$n >/dev/null || ret=1 -+grep "flags:.*ad.*QUERY" dig.out.ns4.test$n >/dev/null || ret=1 -+n=$((n + 1)) -+test "$ret" -eq 0 || echo_i "failed" -+status=$((status + ret)) -+ - echo_i "exit status: $status" - [ $status -eq 0 ] || exit 1 -diff --git a/bin/tests/system/dnssec/tests_sh_dnssec.py b/bin/tests/system/dnssec/tests_sh_dnssec.py -index 529a4a0e10..f731ea2ab4 100644 ---- a/bin/tests/system/dnssec/tests_sh_dnssec.py -+++ b/bin/tests/system/dnssec/tests_sh_dnssec.py -@@ -92,6 +92,7 @@ pytestmark = pytest.mark.extra_artifacts( - "ns3/example.bk", - "ns3/expired.example.db", - "ns3/expiring.example.db", -+ "ns3/extrabadkey.example.db", - "ns3/future.example.db", - "ns3/keyless.example.db", - "ns3/kskonly.example.db", --- -2.51.1 - diff --git a/bind-9.20-CVE-2025-8677-dual-signing.patch b/bind-9.20-CVE-2025-8677-dual-signing.patch deleted file mode 100644 index 40ad87e..0000000 --- a/bind-9.20-CVE-2025-8677-dual-signing.patch +++ /dev/null @@ -1,36 +0,0 @@ -From 5126c74ec19f56294cbfdc312f75778d8f249e59 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= -Date: Mon, 3 Nov 2025 22:03:54 +0100 -Subject: [PATCH] Do not abort key search on unsupported algorithm - -When supported and unsupported algorithm rrsig is present, some keys may -return unsupported algorithm error. Continue to next key without -counting this to validation failures. - -(cherry picked from commit 38ddff3336e08983a4c0b5f3ea4eb35bb0f6ac81) ---- - lib/dns/validator.c | 8 +++++++- - 1 file changed, 7 insertions(+), 1 deletion(-) - -diff --git a/lib/dns/validator.c b/lib/dns/validator.c -index 15e177e4d7..a9db844c27 100644 ---- a/lib/dns/validator.c -+++ b/lib/dns/validator.c -@@ -1163,7 +1163,13 @@ select_signing_key(dns_validator_t *val, dns_rdataset_t *rdataset) { - goto done; - } - dst_key_free(&val->key); -- } else { -+ } else if (result != DST_R_UNSUPPORTEDALG) { -+ /* Unsupported alg happens when RRset is signed by both -+ * supported and unsupported alg. */ -+ validator_log(val, ISC_LOG_DEBUG(3), -+ "select_signing_key alg %d keyid %d: %s", -+ siginfo->algorithm, siginfo->keyid, -+ isc_result_totext(result)); - break; - } - dns_rdata_reset(&rdata); --- -2.51.1 - diff --git a/bind-9.20-nsupdate-tls.patch b/bind-9.20-nsupdate-tls.patch index ccf46e4..5404bd3 100644 --- a/bind-9.20-nsupdate-tls.patch +++ b/bind-9.20-nsupdate-tls.patch @@ -1,4 +1,4 @@ -From b44dc4ed5c34445511f06d4b972407d539f8e9da Mon Sep 17 00:00:00 2001 +From b0a417393f6a656758f40f30234086e1017faa7a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 11 Nov 2024 18:09:07 +0100 Subject: [PATCH] Backport nsupdate TLS support into 9.18 @@ -55,8 +55,8 @@ Adapted to 9.18.33. lib/dns/include/dns/types.h | 2 + lib/dns/request.c | 63 ++++++-- lib/dns/transport.c | 253 ++++++++++++++++++++++++++++++++ - lib/dns/xfrin.c | 232 +---------------------------- - 9 files changed, 668 insertions(+), 292 deletions(-) + lib/dns/xfrin.c | 7 +- + 9 files changed, 671 insertions(+), 64 deletions(-) diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c index 293ed28..819925e 100644 @@ -455,7 +455,7 @@ index 293ed28..819925e 100644 if (answer != NULL) { dns_message_detach(&answer); diff --git a/lib/dns/dispatch.c b/lib/dns/dispatch.c -index eb37198..8273c32 100644 +index bd53763..5722fe2 100644 --- a/lib/dns/dispatch.c +++ b/lib/dns/dispatch.c @@ -30,6 +30,7 @@ @@ -922,10 +922,10 @@ index e74ccd7..e6499a9 100644 * Requires: *\li 'transport' is valid. diff --git a/lib/dns/include/dns/types.h b/lib/dns/include/dns/types.h -index 6465962..f0aaa24 100644 +index 8ddcbeb..7ba4801 100644 --- a/lib/dns/include/dns/types.h +++ b/lib/dns/include/dns/types.h -@@ -141,6 +141,8 @@ typedef struct dns_ssutable dns_ssutable_t; +@@ -142,6 +142,8 @@ typedef struct dns_ssutable dns_ssutable_t; typedef struct dns_stats dns_stats_t; typedef uint32_t dns_rdatastatstype_t; typedef struct dns_tkeyctx dns_tkeyctx_t; @@ -1350,255 +1350,37 @@ index 88a3df4..2a779ba 100644 transport_destroy(dns_transport_t *transport) { isc_refcount_destroy(&transport->references); diff --git a/lib/dns/xfrin.c b/lib/dns/xfrin.c -index 3a4f761..3695815 100644 +index 6a46ea3..ae2b70f 100644 --- a/lib/dns/xfrin.c +++ b/lib/dns/xfrin.c -@@ -962,234 +962,6 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr, +@@ -938,6 +938,7 @@ xfrin_create(isc_mem_t *mctx, dns_zone_t *zone, dns_db_t *db, isc_nm_t *netmgr, *xfrp = xfr; } --static isc_result_t --get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx, -- isc_tlsctx_client_session_cache_t **psess_cache) { -- isc_result_t result = ISC_R_FAILURE; -- isc_tlsctx_t *tlsctx = NULL, *found = NULL; -- isc_tls_cert_store_t *store = NULL, *found_store = NULL; -- isc_tlsctx_client_session_cache_t *sess_cache = NULL, -- *found_sess_cache = NULL; -- uint32_t tls_versions; -- const char *ciphers = NULL; -- bool prefer_server_ciphers; -- const uint16_t family = isc_sockaddr_pf(&xfr->primaryaddr) == PF_INET6 -- ? AF_INET6 -- : AF_INET; -- const char *tlsname = NULL; -- -- REQUIRE(psess_cache != NULL && *psess_cache == NULL); -- REQUIRE(pctx != NULL && *pctx == NULL); -- -- INSIST(xfr->transport != NULL); -- tlsname = dns_transport_get_tlsname(xfr->transport); -- INSIST(tlsname != NULL && *tlsname != '\0'); -- -- /* -- * Let's try to re-use the already created context. This way -- * we have a chance to resume the TLS session, bypassing the -- * full TLS handshake procedure, making establishing -- * subsequent TLS connections for XoT faster. -- */ -- result = isc_tlsctx_cache_find(xfr->tlsctx_cache, tlsname, -- isc_tlsctx_cache_tls, family, &found, -- &found_store, &found_sess_cache); -- if (result != ISC_R_SUCCESS) { -- const char *hostname = -- dns_transport_get_remote_hostname(xfr->transport); -- const char *ca_file = dns_transport_get_cafile(xfr->transport); -- const char *cert_file = -- dns_transport_get_certfile(xfr->transport); -- const char *key_file = -- dns_transport_get_keyfile(xfr->transport); -- char primary_addr_str[INET6_ADDRSTRLEN] = { 0 }; -- isc_netaddr_t primary_netaddr = { 0 }; -- bool hostname_ignore_subject; -- /* -- * So, no context exists. Let's create one using the -- * parameters from the configuration file and try to -- * store it for further reuse. -- */ -- result = isc_tlsctx_createclient(&tlsctx); -- if (result != ISC_R_SUCCESS) { -- goto failure; -- } -- tls_versions = dns_transport_get_tls_versions(xfr->transport); -- if (tls_versions != 0) { -- isc_tlsctx_set_protocols(tlsctx, tls_versions); -- } -- ciphers = dns_transport_get_ciphers(xfr->transport); -- if (ciphers != NULL) { -- isc_tlsctx_set_cipherlist(tlsctx, ciphers); -- } -- -- if (dns_transport_get_prefer_server_ciphers( -- xfr->transport, &prefer_server_ciphers)) -- { -- isc_tlsctx_prefer_server_ciphers(tlsctx, -- prefer_server_ciphers); -- } -- -- if (hostname != NULL || ca_file != NULL) { -- /* -- * The situation when 'found_store != NULL' while 'found -- * == NULL' might appear as there is one to many -- * relation between per transport TLS contexts and cert -- * stores. That is, there could be one store shared -- * between multiple contexts. -- */ -- if (found_store == NULL) { -- /* -- * 'ca_file' can equal 'NULL' here, in -- * that case the store with system-wide -- * CA certificates will be created, just -- * as planned. -- */ -- result = isc_tls_cert_store_create(ca_file, -- &store); -- -- if (result != ISC_R_SUCCESS) { -- goto failure; -- } -- } else { -- store = found_store; -- } -- -- INSIST(store != NULL); -- if (hostname == NULL) { -- /* -- * If CA bundle file is specified, but -- * hostname is not, then use the primary -- * IP address for validation, just like -- * dig does. -- */ -- INSIST(ca_file != NULL); -- isc_netaddr_fromsockaddr(&primary_netaddr, -- &xfr->primaryaddr); -- isc_netaddr_format(&primary_netaddr, -- primary_addr_str, -- sizeof(primary_addr_str)); -- hostname = primary_addr_str; -- } -- /* -- * According to RFC 8310, Subject field MUST NOT -- * be inspected when verifying hostname for DoT. -- * Only SubjectAltName must be checked. -- */ -- hostname_ignore_subject = true; -- result = isc_tlsctx_enable_peer_verification( -- tlsctx, false, store, hostname, -- hostname_ignore_subject); -- if (result != ISC_R_SUCCESS) { -- goto failure; -- } -- -- /* -- * Let's load client certificate and enable -- * Mutual TLS. We do that only in the case when -- * Strict TLS is enabled, because Mutual TLS is -- * an extension of it. -- */ -- if (cert_file != NULL) { -- INSIST(key_file != NULL); -- -- result = isc_tlsctx_load_certificate( -- tlsctx, key_file, cert_file); -- if (result != ISC_R_SUCCESS) { -- goto failure; -- } -- } -- } -- -- isc_tlsctx_enable_dot_client_alpn(tlsctx); -- -- isc_tlsctx_client_session_cache_create( -- xfr->mctx, tlsctx, -- ISC_TLSCTX_CLIENT_SESSION_CACHE_DEFAULT_SIZE, -- &sess_cache); -- -- found_store = NULL; -- result = isc_tlsctx_cache_add(xfr->tlsctx_cache, tlsname, -- isc_tlsctx_cache_tls, family, -- tlsctx, store, sess_cache, &found, -- &found_store, &found_sess_cache); -- if (result == ISC_R_EXISTS) { -- /* -- * It seems the entry has just been created from within -- * another thread while we were initialising -- * ours. Although this is unlikely, it could happen -- * after startup/re-initialisation. In such a case, -- * discard the new context and associated data and use -- * the already established one from now on. -- * -- * Such situation will not occur after the -- * initial 'warm-up', so it is not critical -- * performance-wise. -- */ -- INSIST(found != NULL); -- isc_tlsctx_free(&tlsctx); -- /* -- * The 'store' variable can be 'NULL' when remote server -- * verification is not enabled (that is, when Strict or -- * Mutual TLS are not used). -- * -- * The 'found_store' might be equal to 'store' as there -- * is one-to-many relation between a store and -- * per-transport TLS contexts. In that case, the call to -- * 'isc_tlsctx_cache_find()' above could have returned a -- * store via the 'found_store' variable, whose value we -- * can assign to 'store' later. In that case, -- * 'isc_tlsctx_cache_add()' will return the same value. -- * When that happens, we should not free the store -- * object, as it is managed by the TLS context cache. -- */ -- if (store != NULL && store != found_store) { -- isc_tls_cert_store_free(&store); -- } -- isc_tlsctx_client_session_cache_detach(&sess_cache); -- /* Let's return the data from the cache. */ -- *psess_cache = found_sess_cache; -- *pctx = found; -- } else { -- /* -- * Adding the fresh values into the cache has been -- * successful, let's return them -- */ -- INSIST(result == ISC_R_SUCCESS); -- *psess_cache = sess_cache; -- *pctx = tlsctx; -- } -- } else { -- /* -- * The cache lookup has been successful, let's return the -- * results. -- */ -- INSIST(result == ISC_R_SUCCESS); -- *psess_cache = found_sess_cache; -- *pctx = found; -- } -- -- return ISC_R_SUCCESS; -- --failure: -- if (tlsctx != NULL) { -- isc_tlsctx_free(&tlsctx); -- } -- -- /* -- * The 'found_store' is being managed by the TLS context -- * cache. Thus, we should keep it as it is, as it will get -- * destroyed alongside the cache. As there is one store per -- * multiple TLS contexts, we need to handle store deletion in a -- * special way. -- */ -- if (store != NULL && store != found_store) { -- isc_tls_cert_store_free(&store); -- } -- -- return result; --} -- ++#if 0 + static isc_result_t + get_create_tlsctx(const dns_xfrin_ctx_t *xfr, isc_tlsctx_t **pctx, + isc_tlsctx_client_session_cache_t **psess_cache) { +@@ -1152,6 +1153,8 @@ cleanup: + + return result; + } ++/* if 0 */ ++#endif + static isc_result_t xfrin_start(dns_xfrin_ctx_t *xfr) { - isc_result_t result; -@@ -1232,7 +1004,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) { +@@ -1195,7 +1198,9 @@ xfrin_start(dns_xfrin_ctx_t *xfr) { connect_xfr, 30000, 0); break; case DNS_TRANSPORT_TLS: { -- result = get_create_tlsctx(xfr, &tlsctx, &sess_cache); -+ result = dns_transport_get_tlsctx( +- CHECK(get_create_tlsctx(xfr, &tlsctx, &sess_cache)); ++ CHECK(dns_transport_get_tlsctx( + xfr->transport, &xfr->primaryaddr, xfr->tlsctx_cache, -+ xfr->mctx, &tlsctx, &sess_cache); - if (result != ISC_R_SUCCESS) { - goto failure; - } ++ xfr->mctx, &tlsctx, &sess_cache)); + INSIST(tlsctx != NULL); + isc_nm_tlsdnsconnect(xfr->netmgr, &xfr->sourceaddr, + &xfr->primaryaddr, xfrin_connect_done, -- -2.48.1 +2.52.0 diff --git a/bind.spec b/bind.spec index 9079b37..41c8525 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.41 -Release: 2%{?dist} +Version: 9.18.43 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -142,10 +142,6 @@ Patch32: bind-9.18-partial-additional-records.patch Patch33: bind-9.18-dig-idn-input-always.patch # downstream only too Patch34: bind-9.18-dig-idn-input-always-test.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11194 -Patch35: bind-9.20-CVE-2025-8677-dual-signing.patch -# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/11195 -Patch36: bind-9.20-CVE-2025-8677-dual-signing-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -947,6 +943,9 @@ fi; %endif %changelog +* Wed Dec 17 2025 Petr Menšík - 32:9.18.43-1 +- Update to 9.18.43 (rhbz#2415842) + * Fri Oct 31 2025 Petr Menšík - 32:9.18.41-2 - Fix upstream reported regression in recent CVE fix (CVE-2025-8677) - Add upstream dnssec system test testcase for this problem diff --git a/sources b/sources index df9609f..e0ce143 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.41.tar.xz) = aba4a0add07f1feb2825852faeed14bc946628b818adac93401890cd67ead17c2fd8d820bca70ba7f8c2788dc65195baccc93f87249fb7e47077354341ff0839 -SHA512 (bind-9.18.41.tar.xz.asc) = 5b5a2f969e6da6a64908dba7f94f9877ce2d729e59c3b9c23fa3459cc74059b10479df63b3223c738b4fbfecde5e51dd9906fb34e6763c0b5909dda195afb71b +SHA512 (bind-9.18.43.tar.xz) = 4f0e6849e883110f275739a03de20465c91563f26be94d380d28454f27d7c68fdc3ba0e1eaa8d25a6790cadc8228ee981dceb0a6fcf46ab4ffd24b8c76f42e25 +SHA512 (bind-9.18.43.tar.xz.asc) = 82ecbbba5043793c5f5c6d7fd0166dbc60a9e7a349e396bb28f1be0c7643683e91e98cf2a84635d6c707c52273dd8df438df5601d06ea3a6be8293860d552f22 From 463e7a3d2dff4acfadf9df5ee14db80320d5e6d1 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 04:23:48 +0000 Subject: [PATCH 100/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 41c8525..869a016 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.43 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -943,6 +943,9 @@ fi; %endif %changelog +* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Wed Dec 17 2025 Petr Menšík - 32:9.18.43-1 - Update to 9.18.43 (rhbz#2415842) From 159d742c215ea9d3dd625a88168633643ea29786 Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Fri, 16 Jan 2026 08:20:40 +0000 Subject: [PATCH 101/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 869a016..825d96b 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.43 -Release: 2%{?dist} +Release: 3%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -943,6 +943,9 @@ fi; %endif %changelog +* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + * Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild From d82283632119f3a886b3d317c7c302c95b8bb4dc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 22 Jan 2026 11:15:47 +0100 Subject: [PATCH 102/144] Update to 9.18.44 (rhbz#2431609) Security Fixes: - Fix incorrect length checks for BRID and HHIT records. (CVE-2025-13878) Bug Fixes: - Allow glue in delegations with QTYPE=ANY. - Reconfiguring an NSEC3 opt-out zone to NSEC caused the zone to be invalid. https://downloads.isc.org/isc/bind9/9.18.44/doc/arm/html/notes.html#notes-for-bind-9-18-44 --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index 825d96b..827994d 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.43 -Release: 3%{?dist} +Version: 9.18.44 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -943,6 +943,9 @@ fi; %endif %changelog +* Thu Jan 22 2026 Petr Menšík - 32:9.18.44-1 +- Update to 9.18.44 (rhbz#2431609) + * Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-3 - Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild diff --git a/sources b/sources index e0ce143..c7529d6 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.43.tar.xz) = 4f0e6849e883110f275739a03de20465c91563f26be94d380d28454f27d7c68fdc3ba0e1eaa8d25a6790cadc8228ee981dceb0a6fcf46ab4ffd24b8c76f42e25 -SHA512 (bind-9.18.43.tar.xz.asc) = 82ecbbba5043793c5f5c6d7fd0166dbc60a9e7a349e396bb28f1be0c7643683e91e98cf2a84635d6c707c52273dd8df438df5601d06ea3a6be8293860d552f22 +SHA512 (bind-9.18.44.tar.xz) = 767bc313995576c008c00e073568d5d9bebb2e1dcc7e9e3f7ea128e6dca4358d7879de70fa1cb2980ded0b8db362f4d9eb71875dda2d45898e5607dbb4093a9f +SHA512 (bind-9.18.44.tar.xz.asc) = 6fa084c028e5af89f6ca9e5f205d78fb1423b2e9000bd7859e28d42134738c24d7e26c29261e597fe71aaa0e8c09b2f0563ad1d7e415ee8ebf5ec4d00725c678 From fa6f9dbbd115992b73c21095af39047611e9c862 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 12 Dec 2025 16:52:32 +0100 Subject: [PATCH 103/144] Create /var/named directories for bind-chroot Fixes bind-chroot in Image Mode. Include even subdirectories. Related: RHEL-132053 --- bind-chroot.tmpfiles.d | 37 +++++++++++++++++++++++++++++++++++++ bind.spec | 8 +++++++- 2 files changed, 44 insertions(+), 1 deletion(-) create mode 100644 bind-chroot.tmpfiles.d diff --git a/bind-chroot.tmpfiles.d b/bind-chroot.tmpfiles.d new file mode 100644 index 0000000..ba13ee1 --- /dev/null +++ b/bind-chroot.tmpfiles.d @@ -0,0 +1,37 @@ +# vim: ft=conf: +# TODO: these definitions are in different form in rpm spec %files chroot section +# find a way to have it defined only once +#defattr(0664,root,named,-) +c /var/named/chroot/dev/null 0664 root named - 1:3 +c /var/named/chroot/dev/random 0664 root named - 1:8 +c /var/named/chroot/dev/urandom 0664 root named - 1:9 +c /var/named/chroot/dev/zero 0664 root named - 1:5 +#defattr(0640,root,named,0750) +d /var/named/chroot 0750 root named - +d /var/named/chroot/dev 0750 root named - +d /var/named/chroot/etc 0750 root named - +d /var/named/chroot/etc/named 0750 root named - +d /var/named/chroot/etc/pki 0750 root named - +d /var/named/chroot/etc/pki/dnssec-keys 0750 root named - +d /var/named/chroot/etc/crypto-policies 0750 root named - +d /var/named/chroot/etc/crypto-policies/back-ends 0750 root named - +d /var/named/chroot/var 0750 root named - +d /var/named/chroot/run 0750 root named - +#defattr(-,root,root,-) +d /var/named/chroot/usr - root root - +d /var/named/chroot/usr/lib64 - root root - +d /var/named/chroot/usr/lib64/bind - root root - +d /var/named/chroot/usr/share/GeoIP - root root - +d /var/named/chroot/usr/share/named - root root - +d /var/named/chroot/proc - root root - +d /var/named/chroot/proc/sys - root root - +d /var/named/chroot/proc/sys/net - root root - +d /var/named/chroot/proc/sys/net/ipv4 - root root - +#defattr(0660,root,named,01770) +d /var/named/chroot/var/named 01770 root named - +#defattr(0660,named,named,0770) +d /var/named/chroot/var/tmp 0770 named named - +d /var/named/chroot/var/log 0770 named named - +#defattr(-,named,named,-) +d /var/named/chroot/run/named - named named - +L /var/named/chroot/var/run - named named - ../run diff --git a/bind.spec b/bind.spec index 827994d..25a0c69 100644 --- a/bind.spec +++ b/bind.spec @@ -86,7 +86,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.44 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -117,6 +117,7 @@ Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh Source49: named-chroot.files Source50: named.sysusers +Source51: bind-chroot.tmpfiles.d # Common patches # FIXME: Is this still required? @@ -671,6 +672,7 @@ done mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf +install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named @@ -898,6 +900,7 @@ fi; %{_unitdir}/named-chroot.service %{_unitdir}/named-chroot-setup.service %{_libexecdir}/setup-named-chroot.sh +%{_tmpfilesdir}/%{name}-chroot.conf %defattr(0664,root,named,-) %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null %ghost %dev(c,1,8) %verify(not mtime) %{chroot_prefix}/dev/random @@ -943,6 +946,9 @@ fi; %endif %changelog +* Fri Dec 12 2025 Petr Menšík - 32:9.18.44-2 +- Create /var/named directories for bind-chroot (RHEL-132053) + * Thu Jan 22 2026 Petr Menšík - 32:9.18.44-1 - Update to 9.18.44 (rhbz#2431609) From c92030d6aabf59165bee67af13eddecb6e14c82d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 28 Jan 2026 11:47:33 +0100 Subject: [PATCH 104/144] Add forgotten _libdir/named into bind-chroot tmpfiles One of libdir directories was forgotten. It is the directory containing the actual plugin, might cause issues if filter-aaaa.so plugin is used. Related: RHEL-132054 --- bind-chroot.tmpfiles.d | 1 + bind.spec | 1 + 2 files changed, 2 insertions(+) diff --git a/bind-chroot.tmpfiles.d b/bind-chroot.tmpfiles.d index ba13ee1..13992fd 100644 --- a/bind-chroot.tmpfiles.d +++ b/bind-chroot.tmpfiles.d @@ -21,6 +21,7 @@ d /var/named/chroot/run 0750 root named - d /var/named/chroot/usr - root root - d /var/named/chroot/usr/lib64 - root root - d /var/named/chroot/usr/lib64/bind - root root - +d /var/named/chroot/usr/lib64/named - root root - d /var/named/chroot/usr/share/GeoIP - root root - d /var/named/chroot/usr/share/named - root root - d /var/named/chroot/proc - root root - diff --git a/bind.spec b/bind.spec index 25a0c69..00ce5c7 100644 --- a/bind.spec +++ b/bind.spec @@ -948,6 +948,7 @@ fi; %changelog * Fri Dec 12 2025 Petr Menšík - 32:9.18.44-2 - Create /var/named directories for bind-chroot (RHEL-132053) +- Add forgotten _libdir/named into bind-chroot tmpfiles * Thu Jan 22 2026 Petr Menšík - 32:9.18.44-1 - Update to 9.18.44 (rhbz#2431609) From cc844e18efa4e671f1ef0c6a09796d527a8ab7eb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 3 Mar 2026 19:56:51 +0100 Subject: [PATCH 105/144] Fix changelog date ordering --- bind.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 00ce5c7..de6e974 100644 --- a/bind.spec +++ b/bind.spec @@ -946,7 +946,7 @@ fi; %endif %changelog -* Fri Dec 12 2025 Petr Menšík - 32:9.18.44-2 +* Wed Jan 28 2026 Petr Menšík - 32:9.18.44-2 - Create /var/named directories for bind-chroot (RHEL-132053) - Add forgotten _libdir/named into bind-chroot tmpfiles From 3bda563fa3683129976c3f979d5fd045e86aa9d3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 3 Mar 2026 19:54:55 +0100 Subject: [PATCH 106/144] Update to 9.18.46 (rhbz#2440561) Bug Fixes: - Stale answer could be served when following CNAME and failures occured. [GL #5751] https://downloads.isc.org/isc/bind9/9.18.46/doc/arm/html/notes.html#notes-for-bind-9-18-46 --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index de6e974..38470dd 100644 --- a/bind.spec +++ b/bind.spec @@ -85,8 +85,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.44 -Release: 2%{?dist} +Version: 9.18.46 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -946,6 +946,9 @@ fi; %endif %changelog +* Tue Mar 03 2026 Petr Menšík - 32:9.18.46-1 +- Update to 9.18.46 (rhbz#2440561) + * Wed Jan 28 2026 Petr Menšík - 32:9.18.44-2 - Create /var/named directories for bind-chroot (RHEL-132053) - Add forgotten _libdir/named into bind-chroot tmpfiles diff --git a/sources b/sources index c7529d6..71b30b7 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.44.tar.xz) = 767bc313995576c008c00e073568d5d9bebb2e1dcc7e9e3f7ea128e6dca4358d7879de70fa1cb2980ded0b8db362f4d9eb71875dda2d45898e5607dbb4093a9f -SHA512 (bind-9.18.44.tar.xz.asc) = 6fa084c028e5af89f6ca9e5f205d78fb1423b2e9000bd7859e28d42134738c24d7e26c29261e597fe71aaa0e8c09b2f0563ad1d7e415ee8ebf5ec4d00725c678 +SHA512 (bind-9.18.46.tar.xz) = 92cd1ac5f65ed6f400191f8b81bc4501fc590c9ebe8ffdd1310e67ec784b00d5977a78106b0c2221c90f4b69b9050aae054bad0def0f6d03de94ea98686ad166 +SHA512 (bind-9.18.46.tar.xz.asc) = c208ba214e574079814869a5186a84b1bc2362404baf42d2606dece2d11f948bc458fd32abb579c6cb0385294e6b8fce4fe97a3da6ca0c1a9feb93a1394c31d7 From a3ca8b5f928187b3769d5b9383cb6d5f2d63aee1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 25 Mar 2026 19:27:51 +0100 Subject: [PATCH 107/144] Update to 9.18.47 (rhbz#2440561) Security Fixes: - Fix unbounded NSEC3 iterations when validating referrals to unsigned delegations. (CVE-2026-1519) Source: https://downloads.isc.org/isc/bind9/9.18.47/doc/arm/html/notes.html#notes-for-bind-9-18-47 --- bind.spec | 7 ++++++- sources | 4 ++-- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/bind.spec b/bind.spec index 38470dd..1b223ea 100644 --- a/bind.spec +++ b/bind.spec @@ -42,6 +42,8 @@ %global chroot_create_directories /dev /run/named %{_localstatedir}/{log,named,tmp} \\\ %{_sysconfdir}/{crypto-policies/back-ends,pki/dnssec-keys,named} \\\ %{_libdir}/bind %{_libdir}/named %{_datadir}/{GeoIP,named} /proc/sys/net/ipv4 +%global upstream_sources 0 2 +%global pgp_signature_sources 2 ## The order of libs is important. See lib/Makefile.in for details %define bind_export_libs isc dns isccfg irs @@ -85,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.46 +Version: 9.18.47 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -946,6 +948,9 @@ fi; %endif %changelog +* Wed Mar 25 2026 Petr Menšík - 32:9.18.47-1 +- Update to 9.18.47 (rhbz#2440561) + * Tue Mar 03 2026 Petr Menšík - 32:9.18.46-1 - Update to 9.18.46 (rhbz#2440561) diff --git a/sources b/sources index 71b30b7..4df8f96 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.46.tar.xz) = 92cd1ac5f65ed6f400191f8b81bc4501fc590c9ebe8ffdd1310e67ec784b00d5977a78106b0c2221c90f4b69b9050aae054bad0def0f6d03de94ea98686ad166 -SHA512 (bind-9.18.46.tar.xz.asc) = c208ba214e574079814869a5186a84b1bc2362404baf42d2606dece2d11f948bc458fd32abb579c6cb0385294e6b8fce4fe97a3da6ca0c1a9feb93a1394c31d7 +SHA512 (bind-9.18.47.tar.xz) = 8135d453c0dd99947c93b9fb8fe1a52c5657f1c675b503dbfb745dfc9bb278121dc307d590bae99b439b093e87cb2bd0bf07d0a32ffd8a39841752559a0df1e8 +SHA512 (bind-9.18.47.tar.xz.asc) = 225075bccee8b39366c0eca40a58c3c81296a86187b976ddab730d880388f6ed00c70f8c30ffa6e9f180159296fc41c9d204facc6f53260209ea27626b60ced8 From 492a790266c2fe44062f31221f5e4ac9a37a443d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 7 Apr 2026 16:31:04 +0200 Subject: [PATCH 108/144] Update to 9.18.48 (rhbz#2453853) Security Fixes: - Fix crash when reconfiguring zone update policy during active updates. Bug Fixes: - Fix a crash triggered by rndc modzone on a zone from a configuration file. - Fix a crash triggered by rndc modzone on zone that already existed in NZF file. Source: https://downloads.isc.org/isc/bind9/9.18.48/doc/arm/html/notes.html#notes-for-bind-9-18-48 --- bind.spec | 6 +++++- sources | 4 ++-- 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/bind.spec b/bind.spec index 1b223ea..76862cc 100644 --- a/bind.spec +++ b/bind.spec @@ -87,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.47 +Version: 9.18.48 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -187,6 +187,7 @@ BuildRequires: softhsm BuildRequires: perl(Net::DNS) perl(Net::DNS::Nameserver) perl(Time::HiRes) perl(Getopt::Long) BuildRequires: perl(English) BuildRequires: python3-dns +BuildRequires: python3-hypothesis # manual configuration requires this tool BuildRequires: iproute %endif @@ -948,6 +949,9 @@ fi; %endif %changelog +* Tue Apr 07 2026 Petr Menšík - 32:9.18.48-1 +- Update to 9.18.48 (rhbz#2453853) + * Wed Mar 25 2026 Petr Menšík - 32:9.18.47-1 - Update to 9.18.47 (rhbz#2440561) diff --git a/sources b/sources index 4df8f96..6412bed 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.47.tar.xz) = 8135d453c0dd99947c93b9fb8fe1a52c5657f1c675b503dbfb745dfc9bb278121dc307d590bae99b439b093e87cb2bd0bf07d0a32ffd8a39841752559a0df1e8 -SHA512 (bind-9.18.47.tar.xz.asc) = 225075bccee8b39366c0eca40a58c3c81296a86187b976ddab730d880388f6ed00c70f8c30ffa6e9f180159296fc41c9d204facc6f53260209ea27626b60ced8 +SHA512 (bind-9.18.48.tar.xz) = 9c93fe60e8fdfa140cfd535beaf42b368aed885aa97669f990f100c8d75d02cb2b0423f87e8b0f36315fda5bb998e18b7bf8d3d649e9ffe32a4724947a5bebe7 +SHA512 (bind-9.18.48.tar.xz.asc) = 45e98a05b48ea094c3d1acdf1f46975fad2aea6bbb182f49f0a897f276ef709a9a4cce025bfbac1f7049a497b47306be33e9d5e7230034e730e6de97ce0256f3 From 7c5c8f76adfb2ce5a82c4a45c0c229847f287de9 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 20 May 2026 14:05:28 +0200 Subject: [PATCH 109/144] Update to 9.18.49 (rhbz#2480121) Security Fixes: - Limit resolver server list size. (CVE-2026-3592) - Fix GSS-API resource leak. (CVE-2026-3039) - Disable recursion, UPDATE, and NOTIFY for non-IN views. (CVE-2026-5946) - Avoid unbounded recursion loop. (CVE-2026-5950) - Fix outgoing zone transfers' quota issue. Feature Changes: - Fix CPU spikes and slow queries when cache approaches memory limit. Bug Fixes: - Fix named crash when processing SIG records in dynamic updates. - Fix rndc modzone behavior for a zone in named.conf. - Fix zone verification of NSEC3 signed zones. - Prevent a crash when using both dns64 and filter-aaaa. - Fixed an assertion failure when processing catalog zones. - Prevent malicious DNSSEC zones from exhausting validator CPU. - Fix rndc-confgen aborting on HMAC-SHA-384/512 keys above 512 bits. - Prevent crafted queries from degrading RRL performance. - Fix a bug in allow-query/allow-transfer catalog zone custom properties. - Fix a memory leak issue in catalog zones. - Fix suppressed missing-glue check in named-checkzone. - Reject record sets too large to serve in DNS. Source: https://downloads.isc.org/isc/bind9/9.18.49/doc/arm/html/notes.html#notes-for-bind-9-18-49 --- bind.spec | 5 ++++- sources | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/bind.spec b/bind.spec index 76862cc..e1c9b9d 100644 --- a/bind.spec +++ b/bind.spec @@ -87,7 +87,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.48 +Version: 9.18.49 Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ @@ -949,6 +949,9 @@ fi; %endif %changelog +* Wed May 20 2026 Petr Menšík - 32:9.18.49-1 +- Update to 9.18.49 (rhbz#2480121) + * Tue Apr 07 2026 Petr Menšík - 32:9.18.48-1 - Update to 9.18.48 (rhbz#2453853) diff --git a/sources b/sources index 6412bed..ce795fc 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.48.tar.xz) = 9c93fe60e8fdfa140cfd535beaf42b368aed885aa97669f990f100c8d75d02cb2b0423f87e8b0f36315fda5bb998e18b7bf8d3d649e9ffe32a4724947a5bebe7 -SHA512 (bind-9.18.48.tar.xz.asc) = 45e98a05b48ea094c3d1acdf1f46975fad2aea6bbb182f49f0a897f276ef709a9a4cce025bfbac1f7049a497b47306be33e9d5e7230034e730e6de97ce0256f3 +SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544 +SHA512 (bind-9.18.49.tar.xz.asc) = eec896781f8bcfcc2b2aba884047d35656a0e9d215b06ca1b69ad7e3c6f4b3730ed8e8067514e6818e97e2c119edb8e5a84855d614c14b7e07a98bc3ec26bfa1 From 4fc3a0f1fa067710c976c55d94c8e869893a8e53 Mon Sep 17 00:00:00 2001 From: Yaakov Selkowitz Date: Fri, 12 Jun 2026 16:28:34 -0400 Subject: [PATCH 110/144] Rebuilt for openssl 4.0 --- bind.spec | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index e1c9b9d..bd07d01 100644 --- a/bind.spec +++ b/bind.spec @@ -88,7 +88,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.49 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -949,6 +949,9 @@ fi; %endif %changelog +* Fri Jun 12 2026 Yaakov Selkowitz - 32:9.18.49-2 +- Rebuilt for openssl 4.0 + * Wed May 20 2026 Petr Menšík - 32:9.18.49-1 - Update to 9.18.49 (rhbz#2480121) From 88cf659c1d52f2035fe01bbef3f2c508c6584c50 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 17 Jun 2026 21:57:29 +0200 Subject: [PATCH 111/144] Update to 9.18.50 (rhbz#2489833) Removed Features: - Remove ineffective TCP fallback after repeated UDP timeouts. Feature Changes: - Fall back to TCP on receipt of a UDP response with a mismatched query ID. Bug Fixes: - Fix DNS64 owner case after DNAME restart. - Clear REDIRECT flag when it isn't needed. This should be final release of BIND 9.18 line. That version is now marked EOL. Source: https://downloads.isc.org/isc/bind9/9.18.50/doc/arm/html/notes.html#notes-for-bind-9-18-50 --- bind.spec | 7 +++++-- sources | 4 ++-- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/bind.spec b/bind.spec index bd07d01..4b6fca8 100644 --- a/bind.spec +++ b/bind.spec @@ -87,8 +87,8 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. -Version: 9.18.49 -Release: 2%{?dist} +Version: 9.18.50 +Release: 1%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -949,6 +949,9 @@ fi; %endif %changelog +* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 +- Update to 9.18.50 (rhbz#2489833) + * Fri Jun 12 2026 Yaakov Selkowitz - 32:9.18.49-2 - Rebuilt for openssl 4.0 diff --git a/sources b/sources index ce795fc..9f75241 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (bind-9.18.49.tar.xz) = e5259db8b9fdb3940d4e1d95978514692777a3675fc85a83db30e049d80d8150d10e672d51eeb885a94c6bbd4573ff8fe49248117c24ff155197a24a26b09544 -SHA512 (bind-9.18.49.tar.xz.asc) = eec896781f8bcfcc2b2aba884047d35656a0e9d215b06ca1b69ad7e3c6f4b3730ed8e8067514e6818e97e2c119edb8e5a84855d614c14b7e07a98bc3ec26bfa1 +SHA512 (bind-9.18.50.tar.xz) = 5ae70c95f19868f41fd609bf34a908c38769401ee5b89e4782b94081032a579c00ba9010b2feb2789a95cfd12289cfe250e6488b3b47ff666bfa8cd7edf74d43 +SHA512 (bind-9.18.50.tar.xz.asc) = 41df6df786cd33055a3fd6632ffd2968d6600e314140c547bba3452ec9f7726f44df27c3bd53a5a937ad11407d7391641e0b7b1aff7ebf87f25c65e2a76707b6 From c5a273aaa5fd90e6eb9a231b4aa0e202a0dd805a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 15 Jun 2026 16:52:42 +0200 Subject: [PATCH 112/144] Remove /etc/rwtab from the package --- bind.spec | 6 +----- named.rwtab | 6 ------ 2 files changed, 1 insertion(+), 11 deletions(-) delete mode 100644 named.rwtab diff --git a/bind.spec b/bind.spec index 4b6fca8..b4f8094 100644 --- a/bind.spec +++ b/bind.spec @@ -113,7 +113,6 @@ Source37: named.service Source38: named-chroot.service Source41: setup-named-chroot.sh Source42: generate-rndc-key.sh -Source43: named.rwtab Source44: named-chroot-setup.service Source46: named-setup-rndc.service Source48: setup-named-softhsm.sh @@ -677,9 +676,6 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf -mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d -install -p -m 644 %{SOURCE43} ${RPM_BUILD_ROOT}%{_sysconfdir}/rwtab.d/named - %post %?ldconfig if [ "$1" -eq 1 ]; then @@ -773,7 +769,6 @@ fi; %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/named.conf -%{_sysconfdir}/rwtab.d/named %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service %{_sysusersdir}/named.conf @@ -951,6 +946,7 @@ fi; %changelog * Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 - Update to 9.18.50 (rhbz#2489833) +- Remove rwtab files * Fri Jun 12 2026 Yaakov Selkowitz - 32:9.18.49-2 - Rebuilt for openssl 4.0 diff --git a/named.rwtab b/named.rwtab deleted file mode 100644 index 2cb3a41..0000000 --- a/named.rwtab +++ /dev/null @@ -1,6 +0,0 @@ -dirs /var/named - -files /var/named/named.ca -files /var/named/named.empty -files /var/named/named.localhost -files /var/named/named.loopback From a166e83cd089c6181cb2c46693b1e9797aae149c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 21 Apr 2026 14:25:50 +0200 Subject: [PATCH 113/144] Prepare devel subpackage installable multiple times Only bind-dyndb-ldap uses devel package. Move includes and libraries to contain major version. That should allow to install both bind9.18-devel and bind9.20-devel at the same time. Needed to build multiple bind-dyndb-ldap plugin versions for different variants. Adjusted to bind 9.18 main component. --- bind.spec | 63 +++++++++++++++++++++++++++++++++++++++---------------- 1 file changed, 45 insertions(+), 18 deletions(-) diff --git a/bind.spec b/bind.spec index b4f8094..6856c08 100644 --- a/bind.spec +++ b/bind.spec @@ -48,6 +48,16 @@ ## The order of libs is important. See lib/Makefile.in for details %define bind_export_libs isc dns isccfg irs %{!?_export_dir:%global _export_dir /bind9-export/} + +%define major_ver() %{lua: \ + local ver = rpm.expand("%{1}"); \ + local s, e; \ + s, e = string.find(ver, "^%d+[.]%d+"); \ + if (s and e) then \ + print(string.sub(ver, s, e)); \ + end; \ +} + # libisc-nosym requires to be linked with unresolved symbols # When libisc-nosym linking is fixed, it can be defined to 1 # Visit https://bugzilla.redhat.com/show_bug.cgi?id=1540300 @@ -88,7 +98,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.50 -Release: 1%{?dist} +Release: 2%{?dist} Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -335,6 +345,13 @@ in HTML and PDF format. %endif +# Extract major version 9.x +%global mver %{major_ver %{version}} + +# customize include directory +%global bind_include %{_includedir}/bind%{mver} + + %prep %if 0%{?fedora} # RHEL does not yet support this verification @@ -399,7 +416,7 @@ export LIBDIR_SUFFIX --localstatedir=%{_var} \ --with-pic \ --disable-static \ - --includedir=%{_includedir}/bind9 \ + --includedir=%{bind_include} \ --with-tuning=large \ --with-libidn2 \ %if %{with GEOIP2} @@ -594,6 +611,12 @@ ln -s ../bin/{named-checkconf,named-checkzone,named-compilezone} %{buildroot}%{_ # Remove libtool .la files: find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; +pushd ${RPM_BUILD_ROOT}/%{_libdir} + for LIB in isccc ns dns isc isccfg irs bind9; do + mv "lib${LIB}.so" "lib${LIB}-%{mver}.so" + done +popd + # 9.16.4 installs even manual pages for tools not generated %if %{without DNSTAP} rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true @@ -876,22 +899,23 @@ fi; %{_mandir}/man1/dnssec*.1* %files devel -%{_libdir}/libbind9.so -%{_libdir}/libisccc.so -%{_libdir}/libns.so -%{_libdir}/libdns.so -%{_libdir}/libirs.so -%{_libdir}/libisc.so -%{_libdir}/libisccfg.so -%dir %{_includedir}/bind9 -%{_includedir}/bind9/bind9 -%{_includedir}/bind9/isccc -%{_includedir}/bind9/ns -%{_includedir}/bind9/dns -%{_includedir}/bind9/dst -%{_includedir}/bind9/irs -%{_includedir}/bind9/isc -%{_includedir}/bind9/isccfg +%{_libdir}/libbind9-%{mver}.so +%{_libdir}/libisccc-%{mver}.so +%{_libdir}/libns-%{mver}.so +%{_libdir}/libdns-%{mver}.so +%{_libdir}/libisc-%{mver}.so +%{_libdir}/libisccfg-%{mver}.so +%{_libdir}/libirs-%{mver}.so +%dir %{bind_include} +%{bind_include}/isccc +%{bind_include}/ns +%{bind_include}/bind9 +%{bind_include}/dns +%{bind_include}/dst +%{bind_include}/irs +%{bind_include}/isc +%{bind_include}/isccfg +%{bind_include}/bind9 %files chroot %config(noreplace) %{_sysconfdir}/named-chroot.files @@ -944,6 +968,9 @@ fi; %endif %changelog +* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-2 +- Prepare devel subpackage installable multiple times + * Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 - Update to 9.18.50 (rhbz#2489833) - Remove rwtab files From 7911863b8994d2b5fc3f45a43c88660215d4813b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Apr 2026 19:49:10 +0200 Subject: [PATCH 114/144] Make binaries contain minor version --- ...ble-PROGRAM_SUFFIX-in-install-target.patch | 61 +++++++++ bind.spec | 126 ++++++++++-------- 2 files changed, 128 insertions(+), 59 deletions(-) create mode 100644 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch diff --git a/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch new file mode 100644 index 0000000..a6e700a --- /dev/null +++ b/0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch @@ -0,0 +1,61 @@ +From 31bd3a0996a85c0fced0c6ace3da1241b30dc397 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Thu, 30 Apr 2026 17:28:40 +0200 +Subject: [PATCH] Use variable PROGRAM_SUFFIX in install target + +--program-suffix is handled by configure itself. But some makefile rules +need to know it by a special value. Provide that to make multiple +versions installable together on a single system. +--- + Makefile.top | 1 + + bin/check/Makefile.am | 6 +++--- + bin/confgen/Makefile.am | 6 +++--- + 3 files changed, 7 insertions(+), 6 deletions(-) + +diff --git a/Makefile.top b/Makefile.top +index e186d15..91c076b 100644 +--- a/Makefile.top ++++ b/Makefile.top +@@ -14,6 +14,7 @@ AM_CPPFLAGS = \ + AM_LDFLAGS = \ + $(STD_LDFLAGS) + LDADD = ++PROGRAM_SUFFIX = + + if HOST_MACOS + AM_LDFLAGS += \ +diff --git a/bin/check/Makefile.am b/bin/check/Makefile.am +index 8f63c35..36f232c 100644 +--- a/bin/check/Makefile.am ++++ b/bin/check/Makefile.am +@@ -27,8 +27,8 @@ LDADD += \ + bin_PROGRAMS = named-checkconf named-checkzone + + install-exec-hook: +- ln -f $(DESTDIR)$(bindir)/named-checkzone \ +- $(DESTDIR)$(bindir)/named-compilezone ++ ln -f $(DESTDIR)$(bindir)/named-checkzone$(PROGRAM_SUFFIX) \ ++ $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX) + + uninstall-hook: +- -rm -f $(DESTDIR)$(bindir)/named-compilezone ++ -rm -f $(DESTDIR)$(bindir)/named-compilezone$(PROGRAM_SUFFIX) +diff --git a/bin/confgen/Makefile.am b/bin/confgen/Makefile.am +index c1dca43..fe86dd7 100644 +--- a/bin/confgen/Makefile.am ++++ b/bin/confgen/Makefile.am +@@ -23,8 +23,8 @@ libconfgen_la_SOURCES = \ + sbin_PROGRAMS = tsig-keygen rndc-confgen + + install-exec-hook: +- ln -f $(DESTDIR)$(sbindir)/tsig-keygen \ +- $(DESTDIR)$(sbindir)/ddns-confgen ++ ln -f $(DESTDIR)$(sbindir)/tsig-keygen$(PROGRAM_SUFFIX) \ ++ $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX) + + uninstall-hook: +- -rm -f $(DESTDIR)$(sbindir)/ddns-confgen ++ -rm -f $(DESTDIR)$(sbindir)/ddns-confgen$(PROGRAM_SUFFIX) +-- +2.54.0 + diff --git a/bind.spec b/bind.spec index 6856c08..2b6eb76 100644 --- a/bind.spec +++ b/bind.spec @@ -154,6 +154,8 @@ Patch32: bind-9.18-partial-additional-records.patch Patch33: bind-9.18-dig-idn-input-always.patch # downstream only too Patch34: bind-9.18-dig-idn-input-always-test.patch +# downstream only, https://redhat.atlassian.net/browse/IDM-6189 +Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers @@ -351,6 +353,9 @@ in HTML and PDF format. # customize include directory %global bind_include %{_includedir}/bind%{mver} +# use this suffix for binaries +%global program_suffix -%{mver} + %prep %if 0%{?fedora} @@ -419,6 +424,7 @@ export LIBDIR_SUFFIX --includedir=%{bind_include} \ --with-tuning=large \ --with-libidn2 \ + --program-suffix=%{program_suffix} \ %if %{with GEOIP2} --with-maxminddb \ %endif @@ -444,7 +450,7 @@ export LIBDIR_SUFFIX %endif --enable-fixed-rrset \ --enable-full-report \ - CPPFLAGS="$CPPFLAGS" \ + CPPFLAGS="$CPPFLAGS" PROGRAM_SUFFIX="%{program_suffix}" \ ; %if %{with DNSTAP} pushd lib @@ -461,7 +467,7 @@ fmtutil-user --listcfg || : fmtutil-user --missing || : %endif -%make_build +%make_build PROGRAM_SUFFIX="%{program_suffix}" %if %{with DOC} make doc @@ -576,7 +582,7 @@ touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf #end chroot pushd build -%make_install +%make_install PROGRAM_SUFFIX="%{program_suffix}" popd # Remove unwanted files @@ -592,11 +598,10 @@ install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir} mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir} install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf -mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir} -install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-chroot.sh -install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/generate-rndc-key.sh - -install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/setup-named-softhsm.sh +mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}/%{name} +install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh +install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh +install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig @@ -619,17 +624,20 @@ popd # 9.16.4 installs even manual pages for tools not generated %if %{without DNSTAP} -rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read.1* || true +rm -f ${RPM_BUILD_ROOT}%{_mandir}/man1/dnstap-read%{program_suffix}.1* || true %endif %if %{without LMDB} -rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf.8* || true +rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf%{program_suffix}.8* || true %endif pushd ${RPM_BUILD_ROOT}%{_mandir}/man8 -ln -s ddns-confgen.8.gz tsig-keygen.8.gz +ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz popd pushd ${RPM_BUILD_ROOT}%{_mandir}/man1 -ln -s named-checkzone.1.gz named-compilezone.1.gz +ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz +popd +pushd ${RPM_BUILD_ROOT}%{_mandir}/man5 + mv named.conf%{program_suffix}.5.gz named.conf.5.gz popd %if %{with DOC} @@ -657,7 +665,7 @@ cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log # configuration files: -install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf +install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named%{program_suffix}.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key @@ -696,7 +704,7 @@ done :; mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} -install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/named.conf +install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf %post @@ -791,30 +799,30 @@ fi; %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca %config(noreplace) %{_sysconfdir}/logrotate.d/named -%{_tmpfilesdir}/named.conf +%{_tmpfilesdir}/%{name}.conf %{_unitdir}/named.service %{_unitdir}/named-setup-rndc.service -%{_sysusersdir}/named.conf -%{_bindir}/named-journalprint -%{_bindir}/named-checkconf -%{_bindir}/named-rrchecker -%{_bindir}/mdig -%{_sbindir}/named +%{_sysusersdir}/%{name}.conf +%{_bindir}/named-journalprint%{program_suffix} +%{_bindir}/named-checkconf%{program_suffix} +%{_bindir}/named-rrchecker%{program_suffix} +%{_bindir}/mdig%{program_suffix} +%{_sbindir}/named%{program_suffix} %{_sbindir}/rndc* %if "%{_sbindir}" != "%{_bindir}" -%{_sbindir}/named-checkconf +%{_sbindir}/named-checkconf%{program_suffix} %endif %{_libexecdir}/generate-rndc-key.sh %{_libexecdir}/setup-named-softhsm.sh -%{_mandir}/man1/mdig.1* -%{_mandir}/man1/named-rrchecker.1* +%{_mandir}/man1/mdig%{program_suffix}.1* +%{_mandir}/man1/named-rrchecker%{program_suffix}.1* %{_mandir}/man5/named.conf.5* -%{_mandir}/man5/rndc.conf.5* -%{_mandir}/man8/rndc.8* -%{_mandir}/man8/named.8* -%{_mandir}/man1/named-checkconf.1* -%{_mandir}/man8/rndc-confgen.8* -%{_mandir}/man1/named-journalprint.1* +%{_mandir}/man5/rndc.conf%{program_suffix}.5* +%{_mandir}/man8/rndc%{program_suffix}.8* +%{_mandir}/man8/named%{program_suffix}.8* +%{_mandir}/man1/named-checkconf%{program_suffix}.1* +%{_mandir}/man8/rndc-confgen%{program_suffix}.8* +%{_mandir}/man1/named-journalprint%{program_suffix}.1* %{_mandir}/man8/filter-*.8.gz %doc README.md named.conf.default %doc sample/ @@ -822,7 +830,7 @@ fi; # Hide configuration %defattr(0640,root,named,0750) %dir %{_sysconfdir}/named -%config(noreplace) %verify(not link) %{_sysconfdir}/named.conf +%config(noreplace) %verify(not link) %{_sysconfdir}/named%{program_suffix}.conf %config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones %defattr(0660,root,named,01770) %dir %{_localstatedir}/named @@ -858,40 +866,40 @@ fi; %license COPYRIGHT %files utils -%{_bindir}/dig -%{_bindir}/delv -%{_bindir}/host -%{_bindir}/nslookup -%{_bindir}/nsupdate -%{_bindir}/arpaname -%{_sbindir}/ddns-confgen -%{_sbindir}/tsig-keygen -%{_bindir}/nsec3hash -%{_bindir}/named-checkzone -%{_bindir}/named-compilezone +%{_bindir}/dig%{program_suffix} +%{_bindir}/delv%{program_suffix} +%{_bindir}/host%{program_suffix} +%{_bindir}/nslookup%{program_suffix} +%{_bindir}/nsupdate%{program_suffix} +%{_bindir}/arpaname%{program_suffix} +%{_sbindir}/ddns-confgen%{program_suffix} +%{_sbindir}/tsig-keygen%{program_suffix} +%{_bindir}/nsec3hash%{program_suffix} +%{_bindir}/named-checkzone%{program_suffix} +%{_bindir}/named-compilezone%{program_suffix} %if "%{_sbindir}" != "%{_bindir}" -%{_sbindir}/named-checkzone -%{_sbindir}/named-compilezone +%{_sbindir}/named-checkzone%{program_suffix} +%{_sbindir}/named-compilezone%{program_suffix} %endif %if %{with DNSTAP} -%{_bindir}/dnstap-read -%{_mandir}/man1/dnstap-read.1* +%{_bindir}/dnstap-read%{program_suffix} +%{_mandir}/man1/dnstap-read%{program_suffix}.1* %endif %if %{with LMDB} -%{_bindir}/named-nzd2nzf -%{_mandir}/man1/named-nzd2nzf.1* +%{_bindir}/named-nzd2nzf%{program_suffix} +%{_mandir}/man1/named-nzd2nzf%{program_suffix}.1* %endif -%{_mandir}/man1/host.1* -%{_mandir}/man1/nsupdate.1* -%{_mandir}/man1/dig.1* -%{_mandir}/man1/delv.1* -%{_mandir}/man1/nslookup.1* -%{_mandir}/man1/arpaname.1* -%{_mandir}/man8/ddns-confgen.8* -%{_mandir}/man8/tsig-keygen.8* -%{_mandir}/man1/nsec3hash.1* -%{_mandir}/man1/named-checkzone.1* -%{_mandir}/man1/named-compilezone.1* +%{_mandir}/man1/host%{program_suffix}.1* +%{_mandir}/man1/nsupdate%{program_suffix}.1* +%{_mandir}/man1/dig%{program_suffix}.1* +%{_mandir}/man1/delv%{program_suffix}.1* +%{_mandir}/man1/nslookup%{program_suffix}.1* +%{_mandir}/man1/arpaname%{program_suffix}.1* +%{_mandir}/man8/ddns-confgen%{program_suffix}.8* +%{_mandir}/man8/tsig-keygen%{program_suffix}.8* +%{_mandir}/man1/nsec3hash%{program_suffix}.1* +%{_mandir}/man1/named-checkzone%{program_suffix}.1* +%{_mandir}/man1/named-compilezone%{program_suffix}.1* %{_sysconfdir}/trusted-key.key %files dnssec-utils From 743cc89bef3cab7a83d58c9763800e50ac717fe6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Apr 2026 19:49:43 +0200 Subject: [PATCH 115/144] Use subdirectory in helper services too Fixed with actually building version --- bind.spec | 30 ++++++++++++++++-------------- named-chroot-setup.service | 4 ++-- named-setup-rndc.service | 2 +- 3 files changed, 19 insertions(+), 17 deletions(-) diff --git a/bind.spec b/bind.spec index 2b6eb76..4950e2f 100644 --- a/bind.spec +++ b/bind.spec @@ -590,23 +590,25 @@ rm -f ${RPM_BUILD_ROOT}/etc/bind.keys # Systemd unit files mkdir -p ${RPM_BUILD_ROOT}%{_unitdir} -install -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir} -install -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir} -install -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir} -install -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir} +install -p -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir} +install -p -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir} +install -p -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir} +install -p -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir} + +sed -e "s|\%{name}|%{name}|" -i ${RPM_BUILD_ROOT}%{_unitdir}/named-*.service mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir} -install -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/named.conf +install -p -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf mkdir -p ${RPM_BUILD_ROOT}%{_libexecdir}/%{name} -install -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh -install -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh -install -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh +install -p -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-chroot.sh +install -p -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh +install -p -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig -install -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named -install -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files +install -p -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named +install -p -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files %if "%{_sbindir}" != "%{_bindir}" # Compatibility with previous major versions, only for selected binaries @@ -637,7 +639,7 @@ pushd ${RPM_BUILD_ROOT}%{_mandir}/man1 ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz popd pushd ${RPM_BUILD_ROOT}%{_mandir}/man5 - mv named.conf%{program_suffix}.5.gz named.conf.5.gz + mv named.conf%{program_suffix}.5 named.conf.5 popd %if %{with DOC} @@ -812,8 +814,8 @@ fi; %if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf%{program_suffix} %endif -%{_libexecdir}/generate-rndc-key.sh -%{_libexecdir}/setup-named-softhsm.sh +%{_libexecdir}/%{name}/generate-rndc-key.sh +%{_libexecdir}/%{name}/setup-named-softhsm.sh %{_mandir}/man1/mdig%{program_suffix}.1* %{_mandir}/man1/named-rrchecker%{program_suffix}.1* %{_mandir}/man5/named.conf.5* @@ -929,7 +931,7 @@ fi; %config(noreplace) %{_sysconfdir}/named-chroot.files %{_unitdir}/named-chroot.service %{_unitdir}/named-chroot-setup.service -%{_libexecdir}/setup-named-chroot.sh +%{_libexecdir}/%{name}/setup-named-chroot.sh %{_tmpfilesdir}/%{name}-chroot.conf %defattr(0664,root,named,-) %ghost %dev(c,1,3) %verify(not mtime) %{chroot_prefix}/dev/null diff --git a/named-chroot-setup.service b/named-chroot-setup.service index 237a909..1aae6e4 100644 --- a/named-chroot-setup.service +++ b/named-chroot-setup.service @@ -8,5 +8,5 @@ After=named-setup-rndc.service [Service] Type=oneshot RemainAfterExit=yes -ExecStart=/usr/libexec/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files -ExecStop=/usr/libexec/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files +ExecStart=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot on /etc/named-chroot.files +ExecStop=/usr/libexec/%{name}/setup-named-chroot.sh /var/named/chroot off /etc/named-chroot.files diff --git a/named-setup-rndc.service b/named-setup-rndc.service index ff85e3c..9abab08 100644 --- a/named-setup-rndc.service +++ b/named-setup-rndc.service @@ -4,4 +4,4 @@ Description=Generate rndc key for BIND (DNS) [Service] Type=oneshot -ExecStart=/usr/libexec/generate-rndc-key.sh +ExecStart=/usr/libexec/%{name}/generate-rndc-key.sh From 3c1d216595d8820d5a7347a6ab72df8a5d1f7fb5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 30 Apr 2026 20:30:26 +0200 Subject: [PATCH 116/144] Move binaries to versioned executables spec bump Only bump release. Provide some explanation in changelog. bind-chroot package remains conflicting and can be installed only once. --- bind.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bind.spec b/bind.spec index 4950e2f..61844a0 100644 --- a/bind.spec +++ b/bind.spec @@ -980,6 +980,10 @@ fi; %changelog * Wed Jun 17 2026 Petr Menšík - 32:9.18.50-2 - Prepare devel subpackage installable multiple times +- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages +- Use alternatives symlinks to provide original names +- Allow installation of multiple major versions at the same time +- chroot package still conflicts, might be fixed later * Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 - Update to 9.18.50 (rhbz#2489833) From 8d6979fcf3db0b078819ba7a7c8b94e2407a5292 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 15 May 2026 16:00:53 +0200 Subject: [PATCH 117/144] Update systemd unit files with %name and %program_suffix Move creation of systemd units into build phase. Replace not only %name, also program_suffix. Change services to use template for systemd unit files To execute correctly systemd services, make them templates fixed at the build time. Still conflicts with potential alternatives. Solve also filter plugins to have suffix also. --- bind.spec | 56 +++++++++++-------- ...p.service => named-chroot-setup.service.in | 0 ...-chroot.service => named-chroot.service.in | 9 +-- ...ndc.service => named-setup-rndc.service.in | 0 named.service | 26 --------- named.service.in | 28 ++++++++++ 6 files changed, 67 insertions(+), 52 deletions(-) rename named-chroot-setup.service => named-chroot-setup.service.in (100%) rename named-chroot.service => named-chroot.service.in (57%) rename named-setup-rndc.service => named-setup-rndc.service.in (100%) delete mode 100644 named.service create mode 100644 named.service.in diff --git a/bind.spec b/bind.spec index 61844a0..eec79dd 100644 --- a/bind.spec +++ b/bind.spec @@ -119,12 +119,12 @@ Source25: named.conf.sample Source27: named.root.key Source35: bind.tmpfiles.d Source36: trusted-key.key -Source37: named.service -Source38: named-chroot.service +Source37: named.service.in +Source38: named-chroot.service.in Source41: setup-named-chroot.sh Source42: generate-rndc-key.sh -Source44: named-chroot-setup.service -Source46: named-setup-rndc.service +Source44: named-chroot-setup.service.in +Source46: named-setup-rndc.service.in Source48: setup-named-softhsm.sh Source49: named-chroot.files Source50: named.sysusers @@ -355,6 +355,8 @@ in HTML and PDF format. # use this suffix for binaries %global program_suffix -%{mver} +# preparation scripts directory +%global bind_libexecdir %{_libexecdir}/%{name} %prep @@ -475,6 +477,18 @@ fmtutil-user --missing || : popd # build +# Prepare unit files +for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do + NEWNAME="$(basename -- "$SERVICEFILE" .in)" + sed -e "s|%%{program_suffix}|%{program_suffix}|g" \ + -e "s|%%{name}|%{name}|g" \ + -e "s|%%{bind_libexecdir}|%{bind_libexecdir}|g" \ + -e "s|%%{_bindir}|%{_bindir}|g" \ + -e "s|%%{_sbindir}|%{_sbindir}|g" \ + "$SERVICEFILE" > "$NEWNAME" + touch -r "$SERVICEFILE" "$NEWNAME" # Set change time to time of template +done + %unit_prepare_build build %systemtest_prepare_build build @@ -589,13 +603,8 @@ popd rm -f ${RPM_BUILD_ROOT}/etc/bind.keys # Systemd unit files -mkdir -p ${RPM_BUILD_ROOT}%{_unitdir} -install -p -m 644 %{SOURCE37} ${RPM_BUILD_ROOT}%{_unitdir} -install -p -m 644 %{SOURCE38} ${RPM_BUILD_ROOT}%{_unitdir} -install -p -m 644 %{SOURCE44} ${RPM_BUILD_ROOT}%{_unitdir} -install -p -m 644 %{SOURCE46} ${RPM_BUILD_ROOT}%{_unitdir} - -sed -e "s|\%{name}|%{name}|" -i ${RPM_BUILD_ROOT}%{_unitdir}/named-*.service +mkdir -p "${RPM_BUILD_ROOT}%{_unitdir}" +install -p -m 644 *.service "${RPM_BUILD_ROOT}%{_unitdir}" mkdir -p ${RPM_BUILD_ROOT}%{_sysusersdir} install -p -m 644 %{SOURCE50} ${RPM_BUILD_ROOT}%{_sysusersdir}/%{name}.conf @@ -605,7 +614,9 @@ install -p -m 755 %{SOURCE41} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-name install -p -m 755 %{SOURCE42} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/generate-rndc-key.sh install -p -m 755 %{SOURCE48} ${RPM_BUILD_ROOT}%{_libexecdir}/%{name}/setup-named-softhsm.sh -install -m 644 %SOURCE3 ${RPM_BUILD_ROOT}/etc/logrotate.d/named +mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d +install -m 644 %{SOURCE3} ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/named + mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig install -p -m 644 %{SOURCE1} ${RPM_BUILD_ROOT}%{_sysconfdir}/sysconfig/named install -p -m 644 %{SOURCE49} ${RPM_BUILD_ROOT}%{_sysconfdir}/named-chroot.files @@ -620,7 +631,11 @@ find ${RPM_BUILD_ROOT}/%{_libdir} -name '*.la' -exec '/bin/rm' '-f' '{}' ';'; pushd ${RPM_BUILD_ROOT}/%{_libdir} for LIB in isccc ns dns isc isccfg irs bind9; do - mv "lib${LIB}.so" "lib${LIB}-%{mver}.so" + mv "lib${LIB}.so" "lib${LIB}%{program_suffix}.so" + done + for PLUGIN in bind/*.so; do + TARGET="$(echo "$PLUGIN" | sed -e "s/\.so$/%{program_suffix}&/")" + mv "${PLUGIN}" "${TARGET}" done popd @@ -633,13 +648,10 @@ rm -f ${RPM_BUILD_ROOT}%{_mandir}/man8/named-nzd2nzf%{program_suffix}.8* || true %endif pushd ${RPM_BUILD_ROOT}%{_mandir}/man8 -ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz + ln -s ddns-confgen%{program_suffix}.8.gz tsig-keygen%{program_suffix}.8.gz popd pushd ${RPM_BUILD_ROOT}%{_mandir}/man1 -ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz -popd -pushd ${RPM_BUILD_ROOT}%{_mandir}/man5 - mv named.conf%{program_suffix}.5 named.conf.5 + ln -s named-checkzone%{program_suffix}.1.gz named-compilezone%{program_suffix}.1.gz popd %if %{with DOC} @@ -667,7 +679,7 @@ cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log # configuration files: -install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named%{program_suffix}.conf +install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} install -m 644 %{SOURCE27} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.root.key install -m 644 %{SOURCE36} ${RPM_BUILD_ROOT}%{_sysconfdir}/trusted-key.key @@ -818,21 +830,21 @@ fi; %{_libexecdir}/%{name}/setup-named-softhsm.sh %{_mandir}/man1/mdig%{program_suffix}.1* %{_mandir}/man1/named-rrchecker%{program_suffix}.1* -%{_mandir}/man5/named.conf.5* +%{_mandir}/man5/named.conf%{program_suffix}.5* %{_mandir}/man5/rndc.conf%{program_suffix}.5* %{_mandir}/man8/rndc%{program_suffix}.8* %{_mandir}/man8/named%{program_suffix}.8* %{_mandir}/man1/named-checkconf%{program_suffix}.1* %{_mandir}/man8/rndc-confgen%{program_suffix}.8* %{_mandir}/man1/named-journalprint%{program_suffix}.1* -%{_mandir}/man8/filter-*.8.gz +%{_mandir}/man8/filter-*%{program_suffix}.8.gz %doc README.md named.conf.default %doc sample/ # Hide configuration %defattr(0640,root,named,0750) %dir %{_sysconfdir}/named -%config(noreplace) %verify(not link) %{_sysconfdir}/named%{program_suffix}.conf +%config(noreplace) %verify(not link) %{_sysconfdir}/named.conf %config(noreplace) %verify(not link) %{_sysconfdir}/named.rfc1912.zones %defattr(0660,root,named,01770) %dir %{_localstatedir}/named diff --git a/named-chroot-setup.service b/named-chroot-setup.service.in similarity index 100% rename from named-chroot-setup.service rename to named-chroot-setup.service.in diff --git a/named-chroot.service b/named-chroot.service.in similarity index 57% rename from named-chroot.service rename to named-chroot.service.in index 4c38601..f9f2a3e 100644 --- a/named-chroot.service +++ b/named-chroot.service.in @@ -12,17 +12,18 @@ After=network.target [Service] Type=forking +Environment=OPTIONS= Environment=NAMEDCONF=/etc/named.conf EnvironmentFile=-/etc/sysconfig/named Environment=KRB5_KTNAME=/etc/named.keytab PIDFile=/var/named/chroot/run/named/named.pid -ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi' -ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS +ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_bindir}/named-checkconf%{program_suffix} -t /var/named/chroot -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi' +ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} -t /var/named/chroot $OPTIONS -ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi' +ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi' -ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' +ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID' PrivateTmp=false Restart=on-abnormal diff --git a/named-setup-rndc.service b/named-setup-rndc.service.in similarity index 100% rename from named-setup-rndc.service rename to named-setup-rndc.service.in diff --git a/named.service b/named.service deleted file mode 100644 index 5c32fc5..0000000 --- a/named.service +++ /dev/null @@ -1,26 +0,0 @@ -[Unit] -Description=Berkeley Internet Name Domain (DNS) -Wants=nss-lookup.target -Wants=named-setup-rndc.service -Before=nss-lookup.target -After=named-setup-rndc.service -After=network.target - -[Service] -Type=forking -Environment=NAMEDCONF=/etc/named.conf -EnvironmentFile=-/etc/sysconfig/named -Environment=KRB5_KTNAME=/etc/named.keytab -PIDFile=/run/named/named.pid - -ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then /usr/bin/named-checkconf -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi' -ExecStart=/usr/sbin/named -u named -c ${NAMEDCONF} $OPTIONS -ExecReload=/bin/sh -c 'if /usr/sbin/rndc null > /dev/null 2>&1; then /usr/sbin/rndc reload; else /bin/kill -HUP $MAINPID; fi' - -ExecStop=/bin/sh -c '/usr/sbin/rndc stop > /dev/null 2>&1 || /bin/kill -TERM $MAINPID' - -PrivateTmp=true -Restart=on-abnormal - -[Install] -WantedBy=multi-user.target diff --git a/named.service.in b/named.service.in new file mode 100644 index 0000000..de9a915 --- /dev/null +++ b/named.service.in @@ -0,0 +1,28 @@ +[Unit] +Description=Berkeley Internet Name Domain (DNS) +Wants=nss-lookup.target +Wants=named-setup-rndc.service +Before=nss-lookup.target +After=named-setup-rndc.service +After=network.target + +[Service] +Type=forking +Environment=OPTIONS= +Environment=NAMEDCONF=/etc/named.conf +EnvironmentFile=-/etc/sysconfig/named +Environment=KRB5_KTNAME=/etc/named.keytab +PIDFile=/run/named/named.pid + +ExecStartPre=/bin/bash -c 'if [ ! "$DISABLE_ZONE_CHECKING" == "yes" ]; then %{_sbindir}/named-checkconf%{program_suffix} -z "$NAMEDCONF"; else echo "Checking of zone files is disabled"; fi' +ExecStart=%{_sbindir}/named%{program_suffix} -u named -c ${NAMEDCONF} $OPTIONS + +ExecReload=/bin/sh -c 'if %{_sbindir}/rndc%{program_suffix} null > /dev/null 2>&1; then %{_sbindir}/rndc%{program_suffix} reload; else %{_bindir}/kill -HUP $MAINPID; fi' + +ExecStop=/bin/sh -c '%{_sbindir}/rndc%{program_suffix} stop > /dev/null 2>&1 || %{_bindir}/kill -TERM $MAINPID' + +PrivateTmp=true +Restart=on-abnormal + +[Install] +WantedBy=multi-user.target From 448bd64587914a981f858b710b60dc69793acf59 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 8 Jun 2026 23:17:32 +0200 Subject: [PATCH 118/144] Seemingly working alternatives including unit files Support basic systemd unit handling Fix double inclusion of bind9 include subdirectory Fix bind-dnssec-utils ghost files Make permissions match target binaries too. Do not use alternatives for named-checkzone and named-compilezone Use alternatives, prefix name with %{upname}- Add also usage of --initscript %{name}. Not use if named service name should not be used there instead. Match also remove names. Define reusable variables with tool names Use it to define common lists, reuse them multiple times. Add named-{checkzone,compilezone}. Fix utils man8 typo. Handle mans and units too. --- bind.spec | 320 +++++++++++++++++++++++++++++++++++++++++++++++++----- 1 file changed, 290 insertions(+), 30 deletions(-) diff --git a/bind.spec b/bind.spec index eec79dd..8b0c29c 100644 --- a/bind.spec +++ b/bind.spec @@ -36,6 +36,7 @@ %bcond_with OPENSSL_ENGINE %endif +%{!?manext:%global manext .gz} %{!?_pkgdocdir:%global _pkgdocdir %{_docdir}/%{name}-%{version}} %global bind_dir /var/named %global chroot_prefix %{bind_dir}/chroot @@ -68,6 +69,9 @@ # lib*.so.X versions of selected libraries no longer provided, # lib*-%%{version}-RH.so is provided as an internal implementation detail +# priority of this srpm executables +%global alternatives_prio 10 + # Upstream package name %global upname bind # Epoch is intentionally missing from Provides to be lower than bind package @@ -164,6 +168,8 @@ Requires: coreutils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep +Requires(post): %{_bindir}/alternatives +Requires(postun): %{_bindir}/alternatives Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} @@ -255,6 +261,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} # For compatibility with Debian package Provides: dnsutils = %{epoch}:%{version}-%{release} Obsoletes: %{name}-pkcs11-utils < 32:9.18.4-2 +Requires(post): %{_bindir}/alternatives +Requires(postun): %{_bindir}/alternatives %upname_compat %{upname}-utils %description utils @@ -273,6 +281,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils Obsoletes: python3-%{name} < 32:9.18.0 Obsoletes: %{name}-dnssec-doc < 32:9.18.4-2 +Requires(post): %{_bindir}/alternatives +Requires(postun): %{_bindir}/alternatives %upname_compat %{upname}-dnssec-utils %description dnssec-utils @@ -480,6 +490,9 @@ popd # build # Prepare unit files for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do NEWNAME="$(basename -- "$SERVICEFILE" .in)" + if ! echo "$NEWNAME" | grep -q -- -chroot; then + NEWNAME="$(echo "$NEWNAME" | sed -e "s,^named,%{name},")" + fi sed -e "s|%%{program_suffix}|%{program_suffix}|g" \ -e "s|%%{name}|%{name}|g" \ -e "s|%%{bind_libexecdir}|%{bind_libexecdir}|g" \ @@ -721,8 +734,117 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf + +%if %{with DNSTAP} + %global utils_bin1_dnstap dnstap-read +%endif +%if %{with LMDB} + %global utils_bin1_lmdb named-nzd2nzf +%endif + +%global utils_bin1 dig host delv nslookup nsupdate arpaname nsec3hash named-{checkzone,compilezone} %{?utils_bin1_dnstap} %{?utils_bin1_lmdb} +%global utils_bin8 ddns-confgen tsig-keygen +%global main_bin8 named rndc{,-confgen} +%global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig +%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,verify} +%global main_man5 named.conf rndc.conf +%global main_unit named.service named-setup-rndc.service +%global main_lib filter-{a,aaaa} + +# Alternatives touches symlinks targets +for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do + install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_bindir}/${BIN} + touch ${RPM_BUILD_ROOT}%{_mandir}/man1/${BIN}.1 +done + +for BIN in %{main_bin8}; do + install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_sbindir}/${BIN} + touch ${RPM_BUILD_ROOT}%{_mandir}/man8/${BIN}.8 +done + +for MAN in %{main_man5}; do + touch ${RPM_BUILD_ROOT}%{_mandir}/man5/$MAN.5 +done +for MAN in %{utils_bin8}; do + touch ${RPM_BUILD_ROOT}%{_mandir}/man8/$MAN.8 +done + +# named-chroot*.service are missing intentionally now +# let bind*-chroot conflict +for UNIT in %{main_unit}; do + touch ${RPM_BUILD_ROOT}%{_unitdir}/$UNIT +done + + +%define altfbin() \\\ + --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix} +%define altfman() \\\ + --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} +# {1} (_unitdir/)compat-service {2} new-version-specific-service +%define altfunit() \\\ + --follower %{_unitdir}/%{1} %{upname}-%{1} %{_unitdir}/%{2} + +# {1} (_bindir/)exec-name {2} man-category +%define altfbinman() \\\ + --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix} \\\ + --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} + +%define altfsbin() \\\ + --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix} + +# {1} (_sbindir/)exec-name {2} man-category +%define altfsbinman() \\\ + --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix} \\\ + --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} + +%define altflibman() \\\ + --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\ + --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} + +%define altrmbinman() \ + BINX="%{_bindir}/%{1}"; \ + MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \ + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \ + rm -f -- "$BINX"; \ + fi; \ + if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \ + rm -f -- "$MANX"; \ + fi +%define altrmsbinman() \ + BINX="%{_sbindir}/%{1}"; \ + MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \ + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \ + rm -f -- "$BINX"; \ + fi; \ + if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \ + rm -f -- "$MANX"; \ + fi + +%define altrmlibman() \ + BINX="%{_libdir}/bind/%{1}.so"; \ + MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \ + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \ + rm -f -- "$BINX"; \ + fi; \ + if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \ + rm -f -- "$MANX"; \ + fi + +%define altrmman() \ + MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \ + if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \ + rm -f -- "$MANX"; \ + fi + +%define altrmunit() \ + UNITX="%{_unitdir}/%{1}" \ + if ! [ -L "$UNITX" ] && [ -f "$UNITX" ]; then \ + rm -f -- "$UNITX"; \ + fi + + %post -%?ldconfig +%{?ldconfig} if [ "$1" -eq 1 ]; then # Initial installation [ -x /sbin/restorecon ] && /sbin/restorecon /etc/rndc.* /etc/named.* >/dev/null 2>&1 ; @@ -745,17 +867,105 @@ else fi fi fi -%systemd_post named.service +%if "%{program_suffix}" != "" + ALTS="" + for BIN in %{main_bin1}; do + ALTS+="%{altfbinman $BIN 1}" + %{altrmbinman $BIN 1} + done + for BIN in %{main_bin8}; do + ALTS+="%{altfsbinman $BIN 8}" + %{altrmsbinman $BIN 8} + done + for MAN in %{main_man5}; do + %{altrmman $MAN 5} + ALTS+="%{altfman $MAN 5}" + done + for LIB in %{main_lib}; do + %{altrmlibman $LIB 8} + ALTS+="%{altflibman $LIB 8}" + done + for UNIT in %{main_unit}; do + %{altrmunit $UNIT} + done + alternatives --install %{_sbindir}/named %{upname}-named %{_sbindir}/named%{program_suffix} %{alternatives_prio} \ + %{altfman named 8} \ + %{altfunit named.service %{name}.service} \ + %{altfunit named-setup-rndc.service %{name}-setup-rndc.service} \ + --initscript %{name} \ + ${ALTS} +%endif +%systemd_post %{name}.service :; %preun # Package removal, not upgrade -%systemd_preun named.service +%systemd_preun %{name}.service %postun -%?ldconfig +%{?ldconfig} # Package upgrade, not uninstall -%systemd_postun_with_restart named.service +%systemd_postun_with_restart %{name}.service +%if "%{program_suffix}" != "" +if [ $1 -eq 0 ] ; then + alternatives --remove %{upname}-named %{_sbindir}/named%{program_suffix} +fi +%endif +%end + +%post utils +%if "%{program_suffix}" != "" + ALTS="" + for BIN in %{utils_bin1}; do + %{altrmbinman ${BIN} 1} + [ "$BIN" != dig ] && ALTS+="%{altfbinman $BIN 1}" + done + for BIN in %{utils_bin8}; do + %{altrmsbinman ${BIN} 8} + ALTS+="%{altfbinman $BIN 8}" + done + alternatives --install %{_bindir}/dig %{upname}-utils-dig %{_bindir}/dig%{program_suffix} %{alternatives_prio} \ + %{altfman dig 1} \ + ${ALTS} +%endif +%end + +%postun utils +%if "%{program_suffix}" != "" +if [ $1 -eq 0 ] ; then + alternatives --remove %{upname}-utils-dig %{_bindir}/dig%{program_suffix} +fi +%endif +%end + +%post dnssec-utils +%if "%{program_suffix}" != "" + ALTS="" + for BIN in %{dnssec_utils_bin1}; do + BINX="%{_bindir}/${BIN}" + MANX="%{_mandir}/man1/${BIN}.1%{manext}" + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then + rm -f -- "$BINX" + fi + if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then + rm -f -- "$MANX" + fi + [ "$BIN" != dnssec-verify ] && ALTS+="%{altfbinman $BIN 1}" + done + alternatives --install %{_bindir}/dnssec-verify %{upname}-dnssec-utils %{_bindir}/dnssec-verify%{program_suffix} %{alternatives_prio} \ + %{altfman dnssec-verify 1} \ + $ALTS +%endif +%end + +%postun dnssec-utils +%if "%{program_suffix}" != "" +if [ $1 -eq 0 ] ; then + alternatives --remove %{upname}-dnssec-utils %{_bindir}/dnssec-verify%{program_suffix} +fi +%endif +%end + # Fix permissions on existing device files on upgrade %define chroot_fix_devices() \ @@ -807,37 +1017,60 @@ fi; # TODO: Move from lib/bind to lib/named, as used by upstream # FIXME: current build targets filters into %%_libdir/bind again? %dir %{_libdir}/bind -%{_libdir}/bind/filter*.so +%{_libdir}/bind/filter-{a,aaaa}%{program_suffix}.so %dir %{_libdir}/named %config(noreplace) %verify(not md5 size mtime) %{_sysconfdir}/sysconfig/named %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.root.key %config(noreplace) %attr(0644,root,named) %{_sysconfdir}/named.ca %config(noreplace) %{_sysconfdir}/logrotate.d/named %{_tmpfilesdir}/%{name}.conf -%{_unitdir}/named.service -%{_unitdir}/named-setup-rndc.service +%{_unitdir}/%{name}.service +%{_unitdir}/%{name}-setup-rndc.service %{_sysusersdir}/%{name}.conf %{_bindir}/named-journalprint%{program_suffix} %{_bindir}/named-checkconf%{program_suffix} %{_bindir}/named-rrchecker%{program_suffix} %{_bindir}/mdig%{program_suffix} %{_sbindir}/named%{program_suffix} -%{_sbindir}/rndc* +%{_sbindir}/rndc%{program_suffix} +%{_sbindir}/rndc-confgen%{program_suffix} +%ghost %{_unitdir}/named.service +%ghost %{_unitdir}/named-setup-rndc.service +%ghost %{_libdir}/bind/filter-{a,aaaa}.so +%ghost %{_bindir}/named-checkconf +%ghost %{_bindir}/named-journalprint +%ghost %{_bindir}/named-rrchecker +%ghost %{_bindir}/mdig +%ghost %{_sbindir}/named +%ghost %{_sbindir}/rndc +%ghost %{_sbindir}/rndc-confgen %if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf%{program_suffix} +%ghost %{_sbindir}/named-checkconf %endif %{_libexecdir}/%{name}/generate-rndc-key.sh %{_libexecdir}/%{name}/setup-named-softhsm.sh +# man pages %{_mandir}/man1/mdig%{program_suffix}.1* +%{_mandir}/man1/named-checkconf%{program_suffix}.1* +%{_mandir}/man1/named-journalprint%{program_suffix}.1* %{_mandir}/man1/named-rrchecker%{program_suffix}.1* %{_mandir}/man5/named.conf%{program_suffix}.5* %{_mandir}/man5/rndc.conf%{program_suffix}.5* %{_mandir}/man8/rndc%{program_suffix}.8* %{_mandir}/man8/named%{program_suffix}.8* -%{_mandir}/man1/named-checkconf%{program_suffix}.1* %{_mandir}/man8/rndc-confgen%{program_suffix}.8* -%{_mandir}/man1/named-journalprint%{program_suffix}.1* -%{_mandir}/man8/filter-*%{program_suffix}.8.gz +%{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8* +%ghost %{_mandir}/man1/mdig.1* +%ghost %{_mandir}/man1/named-checkconf.1* +%ghost %{_mandir}/man1/named-journalprint.1* +%ghost %{_mandir}/man1/named-rrchecker.1* +%ghost %{_mandir}/man5/named.conf.5* +%ghost %{_mandir}/man5/rndc.conf.5* +%ghost %{_mandir}/man8/rndc.8* +%ghost %{_mandir}/man8/named.8* +%ghost %{_mandir}/man8/rndc-confgen.8* +%ghost %{_mandir}/man8/filter-{a,aaaa}.8* %doc README.md named.conf.default %doc sample/ @@ -866,7 +1099,7 @@ fi; # ^- The default rndc.conf which uses rndc.key is in named's default internal config - # so rndc.conf is not necessary. %defattr(-,named,named,-) -%dir /run/named +%dir %{_rundir}/named %files libs %{_libdir}/libbind9-%{version}*.so @@ -880,45 +1113,73 @@ fi; %license COPYRIGHT %files utils -%{_bindir}/dig%{program_suffix} +%{_bindir}/arpaname%{program_suffix} %{_bindir}/delv%{program_suffix} +%{_bindir}/dig%{program_suffix} %{_bindir}/host%{program_suffix} +%{_bindir}/nsec3hash%{program_suffix} %{_bindir}/nslookup%{program_suffix} %{_bindir}/nsupdate%{program_suffix} -%{_bindir}/arpaname%{program_suffix} -%{_sbindir}/ddns-confgen%{program_suffix} -%{_sbindir}/tsig-keygen%{program_suffix} -%{_bindir}/nsec3hash%{program_suffix} %{_bindir}/named-checkzone%{program_suffix} %{_bindir}/named-compilezone%{program_suffix} +%{_sbindir}/ddns-confgen%{program_suffix} +%{_sbindir}/tsig-keygen%{program_suffix} +%ghost %{_bindir}/arpaname +%ghost %{_bindir}/delv +%ghost %{_bindir}/dig +%ghost %{_bindir}/host +%ghost %{_bindir}/nsec3hash +%ghost %{_bindir}/nslookup +%ghost %{_bindir}/nsupdate +%ghost %{_bindir}/named-checkzone +%ghost %{_bindir}/named-compilezone +%ghost %{_sbindir}/ddns-confgen +%ghost %{_sbindir}/tsig-keygen %if "%{_sbindir}" != "%{_bindir}" -%{_sbindir}/named-checkzone%{program_suffix} -%{_sbindir}/named-compilezone%{program_suffix} +%{_sbindir}/named-checkzone +%{_sbindir}/named-compilezone %endif %if %{with DNSTAP} %{_bindir}/dnstap-read%{program_suffix} %{_mandir}/man1/dnstap-read%{program_suffix}.1* +%ghost %{_bindir}/dnstap-read +%ghost %{_mandir}/man1/dnstap-read.1* %endif %if %{with LMDB} %{_bindir}/named-nzd2nzf%{program_suffix} %{_mandir}/man1/named-nzd2nzf%{program_suffix}.1* +%ghost %{_bindir}/named-nzd2nzf +%ghost %{_mandir}/man1/named-nzd2nzf.1* %endif -%{_mandir}/man1/host%{program_suffix}.1* -%{_mandir}/man1/nsupdate%{program_suffix}.1* -%{_mandir}/man1/dig%{program_suffix}.1* -%{_mandir}/man1/delv%{program_suffix}.1* -%{_mandir}/man1/nslookup%{program_suffix}.1* %{_mandir}/man1/arpaname%{program_suffix}.1* -%{_mandir}/man8/ddns-confgen%{program_suffix}.8* -%{_mandir}/man8/tsig-keygen%{program_suffix}.8* +%{_mandir}/man1/delv%{program_suffix}.1* +%{_mandir}/man1/dig%{program_suffix}.1* +%{_mandir}/man1/host%{program_suffix}.1* +%{_mandir}/man1/nslookup%{program_suffix}.1* +%{_mandir}/man1/nsupdate%{program_suffix}.1* %{_mandir}/man1/nsec3hash%{program_suffix}.1* %{_mandir}/man1/named-checkzone%{program_suffix}.1* %{_mandir}/man1/named-compilezone%{program_suffix}.1* +%{_mandir}/man8/ddns-confgen%{program_suffix}.8* +%{_mandir}/man8/tsig-keygen%{program_suffix}.8* +%ghost %{_mandir}/man1/arpaname.1* +%ghost %{_mandir}/man1/delv.1* +%ghost %{_mandir}/man1/dig.1* +%ghost %{_mandir}/man1/host.1* +%ghost %{_mandir}/man1/nslookup.1* +%ghost %{_mandir}/man1/nsupdate.1* +%ghost %{_mandir}/man1/nsec3hash.1* +%ghost %{_mandir}/man1/named-checkzone.1* +%ghost %{_mandir}/man1/named-compilezone.1* +%ghost %{_mandir}/man8/ddns-confgen.8* +%ghost %{_mandir}/man8/tsig-keygen.8* %{_sysconfdir}/trusted-key.key %files dnssec-utils -%{_bindir}/dnssec* -%{_mandir}/man1/dnssec*.1* +%{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix} +%{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}.1* +%ghost %{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify} +%ghost %{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}.1* %files devel %{_libdir}/libbind9-%{mver}.so @@ -937,7 +1198,6 @@ fi; %{bind_include}/irs %{bind_include}/isc %{bind_include}/isccfg -%{bind_include}/bind9 %files chroot %config(noreplace) %{_sysconfdir}/named-chroot.files From 3d0ec5111755a2669aa32df30861db2d518abfea Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 11 Jun 2026 20:44:34 +0200 Subject: [PATCH 119/144] Reuse %{dnssec_utils_bin1} instead copy&paste Take advantage it is defined in single value. Can be reused in %files section as it is. --- bind.spec | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/bind.spec b/bind.spec index 8b0c29c..743a497 100644 --- a/bind.spec +++ b/bind.spec @@ -746,7 +746,7 @@ install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.co %global utils_bin8 ddns-confgen tsig-keygen %global main_bin8 named rndc{,-confgen} %global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig -%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,verify} +%global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify} %global main_man5 named.conf rndc.conf %global main_unit named.service named-setup-rndc.service %global main_lib filter-{a,aaaa} @@ -1176,10 +1176,10 @@ fi; %{_sysconfdir}/trusted-key.key %files dnssec-utils -%{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix} -%{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}%{program_suffix}.1* -%ghost %{_bindir}/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify} -%ghost %{_mandir}/man1/dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify}.1* +%{_bindir}/%{dnssec_utils_bin1}%{program_suffix} +%{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1* +%ghost %{_bindir}/%{dnssec_utils_bin1} +%ghost %{_mandir}/man1/%{dnssec_utils_bin1}.1* %files devel %{_libdir}/libbind9-%{mver}.so From c84bc8187a4607882bf27b2db47dd445a0506bd8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 12 Jun 2026 13:11:34 +0200 Subject: [PATCH 120/144] Stop explicitly conflicting with original bind package --- bind.spec | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 743a497..9f4d8c5 100644 --- a/bind.spec +++ b/bind.spec @@ -78,7 +78,7 @@ %define upname_compat() \ %if "%{name}" != "%{upname}" \ Provides: %1 = %{version}-%{release} \ -Conflicts: %1 \ +Provides: alternative(%1) = %{version}-%{release} \ %endif Summary: The Berkeley Internet Name Domain (BIND) DNS (Domain Name System) server @@ -330,6 +330,7 @@ Requires: grep Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} %upname_compat %{upname}-chroot %if "%{name}" != "%{upname}" +Conflicts: %{upname}-chroot != %{epoch}:%{version}-%{release} Conflicts: %{upname}-sdb-chroot %endif From a7c81a2e29803a962ef0ee022930580bd31d4823 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 24 Jun 2026 15:57:41 +0200 Subject: [PATCH 121/144] Stop using build subdirectory and out-of-tree builds Multiple variants are not built in single build for a long time. Using different builddir causes a lot of issues in test suite. We do not need nor want subdirectory anymore. Use source directory for building and test running. Might need additional adjusts in tests repository on running test suite. --- bind.spec | 37 ++++--------------------------------- 1 file changed, 4 insertions(+), 33 deletions(-) diff --git a/bind.spec b/bind.spec index 9f4d8c5..31b5cde 100644 --- a/bind.spec +++ b/bind.spec @@ -392,18 +392,6 @@ sed -e 's, "enable-developer",& \&\& systemctl is-system-running \&>/dev/null \& %build -## We use out of tree configure/build for export libs -%define _configure "../configure" - -# normal and pkcs11 unit tests -%define unit_prepare_build() \ - find lib -name 'K*.key' -exec cp -uv '{}' "%{1}/{}" ';' \ - find lib -name 'testdata' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \ - find lib -name 'testkeys' -type d -exec cp -Tav '{}' "%{1}/{}" ';' \ - -%define systemtest_prepare_build() \ - cp -Tuav bin/tests "%{1}/bin/tests/" \ - %if %{with OPENSSL_ENGINE} CPPFLAGS="$CPPFLAGS -DOPENSSL_API_COMPAT=10100" %else @@ -425,9 +413,6 @@ configure.ac autoreconf --force --install -mkdir build - -pushd build LIBDIR_SUFFIX= export LIBDIR_SUFFIX %configure \ @@ -465,12 +450,6 @@ export LIBDIR_SUFFIX --enable-full-report \ CPPFLAGS="$CPPFLAGS" PROGRAM_SUFFIX="%{program_suffix}" \ ; -%if %{with DNSTAP} - pushd lib - SRCLIB="../../../lib" - (cd dns && ln -s ${SRCLIB}/dns/dnstap.proto) - popd -%endif %if %{with DOCPDF} # avoid using home for pdf latex files @@ -486,8 +465,6 @@ fmtutil-user --missing || : make doc %endif -popd # build - # Prepare unit files for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do NEWNAME="$(basename -- "$SERVICEFILE" .in)" @@ -503,9 +480,6 @@ for SERVICEFILE in %{SOURCE37} %{SOURCE38} %{SOURCE44} %{SOURCE46}; do touch -r "$SERVICEFILE" "$NEWNAME" # Set change time to time of template done -%unit_prepare_build build -%systemtest_prepare_build build - %check %if %{with UNITTEST} || %{with SYSTEMTEST} # Tests require initialization of pkcs11 token @@ -517,7 +491,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" %endif %if %{with UNITTEST} - pushd build CPUS=$(lscpu -p=cpu,core | grep -v '^#' | wc -l) THREADS="$CPUS" %if %{without UNITTEST_ALL} @@ -537,7 +510,6 @@ export TSAN_OPTIONS="log_exe_name=true log_path=ThreadSanitizer exitcode=0" exit $e; fi; [ "$CPUS" -gt 16 ] && ulimit -n $ORIGFILES || : - popd ## End of UNITTEST %endif @@ -566,7 +538,7 @@ rh-allow-sha1-signatures = yes EOF export OPENSSL_CONF %endif - pushd build/bin/tests + pushd bin/tests chown -R ${USER} . # Can be unknown user %make_build test e=$? @@ -609,9 +581,7 @@ popd touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf #end chroot -pushd build %make_install PROGRAM_SUFFIX="%{program_suffix}" -popd # Remove unwanted files rm -f ${RPM_BUILD_ROOT}/etc/bind.keys @@ -670,7 +640,7 @@ popd %if %{with DOC} mkdir -p ${RPM_BUILD_ROOT}%{_pkgdocdir} -cp -a build/doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} +cp -a doc/arm/_build/html ${RPM_BUILD_ROOT}%{_pkgdocdir} rm -rf ${RPM_BUILD_ROOT}%{_pkgdocdir}/html/.{buildinfo,doctrees} # Backward compatible link to 9.11 documentation (cd ${RPM_BUILD_ROOT}%{_pkgdocdir} && ln -s html/index.html Bv9ARM.html) @@ -686,7 +656,7 @@ do done %endif %if %{with DOCPDF} -cp -p build/doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} +cp -p doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif # Ghost config files: @@ -1257,6 +1227,7 @@ fi; - Use alternatives symlinks to provide original names - Allow installation of multiple major versions at the same time - chroot package still conflicts, might be fixed later +- Stop using build subdirectory and out-of-tree builds * Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 - Update to 9.18.50 (rhbz#2489833) From dcf19cde8d39d93b458809d5ea1eafb6737337c3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 1 Jul 2026 12:11:07 +0200 Subject: [PATCH 122/144] Convert to %autorelease and %autochangelog [skip changelog] --- bind.spec | 3193 +---------------------------------------------------- changelog | 3190 ++++++++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3192 insertions(+), 3191 deletions(-) create mode 100644 changelog diff --git a/bind.spec b/bind.spec index 31b5cde..d7b44b9 100644 --- a/bind.spec +++ b/bind.spec @@ -102,7 +102,7 @@ License: MPL-2.0 AND ISC AND MIT AND BSD-3-Clause AND BSD-2-Clause # Before rebasing bind, ensure bind-dyndb-ldap is ready to be rebuild and use side-tag with it. # Updating just bind will cause freeipa-dns-server package to be uninstallable. Version: 9.18.50 -Release: 2%{?dist} +Release: %autorelease Epoch: 32 Url: https://www.isc.org/downloads/bind/ # @@ -1221,3193 +1221,4 @@ fi; %endif %changelog -* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-2 -- Prepare devel subpackage installable multiple times -- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages -- Use alternatives symlinks to provide original names -- Allow installation of multiple major versions at the same time -- chroot package still conflicts, might be fixed later -- Stop using build subdirectory and out-of-tree builds - -* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 -- Update to 9.18.50 (rhbz#2489833) -- Remove rwtab files - -* Fri Jun 12 2026 Yaakov Selkowitz - 32:9.18.49-2 -- Rebuilt for openssl 4.0 - -* Wed May 20 2026 Petr Menšík - 32:9.18.49-1 -- Update to 9.18.49 (rhbz#2480121) - -* Tue Apr 07 2026 Petr Menšík - 32:9.18.48-1 -- Update to 9.18.48 (rhbz#2453853) - -* Wed Mar 25 2026 Petr Menšík - 32:9.18.47-1 -- Update to 9.18.47 (rhbz#2440561) - -* Tue Mar 03 2026 Petr Menšík - 32:9.18.46-1 -- Update to 9.18.46 (rhbz#2440561) - -* Wed Jan 28 2026 Petr Menšík - 32:9.18.44-2 -- Create /var/named directories for bind-chroot (RHEL-132053) -- Add forgotten _libdir/named into bind-chroot tmpfiles - -* Thu Jan 22 2026 Petr Menšík - 32:9.18.44-1 -- Update to 9.18.44 (rhbz#2431609) - -* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild - -* Wed Dec 17 2025 Petr Menšík - 32:9.18.43-1 -- Update to 9.18.43 (rhbz#2415842) - -* Fri Oct 31 2025 Petr Menšík - 32:9.18.41-2 -- Fix upstream reported regression in recent CVE fix (CVE-2025-8677) -- Add upstream dnssec system test testcase for this problem - -* Fri Oct 24 2025 Petr Menšík - 32:9.18.41-1 -- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) - -* Fri Oct 10 2025 Petr Menšík - 32:9.18.39-7 -- Reference to absolute config names from named.rfc1912.zones - -* Fri Oct 03 2025 Petr Menšík - 32:9.18.39-6 -- Move named.* files from /var/named into /usr/share/named -- Move named.ca into /etc/named.ca - -* Tue Sep 16 2025 Petr Menšík - 32:9.18.39-5 -- Fix failures in idna system test (rhbz#2324186) - -* Wed Sep 10 2025 Adam Williamson - 32:9.18.39-4 -- No-change rebuild to fix F43 update - -* Wed Sep 03 2025 Petr Menšík - 32:9.18.39-3 -- Decode IDN names on input in all situations in utilities (rhbz#2324186) - -* Mon Sep 01 2025 Petr Menšík - 32:9.18.39-2 -- Offer up to 13 additional servers records if there are more servers - -* Thu Aug 21 2025 Petr Menšík - 32:9.18.39-1 -- Update to 9.18.39 (rhbz#2389765) - -* Wed Jul 30 2025 'Petr Mensik' <> - 32:9.18.38-1 -- Update to 9.18.38 (rhbz#2367771) - -* Wed Jul 23 2025 Fedora Release Engineering - 32:9.18.36-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild - -* Tue Jun 10 2025 'Petr Mensik' <> - 32:9.18.36-2 -- Prevent name.c:670 attributes assertion failed -- Add extra checks for relative names - -* Fri Apr 25 2025 Petr Mensik - 32:9.18.36-1 -- Update to 9.18.36 (rhbz#2346607) - -* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-2 -- Backport support for OpenSSL provider required for PKCS11 labels -- Deactivate jemalloc default linking - -* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-1 -- Update to 9.18.35 (rhbz#2346607) - -* Thu Mar 20 2025 Petr Menšík - 32:9.18.33-3 -- Remove pre scriptlet - -* Mon Feb 10 2025 Petr Menšík - 32:9.18.33-2 -- Permanently remove DLZ parts build - -* Sun Feb 02 2025 Petr Menšík - 32:9.18.33-1 -- Update to 9.16.33 (rhbz#2342784) - -* Fri Jan 17 2025 Petr Menšík - 32:9.18.32-7 -- Add sysusers named user creation (rhbz#2105415) - -* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-6 -- Rebuild again on mass rebuild tag so -4 doesn't override -5 - -* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-5 -- Provide user(named) and group(named) - -* Thu Jan 16 2025 Fedora Release Engineering - 32:9.18.32-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild - -* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek - 32:9.18.32-3 -- Rebuilt for the bin-sbin merge (2nd attempt) - -* Fri Dec 20 2024 Adam Williamson - 32:9.18.32-2 -- No change sidetag rebuild to include bind-dyndb-ldap - -* Thu Dec 12 2024 Petr Menšík - 32:9.18.32-1 -- Update to 9.18.32 (#2331675) -- Remove CHANGES file from package -- Disable DLZ plugins, they are not shipped with bind anymore -- Add new root key 38696 into package files too - -* Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 -- Disable temporarily PDF generation on all platforms - -* Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 -- Add nsupdate TLS support (FREEIPA-11706) -- Include a test for nsupdate changes - -* Thu Nov 14 2024 Petr Menšík - 32:9.18.31-1 -- Update to 9.18.31 (#2319214) - -* Thu Nov 14 2024 Petr Menšík - 32:9.18.30-3 -- Bump obsoleted license version (rhbz#2308102) - -* Tue Oct 08 2024 Petr Menšík - 32:9.18.30-2 -- Make OpenSSL engine support optional - -* Fri Oct 04 2024 Petr Menšík - 32:9.18.30-1 -- Update to 9.18.30 (rhbz#2306542) - -* Wed Aug 21 2024 Petr Menšík - 32:9.18.29-1 -- Update to 9.18.29 (rhbz#2306542) - -* Wed Aug 21 2024 Petr Menšík - 32:9.18.28-4 -- Remove ancient triggerun and selinux boolean traces - -* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-3 -- Drop PostgreSQL dependencies not used by DLZ anymore - -* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 -- Conflict explicitly with more bind subpackages -- Merge license subpackage into libs -- Add optional QUERYTRACE feature -- Make relative documentation links - -* Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 -- update to 9.18.28 rhbz#2299467 -- Fixes CVE-2024-4076 -- Fixes CVE-2024-1975 -- Fixes CVE-2024-1737 -- Fixes CVE-2024-0760 - -* Wed Jul 17 2024 Fedora Release Engineering - 32:9.18.26-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild - -* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 32:9.18.26-2 -- Rebuilt for the bin-sbin merge - -* Mon Apr 22 2024 Petr Menšík - 32:9.18.26-1 -- Update to 9.18.26 (rhbz#2270476) - -* Thu Feb 15 2024 Petr Menšík - 32:9.18.24-1 -- Update to 9.18.24 (#2264032) - -* Tue Jan 23 2024 Fedora Release Engineering - 32:9.18.21-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Fri Jan 19 2024 Fedora Release Engineering - 32:9.18.21-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild - -* Tue Jan 16 2024 Petr Menšík - 32:9.18.21-2 -- Update changed b.root-servers.net address in hints (#2253460) - -* Mon Jan 15 2024 Petr Menšík - 32:9.18.21-1 -- Update to 9.18.21 (#2255407) - -* Thu Nov 16 2023 Petr Menšík - 32:9.18.20-1 -- Update to 9.18.20 (#2249835) - -* Fri Sep 22 2023 Petr Menšík - 32:9.18.19-1 -- Update to 9.18.19 (#2232346) - -* Fri Sep 22 2023 Petr Menšík - 32:9.18.18-2 -- Skip failing rbtdb_test unit test on i686 (#2240253) - -* Wed Sep 06 2023 Petr Menšík - 32:9.18.18-1 -- Update to 9.18.18 (#2232346) - -* Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 -- Update to 9.18.17 (#2223913) - -* Wed Jul 19 2023 Fedora Release Engineering - 32:9.18.16-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild - -* Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 -- Update to 9.18.16 (#2216462) - -* Wed May 17 2023 Petr Menšík - 32:9.18.15-1 -- Update to 9.18.15 (#2207908) - -* Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 -- Update to 9.18.14 (#2187996) - -* Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 -- Enumerate all SPDX licenses used - -* Sat Mar 18 2023 Petr Menšík - 32:9.18.13-1 -- Update to 9.18.3 (#2178717) - -* Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 -- Update to 9.18.12 (#2170096) - -* Fri Jan 27 2023 Petr Menšík - 32:9.18.11-1 -- Update to 9.18.11 (#2164395) - -* Wed Jan 18 2023 Fedora Release Engineering - 32:9.18.10-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild - -* Mon Jan 16 2023 Petr Menšík - 32:9.18.10-1 -- Update to 9.18.10 (#2143258) -- Include rwlock.h from dns/zt.h - -* Mon Nov 21 2022 Petr Menšík - 32:9.18.9-1 -- Update to 9.18.9 (#2143258) - -* Sat Oct 22 2022 Petr Menšík - 32:9.18.8-1 -- Update to 9.18.8 (#2136100) - -* Fri Sep 30 2022 Petr Menšík - 32:9.18.7-3 -- Update License to SPDX identifier -- Enable automatic restart on crashes - -* Sat Sep 24 2022 Petr Menšík - 32:9.18.7-2 -- Build ARM documentation also with older sphinx on RHEL9 - -* Wed Sep 21 2022 Petr Menšík - 32:9.18.7-1 -- Update to 9.18.7 (#2128609) - -* Wed Sep 14 2022 Petr Menšík - 32:9.18.6-4 -- Disable yet another test (##2122010) - -* Tue Sep 06 2022 Petr Menšík - 32:9.18.6-3 -- Return OpenSSL engine implementation for pkcs11 interface (#2122841) -- Skip problematic netmgr unit tests (#2122010) -- Properly obsolete bind-dnssec-doc - -* Thu Sep 01 2022 Petr Menšík - 32:9.18.6-2 -- Always show error details for failed unittests (#2122010) - -* Tue Aug 30 2022 Petr Menšík - 32:9.18.6-1 -- Update to 9.18.6 (#2119132) -- Report unit tests detailed results - -* Thu Aug 04 2022 Petr Menšík - 32:9.18.5-2 -- Use multiple threads on unit tests, but 16 at most - -* Wed Aug 03 2022 Petr Menšík - 32:9.18.5-1 -- Update to 9.18.5 (#2109170) -- Return doc symlink to main page - -* Wed Jul 20 2022 Petr Menšík - 32:9.18.4-2 -- Stop enabling selinux booleans on every upgrade -- Deprecate python3-bind for smooth upgrade -- Remove PKCS1111 native utilities, libs and daemon - -* Wed Jul 20 2022 Petr Menšík - 32:9.18.4-1 -- Update to 9.18.4 (#2057493) - -* Wed Jul 20 2022 Fedora Release Engineering - 32:9.16.30-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild - -* Mon Jun 20 2022 Petr Menšík - 32:9.16.30-1 -- Update to 9.16.30 (#2097312) - -* Mon Jun 13 2022 Python Maint - 32:9.16.29-2 -- Rebuilt for Python 3.11 - -* Thu May 26 2022 Petr Menšík - 32:9.16.29-1 -- Update to 9.16.29 (#2087920) -- Fix netmgr_test fails on s390x (#2088125) - -* Tue May 17 2022 Petr Menšík - 32:9.16.28-2 -- Parse again timeout and attempts from resolv.conf (#2087156) -- Reenable unit tests during build - -* Wed Apr 20 2022 Petr Menšík - 32:9.16.28-1 -- Update to 9.16.28 (#2076941) - -* Thu Mar 17 2022 Petr Menšík - 32:9.16.27-1 -- Upgrade to 9.16.27 (#2055120) - -* Tue Mar 01 2022 Petr Menšík - 32:9.16.26-2 -- Switch to locked queue (#2048235) - -* Thu Feb 17 2022 Petr Menšík - 32:9.16.26-1 -- Update to 9.16.26 (#2055120) - -* Fri Feb 11 2022 Petr Menšík - 32:9.16.25-3 -- Allow reservation of extra hp threads (#2048235) - -* Tue Jan 25 2022 Petr Menšík - 32:9.16.25-2 -- Replace master with primary in configuration - -* Fri Jan 21 2022 Petr Menšík - 32:9.16.25-1 -- Update to 9.16.25 (#2042504) - -* Wed Jan 19 2022 Fedora Release Engineering - 32:9.16.24-3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild - -* Wed Dec 22 2021 Petr Menšík - 32:9.16.24-2 -- Build with OpenLDAP 2.6 (#2032704) - -* Wed Dec 15 2021 Petr Menšík - 32:9.16.24-1 -- Update to 9.16.24 (#2032934) - -* Fri Nov 26 2021 Petr Menšík - 32:9.16.23-2 -- Correct with GEOIP2 condition (#2026823) - -* Fri Nov 19 2021 Petr Menšík - 32:9.16.23-1 -- Update to 9.16.23 (#2024210) - -* Sat Nov 06 2021 Adrian Reber - 32:9.16.22-2 -- Rebuilt for protobuf 3.19.0 - -* Wed Oct 27 2021 Petr Menšík - 32:9.16.22-1 -- Update to 9.16.22 - -* Sun Oct 24 2021 Adrian Reber - 32:9.16.21-3 -- Rebuilt for protobuf 3.18.1 - -* Wed Oct 13 2021 Petr Menšík - 32:9.16.21-2 -- Propagate ephemeral port ranges to chroot (#2013597) - -* Wed Sep 15 2021 Petr Menšík - 32:9.16.21-1 -- Update to 9.16.21 - -* Tue Sep 14 2021 Sahana Prasad - 32:9.16.20-4 -- Rebuilt with OpenSSL 3.0.0 - -* Wed Aug 25 2021 Petr Menšík - 32:9.16.20-3 -- Increase map format version, lower memory consuption a bit (#1997504) -- Remove unneeded test variants changes -- Include documentation of dig return codes - -* Thu Aug 19 2021 Petr Menšík - 32:9.16.20-2 -- Fix map file format regression - -* Tue Aug 17 2021 Petr Menšík - 32:9.16.20-1 -- Update to 9.16.20 - -* Thu Aug 05 2021 Petr Menšík - 32:9.16.19-4 -- Do not depend on systemd package - -* Tue Aug 03 2021 Petr Menšík - 32:9.16.19-3 -- Reenable PDF building again (#1984687) - -* Fri Jul 23 2021 Petr Menšík - 32:9.16.19-2 -- Include backward compatible html symlink in doc subpackage - -* Wed Jul 21 2021 Petr Menšík - 32:9.16.19-1 -- Update to 9.16.19 (#1984627) -- Disable PDF rebuild on Rawhide (#1984687) - -* Wed Jul 21 2021 Fedora Release Engineering - 32:9.16.18-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild - -* Sat Jul 10 2021 Petr Menšík - 32:9.16.18-4 -- Disable PDF building on ELN - -* Sat Jul 10 2021 Björn Esser - 32:9.16.18-3 -- Rebuild for versioned symbols in json-c - -* Tue Jun 22 2021 Petr Menšík - 32:9.16.18-2 -- Re-enable building of PDF ARM documentation - -* Fri Jun 18 2021 Petr Menšík - 32:9.16.18-1 -- Update to 9.16.18 - -* Fri Jun 18 2021 Petr Menšík - 32:9.16.17-2 -- Fix wildcard expansion not working with 'w' (#1973587) - -* Thu Jun 17 2021 Petr Menšík - 32:9.16.17-1 -- Update to 9.16.17 - -* Fri Jun 04 2021 Python Maint - 32:9.16.16-2 -- Rebuilt for Python 3.10 - -* Thu May 20 2021 Petr Menšík - 32:9.16.16-1 -- Update to 9.16.16 (#1954827) - -* Thu Apr 29 2021 Petr Menšík - 32:9.16.15-1 -- Update to 9.16.15 - -* Thu Mar 25 2021 Petr Menšík - 32:9.16.13-1 -- Update to 9.16.13 -- Changed displayed version just to include -RH suffix, not release -- Version is now part of library names, soname versions are no longer provided -- Removed bind-libs-lite subpackage - -* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 32:9.16.11-6 -- Rebuilt for updated systemd-rpm-macros - See https://pagure.io/fesco/issue/2583. - -* Fri Feb 26 2021 Petr Menšík - 32:9.16.11-5 -- Make logrotate.d world-readable (#1917061) - -* Mon Feb 22 2021 Petr Menšík - 32:9.16.11-4 -- Fix off-by-one bug in ISC SPNEGO implementation (#1929965) - -* Mon Feb 08 2021 Pavel Raiskup - 32:9.16.11-3 -- rebuild for libpq ABI fix rhbz#1908268 - -* Tue Jan 26 2021 Fedora Release Engineering - 32:9.16.11-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild - -* Thu Jan 21 2021 Petr Menšík - 32:9.16.11-1 -- Update to 9.16.11 (#1827602) -- Avoid unit test failures on machines with many cores - -* Thu Jan 14 2021 Petr Menšík - 32:9.16.10-2 -- Update to 9.16.10 -- Remove bind-sdb package -- https://fedoraproject.org/wiki/Changes/BIND9.16 - -* Wed Jan 13 08:55:11 CET 2021 Adrian Reber - 32:9.11.26-3 -- Rebuilt for protobuf 3.14 - -* Wed Jan 06 2021 Petr Menšík - 32:9.11.26-2 -- Use make macros -- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro - -* Mon Jan 04 2021 Petr Menšík - 32:9.11.26-1 -- Update to 9.11.26 - -* Mon Nov 30 2020 Petr Menšík - 32:9.11.25-2 -- Regenerate all manual pages on build - -* Thu Nov 26 2020 Petr Menšík - 32:9.11.25-1 -- Update to 9.11.25 - -* Wed Nov 04 2020 Petr Menšík - 32:9.11.24-2 -- Fix crash on NTA recheck failure (#1893761) - -* Fri Oct 23 2020 Petr Menšík - 32:9.11.24-1 -- Update to 9.11.24 - -* Wed Sep 23 2020 Adrian Reber - 32:9.11.23-2 -- Rebuilt for protobuf 3.13 - -* Thu Sep 17 2020 Petr Menšík - 32:9.11.23-1 -- Update to 9.11.23 -- Merge bind-lite-devel into devel package - -* Tue Sep 01 2020 Petr Menšík - 32:9.11.22-2 -- Require libcap from devel package - -* Thu Aug 20 2020 Petr Menšík - 32:9.11.22-1 -- Update to 9.11.22 - -* Sat Aug 01 2020 Fedora Release Engineering - 32:9.11.21-3 -- Second attempt - Rebuilt for - https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Mon Jul 27 2020 Fedora Release Engineering - 32:9.11.21-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild - -* Wed Jul 15 2020 Petr Menšík - 32:9.11.21-1 -- Update to 9.11.21 - -* Tue Jun 23 2020 Petr Menšík - 32:9.11.20-3 -- Move documentation to separate bind-doc package - -* Sat Jun 20 2020 Adrian Reber - 32:9.11.20-2 -- Rebuilt for protobuf 3.12 - -* Wed Jun 17 2020 Petr Menšík - 32:9.11.20-1 -- Update to 9.11.20 - -* Tue May 26 2020 Miro Hrončok - 32:9.11.19-2 -- Rebuilt for Python 3.9 - -* Fri May 15 2020 Petr Menšík - 32:9.11.19-1 -- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617) -- Make initscripts just optional dependency - -* Tue Apr 21 2020 Björn Esser - 32:9.11.18-2 -- Rebuild (json-c) - -* Thu Apr 16 2020 Petr Menšík - 32:9.11.18-1 -- Update to 9.11.18 - -* Tue Mar 31 2020 Petr Menšík - 32:9.11.17-1 -- Update to 9.11.17 - -* Tue Jan 28 2020 Fedora Release Engineering - 32:9.11.14-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild - - * Wed Jan 08 2020 Petr Menšík - 32:9.11.14-4 -- Remove libmaxminddb-devel from devel package dependencies - -* Fri Jan 03 2020 Petr Menšík - 32:9.11.14-3 -- Preserve symlinks to named.conf on iscdlv modification (#1786626) - -* Thu Dec 19 2019 Petr Menšík - 32:9.11.14-2 -- Include more Thread Sanitizer detected changes (#1736762) - -* Thu Dec 19 2019 Petr Menšík - 32:9.11.14-1 -- Update to 9.11.14 - -* Tue Dec 03 2019 Petr Menšík - 32:9.11.13-4 -- Disable Berkeley DB support (#1779190) - -* Mon Dec 02 2019 Petr Menšík - 32:9.11.13-3 -- Backport few thread safety related fixed from upstream (#1736762) - -* Tue Nov 26 2019 Petr Menšík - 32:9.11.13-2 -- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553) - -* Tue Nov 19 2019 Petr Menšík - 32:9.11.13-1 -- Update to 9.11.13 - -* Tue Nov 19 2019 Petr Menšík - 32:9.11.12-6 -- Report failures on systemctl reload - -* Tue Nov 12 2019 Petr Menšík - 32:9.11.12-5 -- Fix binary compatibility after serve-stale patch (#1770492) - -* Wed Nov 06 2019 Petr Menšík - 32:9.11.12-4 -- Backported serve-stale feature - -* Wed Nov 06 2019 Petr Menšík - 32:9.11.12-3 -- Fix wrong default GeoIP directory (#1768258) - -* Mon Nov 04 2019 Petr Menšík - 32:9.11.12-2 -- Move data files outside config archive -- Specify geoip data directory in config file (#1768258) - -* Mon Oct 21 2019 Petr Menšík - 32:9.11.12-1 -- Update to 9.11.12 (#1557762) - -* Wed Sep 25 2019 Petr Menšík - 32:9.11.11-1 -- Update to 9.11.11 - -* Wed Sep 04 2019 Petr Menšík - 32:9.11.10-3 -- Share pkcs11-utils and dnssec-utils manuals instead of recommend - -* Tue Sep 03 2019 Petr Menšík - 32:9.11.10-2 -- Move some administration utilities back to bind-utils (#1720380) -- Add GeoIP to bind-chroot (#1497646) -- Recommend bind-dnssec-utils from bind-pkcs11-utils - -* Tue Aug 27 2019 Petr Menšík - 32:9.11.10-1 -- Update to 9.11.10 - -* Mon Aug 19 2019 Miro Hrončok - 32:9.11.9-4 -- Rebuilt for Python 3.8 - -* Fri Aug 09 2019 Petr Menšík - 32:9.11.9-3 -- Display errors from rndc reload (#1739441) - -* Thu Aug 08 2019 Petr Menšík - 32:9.11.9-2 -- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553) - -* Wed Jul 24 2019 Petr Menšík - 32:9.11.9-1 -- Update to 9.11.9 -- Add GeoLite2 support -- Disable export-libs - -* Wed Jul 24 2019 Petr Menšík - 32:9.11.8-2 -- Use monotonic time in export library (#1732883) - -* Wed Jul 24 2019 Fedora Release Engineering - 32:9.11.8-2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild - -* Tue Jul 02 2019 Petr Menšík - 32:9.11.8-1 -- Update to 9.11.8 - -* Mon Jun 17 2019 Petr Menšík - 32:9.11.7-2 -- Fix OpenSSL random generator initialization - -* Mon Jun 10 2019 Petr Menšík - 32:9.11.7-1 -- Update to 9.11.7 - -* Mon May 06 2019 Petr Menšík - 32:9.11.6-5.P1 -- Fix also postun script - -* Mon May 06 2019 Petr Menšík - 32:9.11.6-4.P1 -- Fix error in scriptlet condition - -* Thu May 02 2019 Petr Menšík - 32:9.11.6-3.P1 -- Fix inefective limit of TCP clients (CVE-2018-5743) - -* Thu Mar 14 2019 Petr Menšík - 32:9.11.6-2 -- Fix dnstap and timer issues in unit test -- Enable DLZ modules - -* Tue Mar 05 2019 Petr Menšík - 32:9.11.6-1 -- Update to 9.11.6 - -* Fri Mar 01 2019 Petr Menšík - 32:9.11.5-15.P4 -- Support testing of named variants - -* Thu Feb 28 2019 Petr Menšík - 32:9.11.5-14.P4 -- Modify feature-test detection of dlz-filesystem - -* Fri Feb 22 2019 Petr Menšík - 32:9.11.5-13.P4 -- Update to 9.11.5-P4 - -* Fri Feb 22 2019 Petr Menšík - 32:9.11.5-12.P1 -- Enable DNSTAP support (#1564776) -- Enable LMDB support for rndc addzone -- Enable json format in statistics-channel - -* Thu Feb 21 2019 Petr Menšík - 32:9.11.5-11.P1 -- Disable often failing unit test random_test - -* Thu Feb 21 2019 Petr Menšík - 32:9.11.5-10.P1 -- Disable autodetected eddsa algorithm ED448 - -* Thu Jan 31 2019 Petr Menšík - 32:9.11.5-9.P1 -- dig prints ASCII name instead of failure (#1647829) -- disable IDN output from scripts -- Update project URL -- Removed revoked KSK 19164 from trusted keys - -* Thu Jan 31 2019 Fedora Release Engineering - 32:9.11.5-8.P1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild - -* Sun Jan 27 2019 Petr Menšík - 32:9.11.5-7.P1 -- Update to 9.11.5-P1 - -* Wed Jan 23 2019 Petr Menšík - 32:9.11.5-6 -- Reenable crypto rand for DHCP, disable just entropy check (#1663318) - -* Thu Jan 17 2019 Petr Menšík - 32:9.11.5-5 -- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398) - -* Wed Jan 16 2019 Petr Menšík - 32:9.11.5-4 -- Reject invalid binary file (#1666814) - -* Mon Jan 14 2019 Petr Menšík - 32:9.11.5-3 -- Disable crypto rand for DHCP (#1663318) - -* Thu Oct 25 2018 Petr Menšík - 32:9.11.5-2 -- Add optional support for JSON statistics -- Add optional DNSTAP support (#1564776), new dnstap-read tool - -* Wed Oct 24 2018 Petr Menšík - 32:9.11.5-1 -- Update to 9.11.5 - -* Tue Oct 02 2018 Petr Menšík - 32:9.11.4-12.P2 -- Add Requires to devel packages referenced by bind-devel - -* Sat Sep 29 2018 Igor Gnatenko - 32:9.11.4-11.P2 -- Fix export-libs macro & scriptlet - -* Wed Sep 26 2018 Petr Menšík - 32:9.11.4-10.P2 -- Reenable IDN output but allow turning it off (#1580200) - -* Thu Sep 20 2018 Petr Menšík - 32:9.11.4-9.P2 -- Update to bind-9.11.4-P2 -- Add /dev/urandom to chroot (#1631515) - -* Fri Aug 24 2018 Petr Menšík - 32:9.11.4-8.P1 -- Replace unoptimized code by OpenSSL counterparts -- Fix multilib conflicts of devel package -- Add versioned depends to all library subpackages - -* Fri Aug 24 2018 Petr Menšík - 32:9.11.4-7.P1 -- Add support for OpenSSL provided random data - -* Mon Aug 13 2018 Petr Menšík - 32:9.11.4-6.P1 -- Fix sdb-chroot devices upgrade (#1592873) -- Automatically replace obsoleted ISC DLV key with root key (#1595782) - -* Thu Aug 09 2018 Petr Menšík - 32:9.11.4-5.P1 -- Update to 9.11.4-P1 -- Adds root key sentinel support -- Large IXFR zone transfers are rejected to prevent journal corruption - -* Thu Aug 02 2018 Petr Menšík - 32:9.11.4-4 -- Support unavailable MD5 in FIPS mode - -* Thu Aug 02 2018 Petr Menšík - 32:9.11.4-3 -- Use OpenSSL for digest operations (#1611537) - -* Tue Jul 31 2018 Petr Menšík - 32:9.11.4-2 -- Install generated manual pages - -* Thu Jul 12 2018 Petr Menšík - 32:9.11.4-1 -- Update to 9.11.4 -- Use kyua instead of kyua-cli for unit tests - -* Thu Jul 12 2018 Petr Menšík - 32:9.11.3-15 -- Use new config file named-chroot.files for chroot setup (#1429656) -- Fix chroot devices file verification (#1592873) -- Prevent errors on bind-chroot uninstall when running (#1600583) - -* Thu Jul 12 2018 Fedora Release Engineering - 32:9.11.3-14 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild - -* Mon Jul 02 2018 Miro Hrončok - 32:9.11.3-13 -- Rebuilt for Python 3.7 - -* Wed Jun 27 2018 Petr Menšík - 32:9.11.3-12 -- Require utils instead of library - -* Wed Jun 27 2018 Petr Menšík - 32:9.11.3-11 -- Remove named.iscdlv.key file (#1595782) -- Fix CVE-2018-5738 - -* Tue Jun 19 2018 Miro Hrončok - 32:9.11.3-10 -- Rebuilt for Python 3.7 - -* Fri May 25 2018 Petr Menšík - 32:9.11.3-9 -- Make named home writeable (#1422680) -- Change named shell to /bin/false - -* Fri May 25 2018 Petr Menšík - 32:9.11.3-8 -- Require C++ on build when shipped atf library is used - -* Mon Apr 09 2018 Petr Menšík - 32:9.11.3-7 -- Run tests also without kyua - -* Thu Apr 05 2018 Petr Menšík - 32:9.11.3-6 -- Do not link libidn2 to all libraries (#1098783) -- Update named.ca - -* Tue Apr 03 2018 Petr Menšík - 32:9.11.3-5 -- Enable libidn2 support (#1098783) -- Make +noidnout default -- Compile export libs without GSSAPI - -* Wed Mar 21 2018 Petr Menšík - 32:9.11.3-4 -- Rebase to 9.11.3 -- Add dig support for libidn2 (#1098783) - -* Wed Mar 21 2018 Petr Menšík - 32:9.11.3-3.b1 -- Fix build with disabled unittest -- Recommend softhsm from pkcs11 variant - -* Thu Feb 22 2018 Petr Menšík - 32:9.11.3-2.b1 -- Require openssl-devel and libcap-devel from bind-export-devel -- Conflict with bind99-devel -- Change spec globals to rpmbuild --with feature - -* Thu Feb 15 2018 Petr Menšík - 32:9.11.3-1.b1 -- Rebase to 9.11.3b1 - -* Wed Feb 07 2018 Petr Menšík - 32:9.11.2-11.P1 -- Use versioned provides -- Fix starting of unit tests -- Forward export libs path to isc-config -- Rename export devel subpackage to bind-export-devel - -* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-10.P1 -- Add obsoletes/provides tags for smooth update - -* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-9.P1 -- Build devel package for export-libs - -* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-8.P1 -- Build export libraries with disabled threads and selects - -* Wed Feb 07 2018 Fedora Release Engineering - 32:9.11.2-7.P1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild - -* Tue Jan 30 2018 Petr Menšík - 32:9.11.2-6.P1 -- Remove ldconfig calls where possible -- Note -z defs cannot be enabled until more work - -* Tue Jan 16 2018 Petr Menšík - 32:9.11.2-5.P1 -- Fix CVE-2017-3145, rebase to 9.11.2-P1 - -* Tue Jan 02 2018 Petr Menšík - 32:9.11.2-4 -- Enable unit tests with kyua tool (#1532694) -- Provide internal tool to prepare softhsm token storage -- Proper fix for python3-bind subpackage directory ownership (#1522944) - -* Fri Dec 15 2017 Petr Menšík - 32:9.11.2-3 -- Own python3-bind isc directory (#1522944) -- Make tsstsig system test pass again (#1500017) - -* Mon Oct 23 2017 Petr Menšík - 32:9.11.2-2 -- Build against mariadb-connector-c-devel (#1493615) -- Include DNSKEY 20326 also in trusted-key.key (#1505476) -- Fix dynamic symbols conflict with ldap (#1205168) -- Use hmac-sha256 for new RNDC keys (#1508003) -- Include protocols and services in chroot - -* Wed Aug 02 2017 Petr Menšík - 32:9.11.2-1 -- Update to 9.11.2 -- Add recursing and secroots file into default and sample config -- Fix nsupdate GSSAPI auth against AD server (#1484451) - -* Wed Aug 02 2017 Fedora Release Engineering - 32:9.11.1-6.P3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild - -* Wed Jul 26 2017 Fedora Release Engineering - 32:9.11.1-5.P3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild - -* Fri Jul 14 2017 Petr Menšík - 32:9.11.1-4.P3 -- Simplify change of default configuration file path - -* Thu Jul 13 2017 Petr Menšík - 32:9.11.1-3.P3 -- Use mysql_config for SDB variant, build against mariadb-devel - -* Mon Jul 10 2017 Petr Menšík - 32:9.11.1-2.P3 -- Update to 9.11.1-P3 - -* Fri Jun 30 2017 Petr Menšík - 32:9.11.1-2.P2 -- Update to 9.11.1-P2 - -* Thu Jun 29 2017 Petr Menšík - 32:9.11.1-2.P1 -- dnssec-checkds and dnssec-coverage requires python module (#1466183) - -* Thu Jun 15 2017 Petr Menšík - 32:9.11.1-1.P1 -- Update to 9.11.1-P1 - -* Fri Apr 21 2017 Petr Menšík - 32:9.11.0-8.P5 -- Fix queries for TKEY in nsupdate, when using GSSAPI (#1236087) - -* Thu Apr 13 2017 Petr Menšík - 32:9.11.0-7.P5 -- Update to 9.11.0-P5 -- Use BINDVERSION for upstream version - -* Fri Feb 10 2017 Petr Menšík - 32:9.11.0-7.P3 -- Update to 9.11.0-P3 - -* Fri Feb 10 2017 Fedora Release Engineering - 32:9.11.0-7.P2 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild - -* Wed Jan 18 2017 Petr Menšík - 32:9.11.0-6.P2 -- RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb (#1410433) -- Fix some rpm warnings - -* Mon Jan 16 2017 Petr Menšík - 32:9.11.0-5.P2 -- Fix manual pages generated by recent docbook-style-xsl (#1397186) - -* Thu Jan 12 2017 Petr Menšík - 32:9.11.0-4.P2 -- Update to 9.11.0-P2 - -* Mon Dec 19 2016 Miro Hrončok - 32:9.11.0-4.P1 -- Rebuild for Python 3.6 - -* Tue Nov 22 2016 Petr Menšík - 32:9.11.0-3.P1 -- Split pk11 includes, include real functions only in pkcs11 variant - -* Wed Nov 16 2016 Petr Menšík - 32:9.11.0-2.P1 -- Do not change lib permissions in chroot - -* Wed Nov 16 2016 Michal Ruprich - 32:9.11.0-1.P1 -- Update to 9.11.0-P1 - -* Tue Nov 08 2016 Petr Menšík - 32:9.10.4-3.P4 -- Build with OpenSSL 1.1 - -* Thu Nov 03 2016 Petr Menšík - 32:9.10.4-2.P4 -- Update to 9.10.4-P4 - -* Thu Sep 29 2016 Tomas Hozza - 32:9.10.4-2.P3 -- Update to 9.10.4-P3 - -* Wed Jul 20 2016 Michal Ruprich - 32:9.10.4-1.P2 -- Update to 9.10.4-P2 - -* Thu May 26 2016 Tomas Hozza - 32:9.10.4-1.P1 -- Update to 9.10.4-P1 - -* Fri May 20 2016 Tomas Hozza - 32:9.10.3-14.P4 -- (un)mount /var/named in -chroot packages as the last directory (Related: #1279188) - -* Thu May 12 2016 Tomas Hozza - 32:9.10.3-13.P4 -- Remove NM dispatcher script, since it is not needed any more (#1277257) -- Replaced After=network-online.target with After=network.target in all unit files - -* Fri Mar 11 2016 Tomas Hozza - 32:9.10.3-12.P4 -- Update to 9.10.3-P4 due to CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 - -* Wed Feb 03 2016 Fedora Release Engineering - 32:9.10.3-11.P3 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild - -* Thu Jan 21 2016 Tomas Hozza - 32:9.10.3-10.P3 -- Update to 9.10.3-P3 due to CVE-2015-8704 and CVE-2015-8705 (#1300051) - -* Wed Jan 06 2016 Tomas Hozza - 32:9.10.3-9.P2 -- Commented out bindkeys-file statement in default configuration (#1223365#c3) -- Removed unrecognized configure option --enable-developer -- Added configure option --enable-full-report to get report on enabled features - -* Sat Dec 26 2015 Robert Scheck - 32:9.10.3-8.P2 -- Remove unrecognized build options for %%configure -- Own %%{_includedir}/bind9 directory in -lite-devel -- Fixed building without (optional) PKCS#11 support - -* Wed Dec 16 2015 Tomas Hozza - 32:9.10.3-7.P2 -- bump release to maintain update path - -* Wed Dec 16 2015 Tomas Hozza - 32:9.10.3-4.P2 -- Update to 9.10.3-P2 - -* Tue Nov 10 2015 Fedora Release Engineering - 32:9.10.3-3 -- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 - -* Wed Nov 04 2015 Tomas Hozza - 32:9.10.3-2 -- Fixed named-checkconf call in *-chroot.service files (#1277820) - -* Thu Sep 17 2015 Tomas Hozza - 32:9.10.3-1 -- Update to 9.10.3 stable - -* Thu Sep 03 2015 Tomas Hozza -- Update to 9.10.3rc1 - -* Wed Jul 29 2015 Tomas Hozza - 32:9.10.2-9.P3 -- Update to 9.10.2-P3 to fix CVE-2015-5477 - -* Thu Jul 09 2015 Tomas Hozza - 32:9.10.2-8.P2 -- Update to 9.10.2-P2 - -* Mon Jun 29 2015 Tomas Hozza - 32:9.10.2-7.P1 -- Reintroduce the DISABLE_ZONE_CHECKING into /etc/sysconfig/named - -* Fri Jun 19 2015 Tomas Hozza - 32:9.10.2-6.P1 -- Update to 9.10.2-P1 - -* Wed Jun 17 2015 Fedora Release Engineering - 32:9.10.2-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild - -* Wed May 27 2015 Tomas Hozza - 32:9.10.2-4 -- Don't copy /etc/localtime on -chroot package installation - -* Fri May 22 2015 Tomas Hozza - 32:9.10.2-3 -- Don't use ISC's DLV by default (#1223365) -- Utilize system-wide crypto-policies (#1179925) - -* Thu May 21 2015 Tomas Hozza - 32:9.10.2-2 -- enable tuning for large systems - increases hardcoded internal limits -- enable GeoIP access control feature - -* Thu Feb 26 2015 Tomas Hozza - 32:9.10.2-1 -- update to 9.10.2 stable -- remove parallel-build patch after discussion with upstream [ISC-Bugs #38739] - -* Wed Feb 25 2015 Tomas Hozza - 32:9.10.2-0.3.rc1 -- update to 9.10.2rc2 -- call ldconfig for pkcs11-libs -- Use Python3 by default (#1186791) - -* Sat Feb 21 2015 Till Maas - 32:9.10.2-0.2.rc1 -- Rebuilt for Fedora 23 Change - https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code - -* Mon Feb 02 2015 Tomas Hozza - 32:9.10.2-0.1.rc1 -- update to 9.10.2rc1 -- fix nsupdate server auto-detection (#1184151) -- drop merged patch bind99-rh985918.patch - -* Fri Jan 16 2015 Tomas Hozza - 32:9.10.1-2.P1 -- Install config for tmpfiles under %%{_tmpfilesdir} (#1181020) - -* Tue Jan 13 2015 Tomas Hozza - 32:9.10.1-1.P1 -- Update to 9.10.1-P1 stable - -* Fri Dec 12 2014 Tomas Hozza - 32:9.9.6-6.P1 -- Drop downstream patch for nslookup/host rejected by upstream - -* Tue Dec 09 2014 Tomas Hozza - 32:9.9.6-5.P1 -- Update to 9.9.6-P1 (CVE-2014-8500) - -* Fri Nov 14 2014 Tomas Hozza - 32:9.9.6-4 -- Fixed systemctl path in logrotate configuration (#1148360) -- drop engine_pkcs11 dependency, since we use native PKCS#11 implementation - -* Wed Oct 22 2014 Petr Spacek - 32:9.9.6-3 -- Fix crash during GSS-TSIG processing (#1155334, #1155127) - introduced in 32:9.9.6-2 - -* Tue Oct 14 2014 Tomas Hozza - 32:9.9.6-2 -- Added native PKCS#11 functionality (#1097752) -- bind-sdb now requires bind due to configuration and other utilities -- bind-pkcs11 now requires bind due to configuration and other utilities - -* Thu Oct 02 2014 Tomas Hozza - 32:9.9.6-1 -- Update to 9.9.6 -- drop merged patches and rebase some of existing patches -- Add architecture specific dependencies. -- Fix assert in dig when using +sigchase (#985918) - -* Fri Aug 15 2014 Fedora Release Engineering - 32:9.9.5-9.P1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild - -* Fri Jul 18 2014 Tomas Hozza 32:9.9.5-8.P1 -- Use network-online.target instead of network.target (#1117086) - -* Fri Jul 11 2014 Tom Callaway 32:9.9.5-7.P1 -- fix license handling - -* Thu Jun 12 2014 Tomas Hozza 32:9.9.5-6.P1 -- Update to 9.9.5-P1 - -* Mon Jun 09 2014 Tomas Hozza 32:9.9.5-5 -- Use /dev/urandom for generation of rndc.key (#1079799) - -* Sat Jun 07 2014 Fedora Release Engineering - 32:9.9.5-4 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild - -* Tue Apr 22 2014 Tomas Hozza 32:9.9.5-3 -- configure bind with --with-dlopen=yes to support dynamically loadable DLZ drivers - -* Wed Mar 05 2014 Tomas Hozza 32:9.9.5-2 -- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781) -- Fix race condition when freeing fetch object (ISC-Bugs #35385) - -* Thu Feb 13 2014 Tomas Hozza 32:9.9.5-1 -- Update to 9.9.5 stable - -* Sun Jan 26 2014 Rex Dieter 32:9.9.5-0.5.rc2 -- -libs, -libs-lite: track sonames, so abi bumps aren't a surprise - -* Fri Jan 24 2014 Tomas Hozza 32:9.9.5-0.4.rc2 -- update to 9.9.5rc2 -- merged patches dropped -- some patches rebased to the new version - -* Wed Jan 15 2014 Tomas Hozza 32:9.9.5-0.3.b1 -- non-existance of resolv.conf should not be fatal (#1052343) - -* Tue Jan 14 2014 Tomas Hozza 32:9.9.5-0.2.b1 -- Fix CVE-2014-0591 - -* Mon Jan 06 2014 Tomas Hozza 32:9.9.5-0.1.b1 -- Update to bind-9.9.5b1 -- Build bind-sdb against libdb instead of libdb4 - -* Wed Dec 18 2013 Tomas Hozza 32:9.9.4-11 -- Fix crash in rbtdb after two sucessive getoriginnode() calls - -* Tue Dec 17 2013 Tomas Hozza 32:9.9.4-10 -- Split chroot package for named and named-sdb -- Extract setting-up/destroying of chroot to a separate systemd service (#997030) - -* Thu Nov 28 2013 Tomas Hozza 32:9.9.4-9 -- Fixed memory leak in nsupdate if 'realm' was used multiple times (#984687) - -* Tue Nov 12 2013 Tomas Hozza 32:9.9.4-8 -- Install configuration for rwtab and fix chroot setup script - -* Thu Oct 31 2013 Tomas Hozza 32:9.9.4-7 -- Correct the upstream patch for #794940 - -* Thu Oct 31 2013 Tomas Hozza 32:9.9.4-6 -- use --enable-filter-aaaa when building bind to enable use of filter-aaaa-on-v4 option - -* Wed Oct 30 2013 Tomas Hozza 32:9.9.4-5 -- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run -- Added session-keyfile statement into default named.conf since we use /run/named - -* Tue Oct 29 2013 Tomas Hozza 32:9.9.4-4 -- Use upstream version of patch for previously fixed #794940 - -* Fri Oct 18 2013 Tomas Hozza 32:9.9.4-3 -- Fix race condition on send buffers in dighost.c (#794940) - -* Tue Oct 08 2013 Tomas Hozza 32:9.9.4-2 -- install isc/errno2result.h header - -* Fri Sep 20 2013 Tomas Hozza 32:9.9.4-1 -- Update to bind-9.9.4 stable - -* Tue Sep 10 2013 Tomas Hozza 32:9.9.4-0.9.rc2 -- Fix [ISC-Bugs #34738] dns_journal_open() returns a pointer to stack - -* Mon Sep 09 2013 Tomas Hozza 32:9.9.4-0.8.rc2 -- update to bind-9.9.4rc2 - -* Tue Aug 20 2013 Tomas Hozza 32:9.9.4-0.7.rc1 -- Move named-checkzone and named-compilezone to bind-utils package - -* Tue Aug 20 2013 Tomas Hozza 32:9.9.4-0.6.rc1 -- Move tools that don't need the server to run, from main package to bind-utils (#964313) - -* Fri Aug 16 2013 Tomas Hozza 32:9.9.4-0.5.rc1 -- Don't generate rndc.key if there exists rndc.conf - -* Fri Aug 16 2013 Tomas Hozza 32:9.9.4-0.4.rc1 -- don't install named-sdb.service if SDB macro is defined to zero - -* Mon Aug 05 2013 Tomas Hozza 32:9.9.4-0.3.rc1 -- Fix setup-named-chroot.sh to mount/umount everything successfully -- update to bind-9.9.4rc1 - -* Sat Aug 03 2013 Fedora Release Engineering - 32:9.9.4-0.2.b1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild - -* Mon Jul 15 2013 Tomas Hozza 32:9.9.4-0.1.b1 -- update to bind-9.9.4b1 -- drop merged RRL patch -- drop merged stat.h patch - -* Wed Jun 05 2013 Tomas Hozza 32:9.9.3-3.P1 -- update to 9.9.3-P1 (fix for CVE-2013-3919) -- update RRL patch to 9.9.3-P1-rl.156.01 - -* Mon Jun 03 2013 Tomas Hozza 32:9.9.3-2 -- bump release to prevent update path issues - -* Mon Jun 03 2013 Tomas Hozza 32:9.9.3-1 -- update to 9.9.3 -- install dns/update.h header -- update RRL patch to the latest version 9.9.3-rl.150.20 - -* Fri May 17 2013 Tomas Hozza 32:9.9.3-0.7.rc2 -- Fix segfault in host/nslookup (#878139) - -* Mon May 13 2013 Tomas Hozza 32:9.9.3-0.6.rc2 -- update to 9.9.3rc2 -- part of bind97-exportlib.patch not needed any more -- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source -- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch -- bind99-opts.patch merged - -* Fri May 03 2013 Tomas Hozza 32:9.9.3-0.5.rc1 -- Include recursion Warning in named.conf and named.conf.sample (#740894) -- Include managed-keys-directory statement in named.conf.sample (#948026) - -* Thu May 02 2013 Tomas Hozza 32:9.9.3-0.4.rc1 -- Fix zone2sqlite to quote table names when creating/dropping/inserting (#919417) - -* Fri Apr 19 2013 Adam Tkac 32:9.9.3-0.3.rc1 -- fix crash in nsupdate when processing "-r" parameter (#949544) - -* Tue Apr 16 2013 Adam Tkac 32:9.9.3-0.2.rc1 -- ship dns/rrl.h in -devel subpkg - -* Tue Apr 16 2013 Adam Tkac 32:9.9.3-0.1.rc1 -- update to 9.9.3rc1 -- bind-96-libtool2.patch has been merged -- fix bind tmpfiles.d for named.pid /run migration (#920713) - -* Wed Mar 27 2013 Tomas Hozza 32:9.9.2-12.P2 -- New upstream patch version fixing CVE-2013-2266 (#928032) - -* Tue Mar 19 2013 Adam Tkac 32:9.9.2-11.P1 -- move pidfile to /run/named/named.pid - -* Wed Mar 06 2013 Tomas Hozza 32:9.9.2-10.P1 -- Fix Makefile.in to include header added by rate limiting patch (#918330) - -* Tue Mar 05 2013 Adam Tkac 32:9.9.2-9.P1 -- drop some developer-only documentation and move ARM to %%docdir - -* Mon Feb 18 2013 Adam Tkac 32:9.9.2-8.P1 -- include rate limiting patch - -* Tue Jan 29 2013 Tomas Hozza 32:9.9.2-7.P1 -- Corrected IP addresses in named.ca (#901741) -- mount/umount /var/named in setup-named-chroot.sh as the last one (#904666) - -* Thu Dec 20 2012 Adam Tkac 32:9.9.2-6.P1 -- generate /etc/rndc.key during named service startup if doesn't exist -- increase startup timeout in systemd units to 90sec (default) -- fix IDN related statement in dig.1 manpage - -* Wed Dec 05 2012 Tomas Hozza 32:9.9.2-5.P1 -- update to bind-9.9.2-P1 - -* Mon Nov 12 2012 Adam Tkac 32:9.9.2-4 -- document dig exit codes in manpage -- ignore empty "search" options in resolv.conf - -* Mon Nov 12 2012 Adam Tkac 32:9.9.2-3 -- drop PKCS11 support on rhel - -* Thu Oct 11 2012 Adam Tkac 32:9.9.2-2 -- install isc/stat.h - -* Thu Oct 11 2012 Adam Tkac 32:9.9.2-1 -- update to 9.9.2 -- bind97-rh714049.patch has been dropped -- patches merged - - bind98-rh816164.patch - -* Thu Sep 13 2012 Adam Tkac 32:9.9.1-10.P3 -- update to bind-9.9.1-P3 - -* Wed Aug 22 2012 Tomas Hozza 32:9.9.1-9.P2 -- fixed SPEC file so it comply with new systemd-rpm macros guidelines (#850045) -- changed %%define macros to %%global and fixed several rpmlint warnings - -* Wed Aug 08 2012 Tomas Hozza 32:9.9.1-8.P2 -- Changed PrivateTmp to "false" in *-chroot.service unit files (#825869) - -* Wed Aug 01 2012 Tomas Hozza 32:9.9.1-7.P2 -- Fixed bind-devel multilib conflict (#478718) - -* Mon Jul 30 2012 Tomas Hozza 32:9.9.1-6.P2 -- Fixed bad path to systemctl in /etc/NetworkManager/dispatcher.d/13-named (#844047) -- Fixed path to libdb.so in config.dlz.in - -* Thu Jul 26 2012 Adam Tkac 32:9.9.1-5.P2 -- update to 9.9.1-P2 - -* Wed Jul 18 2012 Fedora Release Engineering - 32:9.9.1-4.P1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild - -* Wed Jul 11 2012 Ville Skyttä - 32:9.9.1-3.P1 -- Avoid shell invocation and dep for -libs-lite %%postun. - -* Mon Jun 04 2012 Adam Tkac 32:9.9.1-2.P1 -- update to 9.9.1-P1 (CVE-2012-1667) - -* Thu May 24 2012 Adam Tkac 32:9.9.1-1 -- update to 9.9.1 -- bind99-coverity.patch merged -- bind-9.5-overflow.patch merged - -* Mon May 07 2012 Adam Tkac 32:9.9.0-6 -- nslookup: return non-zero exit code when fail to get answer (#816164) - -* Thu Apr 26 2012 Adam Tkac 32:9.9.0-5 -- initscript: don't umount /var/named when didn't mount it - -* Tue Apr 24 2012 Adam Tkac 32:9.9.0-4 -- apply all non-SDB patches before SDB ones (#804475) -- enable Berkeley DB DLZ backend (#804478) - -* Thu Apr 12 2012 Adam Tkac 32:9.9.0-3 -- bind97-rh699951.patch is no longer needed (different fix is in 9.9.0) - -* Mon Mar 26 2012 Adam Tkac 32:9.9.0-2 -- remove unneeded bind99-v6only.patch - -* Mon Mar 05 2012 Adam Tkac 32:9.9.0-1 -- update to 9.9.0 -- load dynamic DBs later (and update dyndb patch) -- fix memory leak in named during processing of rndc command -- don't call `rndc-confgen -a` in "post" section -- fix some packaging bugs in bind-chroot - -* Wed Feb 15 2012 Adam Tkac 32:9.9.0-0.8.rc2 -- build with "--enable-fixed-rrset" - -* Wed Feb 01 2012 Adam Tkac 32:9.9.0-0.7.rc2 -- update to 9.9.0rc2 -- doc/rfc and doc/draft are no longer shipped in tarball - -* Mon Jan 30 2012 Adam Tkac 32:9.9.0-0.6.rc1 -- retire initscript in favour of systemd unit files (#719419) - -* Thu Jan 12 2012 Adam Tkac 32:9.9.0-0.5.rc1 -- update to 9.9.0rc1 - -* Wed Dec 07 2011 Adam Tkac 32:9.9.0-0.4.b2 -- ship dns/forward.h in -devel subpkg - -* Tue Nov 22 2011 Adam Tkac 32:9.9.0-0.3.b2 -- update to 9.9.0b2 (CVE-2011-4313) -- patches merged - - bind97-rh700097.patch - - bind99-cinfo.patch - -* Mon Nov 14 2011 Adam Tkac 32:9.9.0-0.2.b1 -- ship dns/clientinfo.h in bind-devel - -* Fri Nov 11 2011 Adam Tkac 32:9.9.0-0.1.b1 -- update to 9.9.0b1 -- bind98-dlz_buildfix.patch merged - -* Fri Oct 28 2011 Adam Tkac 32:9.8.1-4 -- nslookup failed to resolve name in certain cases - -* Mon Sep 26 2011 Adam Tkac 32:9.8.1-3 -- remove deps filter, it is no longer needed (#739663) - -* Fri Sep 09 2011 Adam Tkac 32:9.8.1-2 -- fix logrotate config file (#725256) - -* Wed Sep 07 2011 Adam Tkac 32:9.8.1-1 -- update to 9.8.1 -- ship /etc/trusted-key.key (needed by dig) -- use select instead of epoll in export libs (#735103) - -* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.3.rc1 -- fix DLZ related compilation issues -- make /etc/named.{root,iscdlv}.key world-readable -- add bind-libs versioned requires to bind pkg - -* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.2.rc1 -- fix rare race condition in request.c -- print "the working directory is not writable" as debug message -- re-add configtest target to initscript -- initscript: sybsys name is always named, not named-sdb -- nsupdate returned zero when target zone didn't exist (#700097) -- nsupdate could have failed if server has multiple IPs and the first - was unreachable (#714049) - -* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.1.rc1 -- update to 9.8.1rc1 -- patches merged - - bind97-rh674334.patch - - bind97-cleanup.patch - - bind98-includes.patch - -* Wed Aug 03 2011 Adam Tkac 32:9.8.0-9.P4 -- improve patch for #725741 - -* Tue Jul 26 2011 Adam Tkac 32:9.8.0-8.P4 -- named could have crashed during reload when dyndb module is used (#725741) - -* Tue Jul 05 2011 Adam Tkac 32:9.8.0-7.P4 -- update to 9.8.0-P4 - - bind98-libdns-export.patch merged - -* Thu Jun 02 2011 Adam Tkac 32:9.8.0-6.P2 -- update the dyndb patch - -* Fri May 27 2011 Adam Tkac 32:9.8.0-5.P2 -- fix compilation of libdns-export.so - -* Fri May 27 2011 Adam Tkac 32:9.8.0-4.P2 -- update to 9.8.0-P2 (CVE-2011-1910) - -* Fri May 06 2011 Adam Tkac 32:9.8.0-3.P1 -- update to 9.8.0-P1 (CVE-2011-1907) - -* Wed Mar 23 2011 Dan Horák - 32:9.8.0-2 -- rebuilt for mysql 5.5.10 (soname bump in libmysqlclient) - -* Thu Mar 03 2011 Adam Tkac 32:9.8.0-1 -- update to 9.8.0 -- bind97-rh665971.patch merged - -* Thu Mar 03 2011 Adam Tkac 32:9.8.0-0.4.rc1 -- revert previous change (integration with libnmserver) - -* Tue Feb 22 2011 Adam Tkac 32:9.8.0-0.3.rc1 -- integrate named with libnmserver library - -* Tue Feb 22 2011 Adam Tkac 32:9.8.0-0.2.rc1 -- include dns/rpz.h in -devel subpkg - -* Mon Feb 21 2011 Adam Tkac 32:9.8.0-0.1.rc1 -- update to 9.8.0rc1 - -* Fri Feb 18 2011 Adam Tkac 32:9.7.3-1 -- update to 9.7.3 -- fix dig +trace on dualstack systems (#674334) -- fix linkage order when building on system with older BIND (#665971) -- reduce number of gcc warnings - -* Mon Feb 07 2011 Fedora Release Engineering - 32:9.7.3-0.6.rc1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild - -* Tue Jan 25 2011 Adam Tkac 32:9.7.3-0.5.rc1 -- update to 9.7.3rc1 - - bind97-krb5-self.patch merged - -* Wed Jan 12 2011 Adam Tkac 32:9.7.3-0.4.b1 -- fix typo in initscript - -* Thu Jan 06 2011 Adam Tkac 32:9.7.3-0.3.b1 -- fix "service named status" when used with named-sdb -- don't check MD5, size and mtime of sysconfig/named - -* Wed Jan 05 2011 Adam Tkac 32:9.7.3-0.2.b1 -- add new option DISABLE_ZONE_CHECKING to sysconfig/named - -* Wed Jan 05 2011 Adam Tkac 32:9.7.3-0.1.b1 -- update to 9.7.3b1 - -* Wed Jan 05 2011 Adam Tkac 32:9.7.2-10.P3 -- initscript should terminate only the correct "named" process (#622785) - -* Mon Dec 20 2010 Adam Tkac 32:9.7.2-9.P3 -- fix "krb5-self" update-policy rule processing - -* Thu Dec 02 2010 Adam Tkac 32:9.7.2-8.P3 -- update to 9.7.2-P3 - -* Mon Nov 29 2010 Jan Görig 32:9.7.2-7.P2 -- added tmpfiles.d support (#656550) -- removed old PID checking in initscript - -* Mon Nov 08 2010 Adam Tkac 32:9.7.2-6.P2 -- don't emit various informational messages by default (#645544) - -* Wed Oct 20 2010 Adam Tkac 32:9.7.2-5.P2 -- move BIND9 internal libs back to %%{_libdir} -- add "-export" suffix to public libraries (-lite subpkg) - -* Thu Oct 07 2010 Adam Tkac 32:9.7.2-4.P2 -- ship -devel subpkg for internal libs, dnsperf needs it - -* Thu Oct 07 2010 Adam Tkac 32:9.7.2-3.P2 -- new bind-libs-lite and bind-lite-devel subpkgs which contain - public version of BIND 9 libraries -- don't ship devel files for internal version of BIND 9 libraries - -* Wed Sep 29 2010 Adam Tkac 32:9.7.2-2.P2 -- update to 9.7.2-P2 - -* Thu Sep 16 2010 Adam Tkac 32:9.7.2-1 -- update to 9.7.2 - -* Fri Aug 27 2010 Adam Tkac 32:9.7.2-0.3.rc1 -- update to 9.7.2rc1 - -* Tue Aug 10 2010 Adam Tkac 32:9.7.2-0.2.b1 -- host: handle "debug", "attempts" and "timeout" options in resolv.conf well - -* Tue Aug 03 2010 Adam Tkac 32:9.7.2-0.1.b1 -- update to 9.7.2b1 -- patches merged - - bind97-rh507429.patch - -* Mon Jul 19 2010 Adam Tkac 32:9.7.1-5.P2 -- supply root zone DNSKEY in default configuration - -* Mon Jul 19 2010 Adam Tkac 32:9.7.1-4.P2 -- update to 9.7.1-P2 (CVE-2010-0213) - -* Mon Jul 12 2010 Adam Tkac 32:9.7.1-3.P1 -- remove outdated Copyright.caching-nameserver file -- remove rfc1912.txt, it is already located in %%doc/rfc directory -- move COPYRIGHT to the bind-libs subpkg -- add COPYRIGHT to the -pkcs11 subpkg - -* Fri Jul 09 2010 Adam Tkac 32:9.7.1-2.P1 -- update to 9.7.1-P1 - -* Mon Jun 28 2010 Adam Tkac 32:9.7.1-1 -- update to 9.7.1 -- improve the "dnssec-conf" trigger - -* Wed Jun 09 2010 Adam Tkac 32:9.7.1-0.2.rc1 -- update to 9.7.1rc1 -- patches merged - - bind97-keysdir.patch - -* Mon May 31 2010 Adam Tkac 32:9.7.1-0.1.b1 -- update to 9.7.1b1 -- make /var/named/dynamic as a default directory for managed DNSSEC keys -- add patch to get "managed-keys-directory" option working -- patches merged - - bind97-managed-keyfile.patch - - bind97-rh554316.patch - -* Fri May 21 2010 Adam Tkac 32:9.7.0-11.P2 -- update dnssec-conf Obsoletes/Provides - -* Thu May 20 2010 Adam Tkac 32:9.7.0-10.P2 -- update to 9.7.0-P2 - -* Fri Mar 26 2010 Adam Tkac 32:9.7.0-9.P1 -- added lost patch for #554316 (occasional crash in keytable.c) - -* Fri Mar 26 2010 Adam Tkac 32:9.7.0-8.P1 -- active query might be destroyed in resume_dslookup() which triggered REQUIRE - failure (#507429) - -* Mon Mar 22 2010 Adam Tkac 32:9.7.0-7.P1 -- install SDB related manpages only when build with SDB - -* Fri Mar 19 2010 Adam Tkac 32:9.7.0-6.P1 -- update to 9.7.0-P1 - -* Tue Mar 16 2010 Jan Görig 32:9.7.0-5 -- bind-sdb now requires bind - -* Mon Mar 15 2010 Jan Görig 32:9.7.0-4 -- add man-pages ldap2zone.1 zonetodb.1 zone2sqlite.1 named-sdb.8 (#525655) - -* Mon Mar 01 2010 Adam Tkac 32:9.7.0-3 -- fix multilib issue (#478718) [jgorig] - -* Mon Mar 01 2010 Adam Tkac 32:9.7.0-2 -- improve automatic DNSSEC reconfiguration trigger -- initscript now returns 2 in case that action doesn't exist (#523435) -- enable/disable chroot when bind-chroot is installed/uninstalled - -* Wed Feb 17 2010 Adam Tkac 32:9.7.0-1 -- update to 9.7.0 final - -* Mon Feb 15 2010 Adam Tkac 32:9.7.0-0.14.rc2 -- obsolete dnssec-conf -- automatically update configuration from old dnssec-conf based -- improve default configuration; enable DLV by default -- remove obsolete triggerpostun from bind-libs subpackage - -* Thu Jan 28 2010 Adam Tkac 32:9.7.0-0.13.rc2 -- update to 9.7.0rc2 - -* Wed Jan 27 2010 Adam Tkac 32:9.7.0-0.12.rc1 -- initscript LSB related fixes (#523435) - -* Wed Jan 27 2010 Adam Tkac 32:9.7.0-0.11.rc1 -- revert the "DEBUG" feature (#510283), it causes too many problems (#545128) - -* Tue Dec 15 2009 Adam Tkac 32:9.7.0-0.10.rc1 -- update to 9.7.0rc1 -- bind97-headers.patch merged -- update default configuration - -* Tue Dec 01 2009 Adam Tkac 32:9.7.0-0.9.b3 -- update to 9.7.0b3 - -* Thu Nov 26 2009 Adam Tkac 32:9.7.0-0.8.b2 -- install isc/namespace.h header - -* Fri Nov 06 2009 Adam Tkac 32:9.7.0-0.7.b2 -- update to 9.7.0b2 - -* Tue Nov 03 2009 Adam Tkac 32:9.7.0-0.6.b1 -- update to 9.7.0b1 -- add bind-pkcs11 subpackage to support PKCS11 compatible keystores for DNSSEC - keys - -* Thu Oct 08 2009 Adam Tkac 32:9.7.0-0.5.a3 -- don't package named-bootconf utility, it is very outdated and unneeded - -* Mon Sep 21 2009 Adam Tkac 32:9.7.0-0.4.a3 -- determine file size via `stat` instead of `ls` (#523682) - -* Wed Sep 16 2009 Adam Tkac 32:9.7.0-0.3.a3 -- update to 9.7.0a3 - -* Tue Sep 15 2009 Adam Tkac 32:9.7.0-0.2.a2 -- improve chroot related documentation (#507795) -- add NetworkManager dispatcher script to reload named when network interface is - activated/deactivated (#490275) -- don't set/unset named_write_master_zones SELinux boolean every time in - initscript, modify it only when it's actually needed - -* Tue Sep 15 2009 Adam Tkac 32:9.7.0-0.1.a2 -- update to 9.7.0a2 -- merged patches - - bind-96-db_unregister.patch - - bind96-rh507469.patch - -* Tue Sep 01 2009 Adam Tkac 32:9.6.1-9.P1 -- next attempt to fix the postun trigger (#520385) -- remove obsolete bind-9.3.1rc1-fix_libbind_includedir.patch - -* Fri Aug 21 2009 Tomas Mraz - 32:9.6.1-8.P1 -- rebuilt with new openssl - -* Tue Aug 04 2009 Martin Nagy 32:9.6.1-7.P1 -- update the patch for dynamic loading of database backends - -* Wed Jul 29 2009 Adam Tkac 32:9.6.1-6.P1 -- 9.6.1-P1 release (CVE-2009-0696) -- fix postun trigger (#513016, hopefully) - -* Fri Jul 24 2009 Fedora Release Engineering - 32:9.6.1-5 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild - -* Mon Jul 20 2009 Adam Tkac 32:9.6.1-4 -- remove useless bind-9.3.3rc2-rndckey.patch - -* Mon Jul 13 2009 Adam Tkac 32:9.6.1-3 -- fix broken symlinks in bind-libs (#509635) -- fix typos in /etc/sysconfig/named (#509650) -- add DEBUG option to /etc/sysconfig/named (#510283) - -* Wed Jun 24 2009 Adam Tkac 32:9.6.1-2 -- improved "chroot automount" patches (#504596) -- host should fail if specified server doesn't respond (#507469) - -* Wed Jun 17 2009 Adam Tkac 32:9.6.1-1 -- 9.6.1 release -- simplify chroot maintenance. Important files and directories are mounted into - chroot (see /etc/sysconfig/named for more info, #504596) -- fix doc/named.conf.default perms - -* Wed May 27 2009 Adam Tkac 32:9.6.1-0.4.rc1 -- 9.6.1rc1 release - -* Wed Apr 29 2009 Martin Nagy 32:9.6.1-0.3.b1 -- update the patch for dynamic loading of database backends -- create %%{_libdir}/bind directory -- copy default named.conf to doc directory, shared with s-c-bind (atkac) - -* Fri Apr 24 2009 Martin Nagy 32:9.6.1-0.2.b1 -- update the patch for dynamic loading of database backends -- fix dns_db_unregister() -- useradd now takes "-N" instead of "-n" (atkac, #495726) -- print nicer error msg when zone file is actually a directory (atkac, #490837) - -* Mon Mar 30 2009 Adam Tkac 32:9.6.1-0.1.b1 -- 9.6.1b1 release -- patches merged - - bind-96-isc_header.patch - - bind-95-rh469440.patch - - bind-96-realloc.patch - - bind9-fedora-0001.diff -- use -version-number instead of -version-info libtool param - -* Mon Mar 23 2009 Adam Tkac 32:9.6.0-11.1.P1 -- logrotate configuration file now points to /var/named/data/named.run by - default (#489986) - -* Tue Mar 17 2009 Adam Tkac 32:9.6.0-11.P1 -- fall back to insecure mode when no supported DNSSEC algorithm is found - instead of SERVFAIL -- don't fall back to non-EDNS0 queries when DO bit is set - -* Tue Mar 10 2009 Adam Tkac 32:9.6.0-10.P1 -- enable DNSSEC only if it is enabled in sysconfig/dnssec - -* Mon Mar 09 2009 Adam Tkac 32:9.6.0-9.P1 -- add DNSSEC support to initscript, enabled it per default -- add requires dnssec-conf - -* Mon Mar 09 2009 Adam Tkac 32:9.6.0-8.P1 -- fire away libbind, it is now separate package - -* Wed Mar 04 2009 Adam Tkac 32:9.6.0-7.P1 -- fixed some read buffer overflows (upstream) - -* Mon Feb 23 2009 Fedora Release Engineering 32:9.6.0-6.P1 -- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild - -* Thu Feb 12 2009 Martin Nagy 32:9.6.0-5.P1 -- update the patch for dynamic loading of database backends -- include iterated_hash.h - -* Sat Jan 24 2009 Caolán McNamara 32:9.6.0-4.P1 -- rebuild for dependencies - -* Wed Jan 21 2009 Adam Tkac 32:9.6.0-3.P1 -- rebuild against new openssl - -* Thu Jan 08 2009 Adam Tkac 32:9.6.0-2.P1 -- 9.6.0-P1 release (CVE-2009-0025) - -* Mon Jan 05 2009 Adam Tkac 32:9.6.0-1 -- Happy new year -- 9.6.0 release - -* Thu Dec 18 2008 Adam Tkac 32:9.6.0-0.7.rc2 -- 9.6.0rc2 release -- bind-96-rh475120.patch merged - -* Tue Dec 16 2008 Martin Nagy 32:9.6.0-0.6.rc1 -- add patch for dynamic loading of database backends - -* Tue Dec 09 2008 Adam Tkac 32:9.6.0-0.5.1.rc1 -- allow to reuse address for non-random query-source ports (#475120) - -* Wed Dec 03 2008 Adam Tkac 32:9.6.0-0.5.rc1 -- 9.6.0rc1 release -- patches merged - - bind-9.2.0rc3-varrun.patch - - bind-95-sdlz-include.patch - - bind-96-libxml2.patch -- fixed rare use-after-free problem in host utility (#452060) -- enabled chase of DNSSEC signature chains in dig - -* Mon Dec 01 2008 Adam Tkac 32:9.6.0-0.4.1.b1 -- improved sample config file (#473586) - -* Wed Nov 26 2008 Adam Tkac 32:9.6.0-0.4.b1 -- reverted previous change, koji doesn't like it - -* Wed Nov 26 2008 Adam Tkac 32:9.6.0-0.3.b1 -- build bind-chroot as noarch - -* Mon Nov 24 2008 Adam Tkac 32:9.6.0-0.2.1.b1 -- updates due libtool 2.2.6 -- don't pass -DLDAP_DEPRECATED to cpp, handle it directly in sources - -* Tue Nov 11 2008 Adam Tkac 32:9.6.0-0.2.b1 -- make statistics http server working, patch backported from 9.6 HEAD - -* Mon Nov 10 2008 Adam Tkac 32:9.6.0-0.1.b1 -- 9.6.0b1 release -- don't build ODBC and Berkeley DB DLZ drivers -- end of bind-chroot-admin script, copy config files to chroot manually -- /proc doesn't have to be mounted to chroot -- temporary use libbind from 9.5 series, noone has been released for 9.6 yet - -* Mon Nov 03 2008 Adam Tkac 32:9.5.1-0.8.4.b2 -- dig/host: use only IPv4 addresses when -4 option is specified (#469440) - -* Thu Oct 30 2008 Adam Tkac 32:9.5.1-0.8.2.b2 -- removed unneeded bind-9.4.1-ldap-api.patch - -* Thu Oct 30 2008 Adam Tkac 32:9.5.1-0.8.1.b2 -- ship dns/{s,}dlz.h and isc/radix.h in bind-devel - -* Tue Oct 07 2008 Adam Tkac 32:9.5.1-0.8.b2 -- removed bind-9.4.0-dnssec-directory.patch, it is wrong - -* Wed Sep 24 2008 Adam Tkac 32:9.5.1-0.7.b2 -- 9.5.1b2 release -- patches merged - - bind95-rh454783.patch - - bind-9.5-edns.patch - - bind95-rh450995.patch - - bind95-rh457175.patch - -* Wed Sep 17 2008 Adam Tkac 32:9.5.1-0.6.b1 -- IDN output strings didn't honour locale settings (#461409) - -* Tue Aug 05 2008 Adam Tkac 32:9.5.1-0.5.b1 -- disable transfer stats on DLZ zones (#454783) - -* Mon Aug 04 2008 Adam Tkac 32:9.5.1-0.4.b1 -- add forgotten patch for #457175 -- build with -O2 - -* Thu Jul 31 2008 Adam Tkac 32:9.5.1-0.3.b1 -- static libraries are no longer supported -- IP acls weren't merged correctly (#457175) -- use fPIE on sparcv9/sparc64 (Dennis Gilmore) -- add sparc64 to list of 64bit arches in spec (Dennis Gilmore) - -* Mon Jul 21 2008 Adam Tkac 32:9.5.1-0.2.b1 -- updated patches due new rpm (--fuzz=0 patch parameter) - -* Mon Jul 14 2008 Adam Tkac 32:9.5.1-0.1.1.b1 -- use %%patch0 for Patch0 (#455061) -- correct source address (#455118) - -* Tue Jul 08 2008 Adam Tkac 32:9.5.1-0.1.b1 -- 9.5.1b1 release (CVE-2008-1447) -- dropped bind-9.5-recv-race.patch because upstream doesn't want it - -* Mon Jun 30 2008 Adam Tkac 32:9.5.0-37.1 -- update default named.conf statements (#452708) - -* Thu Jun 26 2008 Adam Tkac 32:9.5.0-37 -- some compat changes to fix building on RHEL4 - -* Mon Jun 23 2008 Adam Tkac 32:9.5.0-36.3 -- fixed typo in %%posttrans script - -* Wed Jun 18 2008 Adam Tkac 32:9.5.0-36.2 -- parse inner acls correctly (#450995) - -* Mon Jun 02 2008 Adam Tkac 32:9.5.0-36.1 -- removed dns-keygen utility in favour of rndc-confgen -a (#449287) -- some minor sample fixes (#449274) - -* Thu May 29 2008 Adam Tkac 32:9.5.0-36 -- updated to 9.5.0 final -- use getifaddrs to find available interfaces - -* Mon May 26 2008 Adam Tkac 32:9.5.0-35.rc1 -- make /var/run/named writable by named (#448277) -- fixed one non-utf8 file - -* Thu May 22 2008 Adam Tkac 32:9.5.0-34.rc1 -- fixes needed to pass package review (#225614) - -* Wed May 21 2008 Adam Tkac 32:9.5.0-33.1.rc1 -- bind-chroot now depends on bind (#446477) - -* Wed May 14 2008 Adam Tkac 32:9.5.0-33.rc1 -- updated to 9.5.0rc1 -- merged patches - - bind-9.5-libcap.patch -- make binaries readable by others (#427826) - -* Tue May 13 2008 Adam Tkac 32:9.5.0-32.b3 -- reverted "any" patch, upstream says not needed -- log EDNS failure only when we really switch to plain EDNS (#275091) -- detect configuration file better - -* Tue May 06 2008 Adam Tkac 32:9.5.0-31.1.b3 -- addresses 0.0.0.0 and ::0 really match any (#275091, comment #28) - -* Mon May 05 2008 Adam Tkac 32:9.5.0-31.b3 -- readded bind-9.5-libcap.patch -- added bind-9.5-recv-race.patch from F8 branch (#400461) - -* Wed Apr 23 2008 Adam Tkac 32:9.5.0-30.1.b3 -- build Berkeley DB DLZ backend - -* Mon Apr 21 2008 Adam Tkac 32:9.5.0-30.b3 -- 9.5.0b3 release -- dropped patches (upstream) - - bind-9.5-transfer-segv.patch - - bind-9.5-mudflap.patch - - bind-9.5.0-generate-xml.patch - - bind-9.5-libcap.patch - -* Wed Apr 02 2008 Adam Tkac 32:9.5.0-29.3.b2 -- fixed named.conf.sample file (#437569) - -* Fri Mar 14 2008 Adam Tkac 32:9.5.0-29.2.b2 -- fixed URLs - -* Mon Feb 25 2008 Adam Tkac 32:9.5.0-29.1.b2 -- BuildRequires cleanup - -* Sun Feb 24 2008 Adam Tkac 32:9.5.0-29.b2 -- rebuild without mudflap (#434159) - -* Wed Feb 20 2008 Adam Tkac 32:9.5.0-28.b2 -- port named to use libcap library, enable threads (#433102) -- removed some unneeded Requires - -* Tue Feb 19 2008 Adam Tkac 32:9.5.0-27.b2 -- removed conditional build with libefence (use -fmudflapth instead) -- fixed building of DLZ stuff (#432497) -- do not build Berkeley DB DLZ backend -- temporary build with --disable-linux-caps and without threads (#433102) -- update named.ca file to affect IPv6 changes in root zone - -* Mon Feb 11 2008 Adam Tkac 32:9.5.0-26.b2 -- build with -D_GNU_SOURCE (#431734) -- improved fix for #253537, posttrans script is now used -- improved fix for #400461 -- 9.5.0b2 - - bind-9.3.2b1-PIE.patch replaced by bind-9.5-PIE.patch - - only named, named-sdb and lwresd are PIE - - bind-9.5-sdb.patch has been updated - - bind-9.5-libidn.patch has been updated - - bind-9.4.0-sdb-sqlite-bld.patch replaced by bind-9.5-sdb-sqlite-bld.patch - - removed bind-9.5-gssapi-header.patch (upstream) - - removed bind-9.5-CVE-2008-0122.patch (upstream) -- removed bind-9.2.2-nsl.patch -- improved sdb_tools Makefile.in - -* Mon Feb 04 2008 Adam Tkac 32:9.5.0-25.b1 -- fixed segfault during sending notifies (#400461) -- rebuild with gcc 4.3 series - -* Tue Jan 22 2008 Adam Tkac 32:9.5.0-24.b1 -- removed bind-9.3.2-prctl_set_dumpable.patch (upstream) -- allow parallel building of libdns library -- CVE-2008-0122 - -* Thu Dec 27 2007 Adam Tkac 32:9.5.0-23.b1 -- fixed initscript wait loop (#426382) -- removed dependency on policycoreutils and libselinux (#426515) - -* Thu Dec 20 2007 Adam Tkac 32:9.5.0-22.b1 -- fixed regression caused by libidn2 patch (#426348) - -* Wed Dec 19 2007 Adam Tkac 32:9.5.0-21.b1 -- fixed typo in post section (CVE-2007-6283) - -* Wed Dec 19 2007 Adam Tkac 32:9.5.0-20.b1 -- removed obsoleted triggers -- CVE-2007-6283 - -* Wed Dec 12 2007 Adam Tkac 32:9.5.0-19.2.b1 -- added dst/gssapi.h to -devel subpackage (#419091) -- improved fix for (#417431) - -* Mon Dec 10 2007 Adam Tkac 32:9.5.0-19.1.b1 -- fixed shutdown with initscript when rndc doesn't work (#417431) -- fixed IDN patch (#412241) - -* Thu Dec 06 2007 Adam Tkac 32:9.5.0-19.b1 -- 9.5.0b1 (#405281, #392491) - -* Thu Dec 06 2007 Release Engineering 32:9.5.0-18.6.a7 -- Rebuild for deps - -* Wed Dec 05 2007 Adam Tkac 32:9.5.0-18.5.a7 -- build with -O0 - -* Mon Dec 03 2007 Adam Tkac 32:9.5.0-18.4.a7 -- bind-9.5-random_ports.patch was removed because upstream doesn't - like it. query-source{,v6} options are sufficient (#391931) -- bind-chroot-admin called restorecon on /proc filesystem (#405281) - -* Mon Nov 26 2007 Adam Tkac 32:9.5.0-18.3.a7 -- removed edns patch to keep compatibility with vanilla bind - (#275091, comment #20) - -* Wed Nov 21 2007 Adam Tkac 32:9.5.0-18.2.a7 -- use system port selector instead ISC's (#391931) - -* Mon Nov 19 2007 Adam Tkac 32:9.5.0-18.a7 -- removed statement from initscript which passes -D to named - -* Thu Nov 15 2007 Adam Tkac 32:9.5.0-17.a7 -- 9.5.0a7 -- dropped patches (upstream) - - bind-9.5-update.patch - - bind-9.5-pool_badfree.patch - - bind-9.5-_res_errno.patch - -* Thu Nov 15 2007 Adam Tkac 32:9.5.0-16.5.a6 -- added bind-sdb again, contains SDB modules and DLZ modules -- bind-9.3.1rc1-sdb.patch replaced by bind-9.5-sdb.patch - -* Mon Nov 12 2007 Adam Tkac 32:9.5.0-16.4.a6 -- removed Requires: openldap, postgresql, mysql, db4, unixODBC -- new L.ROOT-SERVERS.NET address - -* Mon Oct 29 2007 Adam Tkac 32:9.5.0-16.3.a6 -- completely disable DBUS - -* Fri Oct 26 2007 Adam Tkac 32:9.5.0-16.2.a6 -- minor cleanup in bind-chroot-admin - -* Thu Oct 25 2007 Adam Tkac 32:9.5.0-16.1.a6 -- fixed typo in initscript - -* Tue Oct 23 2007 Adam Tkac 32:9.5.0-16.a6 -- disabled DBUS (dhcdbd doesn't exist & #339191) - -* Thu Oct 18 2007 Adam Tkac 32:9.5.0-15.1.a6 -- fixed missing va_end () functions (#336601) -- fixed memory leak when dbus initialization fails - -* Tue Oct 16 2007 Adam Tkac 32:9.5.0-15.a6 -- corrected named.5 SDB statement (#326051) - -* Mon Sep 24 2007 Adam Tkac 32:9.5.0-14.a6 -- added edns patch again (#275091) - -* Mon Sep 24 2007 Adam Tkac 32:9.5.0-13.a6 -- removed bind-9.3.3-edns.patch patch (see #275091 for reasons) - -* Thu Sep 20 2007 Adam Tkac 32:9.5.0-12.4.a6 -- build with O2 -- removed "autotools" patch -- bugfixing in bind-chroot-admin (#279901) - -* Thu Sep 06 2007 Adam Tkac 32:9.5.0-12.a6 -- bind-9.5-2119_revert.patch and bind-9.5-fix_h_errno.patch are - obsoleted by upstream bind-9.5-_res_errno.patch - -* Wed Sep 05 2007 Adam Tkac 32:9.5.0-11.9.a6 -- fixed wrong resolver's dispatch pool cleanup (#275011, patch from - tmraz redhat com) - -* Wed Sep 05 2007 Adam Tkac 32:9.5.0-11.3.a6 -- initscript failure message is now printed correctly (#277981, - Quentin Armitage (quentin armitage org uk) ) - -* Mon Sep 03 2007 Adam Tkac 32:9.5.0-11.2.a6 -- temporary revert ISC 2119 change and add "libbind-errno" patch - (#254501) again - -* Thu Aug 23 2007 Adam Tkac 32:9.5.0-11.1.a6 -- removed end dots from Summary sections (skasal@redhat.com) -- fixed wrong file creation by autotools patch (skasal@redhat.com) - -* Thu Aug 23 2007 Adam Tkac 32:9.5.0-11.a6 -- start using --disable-isc-spnego configure option - - remove bind-9.5-spnego-memory_management.patch (source isn't - compiled) - -* Wed Aug 22 2007 Adam Tkac 32:9.5.0-10.2.a6 -- added new initscript option KEYTAB_FILE which specified where - is located kerberos .keytab file for named service -- obsolete temporary bind-9.5-spnego-memory_management.patch by - bind-9.5-gssapictx-free.patch which conforms BIND coding standards - (#251853) - -* Tue Aug 21 2007 Adam Tkac 32:9.5.0-10.a6 -- dropped direct dependency to /etc/openldap/schema directory -- changed hardcoded paths to macros -- fired away code which configure LDAP server - -* Tue Aug 14 2007 Adam Tkac 32:9.5.0-9.1.a6 -- named could crash with SRV record UPDATE (#251336) - -* Mon Aug 13 2007 Adam Tkac 32:9.5.0-9.a6 -- disable 64bit dlz driver patch on alpha and ia64 (#251298) -- remove wrong malloc functions from lib/dns/spnego.c (#251853) - -* Mon Aug 06 2007 Adam Tkac 32:9.5.0-8.2.a6 -- changed licence from BSD-like to ISC - -* Tue Jul 31 2007 Adam Tkac 32:9.5.0-8.1.a6 -- disabled named on all runlevels by default - -* Mon Jul 30 2007 Adam Tkac 32:9.5.0-8.a6 -- minor next improvements on autotools patch -- dig and host utilities now using libidn instead idnkit for - IDN support - -* Wed Jul 25 2007 Warren Togami 32:9.5.0-7.a6 -- binutils/gcc bug rebuild (#249435) - -* Tue Jul 24 2007 Adam Tkac 32:9.5.0-6.a6 -- updated to 9.5.0a6 which contains fixes for CVE-2007-2925 and - CVE-2007-2926 -- fixed building on 64bits - -* Mon Jul 23 2007 Adam Tkac 31:9.5.0a5-5 -- integrated "autotools" patch for testing purposes (upstream will - accept it in future, for easier building) - -* Mon Jul 23 2007 Adam Tkac 31:9.5.0a5-4.1 -- fixed DLZ drivers building on 64bit systems - -* Fri Jul 20 2007 Adam Tkac 31:9.5.0a5-4 -- fixed relation between logrotated and chroot-ed named - -* Wed Jul 18 2007 Adam Tkac 31:9.5.0a5-3.9 -- removed bind-sdb package (default named has compiled SDB backend now) -- integrated DLZ (Dynamically loadable zones) drivers -- integrated GSS-TSIG support (RFC 3645) -- build with -O0 (many new features, potential core dumps will be more useful) - -* Tue Jul 17 2007 Adam Tkac 31:9.5.0a5-3.2 -- initscript should be ready for parallel booting (#246878) - -* Tue Jul 17 2007 Adam Tkac 31:9.5.0a5-3 -- handle integer overflow in isc_time_secondsastimet function gracefully (#247856) - -* Mon Jul 16 2007 Adam Tkac 31:9.5.0a5-2.2 -- moved chroot configfiles into chroot subpackage (#248306) - -* Mon Jul 02 2007 Adam Tkac 31:9.5.0a5-2 -- minor changes in default configuration -- fix h_errno assigment during resolver initialization (unbounded recursion, #245857) -- removed wrong patch to #150288 - -* Tue Jun 19 2007 Adam Tkac 31:9.5.0a5-1 -- updated to latest upstream - -* Wed Jun 13 2007 Adam Tkac 31:9.4.1-7 -- marked caching-nameserver as obsolete (#244604) -- fixed typo in initscript (causes that named doesn't detect NetworkManager - correctly) -- next cleanup in configuration - moved configfiles into config.tar -- removed delay between start & stop in restart function in named.init - -* Tue Jun 12 2007 Adam Tkac 31:9.4.1-6 -- major changes in initscript. Could be LSB compatible now -- removed caching-nameserver subpackage. Move configs from this - package to main bind package as default configuration and major - configuration cleanup - -* Mon Jun 04 2007 Adam Tkac 31:9.4.1-5 -- very minor compatibility change in bind-chroot-admin (line 215) -- enabled IDN support by default and don't distribute IDN libraries -- specfile cleanup -- add dynamic directory to /var/named. This directory will be primarily used for - dynamic DNS zones. ENABLE_ZONE_WRITE and SELinux's named_write_master_zones no longer exist - -* Thu May 24 2007 Adam Tkac 31:9.4.1-4 -- removed ldap-api patch and start using deprecated API -- fixed minor problem in bind-chroot-admin script (#241103) - -* Tue May 22 2007 Adam Tkac 31:9.4.1-3 -- fixed bind-chroot-admin dynamic DNS handling (#239149) -- updated zone-freeze patch to latest upstream -- ldap sdb has been rewriten to latest api (#239802) - -* Mon May 07 2007 Adam Tkac 31:9.4.1-2.fc7 -- test build on new build system - -* Wed May 02 2007 Adam Tkac 31:9.4.1-1.fc7 -- updated to 9.4.1 which contains fix to CVE-2007-2241 - -* Fri Apr 27 2007 Adam Tkac 31:9.4.0-8.fc7 -- improved "zone freeze patch" - if multiple zone with same name exists - no zone is freezed -- minor cleanup in caching-nameserver's config file -- fixed race-condition in dbus code (#235809) -- added forgotten restorecon statement in bind-chroot-admin - -* Tue Apr 17 2007 Adam Tkac 31:9.4.0-7.fc7 -- removed DEBUGINFO option because with this option (default) was bind - builded with -O0 and without this flag no debuginfo package was produced. - (I want faster bind => -O2 + debuginfo) -- fixed zone finding (#236426) - -* Mon Apr 16 2007 Adam Tkac 31:9.4.0-6.fc7 -- added idn support (still under development with upstream, disabled by default) - -* Wed Apr 11 2007 Adam Tkac 31:9.4.0-5.fc7 -- dnssec-signzone utility now doesn't ignore -d parameter - -* Tue Apr 10 2007 Adam Tkac 31:9.4.0-4.fc7 -- removed query-source[-v6] options from caching-nameserver config - (#209954, increase security) -- throw away idn. It won't be ready in fc7 - -* Tue Mar 13 2007 Adam Tkac 31:9.4.0-3.fc7 -- prepared bind to merge review -- added experimental idn support to bind-utils utils (not enabled by default yet) -- change chroot policy in caching-nameserver post section -- fixed bug in bind-chroot-admin - rootdir function is called properly now - -* Mon Mar 12 2007 Adam Tkac 31:9.4.0-2.fc7 -- added experimental SQLite support (written by John Boyd ) -- moved bind-chroot-admin script to chroot package -- bind-9.3.2-redhat_doc.patch is always applied (#231738) - -* Tue Mar 06 2007 Adam Tkac 31:9.4.0-1.fc7 -- updated to 9.4.0 -- bind-chroot-admin now sets EAs correctly (#213926) -- throw away next_server_on_referral and no_servfail_stops patches (fixed in 9.4.0) - -* Thu Feb 15 2007 Adam Tkac 31:9.3.4-7.fc7 -- minor cleanup in bind-chroot-admin script - -* Fri Feb 09 2007 Adam Tkac 31:9.3.4-6.fc7 -- fixed broken bind-chroot-admin script (#227995) - -* Wed Feb 07 2007 Adam Tkac 31:9.3.4-5.fc7 -- bind-chroot-admin now uses correct chroot path (#227600) - -* Mon Feb 05 2007 Adam Tkac 31:9.3.4-4.fc7 -- fixed conflict between bind-sdb and ldap -- removed duplicated bind directory in bind-libs - -* Thu Feb 01 2007 Adam Tkac 31:9.3.4-3.fc7 -- fixed building without libbind -- fixed post section (selinux commands is now in if-endif statement) -- prever macro has been removed from version - -* Mon Jan 29 2007 Adam Tkac 31:9.3.4-2.fc7 -- redirected output from bind-chroot prep and %%preun stages to /dev/null - -* Thu Jan 25 2007 Adam Tkac 31:9.3.4-1.fc7 -- updated to version 9.3.4 which contains security bugfixes - -* Tue Jan 23 2007 Adam Tkac 31:9.3.3-5.fc7 -- package bind-libbind-devel has been marked as obsolete - -* Mon Jan 22 2007 Adam Tkac 31:9.3.3-4.fc7 -- package bind-libbind-devel has beed removed (libs has been moved to bind-devel & bind-libs) -- Resolves: #214208 - -* Tue Jan 16 2007 Martin Stransky - 31:9.3.3-3 -- fixed a multi-lib issue -- Resolves: rhbz#222717 - -* Thu Jan 4 2007 Martin Stransky - 31:9.3.3-2 -- added namedGetForwarders written in shell (#176100), - created by Baris Cicek . - -* Sun Dec 10 2006 Martin Stransky - 31:9.3.3-1 -- update to 9.3.3 final -- fix for #219069: file included twice in src.rpm - -* Wed Dec 6 2006 Martin Stransky - 31:9.3.3-0.1.rc3 -- added back an interval to restart -- renamed package, it should meet the N-V-R criteria -- fix for #216185: bind-chroot-admin able to change root mode 750 -- added fix from #215997: incorrect permissions on dnszone.schema -- added a notice to init script when /etc/named.conf doesn't exist (#216075) - -* Mon Oct 30 2006 Martin Stransky - 30:9.3.3-6 -- fix for #200465: named-checkzone and co. cannot be run as non-root user -- fix for #212348: chroot'd named causes df permission denied error -- fix for #211249, #211083 - problems with stopping named -- fix for #212549: init script does not unmount /proc filesystem -- fix for #211282: EDNS is globally enabled, crashing CheckPoint FW-1, - added edns-enable options to named configuration file which can suppress - EDNS in queries to DNS servers (see /usr/share/doc/bind-9.3.3/misc/options) -- fix for #212961: bind-chroot doesn't clean up its mess on %%preun -- update to 9.3.3rc3, removed already merged patches - -* Fri Oct 13 2006 Martin Stransky - 30:9.3.3-5 -- fix for #209359: bind-libs from compatlayer CD will not - install on ia64 - -* Tue Oct 10 2006 Martin Stransky - 30:9.3.3-4 -- added fix for #210096: warning: group named does not exist - using root - -* Thu Oct 5 2006 Martin Stransky - 30:9.3.3-3 -- added fix from #209400 - Bind Init Script does not create - the PID file always, created by Jeff Means -- added timeout to stop section of init script. - The default is 100 sec. and can be adjusted by NAMED_SHUTDOWN_TIMEOUT - shell variable. - -* Mon Oct 2 2006 Martin Stransky - 30:9.3.3-2 -- removed chcon from %%post script, replaced by restorecon - (Bug 202547, comment no. 37) - -* Fri Sep 15 2006 Martin Stransky - 30:9.3.3-1 -- updated to the latest upstream (9.3.3rc2) - -* Wed Sep 6 2006 Martin Stransky - 30:9.3.2-41 -- added upstream patch for correct SIG handling - CVE-2006-4095 - -* Tue Sep 5 2006 Martin Stransky - 30:9.3.2-40 -- suppressed messages from bind-chroot-admin -- cleared notes about bind-config - -* Tue Aug 22 2006 Martin Stransky - 30:9.3.2-39 -- added fix for #203522 - "bind-chroot-admin -e" command fails - -* Mon Aug 21 2006 Martin Stransky - 30:9.3.2-38 -- fix for #203194 - tmpfile usage - -* Thu Aug 17 2006 Martin Stransky - 30:9.3.2-37 -- fix for #202542 - /usr/sbin/bind-chroot-admin: No such file or directory -- fix for #202547 - file_contexts: invalid context - -* Fri Aug 11 2006 Martin Stransky - 30:9.3.2-36 -- added Provides: bind-config - -* Fri Aug 11 2006 Martin Stransky - 30:9.3.2-35 -- fix bug 197493: renaming subpackage bind-config to caching-nameserver - -* Mon Jul 24 2006 Jason Vas Dias - 30:9.3.2-34 -- fix bug 199876: make '%%exclude libbbind.*' conditional on %%{LIBBIND} - -* Mon Jul 24 2006 Florian La Roche - 30:9.3.2-33 -- fix #195881, perms are not packaged correctly - -* Fri Jul 21 2006 Jason Vas Dias - 30:9.3.2-32 -- fix addenda to bug 189789: - determination of selinux enabled was still not 100% correct in bind-chroot-admin -- fix addenda to bug 196398: - make named.init test for NetworkManager being enabled AFTER testing for -D absence; - named.init now supports a 'DISABLE_NAMED_DBUS' /etc/sysconfig/named setting to disable - auto-enable of named dbus support if NetworkManager enabled. - -* Wed Jul 19 2006 Jason Vas Dias - 30:9.3.2-30 -- fix bug 196398 - Enable -D option automatically in initscript - if NetworkManager enabled in any runlevel. -- fix namedGetForwarders for new dbus -- fix bug 195881 - libbind.so should be owned by bind-libbind-devel - -* Wed Jul 19 2006 Matthias Clasen - 30:9.3.2-28.FC6 -- Rebuild against new dbus - -* Wed Jul 12 2006 Jason Vas Dias - 30:9.3.2-27.FC6 -- rebuild with fixed glibc-kernheaders - -* Wed Jul 12 2006 Jesse Keating - 30:9.3.2-26.FC6.1 -- rebuild - -* Wed Jun 14 2006 Jason Vas Dias - 30:9.3.2-26.FC6 -- fix bugs 191093, 189789 -- backport selected fixes from upstream bind9 'v9_3_3b1' CVS version: - ( see http://www.isc.org/sw/bind9.3.php "Fixes" ): - o change 2024 / bug 16027: - named emitted spurious "zone serial unchanged" messages on reload - o change 2013 / bug 15941: - handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully - o change 2009 / bug 15808: coverity fixes - o change 1997 / bug 15818: - named was failing to replace negative cache entries when a positive one - for the type was learnt - o change 1994 / bug 15694: OpenSSL 0.9.8 support - o change 1991 / bug 15813: - The configuration data, once read, should be treated as readonly. - o misc. validator fixes - o misc. resolver fixes - o misc. dns fixes - o misc. isc fixes - o misc. libbind fixes - o misc. isccfg fix - o misc. lwres fix - o misc. named fixes - o misc. dig fixes - o misc. nsupdate fix - o misc. tests fixes - -* Wed Jun 7 2006 Jeremy Katz - 30:9.3.2-24.FC6 -- and actually put the devel symlinks in the right subpackage - -* Thu May 25 2006 Jeremy Katz - 30:9.3.2-23.FC6 -- rebuild for -devel deps - -* Tue Apr 18 2006 Jason Vas Dias - 30:9.3.2-22 -- apply upstream patch for ncache_adderesult segfault bug 173961 addenda -- fix bug 188382: rpm --verify permissions inconsistencies -- fix bug 189186: use /sbin/service instead of initscript -- rebuild for new gcc, glibc-kernheaders - -* Tue Apr 04 2006 Jason Vas Dias - 30:9.3.2-20 -- fix resolver.c ncache_adderesult segfault reported in addenda to bug 173961 - (upstream bugs #15642, #15528 ?) -- allow named ability to generate core dumps after setuid (upstream bug #15753) - -* Mon Apr 03 2006 Jason Vas Dias - 30:9.3.2-18 -- fix bug 187529: make bind-chroot-admin deal with subdirectories properly - -* Thu Mar 30 2006 Jason Vas Dias - 30:9.3.2-16 -- fix bug 187286: - prevent host(1) printing duplicate 'is an alias for' messages - for the default AAAA and MX lookups as well as for the A lookup - (it now uses the CNAME returned for the A lookup for the AAAA and MX lookups). - This is upstream bug #15702 fixed in the unreleased bind-9.3.3 -- fix bug 187333: fix SOURCE24 and SOURCE25 transposition - -* Wed Mar 29 2006 Jason Vas Dias - 30:9.3.2-14 -- fix bug 186577: remove -L/usr/lib from libbind.pc and more .spec file cleanup -- add '%%doc' sample configuration files in /usr/share/doc/bind*/sample -- rebuild with new gcc and glibc - -* Wed Mar 22 2006 Jason Vas Dias - 30:9.3.2-12 -- fix typo in initscript -- fix Requires(post): policycoreutils in sub-packages - -* Mon Mar 20 2006 Jason Vas Dias - 30.9.3.2-10 -- fix bug 185969: more .spec file cleanup - -* Wed Mar 08 2006 Jason Vas Dias - 30.9.3.2-8 -- Do not allow package to be installed if named:25 userid creation fails -- Give libbind a pkg-config file -- remove restorecon from bind-chroot-admin (not required). -- fix named.caching-nameserver.conf (listen-on-v6 port 53 { ::1 };) - -* Tue Mar 07 2006 Jason Vas Dias - 30:9.3.2-7 -- fix issues with bind-chroot-admin - -* Mon Mar 06 2006 Jason Vas Dias - 30:9.3.2-6 -- replace caching-nameserver with bind-config sub-package -- fix bug 177595: handle case where $ROOTDIR is a link in initscript -- fix bug 177001: bind-config creates symlinks OK now -- fix bug 176388: named.conf is now never replaced by any RPM -- fix bug 176248: remove unecessary creation of rpmsave links -- fix bug 174925: no replacement of named.conf -- fix bug 173963: existing named.conf never modified -- major .spec file cleanup - -* Fri Feb 10 2006 Jesse Keating - 30:9.3.2-4.1 -- bump again for double-long bug on ppc(64) - -* Tue Feb 07 2006 Jason Vas Dias - 30:9.3.2-4 -- regenerate redhat_doc patch for non-DBUS builds -- allow dbus builds to work with dbus version < 0.6 (bz #179816) - -* Tue Feb 07 2006 Florian La Roche 30:9.3.2-3 -- try supporting without dbus support - -* Mon Feb 06 2006 Jason Vas Dias - 30:9.3.2-2.1 -- Rebuild for new gcc, glibc, glibc-kernheaders - -* Mon Jan 16 2006 Jason Vas Dias - 30:9.3.2-2 -- fix bug 177854: temporary fix for broken kernel-2.6.15-1854+ - /proc/net/if_inet6 format - -* Wed Dec 21 2005 Jason Vas Dias - 30:9.3.2-1 -- Upgrade to 9.3.2, released today - -* Tue Dec 20 2005 Jason Vas Dias - 28:9.3.2rc1-2 -- fix bug 176100: do not Require: perl just for namedGetForwarders ! - -* Fri Dec 09 2005 Jesse Keating -- rebuilt - -* Fri Dec 02 2005 Jason Vas Dias - 28:9.3.2rc-1 -- Upgrade to upstream version 9.3.2rc1 -- fix namedSetForwarders -> namedGetForwarders SOURCE14 typo - -* Thu Dec 01 2005 Jason Vas Dias - 24:9.3.1-26 -- rebuild for new dbus 0.6 dependency; remove use of - DBUS_NAME_FLAG_PROHIBIT_REPLACEMENT - -* Wed Nov 23 2005 Jason Vas Dias - 24:9.3.1-24 -- allow D-BUS support to work in bind-chroot environment: - workaround latest selinux policy by mounting /var/run/dbus/ - under chroot instead of /var/run/dbus/system-bus-socket - -* Sun Nov 13 2005 Jason Vas Dias - 24:9.3.1-22 -- fix bug 172632 - remove .la files -- ship namedGetForwarders and namedSetForwarders scripts -- fix detection of -D option in chroot - -* Tue Nov 8 2005 Tomas Mraz - 24:9.3.1-21 -- rebuilt with new openssl - -* Wed Oct 19 2005 Jason Vas Dias - 24.9.3.1-20 -- Allow the -D enable D-BUS option to be used within bind-chroot . -- fix bug 171226: supply some documentation for pgsql SDB . - -* Thu Oct 06 2005 Jason Vas Dias - 24:9.3.1-18 -- fix bug 169969: do NOT call dbus_svc_dispatch() in dbus_mgr_init_dbus() - - task->state != task_ready and will cause Abort in task.c if process - is waiting for NameOwnerChanged to do a SetForwarders - -* Wed Oct 05 2005 Jason Vas Dias - 24:9.3.1-16 -- Fix reconnecting to dbus-daemon after it stops & restarts . - -* Tue Sep 27 2005 Jason Vas Dias - 24:9.3.1-14 -- When forwarder nameservers are changed with D-BUS, flush the cache. - -* Mon Sep 26 2005 Jason Vas Dias - 24:9.3.1-12 -- fix bug 168302: use %%{__cc} for compiling dns-keygen -- fix bug 167682: bind-chroot directory permissions -- fix issues with -D dbus option when dbus service not running or disabled - -* Tue Aug 30 2005 Jason Vas Dias - 24:9.3.1-12 -- fix bug 167062: named should be started after syslogd by default - -* Mon Aug 22 2005 Jason Vas Dias - 24:9.3.1-11 -- fix bug 166227: host: don't do default AAAA and MX lookups with '-t a' option - -* Tue Aug 16 2005 Jason Vas Dias - 24:9.3.1-10 -- Build with D-BUS patch by default; D-BUS support enabled with named -D option -- Enable D-BUS for named_sdb also -- fix sdb pgsql's zonetodb.c: must use isc_hash_create() before dns_db_create() -- update fix for bug 160914 : test for RD=1 and ARCOUNT=0 also before trying next server -- fix named.init script to handle named_sdb properly -- fix named.init script checkconfig() to handle named '-c' option - and make configtest, test, check configcheck synonyms - -* Tue Jul 19 2005 Jason Vas Dias - 24:9.3.1-8 -- fix named.init script bugs 163598, 163409, 151852(addendum) - -* Tue Jul 12 2005 Jason Vas Dias - 24:9.3.1-7 -- fix bug 160914: resolver utilities should try next server on empty referral - (now that glibc bug 162625 is fixed) - host and nslookup now by default try next server on SERVFAIL - (host now has '-s' option to disable, and nslookup given - '[no]fail' option similar to dig's [no]fail option). -- rebuild and re-test with new glibc & gcc (all tests passed). - -* Tue May 31 2005 Jason Vas Dias - 24:9.3.1-6 -- fix bug 157950: dig / host / nslookup should reject invalid resolv.conf - files and not use uninitialized garbage nameserver values - (ISC bug 14841 raised). - -* Mon May 23 2005 Jason Vas Dias - 24:9.3.1-4_FC4 -- Fix SDB LDAP - -* Mon May 16 2005 Jason Vas Dias - 24:9.3.1-4 -- Fix bug 157601: give named.init a configtest function -- Fix bug 156797: named.init should check SELinux booleans.local before booleans -- Fix bug 154335: if no controls in named.conf, stop named with -TERM sig, not rndc -- Fix bug 155848: add NOTES section to named.8 man-page with info on all Red Hat - BIND quirks and SELinux DDNS / slave zone file configuration -- D-BUS patches NOT applied until dhcdbd is in FC - -* Sun May 15 2005 Jason Vas Dias - 24:9.3.1-4_dbus -- Enhancement to allow dynamic forwarder table management and -- DHCP forwarder auto-configuration with D-BUS - -* Thu Apr 14 2005 Jason Vas Dias - 24:9.3.1-2_FC4 -- Rebuild for bind-sdb libpq.so.3 dependency -- fix bug 150981: don't install libbind man-pages if no libbind -- fix bug 151852: mount proc on $ROOTDIR/proc to allow sysconf(...) - to work and correct number of CPUs to be determined - -* Fri Mar 11 2005 Jason Vas Dias - 24:9.3.1-1_FC4 -- Upgrade to ISC BIND 9.3.1 (final release) released today. - -* Wed Mar 9 2005 Jason Vas Dias - 22.9.3.1rc1-5 -- fix bug 150288: h_errno not being accessed / set correctly in libbind -- add libbind man-pages from bind-8.4.6 - -* Mon Mar 7 2005 Jason Vas Dias - 22:9.3.1rc1-4 -- Rebuild with gcc4 / glibc-2.3.4-14. - -* Tue Mar 1 2005 Nalin Dahyabhai - 22:9.3.1rc1-3 -- configure with --with-pic to get PIC libraries - -* Sun Feb 20 2005 Jason Vas Dias - 22:9.3.1rc1-2 -- fix bug 149183: don't use getifaddrs() . - -* Wed Feb 16 2005 Jason Vas Dias - 22:9.3.1rc1-1 -- Upgrade to 9.3.1rc1 -- Add Simplified Database Backend (SDB) sub-package ( bind-sdb ) -- add named_sdb - ldap + pgsql + dir database backend support with -- 'ENABLE_SDB' named.sysconfig option -- Add BIND resolver library & includes sub-package ( libbind-devel) -- fix bug 147824 / 147073 / 145664: ENABLE_ZONE_WRITE in named.init -- fix bug 146084 : shutup restorecon - -* Tue Jan 11 2005 Jason Vas Dias - 22:9.3.0-2 -- Fix bug 143438: named.init will now make correct ownership of $ROOTDIR/var/named -- based on 'named_write_master_zones' SELinux boolean. -- Fix bug 143744: dig & nsupdate IPv6 timeout (dup of 140528) - -* Mon Nov 29 2004 Jason Vas Dias - 9.3.0-1 -- Upgrade BIND to 9.3.0 in Rawhide / FC4 (bugs 134529, 133654...) - -* Mon Nov 29 2004 Jason Vas Dias - 20:9.2.4-4 -- Fix bugs 140528 and 141113: -- 2 second timeouts when IPv6 not configured and root nameserver's -- AAAA addresses are queried - -* Mon Oct 18 2004 Jason Vas Dias - 20:9.2.4-2 -- Fix bug 136243: bind-chroot %%post must run restorecon -R %%{prefix} -- Fix bug 135175: named.init must return non-zero if named is not run -- Fix bug 134060: bind-chroot %%post must use mktemp, not /tmp/named -- Fix bug 133423: bind-chroot %%files entries should have been %%dirs - -* Thu Sep 23 2004 Jason Vas Dias - 20:9.2.4-1 -- BIND 9.2.4 (final release) released - source code actually -- identical to 9.2.4rc8, with only version number change. - -* Mon Sep 20 2004 Jason Vas Dias - 10:9.2.4rc8-14 -- Upgrade to upstream bind-9.2.4rc8 . -- Progress: Finally! Hooray! ISC bind now distributes: -- o named.conf(5) and nslookup(8) manpages -- 'bind-manpages.bz2' source can now disappear -- (could this have something to do with ISC bug I raised about this?) -- o 'deprecation_msg' global has vanished -- bind-9.2.3rc3-deprecation_msg_shut_up.diff.bz2 can disappear - -* Mon Sep 20 2004 Jason Vas Dias - 10:9.2.4rc8-14 -- Fix bug 106572/132385: copy /etc/localtime to chroot on start - -* Fri Sep 10 2004 Jason Vas Dias - 10:9.2.4rc7-12_EL3 -- Fix bug 132303: if ROOTDIR line was replaced after upgrade from -- bind-chroot-9.2.2-21, restart named - -* Wed Sep 8 2004 Jason Vas Dias - 10:9.2.4rc7-11_EL3 -- Fix bug 131803: replace ROOTDIR line removed by broken -- bind-chroot 9.2.2-21's '%%postun'; added %%triggerpostun for bind-chroot - -* Tue Sep 7 2004 Jason Vas Dias - 10:9.2.4rc7-10_EL3 -- Fix bugs 130121 & 130981 for RHEL-3 - -* Mon Aug 30 2004 Jason Vas Dias - 10:9.2.4rc7-10 -- Fix bug 130121: add '%%ghost' entries for files included in previous -- bind-chroot & not in current - ie. named.conf, rndc.key, dev/* - -- that RPM removed after upgrade . - -* Thu Aug 26 2004 Jason Vas Dias -- Fix bug 130981: add '-t' option to named-checkconf invocation in -- named.init if chroot installed. - -* Wed Aug 25 2004 Jason Vas Dias -- Remove resolver(5) manpage now in man-pages (bug 130792); -- Don't create /dev/ entries in bind-chroot if already there (bug 127556); -- fix bind-devel Requires (bug 130919) -- Set default location for dumpdb & stats files to /var/named/data - -* Tue Aug 24 2004 Jason Vas Dias -- Fix devel Requires for bug 130738 & fix version - -* Tue Aug 24 2004 Jason Vas Dias -- Fix errors on clean install if named group does not exist -- (bug 130777) - -* Thu Aug 19 2004 Jason Vas Dias -- Upgrade to bind-9.2.4rc7; applied initscript fix -- for bug 102035. - -* Mon Aug 9 2004 Jason Vas Dias -- Fixed bug 129289: bind-chroot install / deinstall -- on install, existing config files 'safe_replace'd -- with links to chroot copies; on uninstall, moved back. - -* Fri Aug 6 2004 Jason Vas Dias -- Fixed bug 129258: "${prefix}/var/tmp" typo in spec - -* Wed Jul 28 2004 Jason Vas Dias -- Fixed bug 127124 : 'Requires: kernel >= 2.4' -- causes problems with Linux VServers - -* Tue Jul 27 2004 Jason Vas Dias -- Fixed bug 127555 : chroot tar missing var/named/slaves - -* Fri Jul 16 2004 Jason Vas Dias -- Upgraded to ISC version 9.2.4rc6 - -* Fri Jul 16 2004 Jason Vas Dias -- Fixed named.init generation of error messages on -- 'service named stop' and 'service named reload' -- as per bug 127775 - -* Wed Jun 23 2004 Daniel Walsh 9.2.3-19 -- Bump for rhel 3.0 U3 - -* Wed Jun 23 2004 Daniel Walsh 9.2.3-18 -- remove disable-linux-caps - -* Wed Jun 16 2004 Daniel Walsh 9.2.3-17 -- Update RHEL3 to latest bind - -* Tue Jun 15 2004 Elliot Lee -- rebuilt - -* Tue Jun 8 2004 Daniel Walsh 9.2.3-15 -- Remove device files from chroot, Named uses the system one - -* Fri Mar 26 2004 Daniel Walsh 9.2.3-14 -- Move RFC to devel package - -* Fri Mar 26 2004 Daniel Walsh 9.2.3-13 -- Fix location of restorecon - -* Thu Mar 25 2004 Daniel Walsh 9.2.3-12 -- Tighten security on config files. Should be owned by root - -* Thu Mar 25 2004 Daniel Walsh 9.2.3-11 -- Update key patch to include conf-keygen - -* Tue Mar 23 2004 Daniel Walsh 9.2.3-10 -- fix chroot to only happen once. -- fix init script to do kill insteall of killall - -* Mon Mar 15 2004 Daniel Walsh 9.2.3-9 -- Add fix for SELinux security context - -* Tue Mar 02 2004 Elliot Lee -- rebuilt - -* Sat Feb 28 2004 Florian La Roche -- run ldconfig for libs subrpm - -* Mon Feb 23 2004 Tim Waugh -- Use ':' instead of '.' as separator for chown. - -* Tue Feb 17 2004 Daniel Walsh 9.2.3-7 -- Add COPYRIGHT - -* Fri Feb 13 2004 Elliot Lee -- rebuilt - -* Tue Dec 30 2003 Daniel Walsh 9.2.3-5 -- Add defattr to libs - -* Mon Dec 29 2003 Daniel Walsh 9.2.3-4 -- Break out library package - -* Mon Dec 22 2003 Daniel Walsh 9.2.3-3 -- Fix condrestart - -* Wed Nov 12 2003 Daniel Walsh 9.2.3-2 -- Move libisc and libdns to bind from bind-util - -* Tue Nov 11 2003 Daniel Walsh 9.2.3-1 -- Move to 9.2.3 - -* Mon Oct 27 2003 Daniel Walsh 9.2.2.P3-10 -- Add PIE support - -* Fri Oct 17 2003 Daniel Walsh 9.2.2.P3-9 -- Add /var/named/slaves directory - -* Sun Oct 12 2003 Florian La Roche -- do not link against libnsl, not needed for Linux - -* Wed Oct 8 2003 Daniel Walsh 9.2.2.P3-6 -- Fix local time in log file - -* Tue Oct 7 2003 Daniel Walsh 9.2.2.P3-5 -- Try again - -* Mon Oct 6 2003 Daniel Walsh 9.2.2.P3-4 -- Fix handling of chroot -/dev/random - -* Thu Oct 2 2003 Daniel Walsh 9.2.2.P3-3 -- Stop hammering stuff on update of chroot environment - -* Mon Sep 29 2003 Daniel Walsh 9.2.2.P3-2 -- Fix chroot directory to grab all subdirectories - -* Wed Sep 24 2003 Daniel Walsh 9.2.2.P3-1 -- New patch to support for "delegation-only" - -* Wed Sep 17 2003 Daniel Walsh 9.2.2-23 -- patch support for "delegation-only" - -* Wed Jul 30 2003 Daniel Walsh 9.2.2-22 -- Update to build on RHL - -* Wed Jul 30 2003 Daniel Walsh 9.2.2-21 -- Install libraries as exec so debug info will be pulled - -* Sat Jul 19 2003 Daniel Walsh 9.2.2-20 -- Remove BSDCOMPAT (BZ 99454) - -* Tue Jul 15 2003 Daniel Walsh 9.2.2-19 -- Update to build on RHL - -* Tue Jul 15 2003 Daniel Walsh 9.2.2-18 -- Change protections on /var/named and /var/chroot/named - -* Tue Jun 17 2003 Daniel Walsh 9.2.2-17 -- Update to build on RHL - -* Tue Jun 17 2003 Daniel Walsh 9.2.2-16 -- Update to build on RHEL - -* Wed Jun 04 2003 Elliot Lee -- rebuilt - -* Tue Apr 22 2003 Daniel Walsh 9.2.2-14 -- Update to build on RHEL - -* Tue Apr 22 2003 Daniel Walsh 9.2.2-13 -- Fix config description of named.conf in chroot -- Change named.init script to check for existence of /etc/sysconfig/network - -* Fri Apr 18 2003 Daniel Walsh 9.2.2-12 -- Update to build on RHEL - -* Fri Apr 18 2003 Daniel Walsh 9.2.2-11 -- Update to build on RHEL - -* Fri Apr 18 2003 Daniel Walsh 9.2.2-10 -- Fix echo OK on starting/stopping service - -* Fri Mar 28 2003 Daniel Walsh 9.2.2-9 -- Update to build on RHEL - -* Fri Mar 28 2003 Daniel Walsh 9.2.2-8 -- Fix echo on startup - -* Tue Mar 25 2003 Daniel Walsh 9.2.2-7 -- Fix problems with chroot environment -- Eliminate posix threads - -* Mon Mar 24 2003 Daniel Walsh 9.2.2-6 -- Fix build problems - -* Fri Mar 14 2003 Daniel Walsh 9.2.2-5 -- Fix build on beehive - -* Thu Mar 13 2003 Daniel Walsh 9.2.2-4 -- build bind-chroot kit - -* Tue Mar 11 2003 Daniel Walsh 9.2.2-3 -- Change configure to use proper threads model - -* Fri Mar 7 2003 Daniel Walsh 9.2.2-2 -- update to 9.2.2 - -* Tue Mar 4 2003 Daniel Walsh 9.2.2-1 -- update to 9.2.2 - -* Fri Jan 24 2003 Daniel Walsh 9.2.1-16 -- Put a sleep in restart to make sure stop completes - -* Wed Jan 22 2003 Tim Powers -- rebuilt - -* Tue Jan 7 2003 Daniel Walsh 9.2.1-14 -- Separate /etc/rndc.key to separate file - -* Tue Jan 7 2003 Nalin Dahyabhai 9.2.1-13 -- Use openssl's pkgconfig data, if available, at build-time. - -* Mon Jan 6 2003 Daniel Walsh 9.2.1-12 -- Fix log rotate to use service named reload -- Change service named reload to give success/failure message [73770] -- Fix File checking [75710] -- Begin change to automatically run in CHROOT environment - -* Tue Dec 24 2002 Daniel Walsh 9.2.1-10 -- Fix startup script to work like all others. - -* Mon Dec 16 2002 Daniel Walsh 9.2.1-9 -- Fix configure to build on x86_64 platforms - -* Wed Aug 07 2002 Karsten Hopp -- fix #70583, doesn't build on IA64 - -* Tue Jul 30 2002 Karsten Hopp 9.2.1-8 -- bind-utils shouldn't require bind - -* Mon Jul 22 2002 Karsten Hopp 9.2.1-7 -- fix name of pidfine in logrotate script (#68842) -- fix owner of logfile in logrotate script (#41391) -- fix nslookup and named.conf man pages (output on stderr) - (#63553, #63560, #63561, #54889, #57457) -- add rfc1912 (#50005) -- gzip all rfc's -- fix typo in keygen.c (#54870) -- added missing manpages (#64065) -- shutdown named properly with rndc stop (#62492) -- /sbin/nologin instead of /bin/false (#68607) -- move nsupdate to bind-utils (where the manpage already was) (#66209, #66381) -- don't kill initscript when rndc fails (reload) (#58750) - - -* Mon Jun 24 2002 Bernhard Rosenkraenzer 9.2.1-5 -- Fix #65975 - -* Fri Jun 21 2002 Tim Powers -- automated rebuild - -* Thu May 23 2002 Tim Powers -- automated rebuild - -* Thu May 9 2002 Bernhard Rosenkraenzer 9.2.1-2 -- Move libisccc, lib isccfg and liblwres from bind-utils to bind, - they're not required if you aren't running a nameserver. - -* Fri May 03 2002 Florian La Roche -- update to 9.2.1 release - -* Thu Mar 14 2002 Bernhard Rosenkraenzer 9.2.0-8 -- Merge 30+ bug fixes from 9.2.1rc1 code - -* Mon Mar 11 2002 Bernhard Rosenkraenzer 9.2.0-7 -- Don't exit if /etc/named.conf doesn't exist if we're running - chroot (#60868) -- Revert Elliot's changes, we do require specific glibc/glibc-kernheaders - versions or bug #58335 will be back. "It compiles, therefore it works" - isn't always true. - -* Thu Feb 28 2002 Elliot Lee 9.2.0-6 -- Fix BuildRequires (we don't need specific glibc/glibc-kernheaders -versions). -- Use _smp_mflags - -* Wed Feb 20 2002 Bernhard Rosenkraenzer 9.2.0-4 -- rebuild, require recent autoconf, automake (#58335) - -* Fri Jan 25 2002 Tim Powers -- rebuild against new libssl - -* Wed Jan 09 2002 Tim Powers -- automated rebuild - -* Tue Nov 27 2001 Bernhard Rosenkraenzer 9.2.0-1 -- 9.2.0 - -* Thu Nov 22 2001 Bernhard Rosenkraenzer 9.2.0-0.rc10.2 -- 9.2.0rc10 - -* Mon Nov 5 2001 Bernhard Rosenkraenzer 9.2.0-0.rc8.2 -- Fix up rndc.conf (#55574) - -* Thu Oct 25 2001 Bernhard Rosenkraenzer 9.2.0-0.rc8.1 -- rc8 -- Enforce --enable-threads - -* Mon Oct 22 2001 Bernhard Rosenkraenzer 9.2.0-0.rc7.1 -- 9.2.0rc7 -- Use rndc status for "service named status", it's supposed to actually - work in 9.2.x. - -* Wed Oct 3 2001 Bernhard Rosenkraenzer 9.2.0-0.rc5.1 -- 9.2.0rc5 -- Fix rpm --rebuild with ancient libtool versions (#53938, #54257) - -* Tue Sep 25 2001 Bernhard Rosenkraenzer 9.2.0-0.rc4.1 -- 9.2.0rc4 - -* Fri Sep 14 2001 Bernhard Rosenkraenzer 9.2.0-0.rc3.1 -- 9.2.0rc3 -- remove ttl patch, I don't think we need this for 8.0. -- remove dig.1.bz2 from the bind8-manpages tar file, 9.2 has a new dig man page -- add lwres* man pages to -devel - -* Mon Sep 3 2001 Bernhard Rosenkraenzer 9.1.3-4 -- Make sure /etc/rndc.conf isn't world-readable even after the - %%post script inserted a random key (#53009) - -* Thu Jul 19 2001 Bernhard Rosenkraenzer 9.1.3-3 -- Add build dependencies (#49368) -- Make sure running service named start several times doesn't create - useless processes (#47596) -- Work around the named parent process returning 0 even if the config - file is broken (it's parsed later by the child processes) (#45484) - -* Mon Jul 16 2001 Bernhard Rosenkraenzer 9.1.3-2 -- Don't use rndc status, it's not yet implemented (#48839) - -* Sun Jul 08 2001 Florian La Roche -- update to 9.1.3 release - -* Tue Jul 3 2001 Bernhard Rosenkraenzer 9.1.3-0.rc3.1 -- Fix up rndc configuration and improve security (#46586) - -* Tue Jun 26 2001 Bernhard Rosenkraenzer 9.1.3-0.rc2.2 -- Sync with caching-nameserver-7.1-6 - -* Mon Jun 25 2001 Bernhard Rosenkraenzer 9.1.3-0.rc2.1 -- Update to rc2 - -* Fri Jun 1 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.3 -- Remove resolv.conf(5) man page, it's now in man-pages - -* Thu May 31 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.2 -- Add named.conf man page from bind 8.x (outdated, but better than nothing, - #42732) -- Rename the rndc key (#42895) -- Add dnssec* man pages - -* Mon May 28 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.1 -- 9.1.3rc1 -- s/Copyright/License/ - -* Mon May 7 2001 Bernhard Rosenkraenzer 9.1.2-1 -- 9.1.2 final. No changes between 9.1.2-0.rc1.1 and this one, except for - the version number, though. - -* Thu May 3 2001 Bernhard Rosenkraenzer 9.1.2-0.rc1.1 -- 9.1.2rc1 - -* Thu Mar 29 2001 Bernhard Rosenkraenzer 9.1.1-1 -- 9.1.1 - -* Thu Mar 15 2001 Bernhard Rosenkraenzer 9.1.0-10 -- Merge fixes from 9.1.1rc5 - -* Sun Mar 11 2001 Bernhard Rosenkraenzer 9.1.0-9 -- Work around bind 8 -> bind 9 migration problem when using buggy zone files: - accept zones without a TTL, but spew out a big fat warning. (#31393) - -* Thu Mar 8 2001 Bernhard Rosenkraenzer -- Add fixes from rc4 - -* Fri Mar 2 2001 Nalin Dahyabhai -- rebuild in new environment - -* Thu Mar 1 2001 Bernhard Rosenkraenzer -- killall -HUP named if rndc reload fails (#30113) - -* Tue Feb 27 2001 Bernhard Rosenkraenzer -- Merge some fixes from 9.1.1rc3 - -* Tue Feb 20 2001 Bernhard Rosenkraenzer -- Don't use the standard rndc key from the documentation, instead, create a random one - at installation time (#26358) -- Make /etc/rndc.conf readable by user named only, it contains secret keys - -* Tue Feb 20 2001 Bernhard Rosenkraenzer -- 9.1.1 probably won't be out in time, revert to 9.1.0 and apply fixes - from 9.1.1rc2 -- bind requires bind-utils (#28317) - -* Tue Feb 13 2001 Bernhard Rosenkraenzer -- Update to rc2, fixes 2 more bugs -- Fix build with glibc >= 2.2.1-7 - -* Thu Feb 8 2001 Bernhard Rosenkraenzer -- Update to 9.1.1rc1; fixes 17 bugs (14 of them affecting us; - 1 was fixed in a Red Hat patch already, 2 others are portability - improvements) - -* Wed Feb 7 2001 Bernhard Rosenkraenzer -- Remove initscripts 5.54 requirement (#26489) - -* Mon Jan 29 2001 Bernhard Rosenkraenzer -- Add named-checkconf, named-checkzone (#25170) - -* Mon Jan 29 2001 Trond Eivind Glomsrod -- use echo, not gprintf - -* Wed Jan 24 2001 Bernhard Rosenkraenzer -- Fix problems with $GENERATE - Patch from Daniel Roesen - Bug #24890 - -* Thu Jan 18 2001 Bernhard Rosenkraenzer -- 9.1.0 final - -* Sat Jan 13 2001 Bernhard Rosenkraenzer -- 9.1.0rc1 -- i18nify init script -- bzip2 source to save space - -* Thu Jan 11 2001 Bernhard Rosenkraenzer -- Fix %%postun script - -* Tue Jan 9 2001 Bernhard Rosenkraenzer -- 9.1.0b3 - -* Mon Jan 8 2001 Bernhard Rosenkraenzer -- Add named.conf man page from bind8 (#23503) - -* Sun Jan 7 2001 Bernhard Rosenkraenzer -- Make /etc/rndc.conf and /etc/sysconfig/named noreplace -- Make devel require bind = %%{version} rather than just bind - -* Sun Jan 7 2001 Bernhard Rosenkraenzer -- Fix init script for real - -* Sat Jan 6 2001 Bernhard Rosenkraenzer -- Fix init script when ROOTDIR is not set - -* Thu Jan 4 2001 Bernhard Rosenkraenzer -- Add hooks for setting up named to run chroot (RFE #23246) -- Fix up requirements - -* Fri Dec 29 2000 Bernhard Rosenkraenzer -- 9.1.0b2 - -* Wed Dec 20 2000 Bernhard Rosenkraenzer -- Move run files to /var/run/named/ - /var/run isn't writable - by the user we're running as. (Bug #20665) - -* Tue Dec 19 2000 Bernhard Rosenkraenzer -- Fix reverse lookups (#22272) -- Run ldconfig in %%post utils - -* Tue Dec 12 2000 Karsten Hopp -- fixed logrotate script (wrong path to kill) -- include header files in -devel package -- bugzilla #22049, #19147, 21606 - -* Fri Dec 8 2000 Bernhard Rosenkraenzer -- 9.1.0b1 (9.1.0 is in our timeframe and less buggy) - -* Mon Nov 13 2000 Bernhard Rosenkraenzer -- 9.0.1 - -* Mon Oct 30 2000 Bernhard Rosenkraenzer -- Fix initscript (Bug #19956) -- Add sample rndc.conf (Bug #19956) -- Fix build with tar 1.13.18 - -* Tue Oct 10 2000 Bernhard Rosenkraenzer -- Add some missing man pages (taken from bind8) (Bug #18794) - -* Sun Sep 17 2000 Bernhard Rosenkraenzer -- 9.0.0 final - -* Wed Aug 30 2000 Bernhard Rosenkraenzer -- rc5 -- fix up nslookup - -* Thu Aug 24 2000 Bernhard Rosenkraenzer -- rc4 - -* Thu Jul 13 2000 Bernhard Rosenkraenzer -- 9.0.0rc1 - -* Wed Jul 12 2000 Prospector -- automatic rebuild - -* Sun Jul 9 2000 Florian La Roche -- add "exit 0" for uninstall case - -* Fri Jul 7 2000 Florian La Roche -- add prereq init.d and cleanup install section - -* Fri Jun 30 2000 Trond Eivind Glomsrod -- fix the init script - -* Wed Jun 28 2000 Nalin Dahyabhai -- make libbind.a and nslookup.help readable again by setting INSTALL_LIB to "" - -* Mon Jun 26 2000 Bernhard Rosenkranzer -- Fix up the initscript (Bug #13033) -- Fix build with current glibc (Bug #12755) -- /etc/rc.d/init.d -> /etc/init.d -- use %%{_mandir} rather than /usr/share/man - -* Mon Jun 19 2000 Bill Nottingham -- fix conflict with man-pages -- remove compatibilty chkconfig links -- initscript munging - -* Wed Jun 14 2000 Nalin Dahyabhai -- modify logrotate setup to use PID file -- temporarily disable optimization by unsetting $RPM_OPT_FLAGS at build-time -- actually bump the release this time - -* Sun Jun 4 2000 Bernhard Rosenkraenzer -- FHS compliance - -* Mon Apr 17 2000 Nalin Dahyabhai -- clean up restart patch - -* Mon Apr 10 2000 Nalin Dahyabhai -- provide /var/named (fix for bugs #9847, #10205) -- preserve args when restarted via ndc(8) (bug #10227) -- make resolv.conf(5) a link to resolver(5) (bug #10245) -- fix SYSTYPE bug in all makefiles -- move creation of named user from %%post into %%pre - -* Mon Feb 28 2000 Bernhard Rosenkranzer -- Fix TTL (patch from ISC, Bug #9820) - -* Wed Feb 16 2000 Bernhard Rosenkranzer -- fix typo in spec (it's %%post, without a leading blank) introduced in -6 -- change SYSTYPE to linux - -* Fri Feb 11 2000 Bill Nottingham -- pick a standard < 100 uid/gid for named - -* Fri Feb 04 2000 Elliot Lee -- Pass named a '-u named' parameter by default, and add/remove user. - -* Thu Feb 3 2000 Bernhard Rosenkraenzer -- fix host mx bug (Bug #9021) - -* Mon Jan 31 2000 Cristian Gafton -- rebuild to fix dependencies -- man pages are compressed - -* Wed Jan 19 2000 Bernhard Rosenkraenzer -- It's /usr/bin/killall, not /usr/sbin/killall (Bug #8063) - -* Mon Jan 17 2000 Bernhard Rosenkraenzer -- Fix up location of named-bootconf.pl and make it executable - (Bug #8028) -- bind-devel requires bind - -* Mon Nov 15 1999 Bernhard Rosenkraenzer -- update to 8.2.2-P5 - -* Wed Nov 10 1999 Bill Nottingham -- update to 8.2.2-P3 - -* Tue Oct 12 1999 Cristian Gafton -- add patch to stop a cache only server from complaining about lame servers - on every request. - -* Fri Sep 24 1999 Preston Brown -- use real stop and start in named.init for restart, not ndc restart, it has - problems when named has changed during a package update... (# 4890) - -* Fri Sep 10 1999 Bill Nottingham -- chkconfig --del in %%preun, not %%postun - -* Mon Aug 16 1999 Bill Nottingham -- initscript munging - -* Mon Jul 26 1999 Bill Nottingham -- fix installed chkconfig links to match init file - -* Sat Jul 3 1999 Jeff Johnson -- conflict with new (in man-1.24) man pages (#3876,#3877). - -* Tue Jun 29 1999 Bill Nottingham -- fix named.logrotate (wrong %%SOURCE) - -* Fri Jun 25 1999 Jeff Johnson -- update to 8.2.1. -- add named.logrotate (#3571). -- hack around egcs-1.1.2 -m486 bug (#3413, #3485). -- vet file list. - -* Fri Jun 18 1999 Bill Nottingham -- don't run by default - -* Sun May 30 1999 Jeff Johnson -- nslookup fixes (#2463). -- missing files (#3152). - -* Sat May 1 1999 Stepan Kasal -- nslookup patched: - to count numRecords properly - to fix subsequent calls to ls -d - to parse "view" and "finger" commands properly - the view hack updated for bind-8 (using sed) - -* Wed Mar 31 1999 Bill Nottingham -- add ISC patch -- add quick hack to make host not crash -- add more docs - -* Fri Mar 26 1999 Cristian Gafton -- add probing information in the init file to keep linuxconf happy -- dont strip libbind - -* Sun Mar 21 1999 Cristian Gafton -- auto rebuild in the new build environment (release 3) - -* Wed Mar 17 1999 Preston Brown -- removed 'done' output at named shutdown. - -* Tue Mar 16 1999 Cristian Gafton -- version 8.2 - -* Wed Dec 30 1998 Cristian Gafton -- patch to use the __FDS_BITS macro -- build for glibc 2.1 - -* Wed Sep 23 1998 Jeff Johnson -- change named.restart to /usr/sbin/ndc restart - -* Sat Sep 19 1998 Jeff Johnson -- install man pages correctly. -- change K10named to K45named. - -* Wed Aug 12 1998 Jeff Johnson -- don't start if /etc/named.conf doesn't exist. - -* Sat Aug 8 1998 Jeff Johnson -- autmagically create /etc/named.conf from /etc/named.boot in %%post -- remove echo in %%post - -* Wed Jun 10 1998 Jeff Johnson -- merge in 5.1 mods - -* Sun Apr 12 1998 Manuel J. Galan -- Several essential modifications to build and install correctly. -- Modified 'ndc' to avoid deprecated use of '-' - -* Mon Dec 22 1997 Scott Lampert -- Used buildroot -- patched bin/named/ns_udp.c to use for include - on Redhat 5.0 instead of +%autochangelog diff --git a/changelog b/changelog new file mode 100644 index 0000000..da3bb7c --- /dev/null +++ b/changelog @@ -0,0 +1,3190 @@ +* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-2 +- Prepare devel subpackage installable multiple times +- Move binaries to versioned executables in main package, utils and dnssec-utils subpackages +- Use alternatives symlinks to provide original names +- Allow installation of multiple major versions at the same time +- chroot package still conflicts, might be fixed later +- Stop using build subdirectory and out-of-tree builds + +* Wed Jun 17 2026 Petr Menšík - 32:9.18.50-1 +- Update to 9.18.50 (rhbz#2489833) +- Remove rwtab files + +* Fri Jun 12 2026 Yaakov Selkowitz - 32:9.18.49-2 +- Rebuilt for openssl 4.0 + +* Wed May 20 2026 Petr Menšík - 32:9.18.49-1 +- Update to 9.18.49 (rhbz#2480121) + +* Tue Apr 07 2026 Petr Menšík - 32:9.18.48-1 +- Update to 9.18.48 (rhbz#2453853) + +* Wed Mar 25 2026 Petr Menšík - 32:9.18.47-1 +- Update to 9.18.47 (rhbz#2440561) + +* Tue Mar 03 2026 Petr Menšík - 32:9.18.46-1 +- Update to 9.18.46 (rhbz#2440561) + +* Wed Jan 28 2026 Petr Menšík - 32:9.18.44-2 +- Create /var/named directories for bind-chroot (RHEL-132053) +- Add forgotten _libdir/named into bind-chroot tmpfiles + +* Thu Jan 22 2026 Petr Menšík - 32:9.18.44-1 +- Update to 9.18.44 (rhbz#2431609) + +* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Fri Jan 16 2026 Fedora Release Engineering - 32:9.18.43-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_44_Mass_Rebuild + +* Wed Dec 17 2025 Petr Menšík - 32:9.18.43-1 +- Update to 9.18.43 (rhbz#2415842) + +* Fri Oct 31 2025 Petr Menšík - 32:9.18.41-2 +- Fix upstream reported regression in recent CVE fix (CVE-2025-8677) +- Add upstream dnssec system test testcase for this problem + +* Fri Oct 24 2025 Petr Menšík - 32:9.18.41-1 +- Update to 9.18.41 (rhbz#2405786, CVE-2025-8677 CVE-2025-40778 CVE-2025-40780) + +* Fri Oct 10 2025 Petr Menšík - 32:9.18.39-7 +- Reference to absolute config names from named.rfc1912.zones + +* Fri Oct 03 2025 Petr Menšík - 32:9.18.39-6 +- Move named.* files from /var/named into /usr/share/named +- Move named.ca into /etc/named.ca + +* Tue Sep 16 2025 Petr Menšík - 32:9.18.39-5 +- Fix failures in idna system test (rhbz#2324186) + +* Wed Sep 10 2025 Adam Williamson - 32:9.18.39-4 +- No-change rebuild to fix F43 update + +* Wed Sep 03 2025 Petr Menšík - 32:9.18.39-3 +- Decode IDN names on input in all situations in utilities (rhbz#2324186) + +* Mon Sep 01 2025 Petr Menšík - 32:9.18.39-2 +- Offer up to 13 additional servers records if there are more servers + +* Thu Aug 21 2025 Petr Menšík - 32:9.18.39-1 +- Update to 9.18.39 (rhbz#2389765) + +* Wed Jul 30 2025 'Petr Mensik' <> - 32:9.18.38-1 +- Update to 9.18.38 (rhbz#2367771) + +* Wed Jul 23 2025 Fedora Release Engineering - 32:9.18.36-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild + +* Tue Jun 10 2025 'Petr Mensik' <> - 32:9.18.36-2 +- Prevent name.c:670 attributes assertion failed +- Add extra checks for relative names + +* Fri Apr 25 2025 Petr Mensik - 32:9.18.36-1 +- Update to 9.18.36 (rhbz#2346607) + +* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-2 +- Backport support for OpenSSL provider required for PKCS11 labels +- Deactivate jemalloc default linking + +* Wed Mar 26 2025 Petr Menšík - 32:9.18.35-1 +- Update to 9.18.35 (rhbz#2346607) + +* Thu Mar 20 2025 Petr Menšík - 32:9.18.33-3 +- Remove pre scriptlet + +* Mon Feb 10 2025 Petr Menšík - 32:9.18.33-2 +- Permanently remove DLZ parts build + +* Sun Feb 02 2025 Petr Menšík - 32:9.18.33-1 +- Update to 9.16.33 (rhbz#2342784) + +* Fri Jan 17 2025 Petr Menšík - 32:9.18.32-7 +- Add sysusers named user creation (rhbz#2105415) + +* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-6 +- Rebuild again on mass rebuild tag so -4 doesn't override -5 + +* Thu Jan 16 2025 Adam Williamson - 32:9.18.32-5 +- Provide user(named) and group(named) + +* Thu Jan 16 2025 Fedora Release Engineering - 32:9.18.32-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_42_Mass_Rebuild + +* Mon Jan 13 2025 Zbigniew Jędrzejewski-Szmek - 32:9.18.32-3 +- Rebuilt for the bin-sbin merge (2nd attempt) + +* Fri Dec 20 2024 Adam Williamson - 32:9.18.32-2 +- No change sidetag rebuild to include bind-dyndb-ldap + +* Thu Dec 12 2024 Petr Menšík - 32:9.18.32-1 +- Update to 9.18.32 (#2331675) +- Remove CHANGES file from package +- Disable DLZ plugins, they are not shipped with bind anymore +- Add new root key 38696 into package files too + +* Thu Dec 12 2024 Petr Menšík - 32:9.18.31-3 +- Disable temporarily PDF generation on all platforms + +* Wed Dec 04 2024 Petr Menšík - 32:9.18.31-2 +- Add nsupdate TLS support (FREEIPA-11706) +- Include a test for nsupdate changes + +* Thu Nov 14 2024 Petr Menšík - 32:9.18.31-1 +- Update to 9.18.31 (#2319214) + +* Thu Nov 14 2024 Petr Menšík - 32:9.18.30-3 +- Bump obsoleted license version (rhbz#2308102) + +* Tue Oct 08 2024 Petr Menšík - 32:9.18.30-2 +- Make OpenSSL engine support optional + +* Fri Oct 04 2024 Petr Menšík - 32:9.18.30-1 +- Update to 9.18.30 (rhbz#2306542) + +* Wed Aug 21 2024 Petr Menšík - 32:9.18.29-1 +- Update to 9.18.29 (rhbz#2306542) + +* Wed Aug 21 2024 Petr Menšík - 32:9.18.28-4 +- Remove ancient triggerun and selinux boolean traces + +* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-3 +- Drop PostgreSQL dependencies not used by DLZ anymore + +* Wed Jul 31 2024 Petr Menšík - 32:9.18.28-2 +- Conflict explicitly with more bind subpackages +- Merge license subpackage into libs +- Add optional QUERYTRACE feature +- Make relative documentation links + +* Fri Jul 26 2024 Jonathan Wright - 32:9.18.28-1 +- update to 9.18.28 rhbz#2299467 +- Fixes CVE-2024-4076 +- Fixes CVE-2024-1975 +- Fixes CVE-2024-1737 +- Fixes CVE-2024-0760 + +* Wed Jul 17 2024 Fedora Release Engineering - 32:9.18.26-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_41_Mass_Rebuild + +* Tue Jul 09 2024 Zbigniew Jędrzejewski-Szmek - 32:9.18.26-2 +- Rebuilt for the bin-sbin merge + +* Mon Apr 22 2024 Petr Menšík - 32:9.18.26-1 +- Update to 9.18.26 (rhbz#2270476) + +* Thu Feb 15 2024 Petr Menšík - 32:9.18.24-1 +- Update to 9.18.24 (#2264032) + +* Tue Jan 23 2024 Fedora Release Engineering - 32:9.18.21-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Fri Jan 19 2024 Fedora Release Engineering - 32:9.18.21-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_40_Mass_Rebuild + +* Tue Jan 16 2024 Petr Menšík - 32:9.18.21-2 +- Update changed b.root-servers.net address in hints (#2253460) + +* Mon Jan 15 2024 Petr Menšík - 32:9.18.21-1 +- Update to 9.18.21 (#2255407) + +* Thu Nov 16 2023 Petr Menšík - 32:9.18.20-1 +- Update to 9.18.20 (#2249835) + +* Fri Sep 22 2023 Petr Menšík - 32:9.18.19-1 +- Update to 9.18.19 (#2232346) + +* Fri Sep 22 2023 Petr Menšík - 32:9.18.18-2 +- Skip failing rbtdb_test unit test on i686 (#2240253) + +* Wed Sep 06 2023 Petr Menšík - 32:9.18.18-1 +- Update to 9.18.18 (#2232346) + +* Wed Jul 19 2023 Petr Menšík - 32:9.18.17-1 +- Update to 9.18.17 (#2223913) + +* Wed Jul 19 2023 Fedora Release Engineering - 32:9.18.16-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_39_Mass_Rebuild + +* Wed Jun 21 2023 Petr Menšík - 32:9.18.16-1 +- Update to 9.18.16 (#2216462) + +* Wed May 17 2023 Petr Menšík - 32:9.18.15-1 +- Update to 9.18.15 (#2207908) + +* Fri Apr 21 2023 Petr Menšík - 32:9.18.14-1 +- Update to 9.18.14 (#2187996) + +* Wed Apr 05 2023 Petr Menšík - 32:9.18.13-2 +- Enumerate all SPDX licenses used + +* Sat Mar 18 2023 Petr Menšík - 32:9.18.13-1 +- Update to 9.18.3 (#2178717) + +* Thu Feb 16 2023 Petr Menšík - 32:9.18.12-1 +- Update to 9.18.12 (#2170096) + +* Fri Jan 27 2023 Petr Menšík - 32:9.18.11-1 +- Update to 9.18.11 (#2164395) + +* Wed Jan 18 2023 Fedora Release Engineering - 32:9.18.10-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild + +* Mon Jan 16 2023 Petr Menšík - 32:9.18.10-1 +- Update to 9.18.10 (#2143258) +- Include rwlock.h from dns/zt.h + +* Mon Nov 21 2022 Petr Menšík - 32:9.18.9-1 +- Update to 9.18.9 (#2143258) + +* Sat Oct 22 2022 Petr Menšík - 32:9.18.8-1 +- Update to 9.18.8 (#2136100) + +* Fri Sep 30 2022 Petr Menšík - 32:9.18.7-3 +- Update License to SPDX identifier +- Enable automatic restart on crashes + +* Sat Sep 24 2022 Petr Menšík - 32:9.18.7-2 +- Build ARM documentation also with older sphinx on RHEL9 + +* Wed Sep 21 2022 Petr Menšík - 32:9.18.7-1 +- Update to 9.18.7 (#2128609) + +* Wed Sep 14 2022 Petr Menšík - 32:9.18.6-4 +- Disable yet another test (##2122010) + +* Tue Sep 06 2022 Petr Menšík - 32:9.18.6-3 +- Return OpenSSL engine implementation for pkcs11 interface (#2122841) +- Skip problematic netmgr unit tests (#2122010) +- Properly obsolete bind-dnssec-doc + +* Thu Sep 01 2022 Petr Menšík - 32:9.18.6-2 +- Always show error details for failed unittests (#2122010) + +* Tue Aug 30 2022 Petr Menšík - 32:9.18.6-1 +- Update to 9.18.6 (#2119132) +- Report unit tests detailed results + +* Thu Aug 04 2022 Petr Menšík - 32:9.18.5-2 +- Use multiple threads on unit tests, but 16 at most + +* Wed Aug 03 2022 Petr Menšík - 32:9.18.5-1 +- Update to 9.18.5 (#2109170) +- Return doc symlink to main page + +* Wed Jul 20 2022 Petr Menšík - 32:9.18.4-2 +- Stop enabling selinux booleans on every upgrade +- Deprecate python3-bind for smooth upgrade +- Remove PKCS1111 native utilities, libs and daemon + +* Wed Jul 20 2022 Petr Menšík - 32:9.18.4-1 +- Update to 9.18.4 (#2057493) + +* Wed Jul 20 2022 Fedora Release Engineering - 32:9.16.30-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild + +* Mon Jun 20 2022 Petr Menšík - 32:9.16.30-1 +- Update to 9.16.30 (#2097312) + +* Mon Jun 13 2022 Python Maint - 32:9.16.29-2 +- Rebuilt for Python 3.11 + +* Thu May 26 2022 Petr Menšík - 32:9.16.29-1 +- Update to 9.16.29 (#2087920) +- Fix netmgr_test fails on s390x (#2088125) + +* Tue May 17 2022 Petr Menšík - 32:9.16.28-2 +- Parse again timeout and attempts from resolv.conf (#2087156) +- Reenable unit tests during build + +* Wed Apr 20 2022 Petr Menšík - 32:9.16.28-1 +- Update to 9.16.28 (#2076941) + +* Thu Mar 17 2022 Petr Menšík - 32:9.16.27-1 +- Upgrade to 9.16.27 (#2055120) + +* Tue Mar 01 2022 Petr Menšík - 32:9.16.26-2 +- Switch to locked queue (#2048235) + +* Thu Feb 17 2022 Petr Menšík - 32:9.16.26-1 +- Update to 9.16.26 (#2055120) + +* Fri Feb 11 2022 Petr Menšík - 32:9.16.25-3 +- Allow reservation of extra hp threads (#2048235) + +* Tue Jan 25 2022 Petr Menšík - 32:9.16.25-2 +- Replace master with primary in configuration + +* Fri Jan 21 2022 Petr Menšík - 32:9.16.25-1 +- Update to 9.16.25 (#2042504) + +* Wed Jan 19 2022 Fedora Release Engineering - 32:9.16.24-3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild + +* Wed Dec 22 2021 Petr Menšík - 32:9.16.24-2 +- Build with OpenLDAP 2.6 (#2032704) + +* Wed Dec 15 2021 Petr Menšík - 32:9.16.24-1 +- Update to 9.16.24 (#2032934) + +* Fri Nov 26 2021 Petr Menšík - 32:9.16.23-2 +- Correct with GEOIP2 condition (#2026823) + +* Fri Nov 19 2021 Petr Menšík - 32:9.16.23-1 +- Update to 9.16.23 (#2024210) + +* Sat Nov 06 2021 Adrian Reber - 32:9.16.22-2 +- Rebuilt for protobuf 3.19.0 + +* Wed Oct 27 2021 Petr Menšík - 32:9.16.22-1 +- Update to 9.16.22 + +* Sun Oct 24 2021 Adrian Reber - 32:9.16.21-3 +- Rebuilt for protobuf 3.18.1 + +* Wed Oct 13 2021 Petr Menšík - 32:9.16.21-2 +- Propagate ephemeral port ranges to chroot (#2013597) + +* Wed Sep 15 2021 Petr Menšík - 32:9.16.21-1 +- Update to 9.16.21 + +* Tue Sep 14 2021 Sahana Prasad - 32:9.16.20-4 +- Rebuilt with OpenSSL 3.0.0 + +* Wed Aug 25 2021 Petr Menšík - 32:9.16.20-3 +- Increase map format version, lower memory consuption a bit (#1997504) +- Remove unneeded test variants changes +- Include documentation of dig return codes + +* Thu Aug 19 2021 Petr Menšík - 32:9.16.20-2 +- Fix map file format regression + +* Tue Aug 17 2021 Petr Menšík - 32:9.16.20-1 +- Update to 9.16.20 + +* Thu Aug 05 2021 Petr Menšík - 32:9.16.19-4 +- Do not depend on systemd package + +* Tue Aug 03 2021 Petr Menšík - 32:9.16.19-3 +- Reenable PDF building again (#1984687) + +* Fri Jul 23 2021 Petr Menšík - 32:9.16.19-2 +- Include backward compatible html symlink in doc subpackage + +* Wed Jul 21 2021 Petr Menšík - 32:9.16.19-1 +- Update to 9.16.19 (#1984627) +- Disable PDF rebuild on Rawhide (#1984687) + +* Wed Jul 21 2021 Fedora Release Engineering - 32:9.16.18-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild + +* Sat Jul 10 2021 Petr Menšík - 32:9.16.18-4 +- Disable PDF building on ELN + +* Sat Jul 10 2021 Björn Esser - 32:9.16.18-3 +- Rebuild for versioned symbols in json-c + +* Tue Jun 22 2021 Petr Menšík - 32:9.16.18-2 +- Re-enable building of PDF ARM documentation + +* Fri Jun 18 2021 Petr Menšík - 32:9.16.18-1 +- Update to 9.16.18 + +* Fri Jun 18 2021 Petr Menšík - 32:9.16.17-2 +- Fix wildcard expansion not working with 'w' (#1973587) + +* Thu Jun 17 2021 Petr Menšík - 32:9.16.17-1 +- Update to 9.16.17 + +* Fri Jun 04 2021 Python Maint - 32:9.16.16-2 +- Rebuilt for Python 3.10 + +* Thu May 20 2021 Petr Menšík - 32:9.16.16-1 +- Update to 9.16.16 (#1954827) + +* Thu Apr 29 2021 Petr Menšík - 32:9.16.15-1 +- Update to 9.16.15 + +* Thu Mar 25 2021 Petr Menšík - 32:9.16.13-1 +- Update to 9.16.13 +- Changed displayed version just to include -RH suffix, not release +- Version is now part of library names, soname versions are no longer provided +- Removed bind-libs-lite subpackage + +* Tue Mar 02 2021 Zbigniew Jędrzejewski-Szmek - 32:9.16.11-6 +- Rebuilt for updated systemd-rpm-macros + See https://pagure.io/fesco/issue/2583. + +* Fri Feb 26 2021 Petr Menšík - 32:9.16.11-5 +- Make logrotate.d world-readable (#1917061) + +* Mon Feb 22 2021 Petr Menšík - 32:9.16.11-4 +- Fix off-by-one bug in ISC SPNEGO implementation (#1929965) + +* Mon Feb 08 2021 Pavel Raiskup - 32:9.16.11-3 +- rebuild for libpq ABI fix rhbz#1908268 + +* Tue Jan 26 2021 Fedora Release Engineering - 32:9.16.11-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild + +* Thu Jan 21 2021 Petr Menšík - 32:9.16.11-1 +- Update to 9.16.11 (#1827602) +- Avoid unit test failures on machines with many cores + +* Thu Jan 14 2021 Petr Menšík - 32:9.16.10-2 +- Update to 9.16.10 +- Remove bind-sdb package +- https://fedoraproject.org/wiki/Changes/BIND9.16 + +* Wed Jan 13 08:55:11 CET 2021 Adrian Reber - 32:9.11.26-3 +- Rebuilt for protobuf 3.14 + +* Wed Jan 06 2021 Petr Menšík - 32:9.11.26-2 +- Use make macros +- https://fedoraproject.org/wiki/Changes/UseMakeBuildInstallMacro + +* Mon Jan 04 2021 Petr Menšík - 32:9.11.26-1 +- Update to 9.11.26 + +* Mon Nov 30 2020 Petr Menšík - 32:9.11.25-2 +- Regenerate all manual pages on build + +* Thu Nov 26 2020 Petr Menšík - 32:9.11.25-1 +- Update to 9.11.25 + +* Wed Nov 04 2020 Petr Menšík - 32:9.11.24-2 +- Fix crash on NTA recheck failure (#1893761) + +* Fri Oct 23 2020 Petr Menšík - 32:9.11.24-1 +- Update to 9.11.24 + +* Wed Sep 23 2020 Adrian Reber - 32:9.11.23-2 +- Rebuilt for protobuf 3.13 + +* Thu Sep 17 2020 Petr Menšík - 32:9.11.23-1 +- Update to 9.11.23 +- Merge bind-lite-devel into devel package + +* Tue Sep 01 2020 Petr Menšík - 32:9.11.22-2 +- Require libcap from devel package + +* Thu Aug 20 2020 Petr Menšík - 32:9.11.22-1 +- Update to 9.11.22 + +* Sat Aug 01 2020 Fedora Release Engineering - 32:9.11.21-3 +- Second attempt - Rebuilt for + https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Mon Jul 27 2020 Fedora Release Engineering - 32:9.11.21-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_33_Mass_Rebuild + +* Wed Jul 15 2020 Petr Menšík - 32:9.11.21-1 +- Update to 9.11.21 + +* Tue Jun 23 2020 Petr Menšík - 32:9.11.20-3 +- Move documentation to separate bind-doc package + +* Sat Jun 20 2020 Adrian Reber - 32:9.11.20-2 +- Rebuilt for protobuf 3.12 + +* Wed Jun 17 2020 Petr Menšík - 32:9.11.20-1 +- Update to 9.11.20 + +* Tue May 26 2020 Miro Hrončok - 32:9.11.19-2 +- Rebuilt for Python 3.9 + +* Fri May 15 2020 Petr Menšík - 32:9.11.19-1 +- Update to 9.11.19 (CVE-2020-8616, CVE-2020-8617) +- Make initscripts just optional dependency + +* Tue Apr 21 2020 Björn Esser - 32:9.11.18-2 +- Rebuild (json-c) + +* Thu Apr 16 2020 Petr Menšík - 32:9.11.18-1 +- Update to 9.11.18 + +* Tue Mar 31 2020 Petr Menšík - 32:9.11.17-1 +- Update to 9.11.17 + +* Tue Jan 28 2020 Fedora Release Engineering - 32:9.11.14-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_32_Mass_Rebuild + + * Wed Jan 08 2020 Petr Menšík - 32:9.11.14-4 +- Remove libmaxminddb-devel from devel package dependencies + +* Fri Jan 03 2020 Petr Menšík - 32:9.11.14-3 +- Preserve symlinks to named.conf on iscdlv modification (#1786626) + +* Thu Dec 19 2019 Petr Menšík - 32:9.11.14-2 +- Include more Thread Sanitizer detected changes (#1736762) + +* Thu Dec 19 2019 Petr Menšík - 32:9.11.14-1 +- Update to 9.11.14 + +* Tue Dec 03 2019 Petr Menšík - 32:9.11.13-4 +- Disable Berkeley DB support (#1779190) + +* Mon Dec 02 2019 Petr Menšík - 32:9.11.13-3 +- Backport few thread safety related fixed from upstream (#1736762) + +* Tue Nov 26 2019 Petr Menšík - 32:9.11.13-2 +- Complete explicit disabling of RSAMD5 in FIPS mode (#1709553) + +* Tue Nov 19 2019 Petr Menšík - 32:9.11.13-1 +- Update to 9.11.13 + +* Tue Nov 19 2019 Petr Menšík - 32:9.11.12-6 +- Report failures on systemctl reload + +* Tue Nov 12 2019 Petr Menšík - 32:9.11.12-5 +- Fix binary compatibility after serve-stale patch (#1770492) + +* Wed Nov 06 2019 Petr Menšík - 32:9.11.12-4 +- Backported serve-stale feature + +* Wed Nov 06 2019 Petr Menšík - 32:9.11.12-3 +- Fix wrong default GeoIP directory (#1768258) + +* Mon Nov 04 2019 Petr Menšík - 32:9.11.12-2 +- Move data files outside config archive +- Specify geoip data directory in config file (#1768258) + +* Mon Oct 21 2019 Petr Menšík - 32:9.11.12-1 +- Update to 9.11.12 (#1557762) + +* Wed Sep 25 2019 Petr Menšík - 32:9.11.11-1 +- Update to 9.11.11 + +* Wed Sep 04 2019 Petr Menšík - 32:9.11.10-3 +- Share pkcs11-utils and dnssec-utils manuals instead of recommend + +* Tue Sep 03 2019 Petr Menšík - 32:9.11.10-2 +- Move some administration utilities back to bind-utils (#1720380) +- Add GeoIP to bind-chroot (#1497646) +- Recommend bind-dnssec-utils from bind-pkcs11-utils + +* Tue Aug 27 2019 Petr Menšík - 32:9.11.10-1 +- Update to 9.11.10 + +* Mon Aug 19 2019 Miro Hrončok - 32:9.11.9-4 +- Rebuilt for Python 3.8 + +* Fri Aug 09 2019 Petr Menšík - 32:9.11.9-3 +- Display errors from rndc reload (#1739441) + +* Thu Aug 08 2019 Petr Menšík - 32:9.11.9-2 +- Permit explicit disabling of RSAMD5 in FIPS mode (#1709553) + +* Wed Jul 24 2019 Petr Menšík - 32:9.11.9-1 +- Update to 9.11.9 +- Add GeoLite2 support +- Disable export-libs + +* Wed Jul 24 2019 Petr Menšík - 32:9.11.8-2 +- Use monotonic time in export library (#1732883) + +* Wed Jul 24 2019 Fedora Release Engineering - 32:9.11.8-2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_31_Mass_Rebuild + +* Tue Jul 02 2019 Petr Menšík - 32:9.11.8-1 +- Update to 9.11.8 + +* Mon Jun 17 2019 Petr Menšík - 32:9.11.7-2 +- Fix OpenSSL random generator initialization + +* Mon Jun 10 2019 Petr Menšík - 32:9.11.7-1 +- Update to 9.11.7 + +* Mon May 06 2019 Petr Menšík - 32:9.11.6-5.P1 +- Fix also postun script + +* Mon May 06 2019 Petr Menšík - 32:9.11.6-4.P1 +- Fix error in scriptlet condition + +* Thu May 02 2019 Petr Menšík - 32:9.11.6-3.P1 +- Fix inefective limit of TCP clients (CVE-2018-5743) + +* Thu Mar 14 2019 Petr Menšík - 32:9.11.6-2 +- Fix dnstap and timer issues in unit test +- Enable DLZ modules + +* Tue Mar 05 2019 Petr Menšík - 32:9.11.6-1 +- Update to 9.11.6 + +* Fri Mar 01 2019 Petr Menšík - 32:9.11.5-15.P4 +- Support testing of named variants + +* Thu Feb 28 2019 Petr Menšík - 32:9.11.5-14.P4 +- Modify feature-test detection of dlz-filesystem + +* Fri Feb 22 2019 Petr Menšík - 32:9.11.5-13.P4 +- Update to 9.11.5-P4 + +* Fri Feb 22 2019 Petr Menšík - 32:9.11.5-12.P1 +- Enable DNSTAP support (#1564776) +- Enable LMDB support for rndc addzone +- Enable json format in statistics-channel + +* Thu Feb 21 2019 Petr Menšík - 32:9.11.5-11.P1 +- Disable often failing unit test random_test + +* Thu Feb 21 2019 Petr Menšík - 32:9.11.5-10.P1 +- Disable autodetected eddsa algorithm ED448 + +* Thu Jan 31 2019 Petr Menšík - 32:9.11.5-9.P1 +- dig prints ASCII name instead of failure (#1647829) +- disable IDN output from scripts +- Update project URL +- Removed revoked KSK 19164 from trusted keys + +* Thu Jan 31 2019 Fedora Release Engineering - 32:9.11.5-8.P1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_30_Mass_Rebuild + +* Sun Jan 27 2019 Petr Menšík - 32:9.11.5-7.P1 +- Update to 9.11.5-P1 + +* Wed Jan 23 2019 Petr Menšík - 32:9.11.5-6 +- Reenable crypto rand for DHCP, disable just entropy check (#1663318) + +* Thu Jan 17 2019 Petr Menšík - 32:9.11.5-5 +- Move dnssec related tools from bind-utils to bind-dnssec-utils (#1649398) + +* Wed Jan 16 2019 Petr Menšík - 32:9.11.5-4 +- Reject invalid binary file (#1666814) + +* Mon Jan 14 2019 Petr Menšík - 32:9.11.5-3 +- Disable crypto rand for DHCP (#1663318) + +* Thu Oct 25 2018 Petr Menšík - 32:9.11.5-2 +- Add optional support for JSON statistics +- Add optional DNSTAP support (#1564776), new dnstap-read tool + +* Wed Oct 24 2018 Petr Menšík - 32:9.11.5-1 +- Update to 9.11.5 + +* Tue Oct 02 2018 Petr Menšík - 32:9.11.4-12.P2 +- Add Requires to devel packages referenced by bind-devel + +* Sat Sep 29 2018 Igor Gnatenko - 32:9.11.4-11.P2 +- Fix export-libs macro & scriptlet + +* Wed Sep 26 2018 Petr Menšík - 32:9.11.4-10.P2 +- Reenable IDN output but allow turning it off (#1580200) + +* Thu Sep 20 2018 Petr Menšík - 32:9.11.4-9.P2 +- Update to bind-9.11.4-P2 +- Add /dev/urandom to chroot (#1631515) + +* Fri Aug 24 2018 Petr Menšík - 32:9.11.4-8.P1 +- Replace unoptimized code by OpenSSL counterparts +- Fix multilib conflicts of devel package +- Add versioned depends to all library subpackages + +* Fri Aug 24 2018 Petr Menšík - 32:9.11.4-7.P1 +- Add support for OpenSSL provided random data + +* Mon Aug 13 2018 Petr Menšík - 32:9.11.4-6.P1 +- Fix sdb-chroot devices upgrade (#1592873) +- Automatically replace obsoleted ISC DLV key with root key (#1595782) + +* Thu Aug 09 2018 Petr Menšík - 32:9.11.4-5.P1 +- Update to 9.11.4-P1 +- Adds root key sentinel support +- Large IXFR zone transfers are rejected to prevent journal corruption + +* Thu Aug 02 2018 Petr Menšík - 32:9.11.4-4 +- Support unavailable MD5 in FIPS mode + +* Thu Aug 02 2018 Petr Menšík - 32:9.11.4-3 +- Use OpenSSL for digest operations (#1611537) + +* Tue Jul 31 2018 Petr Menšík - 32:9.11.4-2 +- Install generated manual pages + +* Thu Jul 12 2018 Petr Menšík - 32:9.11.4-1 +- Update to 9.11.4 +- Use kyua instead of kyua-cli for unit tests + +* Thu Jul 12 2018 Petr Menšík - 32:9.11.3-15 +- Use new config file named-chroot.files for chroot setup (#1429656) +- Fix chroot devices file verification (#1592873) +- Prevent errors on bind-chroot uninstall when running (#1600583) + +* Thu Jul 12 2018 Fedora Release Engineering - 32:9.11.3-14 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild + +* Mon Jul 02 2018 Miro Hrončok - 32:9.11.3-13 +- Rebuilt for Python 3.7 + +* Wed Jun 27 2018 Petr Menšík - 32:9.11.3-12 +- Require utils instead of library + +* Wed Jun 27 2018 Petr Menšík - 32:9.11.3-11 +- Remove named.iscdlv.key file (#1595782) +- Fix CVE-2018-5738 + +* Tue Jun 19 2018 Miro Hrončok - 32:9.11.3-10 +- Rebuilt for Python 3.7 + +* Fri May 25 2018 Petr Menšík - 32:9.11.3-9 +- Make named home writeable (#1422680) +- Change named shell to /bin/false + +* Fri May 25 2018 Petr Menšík - 32:9.11.3-8 +- Require C++ on build when shipped atf library is used + +* Mon Apr 09 2018 Petr Menšík - 32:9.11.3-7 +- Run tests also without kyua + +* Thu Apr 05 2018 Petr Menšík - 32:9.11.3-6 +- Do not link libidn2 to all libraries (#1098783) +- Update named.ca + +* Tue Apr 03 2018 Petr Menšík - 32:9.11.3-5 +- Enable libidn2 support (#1098783) +- Make +noidnout default +- Compile export libs without GSSAPI + +* Wed Mar 21 2018 Petr Menšík - 32:9.11.3-4 +- Rebase to 9.11.3 +- Add dig support for libidn2 (#1098783) + +* Wed Mar 21 2018 Petr Menšík - 32:9.11.3-3.b1 +- Fix build with disabled unittest +- Recommend softhsm from pkcs11 variant + +* Thu Feb 22 2018 Petr Menšík - 32:9.11.3-2.b1 +- Require openssl-devel and libcap-devel from bind-export-devel +- Conflict with bind99-devel +- Change spec globals to rpmbuild --with feature + +* Thu Feb 15 2018 Petr Menšík - 32:9.11.3-1.b1 +- Rebase to 9.11.3b1 + +* Wed Feb 07 2018 Petr Menšík - 32:9.11.2-11.P1 +- Use versioned provides +- Fix starting of unit tests +- Forward export libs path to isc-config +- Rename export devel subpackage to bind-export-devel + +* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-10.P1 +- Add obsoletes/provides tags for smooth update + +* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-9.P1 +- Build devel package for export-libs + +* Wed Feb 07 2018 Pavel Zhukov - 32:9.11.2-8.P1 +- Build export libraries with disabled threads and selects + +* Wed Feb 07 2018 Fedora Release Engineering - 32:9.11.2-7.P1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild + +* Tue Jan 30 2018 Petr Menšík - 32:9.11.2-6.P1 +- Remove ldconfig calls where possible +- Note -z defs cannot be enabled until more work + +* Tue Jan 16 2018 Petr Menšík - 32:9.11.2-5.P1 +- Fix CVE-2017-3145, rebase to 9.11.2-P1 + +* Tue Jan 02 2018 Petr Menšík - 32:9.11.2-4 +- Enable unit tests with kyua tool (#1532694) +- Provide internal tool to prepare softhsm token storage +- Proper fix for python3-bind subpackage directory ownership (#1522944) + +* Fri Dec 15 2017 Petr Menšík - 32:9.11.2-3 +- Own python3-bind isc directory (#1522944) +- Make tsstsig system test pass again (#1500017) + +* Mon Oct 23 2017 Petr Menšík - 32:9.11.2-2 +- Build against mariadb-connector-c-devel (#1493615) +- Include DNSKEY 20326 also in trusted-key.key (#1505476) +- Fix dynamic symbols conflict with ldap (#1205168) +- Use hmac-sha256 for new RNDC keys (#1508003) +- Include protocols and services in chroot + +* Wed Aug 02 2017 Petr Menšík - 32:9.11.2-1 +- Update to 9.11.2 +- Add recursing and secroots file into default and sample config +- Fix nsupdate GSSAPI auth against AD server (#1484451) + +* Wed Aug 02 2017 Fedora Release Engineering - 32:9.11.1-6.P3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Binutils_Mass_Rebuild + +* Wed Jul 26 2017 Fedora Release Engineering - 32:9.11.1-5.P3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild + +* Fri Jul 14 2017 Petr Menšík - 32:9.11.1-4.P3 +- Simplify change of default configuration file path + +* Thu Jul 13 2017 Petr Menšík - 32:9.11.1-3.P3 +- Use mysql_config for SDB variant, build against mariadb-devel + +* Mon Jul 10 2017 Petr Menšík - 32:9.11.1-2.P3 +- Update to 9.11.1-P3 + +* Fri Jun 30 2017 Petr Menšík - 32:9.11.1-2.P2 +- Update to 9.11.1-P2 + +* Thu Jun 29 2017 Petr Menšík - 32:9.11.1-2.P1 +- dnssec-checkds and dnssec-coverage requires python module (#1466183) + +* Thu Jun 15 2017 Petr Menšík - 32:9.11.1-1.P1 +- Update to 9.11.1-P1 + +* Fri Apr 21 2017 Petr Menšík - 32:9.11.0-8.P5 +- Fix queries for TKEY in nsupdate, when using GSSAPI (#1236087) + +* Thu Apr 13 2017 Petr Menšík - 32:9.11.0-7.P5 +- Update to 9.11.0-P5 +- Use BINDVERSION for upstream version + +* Fri Feb 10 2017 Petr Menšík - 32:9.11.0-7.P3 +- Update to 9.11.0-P3 + +* Fri Feb 10 2017 Fedora Release Engineering - 32:9.11.0-7.P2 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild + +* Wed Jan 18 2017 Petr Menšík - 32:9.11.0-6.P2 +- RTLD_DEEPBIND conflicts with pkcs11 libraries, skip it for dyndb (#1410433) +- Fix some rpm warnings + +* Mon Jan 16 2017 Petr Menšík - 32:9.11.0-5.P2 +- Fix manual pages generated by recent docbook-style-xsl (#1397186) + +* Thu Jan 12 2017 Petr Menšík - 32:9.11.0-4.P2 +- Update to 9.11.0-P2 + +* Mon Dec 19 2016 Miro Hrončok - 32:9.11.0-4.P1 +- Rebuild for Python 3.6 + +* Tue Nov 22 2016 Petr Menšík - 32:9.11.0-3.P1 +- Split pk11 includes, include real functions only in pkcs11 variant + +* Wed Nov 16 2016 Petr Menšík - 32:9.11.0-2.P1 +- Do not change lib permissions in chroot + +* Wed Nov 16 2016 Michal Ruprich - 32:9.11.0-1.P1 +- Update to 9.11.0-P1 + +* Tue Nov 08 2016 Petr Menšík - 32:9.10.4-3.P4 +- Build with OpenSSL 1.1 + +* Thu Nov 03 2016 Petr Menšík - 32:9.10.4-2.P4 +- Update to 9.10.4-P4 + +* Thu Sep 29 2016 Tomas Hozza - 32:9.10.4-2.P3 +- Update to 9.10.4-P3 + +* Wed Jul 20 2016 Michal Ruprich - 32:9.10.4-1.P2 +- Update to 9.10.4-P2 + +* Thu May 26 2016 Tomas Hozza - 32:9.10.4-1.P1 +- Update to 9.10.4-P1 + +* Fri May 20 2016 Tomas Hozza - 32:9.10.3-14.P4 +- (un)mount /var/named in -chroot packages as the last directory (Related: #1279188) + +* Thu May 12 2016 Tomas Hozza - 32:9.10.3-13.P4 +- Remove NM dispatcher script, since it is not needed any more (#1277257) +- Replaced After=network-online.target with After=network.target in all unit files + +* Fri Mar 11 2016 Tomas Hozza - 32:9.10.3-12.P4 +- Update to 9.10.3-P4 due to CVE-2016-1285 CVE-2016-1286 CVE-2016-2088 + +* Wed Feb 03 2016 Fedora Release Engineering - 32:9.10.3-11.P3 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild + +* Thu Jan 21 2016 Tomas Hozza - 32:9.10.3-10.P3 +- Update to 9.10.3-P3 due to CVE-2015-8704 and CVE-2015-8705 (#1300051) + +* Wed Jan 06 2016 Tomas Hozza - 32:9.10.3-9.P2 +- Commented out bindkeys-file statement in default configuration (#1223365#c3) +- Removed unrecognized configure option --enable-developer +- Added configure option --enable-full-report to get report on enabled features + +* Sat Dec 26 2015 Robert Scheck - 32:9.10.3-8.P2 +- Remove unrecognized build options for %%configure +- Own %%{_includedir}/bind9 directory in -lite-devel +- Fixed building without (optional) PKCS#11 support + +* Wed Dec 16 2015 Tomas Hozza - 32:9.10.3-7.P2 +- bump release to maintain update path + +* Wed Dec 16 2015 Tomas Hozza - 32:9.10.3-4.P2 +- Update to 9.10.3-P2 + +* Tue Nov 10 2015 Fedora Release Engineering - 32:9.10.3-3 +- Rebuilt for https://fedoraproject.org/wiki/Changes/python3.5 + +* Wed Nov 04 2015 Tomas Hozza - 32:9.10.3-2 +- Fixed named-checkconf call in *-chroot.service files (#1277820) + +* Thu Sep 17 2015 Tomas Hozza - 32:9.10.3-1 +- Update to 9.10.3 stable + +* Thu Sep 03 2015 Tomas Hozza +- Update to 9.10.3rc1 + +* Wed Jul 29 2015 Tomas Hozza - 32:9.10.2-9.P3 +- Update to 9.10.2-P3 to fix CVE-2015-5477 + +* Thu Jul 09 2015 Tomas Hozza - 32:9.10.2-8.P2 +- Update to 9.10.2-P2 + +* Mon Jun 29 2015 Tomas Hozza - 32:9.10.2-7.P1 +- Reintroduce the DISABLE_ZONE_CHECKING into /etc/sysconfig/named + +* Fri Jun 19 2015 Tomas Hozza - 32:9.10.2-6.P1 +- Update to 9.10.2-P1 + +* Wed Jun 17 2015 Fedora Release Engineering - 32:9.10.2-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild + +* Wed May 27 2015 Tomas Hozza - 32:9.10.2-4 +- Don't copy /etc/localtime on -chroot package installation + +* Fri May 22 2015 Tomas Hozza - 32:9.10.2-3 +- Don't use ISC's DLV by default (#1223365) +- Utilize system-wide crypto-policies (#1179925) + +* Thu May 21 2015 Tomas Hozza - 32:9.10.2-2 +- enable tuning for large systems - increases hardcoded internal limits +- enable GeoIP access control feature + +* Thu Feb 26 2015 Tomas Hozza - 32:9.10.2-1 +- update to 9.10.2 stable +- remove parallel-build patch after discussion with upstream [ISC-Bugs #38739] + +* Wed Feb 25 2015 Tomas Hozza - 32:9.10.2-0.3.rc1 +- update to 9.10.2rc2 +- call ldconfig for pkcs11-libs +- Use Python3 by default (#1186791) + +* Sat Feb 21 2015 Till Maas - 32:9.10.2-0.2.rc1 +- Rebuilt for Fedora 23 Change + https://fedoraproject.org/wiki/Changes/Harden_all_packages_with_position-independent_code + +* Mon Feb 02 2015 Tomas Hozza - 32:9.10.2-0.1.rc1 +- update to 9.10.2rc1 +- fix nsupdate server auto-detection (#1184151) +- drop merged patch bind99-rh985918.patch + +* Fri Jan 16 2015 Tomas Hozza - 32:9.10.1-2.P1 +- Install config for tmpfiles under %%{_tmpfilesdir} (#1181020) + +* Tue Jan 13 2015 Tomas Hozza - 32:9.10.1-1.P1 +- Update to 9.10.1-P1 stable + +* Fri Dec 12 2014 Tomas Hozza - 32:9.9.6-6.P1 +- Drop downstream patch for nslookup/host rejected by upstream + +* Tue Dec 09 2014 Tomas Hozza - 32:9.9.6-5.P1 +- Update to 9.9.6-P1 (CVE-2014-8500) + +* Fri Nov 14 2014 Tomas Hozza - 32:9.9.6-4 +- Fixed systemctl path in logrotate configuration (#1148360) +- drop engine_pkcs11 dependency, since we use native PKCS#11 implementation + +* Wed Oct 22 2014 Petr Spacek - 32:9.9.6-3 +- Fix crash during GSS-TSIG processing (#1155334, #1155127) + introduced in 32:9.9.6-2 + +* Tue Oct 14 2014 Tomas Hozza - 32:9.9.6-2 +- Added native PKCS#11 functionality (#1097752) +- bind-sdb now requires bind due to configuration and other utilities +- bind-pkcs11 now requires bind due to configuration and other utilities + +* Thu Oct 02 2014 Tomas Hozza - 32:9.9.6-1 +- Update to 9.9.6 +- drop merged patches and rebase some of existing patches +- Add architecture specific dependencies. +- Fix assert in dig when using +sigchase (#985918) + +* Fri Aug 15 2014 Fedora Release Engineering - 32:9.9.5-9.P1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_22_Mass_Rebuild + +* Fri Jul 18 2014 Tomas Hozza 32:9.9.5-8.P1 +- Use network-online.target instead of network.target (#1117086) + +* Fri Jul 11 2014 Tom Callaway 32:9.9.5-7.P1 +- fix license handling + +* Thu Jun 12 2014 Tomas Hozza 32:9.9.5-6.P1 +- Update to 9.9.5-P1 + +* Mon Jun 09 2014 Tomas Hozza 32:9.9.5-5 +- Use /dev/urandom for generation of rndc.key (#1079799) + +* Sat Jun 07 2014 Fedora Release Engineering - 32:9.9.5-4 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild + +* Tue Apr 22 2014 Tomas Hozza 32:9.9.5-3 +- configure bind with --with-dlopen=yes to support dynamically loadable DLZ drivers + +* Wed Mar 05 2014 Tomas Hozza 32:9.9.5-2 +- dlz_dlopen driver could return the wrong error leading to a segfault (#1052781) +- Fix race condition when freeing fetch object (ISC-Bugs #35385) + +* Thu Feb 13 2014 Tomas Hozza 32:9.9.5-1 +- Update to 9.9.5 stable + +* Sun Jan 26 2014 Rex Dieter 32:9.9.5-0.5.rc2 +- -libs, -libs-lite: track sonames, so abi bumps aren't a surprise + +* Fri Jan 24 2014 Tomas Hozza 32:9.9.5-0.4.rc2 +- update to 9.9.5rc2 +- merged patches dropped +- some patches rebased to the new version + +* Wed Jan 15 2014 Tomas Hozza 32:9.9.5-0.3.b1 +- non-existance of resolv.conf should not be fatal (#1052343) + +* Tue Jan 14 2014 Tomas Hozza 32:9.9.5-0.2.b1 +- Fix CVE-2014-0591 + +* Mon Jan 06 2014 Tomas Hozza 32:9.9.5-0.1.b1 +- Update to bind-9.9.5b1 +- Build bind-sdb against libdb instead of libdb4 + +* Wed Dec 18 2013 Tomas Hozza 32:9.9.4-11 +- Fix crash in rbtdb after two sucessive getoriginnode() calls + +* Tue Dec 17 2013 Tomas Hozza 32:9.9.4-10 +- Split chroot package for named and named-sdb +- Extract setting-up/destroying of chroot to a separate systemd service (#997030) + +* Thu Nov 28 2013 Tomas Hozza 32:9.9.4-9 +- Fixed memory leak in nsupdate if 'realm' was used multiple times (#984687) + +* Tue Nov 12 2013 Tomas Hozza 32:9.9.4-8 +- Install configuration for rwtab and fix chroot setup script + +* Thu Oct 31 2013 Tomas Hozza 32:9.9.4-7 +- Correct the upstream patch for #794940 + +* Thu Oct 31 2013 Tomas Hozza 32:9.9.4-6 +- use --enable-filter-aaaa when building bind to enable use of filter-aaaa-on-v4 option + +* Wed Oct 30 2013 Tomas Hozza 32:9.9.4-5 +- Create symlink /var/named/chroot/var/run -> /var/named/chroot/run +- Added session-keyfile statement into default named.conf since we use /run/named + +* Tue Oct 29 2013 Tomas Hozza 32:9.9.4-4 +- Use upstream version of patch for previously fixed #794940 + +* Fri Oct 18 2013 Tomas Hozza 32:9.9.4-3 +- Fix race condition on send buffers in dighost.c (#794940) + +* Tue Oct 08 2013 Tomas Hozza 32:9.9.4-2 +- install isc/errno2result.h header + +* Fri Sep 20 2013 Tomas Hozza 32:9.9.4-1 +- Update to bind-9.9.4 stable + +* Tue Sep 10 2013 Tomas Hozza 32:9.9.4-0.9.rc2 +- Fix [ISC-Bugs #34738] dns_journal_open() returns a pointer to stack + +* Mon Sep 09 2013 Tomas Hozza 32:9.9.4-0.8.rc2 +- update to bind-9.9.4rc2 + +* Tue Aug 20 2013 Tomas Hozza 32:9.9.4-0.7.rc1 +- Move named-checkzone and named-compilezone to bind-utils package + +* Tue Aug 20 2013 Tomas Hozza 32:9.9.4-0.6.rc1 +- Move tools that don't need the server to run, from main package to bind-utils (#964313) + +* Fri Aug 16 2013 Tomas Hozza 32:9.9.4-0.5.rc1 +- Don't generate rndc.key if there exists rndc.conf + +* Fri Aug 16 2013 Tomas Hozza 32:9.9.4-0.4.rc1 +- don't install named-sdb.service if SDB macro is defined to zero + +* Mon Aug 05 2013 Tomas Hozza 32:9.9.4-0.3.rc1 +- Fix setup-named-chroot.sh to mount/umount everything successfully +- update to bind-9.9.4rc1 + +* Sat Aug 03 2013 Fedora Release Engineering - 32:9.9.4-0.2.b1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild + +* Mon Jul 15 2013 Tomas Hozza 32:9.9.4-0.1.b1 +- update to bind-9.9.4b1 +- drop merged RRL patch +- drop merged stat.h patch + +* Wed Jun 05 2013 Tomas Hozza 32:9.9.3-3.P1 +- update to 9.9.3-P1 (fix for CVE-2013-3919) +- update RRL patch to 9.9.3-P1-rl.156.01 + +* Mon Jun 03 2013 Tomas Hozza 32:9.9.3-2 +- bump release to prevent update path issues + +* Mon Jun 03 2013 Tomas Hozza 32:9.9.3-1 +- update to 9.9.3 +- install dns/update.h header +- update RRL patch to the latest version 9.9.3-rl.150.20 + +* Fri May 17 2013 Tomas Hozza 32:9.9.3-0.7.rc2 +- Fix segfault in host/nslookup (#878139) + +* Mon May 13 2013 Tomas Hozza 32:9.9.3-0.6.rc2 +- update to 9.9.3rc2 +- part of bind97-exportlib.patch not needed any more +- bind-9.9.1-P2-multlib-conflict.patch modified to reflect latest source +- rl-9.9.3rc1.patch -> rl-9.9.3rc2.patch +- bind99-opts.patch merged + +* Fri May 03 2013 Tomas Hozza 32:9.9.3-0.5.rc1 +- Include recursion Warning in named.conf and named.conf.sample (#740894) +- Include managed-keys-directory statement in named.conf.sample (#948026) + +* Thu May 02 2013 Tomas Hozza 32:9.9.3-0.4.rc1 +- Fix zone2sqlite to quote table names when creating/dropping/inserting (#919417) + +* Fri Apr 19 2013 Adam Tkac 32:9.9.3-0.3.rc1 +- fix crash in nsupdate when processing "-r" parameter (#949544) + +* Tue Apr 16 2013 Adam Tkac 32:9.9.3-0.2.rc1 +- ship dns/rrl.h in -devel subpkg + +* Tue Apr 16 2013 Adam Tkac 32:9.9.3-0.1.rc1 +- update to 9.9.3rc1 +- bind-96-libtool2.patch has been merged +- fix bind tmpfiles.d for named.pid /run migration (#920713) + +* Wed Mar 27 2013 Tomas Hozza 32:9.9.2-12.P2 +- New upstream patch version fixing CVE-2013-2266 (#928032) + +* Tue Mar 19 2013 Adam Tkac 32:9.9.2-11.P1 +- move pidfile to /run/named/named.pid + +* Wed Mar 06 2013 Tomas Hozza 32:9.9.2-10.P1 +- Fix Makefile.in to include header added by rate limiting patch (#918330) + +* Tue Mar 05 2013 Adam Tkac 32:9.9.2-9.P1 +- drop some developer-only documentation and move ARM to %%docdir + +* Mon Feb 18 2013 Adam Tkac 32:9.9.2-8.P1 +- include rate limiting patch + +* Tue Jan 29 2013 Tomas Hozza 32:9.9.2-7.P1 +- Corrected IP addresses in named.ca (#901741) +- mount/umount /var/named in setup-named-chroot.sh as the last one (#904666) + +* Thu Dec 20 2012 Adam Tkac 32:9.9.2-6.P1 +- generate /etc/rndc.key during named service startup if doesn't exist +- increase startup timeout in systemd units to 90sec (default) +- fix IDN related statement in dig.1 manpage + +* Wed Dec 05 2012 Tomas Hozza 32:9.9.2-5.P1 +- update to bind-9.9.2-P1 + +* Mon Nov 12 2012 Adam Tkac 32:9.9.2-4 +- document dig exit codes in manpage +- ignore empty "search" options in resolv.conf + +* Mon Nov 12 2012 Adam Tkac 32:9.9.2-3 +- drop PKCS11 support on rhel + +* Thu Oct 11 2012 Adam Tkac 32:9.9.2-2 +- install isc/stat.h + +* Thu Oct 11 2012 Adam Tkac 32:9.9.2-1 +- update to 9.9.2 +- bind97-rh714049.patch has been dropped +- patches merged + - bind98-rh816164.patch + +* Thu Sep 13 2012 Adam Tkac 32:9.9.1-10.P3 +- update to bind-9.9.1-P3 + +* Wed Aug 22 2012 Tomas Hozza 32:9.9.1-9.P2 +- fixed SPEC file so it comply with new systemd-rpm macros guidelines (#850045) +- changed %%define macros to %%global and fixed several rpmlint warnings + +* Wed Aug 08 2012 Tomas Hozza 32:9.9.1-8.P2 +- Changed PrivateTmp to "false" in *-chroot.service unit files (#825869) + +* Wed Aug 01 2012 Tomas Hozza 32:9.9.1-7.P2 +- Fixed bind-devel multilib conflict (#478718) + +* Mon Jul 30 2012 Tomas Hozza 32:9.9.1-6.P2 +- Fixed bad path to systemctl in /etc/NetworkManager/dispatcher.d/13-named (#844047) +- Fixed path to libdb.so in config.dlz.in + +* Thu Jul 26 2012 Adam Tkac 32:9.9.1-5.P2 +- update to 9.9.1-P2 + +* Wed Jul 18 2012 Fedora Release Engineering - 32:9.9.1-4.P1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_18_Mass_Rebuild + +* Wed Jul 11 2012 Ville Skyttä - 32:9.9.1-3.P1 +- Avoid shell invocation and dep for -libs-lite %%postun. + +* Mon Jun 04 2012 Adam Tkac 32:9.9.1-2.P1 +- update to 9.9.1-P1 (CVE-2012-1667) + +* Thu May 24 2012 Adam Tkac 32:9.9.1-1 +- update to 9.9.1 +- bind99-coverity.patch merged +- bind-9.5-overflow.patch merged + +* Mon May 07 2012 Adam Tkac 32:9.9.0-6 +- nslookup: return non-zero exit code when fail to get answer (#816164) + +* Thu Apr 26 2012 Adam Tkac 32:9.9.0-5 +- initscript: don't umount /var/named when didn't mount it + +* Tue Apr 24 2012 Adam Tkac 32:9.9.0-4 +- apply all non-SDB patches before SDB ones (#804475) +- enable Berkeley DB DLZ backend (#804478) + +* Thu Apr 12 2012 Adam Tkac 32:9.9.0-3 +- bind97-rh699951.patch is no longer needed (different fix is in 9.9.0) + +* Mon Mar 26 2012 Adam Tkac 32:9.9.0-2 +- remove unneeded bind99-v6only.patch + +* Mon Mar 05 2012 Adam Tkac 32:9.9.0-1 +- update to 9.9.0 +- load dynamic DBs later (and update dyndb patch) +- fix memory leak in named during processing of rndc command +- don't call `rndc-confgen -a` in "post" section +- fix some packaging bugs in bind-chroot + +* Wed Feb 15 2012 Adam Tkac 32:9.9.0-0.8.rc2 +- build with "--enable-fixed-rrset" + +* Wed Feb 01 2012 Adam Tkac 32:9.9.0-0.7.rc2 +- update to 9.9.0rc2 +- doc/rfc and doc/draft are no longer shipped in tarball + +* Mon Jan 30 2012 Adam Tkac 32:9.9.0-0.6.rc1 +- retire initscript in favour of systemd unit files (#719419) + +* Thu Jan 12 2012 Adam Tkac 32:9.9.0-0.5.rc1 +- update to 9.9.0rc1 + +* Wed Dec 07 2011 Adam Tkac 32:9.9.0-0.4.b2 +- ship dns/forward.h in -devel subpkg + +* Tue Nov 22 2011 Adam Tkac 32:9.9.0-0.3.b2 +- update to 9.9.0b2 (CVE-2011-4313) +- patches merged + - bind97-rh700097.patch + - bind99-cinfo.patch + +* Mon Nov 14 2011 Adam Tkac 32:9.9.0-0.2.b1 +- ship dns/clientinfo.h in bind-devel + +* Fri Nov 11 2011 Adam Tkac 32:9.9.0-0.1.b1 +- update to 9.9.0b1 +- bind98-dlz_buildfix.patch merged + +* Fri Oct 28 2011 Adam Tkac 32:9.8.1-4 +- nslookup failed to resolve name in certain cases + +* Mon Sep 26 2011 Adam Tkac 32:9.8.1-3 +- remove deps filter, it is no longer needed (#739663) + +* Fri Sep 09 2011 Adam Tkac 32:9.8.1-2 +- fix logrotate config file (#725256) + +* Wed Sep 07 2011 Adam Tkac 32:9.8.1-1 +- update to 9.8.1 +- ship /etc/trusted-key.key (needed by dig) +- use select instead of epoll in export libs (#735103) + +* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.3.rc1 +- fix DLZ related compilation issues +- make /etc/named.{root,iscdlv}.key world-readable +- add bind-libs versioned requires to bind pkg + +* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.2.rc1 +- fix rare race condition in request.c +- print "the working directory is not writable" as debug message +- re-add configtest target to initscript +- initscript: sybsys name is always named, not named-sdb +- nsupdate returned zero when target zone didn't exist (#700097) +- nsupdate could have failed if server has multiple IPs and the first + was unreachable (#714049) + +* Wed Aug 31 2011 Adam Tkac 32:9.8.1-0.1.rc1 +- update to 9.8.1rc1 +- patches merged + - bind97-rh674334.patch + - bind97-cleanup.patch + - bind98-includes.patch + +* Wed Aug 03 2011 Adam Tkac 32:9.8.0-9.P4 +- improve patch for #725741 + +* Tue Jul 26 2011 Adam Tkac 32:9.8.0-8.P4 +- named could have crashed during reload when dyndb module is used (#725741) + +* Tue Jul 05 2011 Adam Tkac 32:9.8.0-7.P4 +- update to 9.8.0-P4 + - bind98-libdns-export.patch merged + +* Thu Jun 02 2011 Adam Tkac 32:9.8.0-6.P2 +- update the dyndb patch + +* Fri May 27 2011 Adam Tkac 32:9.8.0-5.P2 +- fix compilation of libdns-export.so + +* Fri May 27 2011 Adam Tkac 32:9.8.0-4.P2 +- update to 9.8.0-P2 (CVE-2011-1910) + +* Fri May 06 2011 Adam Tkac 32:9.8.0-3.P1 +- update to 9.8.0-P1 (CVE-2011-1907) + +* Wed Mar 23 2011 Dan Horák - 32:9.8.0-2 +- rebuilt for mysql 5.5.10 (soname bump in libmysqlclient) + +* Thu Mar 03 2011 Adam Tkac 32:9.8.0-1 +- update to 9.8.0 +- bind97-rh665971.patch merged + +* Thu Mar 03 2011 Adam Tkac 32:9.8.0-0.4.rc1 +- revert previous change (integration with libnmserver) + +* Tue Feb 22 2011 Adam Tkac 32:9.8.0-0.3.rc1 +- integrate named with libnmserver library + +* Tue Feb 22 2011 Adam Tkac 32:9.8.0-0.2.rc1 +- include dns/rpz.h in -devel subpkg + +* Mon Feb 21 2011 Adam Tkac 32:9.8.0-0.1.rc1 +- update to 9.8.0rc1 + +* Fri Feb 18 2011 Adam Tkac 32:9.7.3-1 +- update to 9.7.3 +- fix dig +trace on dualstack systems (#674334) +- fix linkage order when building on system with older BIND (#665971) +- reduce number of gcc warnings + +* Mon Feb 07 2011 Fedora Release Engineering - 32:9.7.3-0.6.rc1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_15_Mass_Rebuild + +* Tue Jan 25 2011 Adam Tkac 32:9.7.3-0.5.rc1 +- update to 9.7.3rc1 + - bind97-krb5-self.patch merged + +* Wed Jan 12 2011 Adam Tkac 32:9.7.3-0.4.b1 +- fix typo in initscript + +* Thu Jan 06 2011 Adam Tkac 32:9.7.3-0.3.b1 +- fix "service named status" when used with named-sdb +- don't check MD5, size and mtime of sysconfig/named + +* Wed Jan 05 2011 Adam Tkac 32:9.7.3-0.2.b1 +- add new option DISABLE_ZONE_CHECKING to sysconfig/named + +* Wed Jan 05 2011 Adam Tkac 32:9.7.3-0.1.b1 +- update to 9.7.3b1 + +* Wed Jan 05 2011 Adam Tkac 32:9.7.2-10.P3 +- initscript should terminate only the correct "named" process (#622785) + +* Mon Dec 20 2010 Adam Tkac 32:9.7.2-9.P3 +- fix "krb5-self" update-policy rule processing + +* Thu Dec 02 2010 Adam Tkac 32:9.7.2-8.P3 +- update to 9.7.2-P3 + +* Mon Nov 29 2010 Jan Görig 32:9.7.2-7.P2 +- added tmpfiles.d support (#656550) +- removed old PID checking in initscript + +* Mon Nov 08 2010 Adam Tkac 32:9.7.2-6.P2 +- don't emit various informational messages by default (#645544) + +* Wed Oct 20 2010 Adam Tkac 32:9.7.2-5.P2 +- move BIND9 internal libs back to %%{_libdir} +- add "-export" suffix to public libraries (-lite subpkg) + +* Thu Oct 07 2010 Adam Tkac 32:9.7.2-4.P2 +- ship -devel subpkg for internal libs, dnsperf needs it + +* Thu Oct 07 2010 Adam Tkac 32:9.7.2-3.P2 +- new bind-libs-lite and bind-lite-devel subpkgs which contain + public version of BIND 9 libraries +- don't ship devel files for internal version of BIND 9 libraries + +* Wed Sep 29 2010 Adam Tkac 32:9.7.2-2.P2 +- update to 9.7.2-P2 + +* Thu Sep 16 2010 Adam Tkac 32:9.7.2-1 +- update to 9.7.2 + +* Fri Aug 27 2010 Adam Tkac 32:9.7.2-0.3.rc1 +- update to 9.7.2rc1 + +* Tue Aug 10 2010 Adam Tkac 32:9.7.2-0.2.b1 +- host: handle "debug", "attempts" and "timeout" options in resolv.conf well + +* Tue Aug 03 2010 Adam Tkac 32:9.7.2-0.1.b1 +- update to 9.7.2b1 +- patches merged + - bind97-rh507429.patch + +* Mon Jul 19 2010 Adam Tkac 32:9.7.1-5.P2 +- supply root zone DNSKEY in default configuration + +* Mon Jul 19 2010 Adam Tkac 32:9.7.1-4.P2 +- update to 9.7.1-P2 (CVE-2010-0213) + +* Mon Jul 12 2010 Adam Tkac 32:9.7.1-3.P1 +- remove outdated Copyright.caching-nameserver file +- remove rfc1912.txt, it is already located in %%doc/rfc directory +- move COPYRIGHT to the bind-libs subpkg +- add COPYRIGHT to the -pkcs11 subpkg + +* Fri Jul 09 2010 Adam Tkac 32:9.7.1-2.P1 +- update to 9.7.1-P1 + +* Mon Jun 28 2010 Adam Tkac 32:9.7.1-1 +- update to 9.7.1 +- improve the "dnssec-conf" trigger + +* Wed Jun 09 2010 Adam Tkac 32:9.7.1-0.2.rc1 +- update to 9.7.1rc1 +- patches merged + - bind97-keysdir.patch + +* Mon May 31 2010 Adam Tkac 32:9.7.1-0.1.b1 +- update to 9.7.1b1 +- make /var/named/dynamic as a default directory for managed DNSSEC keys +- add patch to get "managed-keys-directory" option working +- patches merged + - bind97-managed-keyfile.patch + - bind97-rh554316.patch + +* Fri May 21 2010 Adam Tkac 32:9.7.0-11.P2 +- update dnssec-conf Obsoletes/Provides + +* Thu May 20 2010 Adam Tkac 32:9.7.0-10.P2 +- update to 9.7.0-P2 + +* Fri Mar 26 2010 Adam Tkac 32:9.7.0-9.P1 +- added lost patch for #554316 (occasional crash in keytable.c) + +* Fri Mar 26 2010 Adam Tkac 32:9.7.0-8.P1 +- active query might be destroyed in resume_dslookup() which triggered REQUIRE + failure (#507429) + +* Mon Mar 22 2010 Adam Tkac 32:9.7.0-7.P1 +- install SDB related manpages only when build with SDB + +* Fri Mar 19 2010 Adam Tkac 32:9.7.0-6.P1 +- update to 9.7.0-P1 + +* Tue Mar 16 2010 Jan Görig 32:9.7.0-5 +- bind-sdb now requires bind + +* Mon Mar 15 2010 Jan Görig 32:9.7.0-4 +- add man-pages ldap2zone.1 zonetodb.1 zone2sqlite.1 named-sdb.8 (#525655) + +* Mon Mar 01 2010 Adam Tkac 32:9.7.0-3 +- fix multilib issue (#478718) [jgorig] + +* Mon Mar 01 2010 Adam Tkac 32:9.7.0-2 +- improve automatic DNSSEC reconfiguration trigger +- initscript now returns 2 in case that action doesn't exist (#523435) +- enable/disable chroot when bind-chroot is installed/uninstalled + +* Wed Feb 17 2010 Adam Tkac 32:9.7.0-1 +- update to 9.7.0 final + +* Mon Feb 15 2010 Adam Tkac 32:9.7.0-0.14.rc2 +- obsolete dnssec-conf +- automatically update configuration from old dnssec-conf based +- improve default configuration; enable DLV by default +- remove obsolete triggerpostun from bind-libs subpackage + +* Thu Jan 28 2010 Adam Tkac 32:9.7.0-0.13.rc2 +- update to 9.7.0rc2 + +* Wed Jan 27 2010 Adam Tkac 32:9.7.0-0.12.rc1 +- initscript LSB related fixes (#523435) + +* Wed Jan 27 2010 Adam Tkac 32:9.7.0-0.11.rc1 +- revert the "DEBUG" feature (#510283), it causes too many problems (#545128) + +* Tue Dec 15 2009 Adam Tkac 32:9.7.0-0.10.rc1 +- update to 9.7.0rc1 +- bind97-headers.patch merged +- update default configuration + +* Tue Dec 01 2009 Adam Tkac 32:9.7.0-0.9.b3 +- update to 9.7.0b3 + +* Thu Nov 26 2009 Adam Tkac 32:9.7.0-0.8.b2 +- install isc/namespace.h header + +* Fri Nov 06 2009 Adam Tkac 32:9.7.0-0.7.b2 +- update to 9.7.0b2 + +* Tue Nov 03 2009 Adam Tkac 32:9.7.0-0.6.b1 +- update to 9.7.0b1 +- add bind-pkcs11 subpackage to support PKCS11 compatible keystores for DNSSEC + keys + +* Thu Oct 08 2009 Adam Tkac 32:9.7.0-0.5.a3 +- don't package named-bootconf utility, it is very outdated and unneeded + +* Mon Sep 21 2009 Adam Tkac 32:9.7.0-0.4.a3 +- determine file size via `stat` instead of `ls` (#523682) + +* Wed Sep 16 2009 Adam Tkac 32:9.7.0-0.3.a3 +- update to 9.7.0a3 + +* Tue Sep 15 2009 Adam Tkac 32:9.7.0-0.2.a2 +- improve chroot related documentation (#507795) +- add NetworkManager dispatcher script to reload named when network interface is + activated/deactivated (#490275) +- don't set/unset named_write_master_zones SELinux boolean every time in + initscript, modify it only when it's actually needed + +* Tue Sep 15 2009 Adam Tkac 32:9.7.0-0.1.a2 +- update to 9.7.0a2 +- merged patches + - bind-96-db_unregister.patch + - bind96-rh507469.patch + +* Tue Sep 01 2009 Adam Tkac 32:9.6.1-9.P1 +- next attempt to fix the postun trigger (#520385) +- remove obsolete bind-9.3.1rc1-fix_libbind_includedir.patch + +* Fri Aug 21 2009 Tomas Mraz - 32:9.6.1-8.P1 +- rebuilt with new openssl + +* Tue Aug 04 2009 Martin Nagy 32:9.6.1-7.P1 +- update the patch for dynamic loading of database backends + +* Wed Jul 29 2009 Adam Tkac 32:9.6.1-6.P1 +- 9.6.1-P1 release (CVE-2009-0696) +- fix postun trigger (#513016, hopefully) + +* Fri Jul 24 2009 Fedora Release Engineering - 32:9.6.1-5 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_12_Mass_Rebuild + +* Mon Jul 20 2009 Adam Tkac 32:9.6.1-4 +- remove useless bind-9.3.3rc2-rndckey.patch + +* Mon Jul 13 2009 Adam Tkac 32:9.6.1-3 +- fix broken symlinks in bind-libs (#509635) +- fix typos in /etc/sysconfig/named (#509650) +- add DEBUG option to /etc/sysconfig/named (#510283) + +* Wed Jun 24 2009 Adam Tkac 32:9.6.1-2 +- improved "chroot automount" patches (#504596) +- host should fail if specified server doesn't respond (#507469) + +* Wed Jun 17 2009 Adam Tkac 32:9.6.1-1 +- 9.6.1 release +- simplify chroot maintenance. Important files and directories are mounted into + chroot (see /etc/sysconfig/named for more info, #504596) +- fix doc/named.conf.default perms + +* Wed May 27 2009 Adam Tkac 32:9.6.1-0.4.rc1 +- 9.6.1rc1 release + +* Wed Apr 29 2009 Martin Nagy 32:9.6.1-0.3.b1 +- update the patch for dynamic loading of database backends +- create %%{_libdir}/bind directory +- copy default named.conf to doc directory, shared with s-c-bind (atkac) + +* Fri Apr 24 2009 Martin Nagy 32:9.6.1-0.2.b1 +- update the patch for dynamic loading of database backends +- fix dns_db_unregister() +- useradd now takes "-N" instead of "-n" (atkac, #495726) +- print nicer error msg when zone file is actually a directory (atkac, #490837) + +* Mon Mar 30 2009 Adam Tkac 32:9.6.1-0.1.b1 +- 9.6.1b1 release +- patches merged + - bind-96-isc_header.patch + - bind-95-rh469440.patch + - bind-96-realloc.patch + - bind9-fedora-0001.diff +- use -version-number instead of -version-info libtool param + +* Mon Mar 23 2009 Adam Tkac 32:9.6.0-11.1.P1 +- logrotate configuration file now points to /var/named/data/named.run by + default (#489986) + +* Tue Mar 17 2009 Adam Tkac 32:9.6.0-11.P1 +- fall back to insecure mode when no supported DNSSEC algorithm is found + instead of SERVFAIL +- don't fall back to non-EDNS0 queries when DO bit is set + +* Tue Mar 10 2009 Adam Tkac 32:9.6.0-10.P1 +- enable DNSSEC only if it is enabled in sysconfig/dnssec + +* Mon Mar 09 2009 Adam Tkac 32:9.6.0-9.P1 +- add DNSSEC support to initscript, enabled it per default +- add requires dnssec-conf + +* Mon Mar 09 2009 Adam Tkac 32:9.6.0-8.P1 +- fire away libbind, it is now separate package + +* Wed Mar 04 2009 Adam Tkac 32:9.6.0-7.P1 +- fixed some read buffer overflows (upstream) + +* Mon Feb 23 2009 Fedora Release Engineering 32:9.6.0-6.P1 +- Rebuilt for https://fedoraproject.org/wiki/Fedora_11_Mass_Rebuild + +* Thu Feb 12 2009 Martin Nagy 32:9.6.0-5.P1 +- update the patch for dynamic loading of database backends +- include iterated_hash.h + +* Sat Jan 24 2009 Caolán McNamara 32:9.6.0-4.P1 +- rebuild for dependencies + +* Wed Jan 21 2009 Adam Tkac 32:9.6.0-3.P1 +- rebuild against new openssl + +* Thu Jan 08 2009 Adam Tkac 32:9.6.0-2.P1 +- 9.6.0-P1 release (CVE-2009-0025) + +* Mon Jan 05 2009 Adam Tkac 32:9.6.0-1 +- Happy new year +- 9.6.0 release + +* Thu Dec 18 2008 Adam Tkac 32:9.6.0-0.7.rc2 +- 9.6.0rc2 release +- bind-96-rh475120.patch merged + +* Tue Dec 16 2008 Martin Nagy 32:9.6.0-0.6.rc1 +- add patch for dynamic loading of database backends + +* Tue Dec 09 2008 Adam Tkac 32:9.6.0-0.5.1.rc1 +- allow to reuse address for non-random query-source ports (#475120) + +* Wed Dec 03 2008 Adam Tkac 32:9.6.0-0.5.rc1 +- 9.6.0rc1 release +- patches merged + - bind-9.2.0rc3-varrun.patch + - bind-95-sdlz-include.patch + - bind-96-libxml2.patch +- fixed rare use-after-free problem in host utility (#452060) +- enabled chase of DNSSEC signature chains in dig + +* Mon Dec 01 2008 Adam Tkac 32:9.6.0-0.4.1.b1 +- improved sample config file (#473586) + +* Wed Nov 26 2008 Adam Tkac 32:9.6.0-0.4.b1 +- reverted previous change, koji doesn't like it + +* Wed Nov 26 2008 Adam Tkac 32:9.6.0-0.3.b1 +- build bind-chroot as noarch + +* Mon Nov 24 2008 Adam Tkac 32:9.6.0-0.2.1.b1 +- updates due libtool 2.2.6 +- don't pass -DLDAP_DEPRECATED to cpp, handle it directly in sources + +* Tue Nov 11 2008 Adam Tkac 32:9.6.0-0.2.b1 +- make statistics http server working, patch backported from 9.6 HEAD + +* Mon Nov 10 2008 Adam Tkac 32:9.6.0-0.1.b1 +- 9.6.0b1 release +- don't build ODBC and Berkeley DB DLZ drivers +- end of bind-chroot-admin script, copy config files to chroot manually +- /proc doesn't have to be mounted to chroot +- temporary use libbind from 9.5 series, noone has been released for 9.6 yet + +* Mon Nov 03 2008 Adam Tkac 32:9.5.1-0.8.4.b2 +- dig/host: use only IPv4 addresses when -4 option is specified (#469440) + +* Thu Oct 30 2008 Adam Tkac 32:9.5.1-0.8.2.b2 +- removed unneeded bind-9.4.1-ldap-api.patch + +* Thu Oct 30 2008 Adam Tkac 32:9.5.1-0.8.1.b2 +- ship dns/{s,}dlz.h and isc/radix.h in bind-devel + +* Tue Oct 07 2008 Adam Tkac 32:9.5.1-0.8.b2 +- removed bind-9.4.0-dnssec-directory.patch, it is wrong + +* Wed Sep 24 2008 Adam Tkac 32:9.5.1-0.7.b2 +- 9.5.1b2 release +- patches merged + - bind95-rh454783.patch + - bind-9.5-edns.patch + - bind95-rh450995.patch + - bind95-rh457175.patch + +* Wed Sep 17 2008 Adam Tkac 32:9.5.1-0.6.b1 +- IDN output strings didn't honour locale settings (#461409) + +* Tue Aug 05 2008 Adam Tkac 32:9.5.1-0.5.b1 +- disable transfer stats on DLZ zones (#454783) + +* Mon Aug 04 2008 Adam Tkac 32:9.5.1-0.4.b1 +- add forgotten patch for #457175 +- build with -O2 + +* Thu Jul 31 2008 Adam Tkac 32:9.5.1-0.3.b1 +- static libraries are no longer supported +- IP acls weren't merged correctly (#457175) +- use fPIE on sparcv9/sparc64 (Dennis Gilmore) +- add sparc64 to list of 64bit arches in spec (Dennis Gilmore) + +* Mon Jul 21 2008 Adam Tkac 32:9.5.1-0.2.b1 +- updated patches due new rpm (--fuzz=0 patch parameter) + +* Mon Jul 14 2008 Adam Tkac 32:9.5.1-0.1.1.b1 +- use %%patch0 for Patch0 (#455061) +- correct source address (#455118) + +* Tue Jul 08 2008 Adam Tkac 32:9.5.1-0.1.b1 +- 9.5.1b1 release (CVE-2008-1447) +- dropped bind-9.5-recv-race.patch because upstream doesn't want it + +* Mon Jun 30 2008 Adam Tkac 32:9.5.0-37.1 +- update default named.conf statements (#452708) + +* Thu Jun 26 2008 Adam Tkac 32:9.5.0-37 +- some compat changes to fix building on RHEL4 + +* Mon Jun 23 2008 Adam Tkac 32:9.5.0-36.3 +- fixed typo in %%posttrans script + +* Wed Jun 18 2008 Adam Tkac 32:9.5.0-36.2 +- parse inner acls correctly (#450995) + +* Mon Jun 02 2008 Adam Tkac 32:9.5.0-36.1 +- removed dns-keygen utility in favour of rndc-confgen -a (#449287) +- some minor sample fixes (#449274) + +* Thu May 29 2008 Adam Tkac 32:9.5.0-36 +- updated to 9.5.0 final +- use getifaddrs to find available interfaces + +* Mon May 26 2008 Adam Tkac 32:9.5.0-35.rc1 +- make /var/run/named writable by named (#448277) +- fixed one non-utf8 file + +* Thu May 22 2008 Adam Tkac 32:9.5.0-34.rc1 +- fixes needed to pass package review (#225614) + +* Wed May 21 2008 Adam Tkac 32:9.5.0-33.1.rc1 +- bind-chroot now depends on bind (#446477) + +* Wed May 14 2008 Adam Tkac 32:9.5.0-33.rc1 +- updated to 9.5.0rc1 +- merged patches + - bind-9.5-libcap.patch +- make binaries readable by others (#427826) + +* Tue May 13 2008 Adam Tkac 32:9.5.0-32.b3 +- reverted "any" patch, upstream says not needed +- log EDNS failure only when we really switch to plain EDNS (#275091) +- detect configuration file better + +* Tue May 06 2008 Adam Tkac 32:9.5.0-31.1.b3 +- addresses 0.0.0.0 and ::0 really match any (#275091, comment #28) + +* Mon May 05 2008 Adam Tkac 32:9.5.0-31.b3 +- readded bind-9.5-libcap.patch +- added bind-9.5-recv-race.patch from F8 branch (#400461) + +* Wed Apr 23 2008 Adam Tkac 32:9.5.0-30.1.b3 +- build Berkeley DB DLZ backend + +* Mon Apr 21 2008 Adam Tkac 32:9.5.0-30.b3 +- 9.5.0b3 release +- dropped patches (upstream) + - bind-9.5-transfer-segv.patch + - bind-9.5-mudflap.patch + - bind-9.5.0-generate-xml.patch + - bind-9.5-libcap.patch + +* Wed Apr 02 2008 Adam Tkac 32:9.5.0-29.3.b2 +- fixed named.conf.sample file (#437569) + +* Fri Mar 14 2008 Adam Tkac 32:9.5.0-29.2.b2 +- fixed URLs + +* Mon Feb 25 2008 Adam Tkac 32:9.5.0-29.1.b2 +- BuildRequires cleanup + +* Sun Feb 24 2008 Adam Tkac 32:9.5.0-29.b2 +- rebuild without mudflap (#434159) + +* Wed Feb 20 2008 Adam Tkac 32:9.5.0-28.b2 +- port named to use libcap library, enable threads (#433102) +- removed some unneeded Requires + +* Tue Feb 19 2008 Adam Tkac 32:9.5.0-27.b2 +- removed conditional build with libefence (use -fmudflapth instead) +- fixed building of DLZ stuff (#432497) +- do not build Berkeley DB DLZ backend +- temporary build with --disable-linux-caps and without threads (#433102) +- update named.ca file to affect IPv6 changes in root zone + +* Mon Feb 11 2008 Adam Tkac 32:9.5.0-26.b2 +- build with -D_GNU_SOURCE (#431734) +- improved fix for #253537, posttrans script is now used +- improved fix for #400461 +- 9.5.0b2 + - bind-9.3.2b1-PIE.patch replaced by bind-9.5-PIE.patch + - only named, named-sdb and lwresd are PIE + - bind-9.5-sdb.patch has been updated + - bind-9.5-libidn.patch has been updated + - bind-9.4.0-sdb-sqlite-bld.patch replaced by bind-9.5-sdb-sqlite-bld.patch + - removed bind-9.5-gssapi-header.patch (upstream) + - removed bind-9.5-CVE-2008-0122.patch (upstream) +- removed bind-9.2.2-nsl.patch +- improved sdb_tools Makefile.in + +* Mon Feb 04 2008 Adam Tkac 32:9.5.0-25.b1 +- fixed segfault during sending notifies (#400461) +- rebuild with gcc 4.3 series + +* Tue Jan 22 2008 Adam Tkac 32:9.5.0-24.b1 +- removed bind-9.3.2-prctl_set_dumpable.patch (upstream) +- allow parallel building of libdns library +- CVE-2008-0122 + +* Thu Dec 27 2007 Adam Tkac 32:9.5.0-23.b1 +- fixed initscript wait loop (#426382) +- removed dependency on policycoreutils and libselinux (#426515) + +* Thu Dec 20 2007 Adam Tkac 32:9.5.0-22.b1 +- fixed regression caused by libidn2 patch (#426348) + +* Wed Dec 19 2007 Adam Tkac 32:9.5.0-21.b1 +- fixed typo in post section (CVE-2007-6283) + +* Wed Dec 19 2007 Adam Tkac 32:9.5.0-20.b1 +- removed obsoleted triggers +- CVE-2007-6283 + +* Wed Dec 12 2007 Adam Tkac 32:9.5.0-19.2.b1 +- added dst/gssapi.h to -devel subpackage (#419091) +- improved fix for (#417431) + +* Mon Dec 10 2007 Adam Tkac 32:9.5.0-19.1.b1 +- fixed shutdown with initscript when rndc doesn't work (#417431) +- fixed IDN patch (#412241) + +* Thu Dec 06 2007 Adam Tkac 32:9.5.0-19.b1 +- 9.5.0b1 (#405281, #392491) + +* Thu Dec 06 2007 Release Engineering 32:9.5.0-18.6.a7 +- Rebuild for deps + +* Wed Dec 05 2007 Adam Tkac 32:9.5.0-18.5.a7 +- build with -O0 + +* Mon Dec 03 2007 Adam Tkac 32:9.5.0-18.4.a7 +- bind-9.5-random_ports.patch was removed because upstream doesn't + like it. query-source{,v6} options are sufficient (#391931) +- bind-chroot-admin called restorecon on /proc filesystem (#405281) + +* Mon Nov 26 2007 Adam Tkac 32:9.5.0-18.3.a7 +- removed edns patch to keep compatibility with vanilla bind + (#275091, comment #20) + +* Wed Nov 21 2007 Adam Tkac 32:9.5.0-18.2.a7 +- use system port selector instead ISC's (#391931) + +* Mon Nov 19 2007 Adam Tkac 32:9.5.0-18.a7 +- removed statement from initscript which passes -D to named + +* Thu Nov 15 2007 Adam Tkac 32:9.5.0-17.a7 +- 9.5.0a7 +- dropped patches (upstream) + - bind-9.5-update.patch + - bind-9.5-pool_badfree.patch + - bind-9.5-_res_errno.patch + +* Thu Nov 15 2007 Adam Tkac 32:9.5.0-16.5.a6 +- added bind-sdb again, contains SDB modules and DLZ modules +- bind-9.3.1rc1-sdb.patch replaced by bind-9.5-sdb.patch + +* Mon Nov 12 2007 Adam Tkac 32:9.5.0-16.4.a6 +- removed Requires: openldap, postgresql, mysql, db4, unixODBC +- new L.ROOT-SERVERS.NET address + +* Mon Oct 29 2007 Adam Tkac 32:9.5.0-16.3.a6 +- completely disable DBUS + +* Fri Oct 26 2007 Adam Tkac 32:9.5.0-16.2.a6 +- minor cleanup in bind-chroot-admin + +* Thu Oct 25 2007 Adam Tkac 32:9.5.0-16.1.a6 +- fixed typo in initscript + +* Tue Oct 23 2007 Adam Tkac 32:9.5.0-16.a6 +- disabled DBUS (dhcdbd doesn't exist & #339191) + +* Thu Oct 18 2007 Adam Tkac 32:9.5.0-15.1.a6 +- fixed missing va_end () functions (#336601) +- fixed memory leak when dbus initialization fails + +* Tue Oct 16 2007 Adam Tkac 32:9.5.0-15.a6 +- corrected named.5 SDB statement (#326051) + +* Mon Sep 24 2007 Adam Tkac 32:9.5.0-14.a6 +- added edns patch again (#275091) + +* Mon Sep 24 2007 Adam Tkac 32:9.5.0-13.a6 +- removed bind-9.3.3-edns.patch patch (see #275091 for reasons) + +* Thu Sep 20 2007 Adam Tkac 32:9.5.0-12.4.a6 +- build with O2 +- removed "autotools" patch +- bugfixing in bind-chroot-admin (#279901) + +* Thu Sep 06 2007 Adam Tkac 32:9.5.0-12.a6 +- bind-9.5-2119_revert.patch and bind-9.5-fix_h_errno.patch are + obsoleted by upstream bind-9.5-_res_errno.patch + +* Wed Sep 05 2007 Adam Tkac 32:9.5.0-11.9.a6 +- fixed wrong resolver's dispatch pool cleanup (#275011, patch from + tmraz redhat com) + +* Wed Sep 05 2007 Adam Tkac 32:9.5.0-11.3.a6 +- initscript failure message is now printed correctly (#277981, + Quentin Armitage (quentin armitage org uk) ) + +* Mon Sep 03 2007 Adam Tkac 32:9.5.0-11.2.a6 +- temporary revert ISC 2119 change and add "libbind-errno" patch + (#254501) again + +* Thu Aug 23 2007 Adam Tkac 32:9.5.0-11.1.a6 +- removed end dots from Summary sections (skasal@redhat.com) +- fixed wrong file creation by autotools patch (skasal@redhat.com) + +* Thu Aug 23 2007 Adam Tkac 32:9.5.0-11.a6 +- start using --disable-isc-spnego configure option + - remove bind-9.5-spnego-memory_management.patch (source isn't + compiled) + +* Wed Aug 22 2007 Adam Tkac 32:9.5.0-10.2.a6 +- added new initscript option KEYTAB_FILE which specified where + is located kerberos .keytab file for named service +- obsolete temporary bind-9.5-spnego-memory_management.patch by + bind-9.5-gssapictx-free.patch which conforms BIND coding standards + (#251853) + +* Tue Aug 21 2007 Adam Tkac 32:9.5.0-10.a6 +- dropped direct dependency to /etc/openldap/schema directory +- changed hardcoded paths to macros +- fired away code which configure LDAP server + +* Tue Aug 14 2007 Adam Tkac 32:9.5.0-9.1.a6 +- named could crash with SRV record UPDATE (#251336) + +* Mon Aug 13 2007 Adam Tkac 32:9.5.0-9.a6 +- disable 64bit dlz driver patch on alpha and ia64 (#251298) +- remove wrong malloc functions from lib/dns/spnego.c (#251853) + +* Mon Aug 06 2007 Adam Tkac 32:9.5.0-8.2.a6 +- changed licence from BSD-like to ISC + +* Tue Jul 31 2007 Adam Tkac 32:9.5.0-8.1.a6 +- disabled named on all runlevels by default + +* Mon Jul 30 2007 Adam Tkac 32:9.5.0-8.a6 +- minor next improvements on autotools patch +- dig and host utilities now using libidn instead idnkit for + IDN support + +* Wed Jul 25 2007 Warren Togami 32:9.5.0-7.a6 +- binutils/gcc bug rebuild (#249435) + +* Tue Jul 24 2007 Adam Tkac 32:9.5.0-6.a6 +- updated to 9.5.0a6 which contains fixes for CVE-2007-2925 and + CVE-2007-2926 +- fixed building on 64bits + +* Mon Jul 23 2007 Adam Tkac 31:9.5.0a5-5 +- integrated "autotools" patch for testing purposes (upstream will + accept it in future, for easier building) + +* Mon Jul 23 2007 Adam Tkac 31:9.5.0a5-4.1 +- fixed DLZ drivers building on 64bit systems + +* Fri Jul 20 2007 Adam Tkac 31:9.5.0a5-4 +- fixed relation between logrotated and chroot-ed named + +* Wed Jul 18 2007 Adam Tkac 31:9.5.0a5-3.9 +- removed bind-sdb package (default named has compiled SDB backend now) +- integrated DLZ (Dynamically loadable zones) drivers +- integrated GSS-TSIG support (RFC 3645) +- build with -O0 (many new features, potential core dumps will be more useful) + +* Tue Jul 17 2007 Adam Tkac 31:9.5.0a5-3.2 +- initscript should be ready for parallel booting (#246878) + +* Tue Jul 17 2007 Adam Tkac 31:9.5.0a5-3 +- handle integer overflow in isc_time_secondsastimet function gracefully (#247856) + +* Mon Jul 16 2007 Adam Tkac 31:9.5.0a5-2.2 +- moved chroot configfiles into chroot subpackage (#248306) + +* Mon Jul 02 2007 Adam Tkac 31:9.5.0a5-2 +- minor changes in default configuration +- fix h_errno assigment during resolver initialization (unbounded recursion, #245857) +- removed wrong patch to #150288 + +* Tue Jun 19 2007 Adam Tkac 31:9.5.0a5-1 +- updated to latest upstream + +* Wed Jun 13 2007 Adam Tkac 31:9.4.1-7 +- marked caching-nameserver as obsolete (#244604) +- fixed typo in initscript (causes that named doesn't detect NetworkManager + correctly) +- next cleanup in configuration - moved configfiles into config.tar +- removed delay between start & stop in restart function in named.init + +* Tue Jun 12 2007 Adam Tkac 31:9.4.1-6 +- major changes in initscript. Could be LSB compatible now +- removed caching-nameserver subpackage. Move configs from this + package to main bind package as default configuration and major + configuration cleanup + +* Mon Jun 04 2007 Adam Tkac 31:9.4.1-5 +- very minor compatibility change in bind-chroot-admin (line 215) +- enabled IDN support by default and don't distribute IDN libraries +- specfile cleanup +- add dynamic directory to /var/named. This directory will be primarily used for + dynamic DNS zones. ENABLE_ZONE_WRITE and SELinux's named_write_master_zones no longer exist + +* Thu May 24 2007 Adam Tkac 31:9.4.1-4 +- removed ldap-api patch and start using deprecated API +- fixed minor problem in bind-chroot-admin script (#241103) + +* Tue May 22 2007 Adam Tkac 31:9.4.1-3 +- fixed bind-chroot-admin dynamic DNS handling (#239149) +- updated zone-freeze patch to latest upstream +- ldap sdb has been rewriten to latest api (#239802) + +* Mon May 07 2007 Adam Tkac 31:9.4.1-2.fc7 +- test build on new build system + +* Wed May 02 2007 Adam Tkac 31:9.4.1-1.fc7 +- updated to 9.4.1 which contains fix to CVE-2007-2241 + +* Fri Apr 27 2007 Adam Tkac 31:9.4.0-8.fc7 +- improved "zone freeze patch" - if multiple zone with same name exists + no zone is freezed +- minor cleanup in caching-nameserver's config file +- fixed race-condition in dbus code (#235809) +- added forgotten restorecon statement in bind-chroot-admin + +* Tue Apr 17 2007 Adam Tkac 31:9.4.0-7.fc7 +- removed DEBUGINFO option because with this option (default) was bind + builded with -O0 and without this flag no debuginfo package was produced. + (I want faster bind => -O2 + debuginfo) +- fixed zone finding (#236426) + +* Mon Apr 16 2007 Adam Tkac 31:9.4.0-6.fc7 +- added idn support (still under development with upstream, disabled by default) + +* Wed Apr 11 2007 Adam Tkac 31:9.4.0-5.fc7 +- dnssec-signzone utility now doesn't ignore -d parameter + +* Tue Apr 10 2007 Adam Tkac 31:9.4.0-4.fc7 +- removed query-source[-v6] options from caching-nameserver config + (#209954, increase security) +- throw away idn. It won't be ready in fc7 + +* Tue Mar 13 2007 Adam Tkac 31:9.4.0-3.fc7 +- prepared bind to merge review +- added experimental idn support to bind-utils utils (not enabled by default yet) +- change chroot policy in caching-nameserver post section +- fixed bug in bind-chroot-admin - rootdir function is called properly now + +* Mon Mar 12 2007 Adam Tkac 31:9.4.0-2.fc7 +- added experimental SQLite support (written by John Boyd ) +- moved bind-chroot-admin script to chroot package +- bind-9.3.2-redhat_doc.patch is always applied (#231738) + +* Tue Mar 06 2007 Adam Tkac 31:9.4.0-1.fc7 +- updated to 9.4.0 +- bind-chroot-admin now sets EAs correctly (#213926) +- throw away next_server_on_referral and no_servfail_stops patches (fixed in 9.4.0) + +* Thu Feb 15 2007 Adam Tkac 31:9.3.4-7.fc7 +- minor cleanup in bind-chroot-admin script + +* Fri Feb 09 2007 Adam Tkac 31:9.3.4-6.fc7 +- fixed broken bind-chroot-admin script (#227995) + +* Wed Feb 07 2007 Adam Tkac 31:9.3.4-5.fc7 +- bind-chroot-admin now uses correct chroot path (#227600) + +* Mon Feb 05 2007 Adam Tkac 31:9.3.4-4.fc7 +- fixed conflict between bind-sdb and ldap +- removed duplicated bind directory in bind-libs + +* Thu Feb 01 2007 Adam Tkac 31:9.3.4-3.fc7 +- fixed building without libbind +- fixed post section (selinux commands is now in if-endif statement) +- prever macro has been removed from version + +* Mon Jan 29 2007 Adam Tkac 31:9.3.4-2.fc7 +- redirected output from bind-chroot prep and %%preun stages to /dev/null + +* Thu Jan 25 2007 Adam Tkac 31:9.3.4-1.fc7 +- updated to version 9.3.4 which contains security bugfixes + +* Tue Jan 23 2007 Adam Tkac 31:9.3.3-5.fc7 +- package bind-libbind-devel has been marked as obsolete + +* Mon Jan 22 2007 Adam Tkac 31:9.3.3-4.fc7 +- package bind-libbind-devel has beed removed (libs has been moved to bind-devel & bind-libs) +- Resolves: #214208 + +* Tue Jan 16 2007 Martin Stransky - 31:9.3.3-3 +- fixed a multi-lib issue +- Resolves: rhbz#222717 + +* Thu Jan 4 2007 Martin Stransky - 31:9.3.3-2 +- added namedGetForwarders written in shell (#176100), + created by Baris Cicek . + +* Sun Dec 10 2006 Martin Stransky - 31:9.3.3-1 +- update to 9.3.3 final +- fix for #219069: file included twice in src.rpm + +* Wed Dec 6 2006 Martin Stransky - 31:9.3.3-0.1.rc3 +- added back an interval to restart +- renamed package, it should meet the N-V-R criteria +- fix for #216185: bind-chroot-admin able to change root mode 750 +- added fix from #215997: incorrect permissions on dnszone.schema +- added a notice to init script when /etc/named.conf doesn't exist (#216075) + +* Mon Oct 30 2006 Martin Stransky - 30:9.3.3-6 +- fix for #200465: named-checkzone and co. cannot be run as non-root user +- fix for #212348: chroot'd named causes df permission denied error +- fix for #211249, #211083 - problems with stopping named +- fix for #212549: init script does not unmount /proc filesystem +- fix for #211282: EDNS is globally enabled, crashing CheckPoint FW-1, + added edns-enable options to named configuration file which can suppress + EDNS in queries to DNS servers (see /usr/share/doc/bind-9.3.3/misc/options) +- fix for #212961: bind-chroot doesn't clean up its mess on %%preun +- update to 9.3.3rc3, removed already merged patches + +* Fri Oct 13 2006 Martin Stransky - 30:9.3.3-5 +- fix for #209359: bind-libs from compatlayer CD will not + install on ia64 + +* Tue Oct 10 2006 Martin Stransky - 30:9.3.3-4 +- added fix for #210096: warning: group named does not exist - using root + +* Thu Oct 5 2006 Martin Stransky - 30:9.3.3-3 +- added fix from #209400 - Bind Init Script does not create + the PID file always, created by Jeff Means +- added timeout to stop section of init script. + The default is 100 sec. and can be adjusted by NAMED_SHUTDOWN_TIMEOUT + shell variable. + +* Mon Oct 2 2006 Martin Stransky - 30:9.3.3-2 +- removed chcon from %%post script, replaced by restorecon + (Bug 202547, comment no. 37) + +* Fri Sep 15 2006 Martin Stransky - 30:9.3.3-1 +- updated to the latest upstream (9.3.3rc2) + +* Wed Sep 6 2006 Martin Stransky - 30:9.3.2-41 +- added upstream patch for correct SIG handling - CVE-2006-4095 + +* Tue Sep 5 2006 Martin Stransky - 30:9.3.2-40 +- suppressed messages from bind-chroot-admin +- cleared notes about bind-config + +* Tue Aug 22 2006 Martin Stransky - 30:9.3.2-39 +- added fix for #203522 - "bind-chroot-admin -e" command fails + +* Mon Aug 21 2006 Martin Stransky - 30:9.3.2-38 +- fix for #203194 - tmpfile usage + +* Thu Aug 17 2006 Martin Stransky - 30:9.3.2-37 +- fix for #202542 - /usr/sbin/bind-chroot-admin: No such file or directory +- fix for #202547 - file_contexts: invalid context + +* Fri Aug 11 2006 Martin Stransky - 30:9.3.2-36 +- added Provides: bind-config + +* Fri Aug 11 2006 Martin Stransky - 30:9.3.2-35 +- fix bug 197493: renaming subpackage bind-config to caching-nameserver + +* Mon Jul 24 2006 Jason Vas Dias - 30:9.3.2-34 +- fix bug 199876: make '%%exclude libbbind.*' conditional on %%{LIBBIND} + +* Mon Jul 24 2006 Florian La Roche - 30:9.3.2-33 +- fix #195881, perms are not packaged correctly + +* Fri Jul 21 2006 Jason Vas Dias - 30:9.3.2-32 +- fix addenda to bug 189789: + determination of selinux enabled was still not 100% correct in bind-chroot-admin +- fix addenda to bug 196398: + make named.init test for NetworkManager being enabled AFTER testing for -D absence; + named.init now supports a 'DISABLE_NAMED_DBUS' /etc/sysconfig/named setting to disable + auto-enable of named dbus support if NetworkManager enabled. + +* Wed Jul 19 2006 Jason Vas Dias - 30:9.3.2-30 +- fix bug 196398 - Enable -D option automatically in initscript + if NetworkManager enabled in any runlevel. +- fix namedGetForwarders for new dbus +- fix bug 195881 - libbind.so should be owned by bind-libbind-devel + +* Wed Jul 19 2006 Matthias Clasen - 30:9.3.2-28.FC6 +- Rebuild against new dbus + +* Wed Jul 12 2006 Jason Vas Dias - 30:9.3.2-27.FC6 +- rebuild with fixed glibc-kernheaders + +* Wed Jul 12 2006 Jesse Keating - 30:9.3.2-26.FC6.1 +- rebuild + +* Wed Jun 14 2006 Jason Vas Dias - 30:9.3.2-26.FC6 +- fix bugs 191093, 189789 +- backport selected fixes from upstream bind9 'v9_3_3b1' CVS version: + ( see http://www.isc.org/sw/bind9.3.php "Fixes" ): + o change 2024 / bug 16027: + named emitted spurious "zone serial unchanged" messages on reload + o change 2013 / bug 15941: + handle unexpected TSIGs on unsigned AXFR/IXFR responses more gracefully + o change 2009 / bug 15808: coverity fixes + o change 1997 / bug 15818: + named was failing to replace negative cache entries when a positive one + for the type was learnt + o change 1994 / bug 15694: OpenSSL 0.9.8 support + o change 1991 / bug 15813: + The configuration data, once read, should be treated as readonly. + o misc. validator fixes + o misc. resolver fixes + o misc. dns fixes + o misc. isc fixes + o misc. libbind fixes + o misc. isccfg fix + o misc. lwres fix + o misc. named fixes + o misc. dig fixes + o misc. nsupdate fix + o misc. tests fixes + +* Wed Jun 7 2006 Jeremy Katz - 30:9.3.2-24.FC6 +- and actually put the devel symlinks in the right subpackage + +* Thu May 25 2006 Jeremy Katz - 30:9.3.2-23.FC6 +- rebuild for -devel deps + +* Tue Apr 18 2006 Jason Vas Dias - 30:9.3.2-22 +- apply upstream patch for ncache_adderesult segfault bug 173961 addenda +- fix bug 188382: rpm --verify permissions inconsistencies +- fix bug 189186: use /sbin/service instead of initscript +- rebuild for new gcc, glibc-kernheaders + +* Tue Apr 04 2006 Jason Vas Dias - 30:9.3.2-20 +- fix resolver.c ncache_adderesult segfault reported in addenda to bug 173961 + (upstream bugs #15642, #15528 ?) +- allow named ability to generate core dumps after setuid (upstream bug #15753) + +* Mon Apr 03 2006 Jason Vas Dias - 30:9.3.2-18 +- fix bug 187529: make bind-chroot-admin deal with subdirectories properly + +* Thu Mar 30 2006 Jason Vas Dias - 30:9.3.2-16 +- fix bug 187286: + prevent host(1) printing duplicate 'is an alias for' messages + for the default AAAA and MX lookups as well as for the A lookup + (it now uses the CNAME returned for the A lookup for the AAAA and MX lookups). + This is upstream bug #15702 fixed in the unreleased bind-9.3.3 +- fix bug 187333: fix SOURCE24 and SOURCE25 transposition + +* Wed Mar 29 2006 Jason Vas Dias - 30:9.3.2-14 +- fix bug 186577: remove -L/usr/lib from libbind.pc and more .spec file cleanup +- add '%%doc' sample configuration files in /usr/share/doc/bind*/sample +- rebuild with new gcc and glibc + +* Wed Mar 22 2006 Jason Vas Dias - 30:9.3.2-12 +- fix typo in initscript +- fix Requires(post): policycoreutils in sub-packages + +* Mon Mar 20 2006 Jason Vas Dias - 30.9.3.2-10 +- fix bug 185969: more .spec file cleanup + +* Wed Mar 08 2006 Jason Vas Dias - 30.9.3.2-8 +- Do not allow package to be installed if named:25 userid creation fails +- Give libbind a pkg-config file +- remove restorecon from bind-chroot-admin (not required). +- fix named.caching-nameserver.conf (listen-on-v6 port 53 { ::1 };) + +* Tue Mar 07 2006 Jason Vas Dias - 30:9.3.2-7 +- fix issues with bind-chroot-admin + +* Mon Mar 06 2006 Jason Vas Dias - 30:9.3.2-6 +- replace caching-nameserver with bind-config sub-package +- fix bug 177595: handle case where $ROOTDIR is a link in initscript +- fix bug 177001: bind-config creates symlinks OK now +- fix bug 176388: named.conf is now never replaced by any RPM +- fix bug 176248: remove unecessary creation of rpmsave links +- fix bug 174925: no replacement of named.conf +- fix bug 173963: existing named.conf never modified +- major .spec file cleanup + +* Fri Feb 10 2006 Jesse Keating - 30:9.3.2-4.1 +- bump again for double-long bug on ppc(64) + +* Tue Feb 07 2006 Jason Vas Dias - 30:9.3.2-4 +- regenerate redhat_doc patch for non-DBUS builds +- allow dbus builds to work with dbus version < 0.6 (bz #179816) + +* Tue Feb 07 2006 Florian La Roche 30:9.3.2-3 +- try supporting without dbus support + +* Mon Feb 06 2006 Jason Vas Dias - 30:9.3.2-2.1 +- Rebuild for new gcc, glibc, glibc-kernheaders + +* Mon Jan 16 2006 Jason Vas Dias - 30:9.3.2-2 +- fix bug 177854: temporary fix for broken kernel-2.6.15-1854+ + /proc/net/if_inet6 format + +* Wed Dec 21 2005 Jason Vas Dias - 30:9.3.2-1 +- Upgrade to 9.3.2, released today + +* Tue Dec 20 2005 Jason Vas Dias - 28:9.3.2rc1-2 +- fix bug 176100: do not Require: perl just for namedGetForwarders ! + +* Fri Dec 09 2005 Jesse Keating +- rebuilt + +* Fri Dec 02 2005 Jason Vas Dias - 28:9.3.2rc-1 +- Upgrade to upstream version 9.3.2rc1 +- fix namedSetForwarders -> namedGetForwarders SOURCE14 typo + +* Thu Dec 01 2005 Jason Vas Dias - 24:9.3.1-26 +- rebuild for new dbus 0.6 dependency; remove use of + DBUS_NAME_FLAG_PROHIBIT_REPLACEMENT + +* Wed Nov 23 2005 Jason Vas Dias - 24:9.3.1-24 +- allow D-BUS support to work in bind-chroot environment: + workaround latest selinux policy by mounting /var/run/dbus/ + under chroot instead of /var/run/dbus/system-bus-socket + +* Sun Nov 13 2005 Jason Vas Dias - 24:9.3.1-22 +- fix bug 172632 - remove .la files +- ship namedGetForwarders and namedSetForwarders scripts +- fix detection of -D option in chroot + +* Tue Nov 8 2005 Tomas Mraz - 24:9.3.1-21 +- rebuilt with new openssl + +* Wed Oct 19 2005 Jason Vas Dias - 24.9.3.1-20 +- Allow the -D enable D-BUS option to be used within bind-chroot . +- fix bug 171226: supply some documentation for pgsql SDB . + +* Thu Oct 06 2005 Jason Vas Dias - 24:9.3.1-18 +- fix bug 169969: do NOT call dbus_svc_dispatch() in dbus_mgr_init_dbus() - + task->state != task_ready and will cause Abort in task.c if process + is waiting for NameOwnerChanged to do a SetForwarders + +* Wed Oct 05 2005 Jason Vas Dias - 24:9.3.1-16 +- Fix reconnecting to dbus-daemon after it stops & restarts . + +* Tue Sep 27 2005 Jason Vas Dias - 24:9.3.1-14 +- When forwarder nameservers are changed with D-BUS, flush the cache. + +* Mon Sep 26 2005 Jason Vas Dias - 24:9.3.1-12 +- fix bug 168302: use %%{__cc} for compiling dns-keygen +- fix bug 167682: bind-chroot directory permissions +- fix issues with -D dbus option when dbus service not running or disabled + +* Tue Aug 30 2005 Jason Vas Dias - 24:9.3.1-12 +- fix bug 167062: named should be started after syslogd by default + +* Mon Aug 22 2005 Jason Vas Dias - 24:9.3.1-11 +- fix bug 166227: host: don't do default AAAA and MX lookups with '-t a' option + +* Tue Aug 16 2005 Jason Vas Dias - 24:9.3.1-10 +- Build with D-BUS patch by default; D-BUS support enabled with named -D option +- Enable D-BUS for named_sdb also +- fix sdb pgsql's zonetodb.c: must use isc_hash_create() before dns_db_create() +- update fix for bug 160914 : test for RD=1 and ARCOUNT=0 also before trying next server +- fix named.init script to handle named_sdb properly +- fix named.init script checkconfig() to handle named '-c' option + and make configtest, test, check configcheck synonyms + +* Tue Jul 19 2005 Jason Vas Dias - 24:9.3.1-8 +- fix named.init script bugs 163598, 163409, 151852(addendum) + +* Tue Jul 12 2005 Jason Vas Dias - 24:9.3.1-7 +- fix bug 160914: resolver utilities should try next server on empty referral + (now that glibc bug 162625 is fixed) + host and nslookup now by default try next server on SERVFAIL + (host now has '-s' option to disable, and nslookup given + '[no]fail' option similar to dig's [no]fail option). +- rebuild and re-test with new glibc & gcc (all tests passed). + +* Tue May 31 2005 Jason Vas Dias - 24:9.3.1-6 +- fix bug 157950: dig / host / nslookup should reject invalid resolv.conf + files and not use uninitialized garbage nameserver values + (ISC bug 14841 raised). + +* Mon May 23 2005 Jason Vas Dias - 24:9.3.1-4_FC4 +- Fix SDB LDAP + +* Mon May 16 2005 Jason Vas Dias - 24:9.3.1-4 +- Fix bug 157601: give named.init a configtest function +- Fix bug 156797: named.init should check SELinux booleans.local before booleans +- Fix bug 154335: if no controls in named.conf, stop named with -TERM sig, not rndc +- Fix bug 155848: add NOTES section to named.8 man-page with info on all Red Hat + BIND quirks and SELinux DDNS / slave zone file configuration +- D-BUS patches NOT applied until dhcdbd is in FC + +* Sun May 15 2005 Jason Vas Dias - 24:9.3.1-4_dbus +- Enhancement to allow dynamic forwarder table management and +- DHCP forwarder auto-configuration with D-BUS + +* Thu Apr 14 2005 Jason Vas Dias - 24:9.3.1-2_FC4 +- Rebuild for bind-sdb libpq.so.3 dependency +- fix bug 150981: don't install libbind man-pages if no libbind +- fix bug 151852: mount proc on $ROOTDIR/proc to allow sysconf(...) + to work and correct number of CPUs to be determined + +* Fri Mar 11 2005 Jason Vas Dias - 24:9.3.1-1_FC4 +- Upgrade to ISC BIND 9.3.1 (final release) released today. + +* Wed Mar 9 2005 Jason Vas Dias - 22.9.3.1rc1-5 +- fix bug 150288: h_errno not being accessed / set correctly in libbind +- add libbind man-pages from bind-8.4.6 + +* Mon Mar 7 2005 Jason Vas Dias - 22:9.3.1rc1-4 +- Rebuild with gcc4 / glibc-2.3.4-14. + +* Tue Mar 1 2005 Nalin Dahyabhai - 22:9.3.1rc1-3 +- configure with --with-pic to get PIC libraries + +* Sun Feb 20 2005 Jason Vas Dias - 22:9.3.1rc1-2 +- fix bug 149183: don't use getifaddrs() . + +* Wed Feb 16 2005 Jason Vas Dias - 22:9.3.1rc1-1 +- Upgrade to 9.3.1rc1 +- Add Simplified Database Backend (SDB) sub-package ( bind-sdb ) +- add named_sdb - ldap + pgsql + dir database backend support with +- 'ENABLE_SDB' named.sysconfig option +- Add BIND resolver library & includes sub-package ( libbind-devel) +- fix bug 147824 / 147073 / 145664: ENABLE_ZONE_WRITE in named.init +- fix bug 146084 : shutup restorecon + +* Tue Jan 11 2005 Jason Vas Dias - 22:9.3.0-2 +- Fix bug 143438: named.init will now make correct ownership of $ROOTDIR/var/named +- based on 'named_write_master_zones' SELinux boolean. +- Fix bug 143744: dig & nsupdate IPv6 timeout (dup of 140528) + +* Mon Nov 29 2004 Jason Vas Dias - 9.3.0-1 +- Upgrade BIND to 9.3.0 in Rawhide / FC4 (bugs 134529, 133654...) + +* Mon Nov 29 2004 Jason Vas Dias - 20:9.2.4-4 +- Fix bugs 140528 and 141113: +- 2 second timeouts when IPv6 not configured and root nameserver's +- AAAA addresses are queried + +* Mon Oct 18 2004 Jason Vas Dias - 20:9.2.4-2 +- Fix bug 136243: bind-chroot %%post must run restorecon -R %%{prefix} +- Fix bug 135175: named.init must return non-zero if named is not run +- Fix bug 134060: bind-chroot %%post must use mktemp, not /tmp/named +- Fix bug 133423: bind-chroot %%files entries should have been %%dirs + +* Thu Sep 23 2004 Jason Vas Dias - 20:9.2.4-1 +- BIND 9.2.4 (final release) released - source code actually +- identical to 9.2.4rc8, with only version number change. + +* Mon Sep 20 2004 Jason Vas Dias - 10:9.2.4rc8-14 +- Upgrade to upstream bind-9.2.4rc8 . +- Progress: Finally! Hooray! ISC bind now distributes: +- o named.conf(5) and nslookup(8) manpages +- 'bind-manpages.bz2' source can now disappear +- (could this have something to do with ISC bug I raised about this?) +- o 'deprecation_msg' global has vanished +- bind-9.2.3rc3-deprecation_msg_shut_up.diff.bz2 can disappear + +* Mon Sep 20 2004 Jason Vas Dias - 10:9.2.4rc8-14 +- Fix bug 106572/132385: copy /etc/localtime to chroot on start + +* Fri Sep 10 2004 Jason Vas Dias - 10:9.2.4rc7-12_EL3 +- Fix bug 132303: if ROOTDIR line was replaced after upgrade from +- bind-chroot-9.2.2-21, restart named + +* Wed Sep 8 2004 Jason Vas Dias - 10:9.2.4rc7-11_EL3 +- Fix bug 131803: replace ROOTDIR line removed by broken +- bind-chroot 9.2.2-21's '%%postun'; added %%triggerpostun for bind-chroot + +* Tue Sep 7 2004 Jason Vas Dias - 10:9.2.4rc7-10_EL3 +- Fix bugs 130121 & 130981 for RHEL-3 + +* Mon Aug 30 2004 Jason Vas Dias - 10:9.2.4rc7-10 +- Fix bug 130121: add '%%ghost' entries for files included in previous +- bind-chroot & not in current - ie. named.conf, rndc.key, dev/* - +- that RPM removed after upgrade . + +* Thu Aug 26 2004 Jason Vas Dias +- Fix bug 130981: add '-t' option to named-checkconf invocation in +- named.init if chroot installed. + +* Wed Aug 25 2004 Jason Vas Dias +- Remove resolver(5) manpage now in man-pages (bug 130792); +- Don't create /dev/ entries in bind-chroot if already there (bug 127556); +- fix bind-devel Requires (bug 130919) +- Set default location for dumpdb & stats files to /var/named/data + +* Tue Aug 24 2004 Jason Vas Dias +- Fix devel Requires for bug 130738 & fix version + +* Tue Aug 24 2004 Jason Vas Dias +- Fix errors on clean install if named group does not exist +- (bug 130777) + +* Thu Aug 19 2004 Jason Vas Dias +- Upgrade to bind-9.2.4rc7; applied initscript fix +- for bug 102035. + +* Mon Aug 9 2004 Jason Vas Dias +- Fixed bug 129289: bind-chroot install / deinstall +- on install, existing config files 'safe_replace'd +- with links to chroot copies; on uninstall, moved back. + +* Fri Aug 6 2004 Jason Vas Dias +- Fixed bug 129258: "${prefix}/var/tmp" typo in spec + +* Wed Jul 28 2004 Jason Vas Dias +- Fixed bug 127124 : 'Requires: kernel >= 2.4' +- causes problems with Linux VServers + +* Tue Jul 27 2004 Jason Vas Dias +- Fixed bug 127555 : chroot tar missing var/named/slaves + +* Fri Jul 16 2004 Jason Vas Dias +- Upgraded to ISC version 9.2.4rc6 + +* Fri Jul 16 2004 Jason Vas Dias +- Fixed named.init generation of error messages on +- 'service named stop' and 'service named reload' +- as per bug 127775 + +* Wed Jun 23 2004 Daniel Walsh 9.2.3-19 +- Bump for rhel 3.0 U3 + +* Wed Jun 23 2004 Daniel Walsh 9.2.3-18 +- remove disable-linux-caps + +* Wed Jun 16 2004 Daniel Walsh 9.2.3-17 +- Update RHEL3 to latest bind + +* Tue Jun 15 2004 Elliot Lee +- rebuilt + +* Tue Jun 8 2004 Daniel Walsh 9.2.3-15 +- Remove device files from chroot, Named uses the system one + +* Fri Mar 26 2004 Daniel Walsh 9.2.3-14 +- Move RFC to devel package + +* Fri Mar 26 2004 Daniel Walsh 9.2.3-13 +- Fix location of restorecon + +* Thu Mar 25 2004 Daniel Walsh 9.2.3-12 +- Tighten security on config files. Should be owned by root + +* Thu Mar 25 2004 Daniel Walsh 9.2.3-11 +- Update key patch to include conf-keygen + +* Tue Mar 23 2004 Daniel Walsh 9.2.3-10 +- fix chroot to only happen once. +- fix init script to do kill insteall of killall + +* Mon Mar 15 2004 Daniel Walsh 9.2.3-9 +- Add fix for SELinux security context + +* Tue Mar 02 2004 Elliot Lee +- rebuilt + +* Sat Feb 28 2004 Florian La Roche +- run ldconfig for libs subrpm + +* Mon Feb 23 2004 Tim Waugh +- Use ':' instead of '.' as separator for chown. + +* Tue Feb 17 2004 Daniel Walsh 9.2.3-7 +- Add COPYRIGHT + +* Fri Feb 13 2004 Elliot Lee +- rebuilt + +* Tue Dec 30 2003 Daniel Walsh 9.2.3-5 +- Add defattr to libs + +* Mon Dec 29 2003 Daniel Walsh 9.2.3-4 +- Break out library package + +* Mon Dec 22 2003 Daniel Walsh 9.2.3-3 +- Fix condrestart + +* Wed Nov 12 2003 Daniel Walsh 9.2.3-2 +- Move libisc and libdns to bind from bind-util + +* Tue Nov 11 2003 Daniel Walsh 9.2.3-1 +- Move to 9.2.3 + +* Mon Oct 27 2003 Daniel Walsh 9.2.2.P3-10 +- Add PIE support + +* Fri Oct 17 2003 Daniel Walsh 9.2.2.P3-9 +- Add /var/named/slaves directory + +* Sun Oct 12 2003 Florian La Roche +- do not link against libnsl, not needed for Linux + +* Wed Oct 8 2003 Daniel Walsh 9.2.2.P3-6 +- Fix local time in log file + +* Tue Oct 7 2003 Daniel Walsh 9.2.2.P3-5 +- Try again + +* Mon Oct 6 2003 Daniel Walsh 9.2.2.P3-4 +- Fix handling of chroot -/dev/random + +* Thu Oct 2 2003 Daniel Walsh 9.2.2.P3-3 +- Stop hammering stuff on update of chroot environment + +* Mon Sep 29 2003 Daniel Walsh 9.2.2.P3-2 +- Fix chroot directory to grab all subdirectories + +* Wed Sep 24 2003 Daniel Walsh 9.2.2.P3-1 +- New patch to support for "delegation-only" + +* Wed Sep 17 2003 Daniel Walsh 9.2.2-23 +- patch support for "delegation-only" + +* Wed Jul 30 2003 Daniel Walsh 9.2.2-22 +- Update to build on RHL + +* Wed Jul 30 2003 Daniel Walsh 9.2.2-21 +- Install libraries as exec so debug info will be pulled + +* Sat Jul 19 2003 Daniel Walsh 9.2.2-20 +- Remove BSDCOMPAT (BZ 99454) + +* Tue Jul 15 2003 Daniel Walsh 9.2.2-19 +- Update to build on RHL + +* Tue Jul 15 2003 Daniel Walsh 9.2.2-18 +- Change protections on /var/named and /var/chroot/named + +* Tue Jun 17 2003 Daniel Walsh 9.2.2-17 +- Update to build on RHL + +* Tue Jun 17 2003 Daniel Walsh 9.2.2-16 +- Update to build on RHEL + +* Wed Jun 04 2003 Elliot Lee +- rebuilt + +* Tue Apr 22 2003 Daniel Walsh 9.2.2-14 +- Update to build on RHEL + +* Tue Apr 22 2003 Daniel Walsh 9.2.2-13 +- Fix config description of named.conf in chroot +- Change named.init script to check for existence of /etc/sysconfig/network + +* Fri Apr 18 2003 Daniel Walsh 9.2.2-12 +- Update to build on RHEL + +* Fri Apr 18 2003 Daniel Walsh 9.2.2-11 +- Update to build on RHEL + +* Fri Apr 18 2003 Daniel Walsh 9.2.2-10 +- Fix echo OK on starting/stopping service + +* Fri Mar 28 2003 Daniel Walsh 9.2.2-9 +- Update to build on RHEL + +* Fri Mar 28 2003 Daniel Walsh 9.2.2-8 +- Fix echo on startup + +* Tue Mar 25 2003 Daniel Walsh 9.2.2-7 +- Fix problems with chroot environment +- Eliminate posix threads + +* Mon Mar 24 2003 Daniel Walsh 9.2.2-6 +- Fix build problems + +* Fri Mar 14 2003 Daniel Walsh 9.2.2-5 +- Fix build on beehive + +* Thu Mar 13 2003 Daniel Walsh 9.2.2-4 +- build bind-chroot kit + +* Tue Mar 11 2003 Daniel Walsh 9.2.2-3 +- Change configure to use proper threads model + +* Fri Mar 7 2003 Daniel Walsh 9.2.2-2 +- update to 9.2.2 + +* Tue Mar 4 2003 Daniel Walsh 9.2.2-1 +- update to 9.2.2 + +* Fri Jan 24 2003 Daniel Walsh 9.2.1-16 +- Put a sleep in restart to make sure stop completes + +* Wed Jan 22 2003 Tim Powers +- rebuilt + +* Tue Jan 7 2003 Daniel Walsh 9.2.1-14 +- Separate /etc/rndc.key to separate file + +* Tue Jan 7 2003 Nalin Dahyabhai 9.2.1-13 +- Use openssl's pkgconfig data, if available, at build-time. + +* Mon Jan 6 2003 Daniel Walsh 9.2.1-12 +- Fix log rotate to use service named reload +- Change service named reload to give success/failure message [73770] +- Fix File checking [75710] +- Begin change to automatically run in CHROOT environment + +* Tue Dec 24 2002 Daniel Walsh 9.2.1-10 +- Fix startup script to work like all others. + +* Mon Dec 16 2002 Daniel Walsh 9.2.1-9 +- Fix configure to build on x86_64 platforms + +* Wed Aug 07 2002 Karsten Hopp +- fix #70583, doesn't build on IA64 + +* Tue Jul 30 2002 Karsten Hopp 9.2.1-8 +- bind-utils shouldn't require bind + +* Mon Jul 22 2002 Karsten Hopp 9.2.1-7 +- fix name of pidfine in logrotate script (#68842) +- fix owner of logfile in logrotate script (#41391) +- fix nslookup and named.conf man pages (output on stderr) + (#63553, #63560, #63561, #54889, #57457) +- add rfc1912 (#50005) +- gzip all rfc's +- fix typo in keygen.c (#54870) +- added missing manpages (#64065) +- shutdown named properly with rndc stop (#62492) +- /sbin/nologin instead of /bin/false (#68607) +- move nsupdate to bind-utils (where the manpage already was) (#66209, #66381) +- don't kill initscript when rndc fails (reload) (#58750) + + +* Mon Jun 24 2002 Bernhard Rosenkraenzer 9.2.1-5 +- Fix #65975 + +* Fri Jun 21 2002 Tim Powers +- automated rebuild + +* Thu May 23 2002 Tim Powers +- automated rebuild + +* Thu May 9 2002 Bernhard Rosenkraenzer 9.2.1-2 +- Move libisccc, lib isccfg and liblwres from bind-utils to bind, + they're not required if you aren't running a nameserver. + +* Fri May 03 2002 Florian La Roche +- update to 9.2.1 release + +* Thu Mar 14 2002 Bernhard Rosenkraenzer 9.2.0-8 +- Merge 30+ bug fixes from 9.2.1rc1 code + +* Mon Mar 11 2002 Bernhard Rosenkraenzer 9.2.0-7 +- Don't exit if /etc/named.conf doesn't exist if we're running + chroot (#60868) +- Revert Elliot's changes, we do require specific glibc/glibc-kernheaders + versions or bug #58335 will be back. "It compiles, therefore it works" + isn't always true. + +* Thu Feb 28 2002 Elliot Lee 9.2.0-6 +- Fix BuildRequires (we don't need specific glibc/glibc-kernheaders +versions). +- Use _smp_mflags + +* Wed Feb 20 2002 Bernhard Rosenkraenzer 9.2.0-4 +- rebuild, require recent autoconf, automake (#58335) + +* Fri Jan 25 2002 Tim Powers +- rebuild against new libssl + +* Wed Jan 09 2002 Tim Powers +- automated rebuild + +* Tue Nov 27 2001 Bernhard Rosenkraenzer 9.2.0-1 +- 9.2.0 + +* Thu Nov 22 2001 Bernhard Rosenkraenzer 9.2.0-0.rc10.2 +- 9.2.0rc10 + +* Mon Nov 5 2001 Bernhard Rosenkraenzer 9.2.0-0.rc8.2 +- Fix up rndc.conf (#55574) + +* Thu Oct 25 2001 Bernhard Rosenkraenzer 9.2.0-0.rc8.1 +- rc8 +- Enforce --enable-threads + +* Mon Oct 22 2001 Bernhard Rosenkraenzer 9.2.0-0.rc7.1 +- 9.2.0rc7 +- Use rndc status for "service named status", it's supposed to actually + work in 9.2.x. + +* Wed Oct 3 2001 Bernhard Rosenkraenzer 9.2.0-0.rc5.1 +- 9.2.0rc5 +- Fix rpm --rebuild with ancient libtool versions (#53938, #54257) + +* Tue Sep 25 2001 Bernhard Rosenkraenzer 9.2.0-0.rc4.1 +- 9.2.0rc4 + +* Fri Sep 14 2001 Bernhard Rosenkraenzer 9.2.0-0.rc3.1 +- 9.2.0rc3 +- remove ttl patch, I don't think we need this for 8.0. +- remove dig.1.bz2 from the bind8-manpages tar file, 9.2 has a new dig man page +- add lwres* man pages to -devel + +* Mon Sep 3 2001 Bernhard Rosenkraenzer 9.1.3-4 +- Make sure /etc/rndc.conf isn't world-readable even after the + %%post script inserted a random key (#53009) + +* Thu Jul 19 2001 Bernhard Rosenkraenzer 9.1.3-3 +- Add build dependencies (#49368) +- Make sure running service named start several times doesn't create + useless processes (#47596) +- Work around the named parent process returning 0 even if the config + file is broken (it's parsed later by the child processes) (#45484) + +* Mon Jul 16 2001 Bernhard Rosenkraenzer 9.1.3-2 +- Don't use rndc status, it's not yet implemented (#48839) + +* Sun Jul 08 2001 Florian La Roche +- update to 9.1.3 release + +* Tue Jul 3 2001 Bernhard Rosenkraenzer 9.1.3-0.rc3.1 +- Fix up rndc configuration and improve security (#46586) + +* Tue Jun 26 2001 Bernhard Rosenkraenzer 9.1.3-0.rc2.2 +- Sync with caching-nameserver-7.1-6 + +* Mon Jun 25 2001 Bernhard Rosenkraenzer 9.1.3-0.rc2.1 +- Update to rc2 + +* Fri Jun 1 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.3 +- Remove resolv.conf(5) man page, it's now in man-pages + +* Thu May 31 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.2 +- Add named.conf man page from bind 8.x (outdated, but better than nothing, + #42732) +- Rename the rndc key (#42895) +- Add dnssec* man pages + +* Mon May 28 2001 Bernhard Rosenkraenzer 9.1.3-0.rc1.1 +- 9.1.3rc1 +- s/Copyright/License/ + +* Mon May 7 2001 Bernhard Rosenkraenzer 9.1.2-1 +- 9.1.2 final. No changes between 9.1.2-0.rc1.1 and this one, except for + the version number, though. + +* Thu May 3 2001 Bernhard Rosenkraenzer 9.1.2-0.rc1.1 +- 9.1.2rc1 + +* Thu Mar 29 2001 Bernhard Rosenkraenzer 9.1.1-1 +- 9.1.1 + +* Thu Mar 15 2001 Bernhard Rosenkraenzer 9.1.0-10 +- Merge fixes from 9.1.1rc5 + +* Sun Mar 11 2001 Bernhard Rosenkraenzer 9.1.0-9 +- Work around bind 8 -> bind 9 migration problem when using buggy zone files: + accept zones without a TTL, but spew out a big fat warning. (#31393) + +* Thu Mar 8 2001 Bernhard Rosenkraenzer +- Add fixes from rc4 + +* Fri Mar 2 2001 Nalin Dahyabhai +- rebuild in new environment + +* Thu Mar 1 2001 Bernhard Rosenkraenzer +- killall -HUP named if rndc reload fails (#30113) + +* Tue Feb 27 2001 Bernhard Rosenkraenzer +- Merge some fixes from 9.1.1rc3 + +* Tue Feb 20 2001 Bernhard Rosenkraenzer +- Don't use the standard rndc key from the documentation, instead, create a random one + at installation time (#26358) +- Make /etc/rndc.conf readable by user named only, it contains secret keys + +* Tue Feb 20 2001 Bernhard Rosenkraenzer +- 9.1.1 probably won't be out in time, revert to 9.1.0 and apply fixes + from 9.1.1rc2 +- bind requires bind-utils (#28317) + +* Tue Feb 13 2001 Bernhard Rosenkraenzer +- Update to rc2, fixes 2 more bugs +- Fix build with glibc >= 2.2.1-7 + +* Thu Feb 8 2001 Bernhard Rosenkraenzer +- Update to 9.1.1rc1; fixes 17 bugs (14 of them affecting us; + 1 was fixed in a Red Hat patch already, 2 others are portability + improvements) + +* Wed Feb 7 2001 Bernhard Rosenkraenzer +- Remove initscripts 5.54 requirement (#26489) + +* Mon Jan 29 2001 Bernhard Rosenkraenzer +- Add named-checkconf, named-checkzone (#25170) + +* Mon Jan 29 2001 Trond Eivind Glomsrod +- use echo, not gprintf + +* Wed Jan 24 2001 Bernhard Rosenkraenzer +- Fix problems with $GENERATE + Patch from Daniel Roesen + Bug #24890 + +* Thu Jan 18 2001 Bernhard Rosenkraenzer +- 9.1.0 final + +* Sat Jan 13 2001 Bernhard Rosenkraenzer +- 9.1.0rc1 +- i18nify init script +- bzip2 source to save space + +* Thu Jan 11 2001 Bernhard Rosenkraenzer +- Fix %%postun script + +* Tue Jan 9 2001 Bernhard Rosenkraenzer +- 9.1.0b3 + +* Mon Jan 8 2001 Bernhard Rosenkraenzer +- Add named.conf man page from bind8 (#23503) + +* Sun Jan 7 2001 Bernhard Rosenkraenzer +- Make /etc/rndc.conf and /etc/sysconfig/named noreplace +- Make devel require bind = %%{version} rather than just bind + +* Sun Jan 7 2001 Bernhard Rosenkraenzer +- Fix init script for real + +* Sat Jan 6 2001 Bernhard Rosenkraenzer +- Fix init script when ROOTDIR is not set + +* Thu Jan 4 2001 Bernhard Rosenkraenzer +- Add hooks for setting up named to run chroot (RFE #23246) +- Fix up requirements + +* Fri Dec 29 2000 Bernhard Rosenkraenzer +- 9.1.0b2 + +* Wed Dec 20 2000 Bernhard Rosenkraenzer +- Move run files to /var/run/named/ - /var/run isn't writable + by the user we're running as. (Bug #20665) + +* Tue Dec 19 2000 Bernhard Rosenkraenzer +- Fix reverse lookups (#22272) +- Run ldconfig in %%post utils + +* Tue Dec 12 2000 Karsten Hopp +- fixed logrotate script (wrong path to kill) +- include header files in -devel package +- bugzilla #22049, #19147, 21606 + +* Fri Dec 8 2000 Bernhard Rosenkraenzer +- 9.1.0b1 (9.1.0 is in our timeframe and less buggy) + +* Mon Nov 13 2000 Bernhard Rosenkraenzer +- 9.0.1 + +* Mon Oct 30 2000 Bernhard Rosenkraenzer +- Fix initscript (Bug #19956) +- Add sample rndc.conf (Bug #19956) +- Fix build with tar 1.13.18 + +* Tue Oct 10 2000 Bernhard Rosenkraenzer +- Add some missing man pages (taken from bind8) (Bug #18794) + +* Sun Sep 17 2000 Bernhard Rosenkraenzer +- 9.0.0 final + +* Wed Aug 30 2000 Bernhard Rosenkraenzer +- rc5 +- fix up nslookup + +* Thu Aug 24 2000 Bernhard Rosenkraenzer +- rc4 + +* Thu Jul 13 2000 Bernhard Rosenkraenzer +- 9.0.0rc1 + +* Wed Jul 12 2000 Prospector +- automatic rebuild + +* Sun Jul 9 2000 Florian La Roche +- add "exit 0" for uninstall case + +* Fri Jul 7 2000 Florian La Roche +- add prereq init.d and cleanup install section + +* Fri Jun 30 2000 Trond Eivind Glomsrod +- fix the init script + +* Wed Jun 28 2000 Nalin Dahyabhai +- make libbind.a and nslookup.help readable again by setting INSTALL_LIB to "" + +* Mon Jun 26 2000 Bernhard Rosenkranzer +- Fix up the initscript (Bug #13033) +- Fix build with current glibc (Bug #12755) +- /etc/rc.d/init.d -> /etc/init.d +- use %%{_mandir} rather than /usr/share/man + +* Mon Jun 19 2000 Bill Nottingham +- fix conflict with man-pages +- remove compatibilty chkconfig links +- initscript munging + +* Wed Jun 14 2000 Nalin Dahyabhai +- modify logrotate setup to use PID file +- temporarily disable optimization by unsetting $RPM_OPT_FLAGS at build-time +- actually bump the release this time + +* Sun Jun 4 2000 Bernhard Rosenkraenzer +- FHS compliance + +* Mon Apr 17 2000 Nalin Dahyabhai +- clean up restart patch + +* Mon Apr 10 2000 Nalin Dahyabhai +- provide /var/named (fix for bugs #9847, #10205) +- preserve args when restarted via ndc(8) (bug #10227) +- make resolv.conf(5) a link to resolver(5) (bug #10245) +- fix SYSTYPE bug in all makefiles +- move creation of named user from %%post into %%pre + +* Mon Feb 28 2000 Bernhard Rosenkranzer +- Fix TTL (patch from ISC, Bug #9820) + +* Wed Feb 16 2000 Bernhard Rosenkranzer +- fix typo in spec (it's %%post, without a leading blank) introduced in -6 +- change SYSTYPE to linux + +* Fri Feb 11 2000 Bill Nottingham +- pick a standard < 100 uid/gid for named + +* Fri Feb 04 2000 Elliot Lee +- Pass named a '-u named' parameter by default, and add/remove user. + +* Thu Feb 3 2000 Bernhard Rosenkraenzer +- fix host mx bug (Bug #9021) + +* Mon Jan 31 2000 Cristian Gafton +- rebuild to fix dependencies +- man pages are compressed + +* Wed Jan 19 2000 Bernhard Rosenkraenzer +- It's /usr/bin/killall, not /usr/sbin/killall (Bug #8063) + +* Mon Jan 17 2000 Bernhard Rosenkraenzer +- Fix up location of named-bootconf.pl and make it executable + (Bug #8028) +- bind-devel requires bind + +* Mon Nov 15 1999 Bernhard Rosenkraenzer +- update to 8.2.2-P5 + +* Wed Nov 10 1999 Bill Nottingham +- update to 8.2.2-P3 + +* Tue Oct 12 1999 Cristian Gafton +- add patch to stop a cache only server from complaining about lame servers + on every request. + +* Fri Sep 24 1999 Preston Brown +- use real stop and start in named.init for restart, not ndc restart, it has + problems when named has changed during a package update... (# 4890) + +* Fri Sep 10 1999 Bill Nottingham +- chkconfig --del in %%preun, not %%postun + +* Mon Aug 16 1999 Bill Nottingham +- initscript munging + +* Mon Jul 26 1999 Bill Nottingham +- fix installed chkconfig links to match init file + +* Sat Jul 3 1999 Jeff Johnson +- conflict with new (in man-1.24) man pages (#3876,#3877). + +* Tue Jun 29 1999 Bill Nottingham +- fix named.logrotate (wrong %%SOURCE) + +* Fri Jun 25 1999 Jeff Johnson +- update to 8.2.1. +- add named.logrotate (#3571). +- hack around egcs-1.1.2 -m486 bug (#3413, #3485). +- vet file list. + +* Fri Jun 18 1999 Bill Nottingham +- don't run by default + +* Sun May 30 1999 Jeff Johnson +- nslookup fixes (#2463). +- missing files (#3152). + +* Sat May 1 1999 Stepan Kasal +- nslookup patched: + to count numRecords properly + to fix subsequent calls to ls -d + to parse "view" and "finger" commands properly + the view hack updated for bind-8 (using sed) + +* Wed Mar 31 1999 Bill Nottingham +- add ISC patch +- add quick hack to make host not crash +- add more docs + +* Fri Mar 26 1999 Cristian Gafton +- add probing information in the init file to keep linuxconf happy +- dont strip libbind + +* Sun Mar 21 1999 Cristian Gafton +- auto rebuild in the new build environment (release 3) + +* Wed Mar 17 1999 Preston Brown +- removed 'done' output at named shutdown. + +* Tue Mar 16 1999 Cristian Gafton +- version 8.2 + +* Wed Dec 30 1998 Cristian Gafton +- patch to use the __FDS_BITS macro +- build for glibc 2.1 + +* Wed Sep 23 1998 Jeff Johnson +- change named.restart to /usr/sbin/ndc restart + +* Sat Sep 19 1998 Jeff Johnson +- install man pages correctly. +- change K10named to K45named. + +* Wed Aug 12 1998 Jeff Johnson +- don't start if /etc/named.conf doesn't exist. + +* Sat Aug 8 1998 Jeff Johnson +- autmagically create /etc/named.conf from /etc/named.boot in %%post +- remove echo in %%post + +* Wed Jun 10 1998 Jeff Johnson +- merge in 5.1 mods + +* Sun Apr 12 1998 Manuel J. Galan +- Several essential modifications to build and install correctly. +- Modified 'ndc' to avoid deprecated use of '-' + +* Mon Dec 22 1997 Scott Lampert +- Used buildroot +- patched bin/named/ns_udp.c to use for include + on Redhat 5.0 instead of From 5cc93baa3a419963f211c74608b36f7ca5430899 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 2 Jul 2026 11:32:39 +0200 Subject: [PATCH 123/144] _libexec/generate-rndc-key.sh is used by freeipa Provide compatibility symlink until it is replaced. Freeipa calls the original place for script used to generate /etc/rndc.key. Preferred variant should be "systemctl restart named-setup-rndc.service" command. Until that is used everywhere, provide compatibility fix. --- bind.spec | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/bind.spec b/bind.spec index d7b44b9..d82e505 100644 --- a/bind.spec +++ b/bind.spec @@ -721,6 +721,7 @@ install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.co %global main_man5 named.conf rndc.conf %global main_unit named.service named-setup-rndc.service %global main_lib filter-{a,aaaa} +%global main_libexec generate-rndc-key.sh # Alternatives touches symlinks targets for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do @@ -768,6 +769,9 @@ done --follower %{_sbindir}/%{1} %{upname}-%{1} %{_sbindir}/%{1}%{program_suffix} \\\ --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} +%define altflibexec() \\\ + --follower %{_libexecdir}/%{1} %{upname}-%{1} %{_libexecdir}/%{name}/%{1} + %define altflibman() \\\ --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\ --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} @@ -801,6 +805,12 @@ done rm -f -- "$MANX"; \ fi +%define altrmlibexec() \ + BINX="%{_libexecdir}/%{1}"; \ + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then \ + rm -f -- "$BINX"; \ + fi + %define altrmman() \ MANX="%{_mandir}/man%{2}/%{1}.%{2}%{?manext}"; \ if ! [ -L "$MANX" ] && [ -f "$MANX" ]; then \ @@ -856,6 +866,10 @@ fi %{altrmlibman $LIB 8} ALTS+="%{altflibman $LIB 8}" done + for LIBEXEC in %{main_libexec}; do + %{altrmlibexec $LIBEXEC} + ALTS+="%{altflibexec $LIBEXEC}" + done for UNIT in %{main_unit}; do %{altrmunit $UNIT} done @@ -1021,6 +1035,7 @@ fi; %endif %{_libexecdir}/%{name}/generate-rndc-key.sh %{_libexecdir}/%{name}/setup-named-softhsm.sh +%ghost %{_libexecdir}/generate-rndc-key.sh # man pages %{_mandir}/man1/mdig%{program_suffix}.1* %{_mandir}/man1/named-checkconf%{program_suffix}.1* From f4645b66ad1a8d04c6430ea2ce1e4fdec7bf3792 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 2 Jul 2026 11:48:38 +0200 Subject: [PATCH 124/144] Create compat symlink also for bind-devel includes Try to preserve original _includedir/bind9 directory. Replace it with alternatives symlink leading to version explicit includes. --- bind.spec | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/bind.spec b/bind.spec index d82e505..d2af2fb 100644 --- a/bind.spec +++ b/bind.spec @@ -300,6 +300,8 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} Requires: libcap-devel%{?_isa} +Requires(post): %{_bindir}/alternatives +Requires(postun): %{_bindir}/alternatives %upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: krb5-devel%{?_isa} @@ -705,6 +707,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_tmpfilesdir} install -p -m 644 %{SOURCE35} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}.conf install -p -m 644 %{SOURCE51} ${RPM_BUILD_ROOT}%{_tmpfilesdir}/%{name}-chroot.conf +mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9 %if %{with DNSTAP} %global utils_bin1_dnstap dnstap-read @@ -975,6 +978,19 @@ if [ -x %{_sbindir}/selinuxenabled ] && [ -x %{_sbindir}/getsebool ] && [ -x %{_ fi fi +%post devel +%if "%{program_suffix}" != "" + alternatives --install %{_includedir}/bind9 %{upname}-includedir %{_includedir}/bind-%{mver} %{alternatives_prio} +%endif + +%postun devel +%if "%{program_suffix}" != "" +if [ $1 -eq 0 ] ; then + alternatives --remove %{upname}-includedir %{_includedir}/bind9 +fi +%endif +%end + %ldconfig_scriptlets libs %post chroot @@ -1175,6 +1191,7 @@ fi; %{_libdir}/libisc-%{mver}.so %{_libdir}/libisccfg-%{mver}.so %{_libdir}/libirs-%{mver}.so +%ghost %{_includedir}/bind9 %dir %{bind_include} %{bind_include}/isccc %{bind_include}/ns From c42426f28997b5b1b80e0a72b4a0082559c68d99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Thu, 2 Jul 2026 12:42:06 +0200 Subject: [PATCH 125/144] Replace direct dependencies with pkgconfig symbolic names In this case it should help with protobuf-c-devel dependency, because it is now provided by protobuf3-c-devel. But pkgconfig is used by bind anyway and it should make it more safe. Break requires onto separate lines, if they are provided by different packages. Stylistic change only. --- bind.spec | 53 ++++++++++++++++++++++++++++++++--------------------- 1 file changed, 32 insertions(+), 21 deletions(-) diff --git a/bind.spec b/bind.spec index d2af2fb..ecd0d0d 100644 --- a/bind.spec +++ b/bind.spec @@ -175,26 +175,33 @@ Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} Obsoletes: %{name}-pkcs11 < 32:9.18.4-2 -BuildRequires: gcc, make -BuildRequires: openssl-devel, libtool, autoconf, pkgconfig, libcap-devel +BuildRequires: gcc +BuildRequires: make +BuildRequires: pkgconfig(libcrypto) pkgconfig(libssl) +BuildRequires: libtool +BuildRequires: autoconf +BuildRequires: pkgconfig +BuildRequires: pkgconfig(libcap) %if %{with OPENSSL_ENGINE} BuildRequires: openssl-devel-engine %endif -BuildRequires: libidn2-devel, libxml2-devel +BuildRequires: pkgconfig(libidn2) +BuildRequires: pkgconfig(libxml-2.0) BuildRequires: systemd-rpm-macros BuildRequires: selinux-policy -BuildRequires: findutils sed -BuildRequires: libnghttp2-devel +BuildRequires: findutils +BuildRequires: sed +BuildRequires: pkgconfig(libnghttp2) %if %{with JEMALLOC} && 0%{?fedora} -BuildRequires: jemalloc-devel +BuildRequires: pkgconfig(jemalloc) %endif %if 0%{?fedora} BuildRequires: gnupg2 %endif -BuildRequires: libuv-devel +BuildRequires: pkgconfig(libuv) %if %{with UNITTEST} # make unit dependencies -BuildRequires: libcmocka-devel +BuildRequires: pkgconfig(cmocka) %endif %if %{with UNITTEST} || %{with SYSTEMTEST} BuildRequires: softhsm @@ -209,23 +216,25 @@ BuildRequires: python3-hypothesis BuildRequires: iproute %endif %if %{with GSSTSIG} -BuildRequires: krb5-devel +BuildRequires: pkgconfig(krb5) %endif %if %{with LMDB} -BuildRequires: lmdb-devel +BuildRequires: pkgconfig(lmdb) %endif %if %{with JSON} -BuildRequires: json-c-devel +BuildRequires: pkgconfig(json-c) %endif %if %{with GEOIP2} -BuildRequires: libmaxminddb-devel +BuildRequires: pkgconfig(libmaxminddb) %endif %if %{with DNSTAP} -BuildRequires: fstrm-devel protobuf-c-devel +BuildRequires: pkgconfig(libfstrm) +BuildRequires: pkgconfig(libprotobuf-c) %endif # Needed to regenerate dig.1 manpage %if %{with DOC} -BuildRequires: python3-sphinx python3-sphinx_rtd_theme +BuildRequires: python3-sphinx +BuildRequires: python3-sphinx_rtd_theme BuildRequires: doxygen %endif %if %{with DOCPDF} @@ -298,25 +307,27 @@ Summary: Header files and libraries needed for bind-dyndb-ldap Provides: %{name}-lite-devel = %{epoch}:%{version}-%{release} Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} -Requires: openssl-devel%{?_isa} libxml2-devel%{?_isa} -Requires: libcap-devel%{?_isa} +Requires: pkgconfig(libcrypto) pkgconfig(libssl) +Requires: pkgconfig(libxml-2.0) +Requires: pkgconfig(libpcap) Requires(post): %{_bindir}/alternatives Requires(postun): %{_bindir}/alternatives %upname_compat %{upname}-devel %if %{with GSSTSIG} -Requires: krb5-devel%{?_isa} +Requires: pkgconfig(krb5) %endif %if %{with LMDB} -Requires: lmdb-devel%{?_isa} +Requires: pkgconfig(lmdb) %endif %if %{with JSON} -Requires: json-c-devel%{?_isa} +Requires: pkgconfig(json-c) %endif %if %{with DNSTAP} -Requires: fstrm-devel%{?_isa} protobuf-c-devel%{?_isa} +Requires: pkgconfig(libfstrm) +Requires: pkgconfig(libprotobuf-c) %endif %if %{with GEOIP2} -Requires: libmaxminddb-devel%{?_isa} +Requires: pkgconfig(libmaxminddb) %endif %description devel From 94cc562d63874de562927ffb9a69b9c1172ba9a7 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 3 Jul 2026 17:49:24 +0200 Subject: [PATCH 126/144] Fix bind-devel compat link It points to the non-existent directory. Correct the path to point to actually used directory for headers. --- bind.spec | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index ecd0d0d..c42fda4 100644 --- a/bind.spec +++ b/bind.spec @@ -991,13 +991,13 @@ fi %post devel %if "%{program_suffix}" != "" - alternatives --install %{_includedir}/bind9 %{upname}-includedir %{_includedir}/bind-%{mver} %{alternatives_prio} + alternatives --install %{_includedir}/bind9 %{upname}-includedir %{bind_include} %{alternatives_prio} %endif %postun devel %if "%{program_suffix}" != "" if [ $1 -eq 0 ] ; then - alternatives --remove %{upname}-includedir %{_includedir}/bind9 + alternatives --remove %{upname}-includedir %{bind_include} fi %endif %end From 78e7e9e5ff4c8f5d4a112f99945ce5c1973566d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Jul 2026 19:53:21 +0200 Subject: [PATCH 127/144] Fix filter-{a,aaaa}.so unexpanded with ghost flag The same trick that worked fine for normal files does not work on ghost file. %ghost flag seems to require only single file after it. Shell is not expanded, but used in the name. --- bind.spec | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bind.spec b/bind.spec index c42fda4..ef4be45 100644 --- a/bind.spec +++ b/bind.spec @@ -1048,7 +1048,8 @@ fi; %{_sbindir}/rndc-confgen%{program_suffix} %ghost %{_unitdir}/named.service %ghost %{_unitdir}/named-setup-rndc.service -%ghost %{_libdir}/bind/filter-{a,aaaa}.so +%ghost %attr(0755,-,-) %{_libdir}/bind/filter-a.so +%ghost %attr(0755,-,-) %{_libdir}/bind/filter-aaaa.so %ghost %{_bindir}/named-checkconf %ghost %{_bindir}/named-journalprint %ghost %{_bindir}/named-rrchecker @@ -1083,7 +1084,8 @@ fi; %ghost %{_mandir}/man8/rndc.8* %ghost %{_mandir}/man8/named.8* %ghost %{_mandir}/man8/rndc-confgen.8* -%ghost %{_mandir}/man8/filter-{a,aaaa}.8* +%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8* +%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8* %doc README.md named.conf.default %doc sample/ From 0049ee45a47d990c4678ba8af1c00e8723192b01 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Jul 2026 20:32:23 +0200 Subject: [PATCH 128/144] Ghost files do not need explicit touch anymore Touches for ghost files are not necessary for a long time. Drop extra touches. Use %attr instead to generate good permissions on such files. Found at: https://github.com/rpm-software-management/rpm/discussions/3380 --- bind.spec | 131 ++++++++++++++++++++++-------------------------------- 1 file changed, 52 insertions(+), 79 deletions(-) diff --git a/bind.spec b/bind.spec index ef4be45..f8d0be2 100644 --- a/bind.spec +++ b/bind.spec @@ -672,9 +672,6 @@ done cp -p doc/arm/_build/latex/Bv9ARM.pdf ${RPM_BUILD_ROOT}%{_pkgdocdir} %endif -# Ghost config files: -touch ${RPM_BUILD_ROOT}%{_localstatedir}/log/named.log - # configuration files: install -m 640 %{SOURCE16} ${RPM_BUILD_ROOT}%{_sysconfdir}/named.conf touch ${RPM_BUILD_ROOT}%{_sysconfdir}/rndc.{key,conf} @@ -737,30 +734,6 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9 %global main_lib filter-{a,aaaa} %global main_libexec generate-rndc-key.sh -# Alternatives touches symlinks targets -for BIN in %{utils_bin1} %{main_bin1} %{dnssec_utils_bin1}; do - install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_bindir}/${BIN} - touch ${RPM_BUILD_ROOT}%{_mandir}/man1/${BIN}.1 -done - -for BIN in %{main_bin8}; do - install -m 0755 /dev/null ${RPM_BUILD_ROOT}%{_sbindir}/${BIN} - touch ${RPM_BUILD_ROOT}%{_mandir}/man8/${BIN}.8 -done - -for MAN in %{main_man5}; do - touch ${RPM_BUILD_ROOT}%{_mandir}/man5/$MAN.5 -done -for MAN in %{utils_bin8}; do - touch ${RPM_BUILD_ROOT}%{_mandir}/man8/$MAN.8 -done - -# named-chroot*.service are missing intentionally now -# let bind*-chroot conflict -for UNIT in %{main_unit}; do - touch ${RPM_BUILD_ROOT}%{_unitdir}/$UNIT -done - %define altfbin() \\\ --follower %{_bindir}/%{1} %{upname}-%{1} %{_bindir}/%{1}%{program_suffix} @@ -1046,24 +1019,24 @@ fi; %{_sbindir}/named%{program_suffix} %{_sbindir}/rndc%{program_suffix} %{_sbindir}/rndc-confgen%{program_suffix} -%ghost %{_unitdir}/named.service -%ghost %{_unitdir}/named-setup-rndc.service +%ghost %attr(0644,-,-) %{_unitdir}/named.service +%ghost %attr(0644,-,-) %{_unitdir}/named-setup-rndc.service %ghost %attr(0755,-,-) %{_libdir}/bind/filter-a.so %ghost %attr(0755,-,-) %{_libdir}/bind/filter-aaaa.so -%ghost %{_bindir}/named-checkconf -%ghost %{_bindir}/named-journalprint -%ghost %{_bindir}/named-rrchecker -%ghost %{_bindir}/mdig -%ghost %{_sbindir}/named -%ghost %{_sbindir}/rndc -%ghost %{_sbindir}/rndc-confgen +%ghost %attr(0755,-,-) %{_bindir}/named-checkconf +%ghost %attr(0755,-,-) %{_bindir}/named-journalprint +%ghost %attr(0755,-,-) %{_bindir}/named-rrchecker +%ghost %attr(0755,-,-) %{_bindir}/mdig +%ghost %attr(0755,-,-) %{_sbindir}/named +%ghost %attr(0755,-,-) %{_sbindir}/rndc +%ghost %attr(0755,-,-) %{_sbindir}/rndc-confgen %if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkconf%{program_suffix} -%ghost %{_sbindir}/named-checkconf +%ghost %attr(0755,-,-) %{_sbindir}/named-checkconf %endif %{_libexecdir}/%{name}/generate-rndc-key.sh %{_libexecdir}/%{name}/setup-named-softhsm.sh -%ghost %{_libexecdir}/generate-rndc-key.sh +%ghost %attr(0755,-,-) %{_libexecdir}/generate-rndc-key.sh # man pages %{_mandir}/man1/mdig%{program_suffix}.1* %{_mandir}/man1/named-checkconf%{program_suffix}.1* @@ -1075,15 +1048,15 @@ fi; %{_mandir}/man8/named%{program_suffix}.8* %{_mandir}/man8/rndc-confgen%{program_suffix}.8* %{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8* -%ghost %{_mandir}/man1/mdig.1* -%ghost %{_mandir}/man1/named-checkconf.1* -%ghost %{_mandir}/man1/named-journalprint.1* -%ghost %{_mandir}/man1/named-rrchecker.1* -%ghost %{_mandir}/man5/named.conf.5* -%ghost %{_mandir}/man5/rndc.conf.5* -%ghost %{_mandir}/man8/rndc.8* -%ghost %{_mandir}/man8/named.8* -%ghost %{_mandir}/man8/rndc-confgen.8* +%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1* +%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5* +%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5* +%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8* +%ghost %attr(0644,-,-) %{_mandir}/man8/named.8* +%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8* %ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8* %ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8* %doc README.md named.conf.default @@ -1100,7 +1073,7 @@ fi; %dir %{_localstatedir}/named/slaves %dir %{_localstatedir}/named/data %dir %{_localstatedir}/named/dynamic -%ghost %{_localstatedir}/log/named.log +%ghost %attr(0644,named,named) %{_localstatedir}/log/named.log %defattr(0640,root,named,0750) %{_datadir}/named/ %config %verify(not link) %{_localstatedir}/named/named.ca @@ -1108,9 +1081,9 @@ fi; %config %verify(not link) %{_localstatedir}/named/named.localhost %config %verify(not link) %{_localstatedir}/named/named.loopback %config %verify(not link) %{_localstatedir}/named/named.empty -%ghost %config(noreplace) %{_sysconfdir}/rndc.key +%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/rndc.key # ^- rndc.key now created on first install only if it does not exist -%ghost %config(noreplace) %{_sysconfdir}/rndc.conf +%ghost %attr(0640,root,named) %config(noreplace) %{_sysconfdir}/rndc.conf # ^- The default rndc.conf which uses rndc.key is in named's default internal config - # so rndc.conf is not necessary. %defattr(-,named,named,-) @@ -1139,17 +1112,17 @@ fi; %{_bindir}/named-compilezone%{program_suffix} %{_sbindir}/ddns-confgen%{program_suffix} %{_sbindir}/tsig-keygen%{program_suffix} -%ghost %{_bindir}/arpaname -%ghost %{_bindir}/delv -%ghost %{_bindir}/dig -%ghost %{_bindir}/host -%ghost %{_bindir}/nsec3hash -%ghost %{_bindir}/nslookup -%ghost %{_bindir}/nsupdate -%ghost %{_bindir}/named-checkzone -%ghost %{_bindir}/named-compilezone -%ghost %{_sbindir}/ddns-confgen -%ghost %{_sbindir}/tsig-keygen +%ghost %attr(0755,-,-) %{_bindir}/arpaname +%ghost %attr(0755,-,-) %{_bindir}/delv +%ghost %attr(0755,-,-) %{_bindir}/dig +%ghost %attr(0755,-,-) %{_bindir}/host +%ghost %attr(0755,-,-) %{_bindir}/nsec3hash +%ghost %attr(0755,-,-) %{_bindir}/nslookup +%ghost %attr(0755,-,-) %{_bindir}/nsupdate +%ghost %attr(0755,-,-) %{_bindir}/named-checkzone +%ghost %attr(0755,-,-) %{_bindir}/named-compilezone +%ghost %attr(0755,-,-) %{_sbindir}/ddns-confgen +%ghost %attr(0755,-,-) %{_sbindir}/tsig-keygen %if "%{_sbindir}" != "%{_bindir}" %{_sbindir}/named-checkzone %{_sbindir}/named-compilezone @@ -1157,14 +1130,14 @@ fi; %if %{with DNSTAP} %{_bindir}/dnstap-read%{program_suffix} %{_mandir}/man1/dnstap-read%{program_suffix}.1* -%ghost %{_bindir}/dnstap-read -%ghost %{_mandir}/man1/dnstap-read.1* +%ghost %attr(0755,-,-) %{_bindir}/dnstap-read +%ghost %attr(0644,-,-) %{_mandir}/man1/dnstap-read.1* %endif %if %{with LMDB} %{_bindir}/named-nzd2nzf%{program_suffix} %{_mandir}/man1/named-nzd2nzf%{program_suffix}.1* -%ghost %{_bindir}/named-nzd2nzf -%ghost %{_mandir}/man1/named-nzd2nzf.1* +%ghost %attr(0755,-,-) %{_bindir}/named-nzd2nzf +%ghost %attr(0644,-,-) %{_mandir}/man1/named-nzd2nzf.1* %endif %{_mandir}/man1/arpaname%{program_suffix}.1* %{_mandir}/man1/delv%{program_suffix}.1* @@ -1177,24 +1150,24 @@ fi; %{_mandir}/man1/named-compilezone%{program_suffix}.1* %{_mandir}/man8/ddns-confgen%{program_suffix}.8* %{_mandir}/man8/tsig-keygen%{program_suffix}.8* -%ghost %{_mandir}/man1/arpaname.1* -%ghost %{_mandir}/man1/delv.1* -%ghost %{_mandir}/man1/dig.1* -%ghost %{_mandir}/man1/host.1* -%ghost %{_mandir}/man1/nslookup.1* -%ghost %{_mandir}/man1/nsupdate.1* -%ghost %{_mandir}/man1/nsec3hash.1* -%ghost %{_mandir}/man1/named-checkzone.1* -%ghost %{_mandir}/man1/named-compilezone.1* -%ghost %{_mandir}/man8/ddns-confgen.8* -%ghost %{_mandir}/man8/tsig-keygen.8* +%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/host.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1* +%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8* +%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8* %{_sysconfdir}/trusted-key.key %files dnssec-utils %{_bindir}/%{dnssec_utils_bin1}%{program_suffix} %{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1* -%ghost %{_bindir}/%{dnssec_utils_bin1} -%ghost %{_mandir}/man1/%{dnssec_utils_bin1}.1* +%ghost %attr(0755,-,-) %{_bindir}/%{dnssec_utils_bin1} +%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1* %files devel %{_libdir}/libbind9-%{mver}.so @@ -1204,7 +1177,7 @@ fi; %{_libdir}/libisc-%{mver}.so %{_libdir}/libisccfg-%{mver}.so %{_libdir}/libirs-%{mver}.so -%ghost %{_includedir}/bind9 +%ghost %attr(0755,-,-) %{_includedir}/bind9 %dir %{bind_include} %{bind_include}/isccc %{bind_include}/ns From 046122bd9e39a537b004b89517bbeb575c3fe7cd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Wed, 8 Jul 2026 20:43:09 +0200 Subject: [PATCH 129/144] Fix ghost man pages suffix Classic shell glob star does not work on non-existing files. Use explicit man page suffix. It needs to be defined for use in alternatives anyway. --- bind.spec | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) diff --git a/bind.spec b/bind.spec index f8d0be2..f69351a 100644 --- a/bind.spec +++ b/bind.spec @@ -1048,17 +1048,17 @@ fi; %{_mandir}/man8/named%{program_suffix}.8* %{_mandir}/man8/rndc-confgen%{program_suffix}.8* %{_mandir}/man8/filter-{a,aaaa}%{program_suffix}.8* -%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1* -%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5* -%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5* -%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8* -%ghost %attr(0644,-,-) %{_mandir}/man8/named.8* -%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8* -%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8* -%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8* +%ghost %attr(0644,-,-) %{_mandir}/man1/mdig.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkconf.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/named-journalprint.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/named-rrchecker.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man5/named.conf.5%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man5/rndc.conf.5%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/rndc.8%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/named.8%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/rndc-confgen.8%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/filter-a.8%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/filter-aaaa.8%{manext} %doc README.md named.conf.default %doc sample/ @@ -1150,24 +1150,24 @@ fi; %{_mandir}/man1/named-compilezone%{program_suffix}.1* %{_mandir}/man8/ddns-confgen%{program_suffix}.8* %{_mandir}/man8/tsig-keygen%{program_suffix}.8* -%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/host.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1* -%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1* -%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8* -%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8* +%ghost %attr(0644,-,-) %{_mandir}/man1/arpaname.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/delv.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/dig.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/host.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/nslookup.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/nsupdate.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/nsec3hash.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/named-checkzone.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man1/named-compilezone.1%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/ddns-confgen.8%{manext} +%ghost %attr(0644,-,-) %{_mandir}/man8/tsig-keygen.8%{manext} %{_sysconfdir}/trusted-key.key %files dnssec-utils %{_bindir}/%{dnssec_utils_bin1}%{program_suffix} %{_mandir}/man1/%{dnssec_utils_bin1}%{program_suffix}.1* %ghost %attr(0755,-,-) %{_bindir}/%{dnssec_utils_bin1} -%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1* +%ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1%{manext} %files devel %{_libdir}/libbind9-%{mver}.so From 211a5b09a632dccafcca84067e5ef4361f5b92d5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 13 Jul 2026 16:58:28 +0200 Subject: [PATCH 130/144] Switch to _sbindir/alternatives It is in sbin in CentOS. But on Fedora it is equivalent. --- bind.spec | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/bind.spec b/bind.spec index f69351a..2cdd2fe 100644 --- a/bind.spec +++ b/bind.spec @@ -168,8 +168,8 @@ Requires: coreutils Requires(post): shadow-utils Requires(post): glibc-common Requires(post): grep -Requires(post): %{_bindir}/alternatives -Requires(postun): %{_bindir}/alternatives +Requires(post): %{_sbindir}/alternatives +Requires(postun): %{_sbindir}/alternatives Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils %{name}-dnssec-utils %upname_compat %{upname} @@ -270,8 +270,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} # For compatibility with Debian package Provides: dnsutils = %{epoch}:%{version}-%{release} Obsoletes: %{name}-pkcs11-utils < 32:9.18.4-2 -Requires(post): %{_bindir}/alternatives -Requires(postun): %{_bindir}/alternatives +Requires(post): %{_sbindir}/alternatives +Requires(postun): %{_sbindir}/alternatives %upname_compat %{upname}-utils %description utils @@ -290,8 +290,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Recommends: %{name}-utils Obsoletes: python3-%{name} < 32:9.18.0 Obsoletes: %{name}-dnssec-doc < 32:9.18.4-2 -Requires(post): %{_bindir}/alternatives -Requires(postun): %{_bindir}/alternatives +Requires(post): %{_sbindir}/alternatives +Requires(postun): %{_sbindir}/alternatives %upname_compat %{upname}-dnssec-utils %description dnssec-utils @@ -310,8 +310,8 @@ Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: pkgconfig(libcrypto) pkgconfig(libssl) Requires: pkgconfig(libxml-2.0) Requires: pkgconfig(libpcap) -Requires(post): %{_bindir}/alternatives -Requires(postun): %{_bindir}/alternatives +Requires(post): %{_sbindir}/alternatives +Requires(postun): %{_sbindir}/alternatives %upname_compat %{upname}-devel %if %{with GSSTSIG} Requires: pkgconfig(krb5) From fbbe880e062e9e0937f6f5e1f90e35c8be370cf2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Mon, 13 Jul 2026 17:02:01 +0200 Subject: [PATCH 131/144] fixup! Replace direct dependencies with pkgconfig symbolic names --- bind.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 2cdd2fe..a29bad8 100644 --- a/bind.spec +++ b/bind.spec @@ -309,7 +309,7 @@ Obsoletes: %{name}-lite-devel < 32:9.16.6-3 Requires: %{name}-libs%{?_isa} = %{epoch}:%{version}-%{release} Requires: pkgconfig(libcrypto) pkgconfig(libssl) Requires: pkgconfig(libxml-2.0) -Requires: pkgconfig(libpcap) +Requires: pkgconfig(libcap) Requires(post): %{_sbindir}/alternatives Requires(postun): %{_sbindir}/alternatives %upname_compat %{upname}-devel From 55c3f8e6d3577eeeaa80d74ddf2c872ce213e86d Mon Sep 17 00:00:00 2001 From: Fedora Release Engineering Date: Wed, 15 Jul 2026 20:11:13 +0000 Subject: [PATCH 132/144] Rebuilt for https://fedoraproject.org/wiki/Fedora_45_Mass_Rebuild From 3a99b5a25e4ce9e1ff97709cf96a9150b02bb2bb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 12:19:35 +0200 Subject: [PATCH 133/144] Potential wildcard CNAME RPZ policy bypass (CVE-2026-11331) [9.18] [CVE-2026-11331] sec: usr: Fix handling of rpz CNAME expansion that returns name too long Previously, if the expansion of a wildcard CNAME RPZ policy resulted in a name that exceeded the length limit, a self referential CNAME and the original address record were returned, allowing the policy to be bypassed. In branches up to 9.20, this also left query processing in an inconsistent state which could trigger an assertion failure. We now return a YXDOMAIN response, without the address. ISC would like to thank Laith Mash'al (0xmshal) for bringing this issue to our attention. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5856 --- bind-9.18-CVE-2026-11331-test.patch | 69 +++++++++++++++++++++++++++++ bind-9.18-CVE-2026-11331.patch | 31 +++++++++++++ bind.spec | 4 ++ 3 files changed, 104 insertions(+) create mode 100644 bind-9.18-CVE-2026-11331-test.patch create mode 100644 bind-9.18-CVE-2026-11331.patch diff --git a/bind-9.18-CVE-2026-11331-test.patch b/bind-9.18-CVE-2026-11331-test.patch new file mode 100644 index 0000000..27aa6cc --- /dev/null +++ b/bind-9.18-CVE-2026-11331-test.patch @@ -0,0 +1,69 @@ +From cde8bb21e09205a7bd1f41fd07ed011fc80d8d71 Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Fri, 10 Apr 2026 10:24:06 +1000 +Subject: [PATCH] Fix TTL extraction from A/AAAA record + +(cherry picked from commit 89c86e338db2492b92e6618c586f146c6928dc6d) +(cherry picked from commit adc8285d23e2eac6ec463f5dbc5a9596fdd36c60) + +Check rpz name too long wildcard CNAME expansion handling + +(cherry picked from commit 9345394e2097031b55b3ef34ceaadf5a7ebbeef2) +(cherry picked from commit 095b11f20f911f5b8059bdc349b256d6c64ece30) +--- + bin/tests/system/rpz/ns2/tld2.db | 2 ++ + bin/tests/system/rpz/ns4/tld4.db | 2 ++ + bin/tests/system/rpz/tests.sh | 7 +++++-- + 3 files changed, 9 insertions(+), 2 deletions(-) + +diff --git a/bin/tests/system/rpz/ns2/tld2.db b/bin/tests/system/rpz/ns2/tld2.db +index c6f2556db5..c091ee27b7 100644 +--- a/bin/tests/system/rpz/ns2/tld2.db ++++ b/bin/tests/system/rpz/ns2/tld2.db +@@ -123,3 +123,5 @@ a7-1 A 192.168.7.1 + + a7-2 A 192.168.7.2 + TXT "a7-2 tld2 text" ++ ++*.wild A 192.168.9.1 +diff --git a/bin/tests/system/rpz/ns4/tld4.db b/bin/tests/system/rpz/ns4/tld4.db +index fca419c6dd..8accd76baf 100644 +--- a/bin/tests/system/rpz/ns4/tld4.db ++++ b/bin/tests/system/rpz/ns4/tld4.db +@@ -59,6 +59,8 @@ a3-6.tld2 A 56.56.56.56 + + a3-7.sub1.tld2 A 57.57.57.57 + ++*.wild.sub1.tld2 A 57.57.57.57 ++ + a3-8.tld2 A 58.58.58.58 + + a3-9.sub9.tld2 A 59.59.59.59 +diff --git a/bin/tests/system/rpz/tests.sh b/bin/tests/system/rpz/tests.sh +index 87e4118ca3..5297437694 100644 +--- a/bin/tests/system/rpz/tests.sh ++++ b/bin/tests/system/rpz/tests.sh +@@ -391,7 +391,7 @@ addr() { + digcmd $2 >$DIGNM + #ckalive "$2" "server crashed by 'dig $2'" || return 1 + ADDR_ESC=$(echo "$ADDR" | sed -e 's/\./\\./g') +- ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\) IN AA* ${ADDR_ESC}\$/\1/p" $DIGNM) ++ ADDR_TTL=$(sed -n -e "s/^[-.a-z0-9]\{1,\}[ ]*\([0-9]*\)[ ]IN[ ]AA*[ ]${ADDR_ESC}\$/\1/p" $DIGNM) + if test -z "$ADDR_TTL"; then + setret "'dig $2' wrong; no address $ADDR record in $DIGNM" + return 0 +@@ -516,7 +516,10 @@ nochange TCP a3-9.tld2 # 33 tcp-only + here x.servfail <<'EOF' # 34 qname-wait-recurse yes + ;; status: SERVFAIL, x + EOF +-addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no ++addr 35.35.35.35 "x.servfail @$ns5" # 35 qname-wait-recurse no ++here aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.wild.sub1.tld2 <<'EOF' # 36 wildcard CNAME name to long ++ ;; status: YXDOMAIN, x ++EOF + end_group + ckstats $ns3 test1 ns3 22 + ckstats $ns5 test1 ns5 1 +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-11331.patch b/bind-9.18-CVE-2026-11331.patch new file mode 100644 index 0000000..8baa98c --- /dev/null +++ b/bind-9.18-CVE-2026-11331.patch @@ -0,0 +1,31 @@ +From 49f4cc4e93f14f1d5b6a472124e6aa457167fede Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Fri, 10 Apr 2026 10:26:14 +1000 +Subject: [PATCH] Properly handle rpz name to long wildcard expansion + +Previously a self referential CNAME and the original address +record were returned. We now return a YXDOMAIN response. + +(cherry picked from commit cfc4c4f69870ce492deaaa429453563d1621ded3) +(cherry picked from commit dc328a199f96222e0c30cc20b7b795bfc2c9b2e4) +--- + lib/ns/query.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/ns/query.c b/lib/ns/query.c +index d3a10be9ba..3bd7daf79c 100644 +--- a/lib/ns/query.c ++++ b/lib/ns/query.c +@@ -7591,7 +7591,8 @@ query_rpzcname(query_ctx_t *qctx, dns_name_t *cname) { + qctx->fname, NULL); + if (result == DNS_R_NAMETOOLONG) { + client->message->rcode = dns_rcode_yxdomain; +- } else if (result != ISC_R_SUCCESS) { ++ } ++ if (result != ISC_R_SUCCESS) { + return result; + } + } else { +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index a29bad8..bbe677d 100644 --- a/bind.spec +++ b/bind.spec @@ -160,6 +160,10 @@ Patch33: bind-9.18-dig-idn-input-always.patch Patch34: bind-9.18-dig-idn-input-always-test.patch # downstream only, https://redhat.atlassian.net/browse/IDM-6189 Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/4fd0755bdd08471f74e6e4c76cd2326f356e0a61 +# https://gitlab.isc.org/isc-projects/bind9/-/work_items/5856 +Patch36: bind-9.18-CVE-2026-11331.patch +Patch37: bind-9.18-CVE-2026-11331-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From c72c35866e76095ca27413a6473f31d1fb8fd4c1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 12:25:22 +0200 Subject: [PATCH 134/144] Key Record using PRIVATEDNS algorithm may lead to exit (CVE-2026-10822) [9.18] [CVE-2026-10822] sec: usr: Fix dns_name_fromwire to record boundaries Previously, `dns_name_fromwire()` did not honor the record boundary when reading names from the wire, allowing malformed records to be accepted when they should not have been. This has been fixed. Closes: https://gitlab.isc.org/isc-projects/bind9/-/issues/6004 --- bind-9.18-CVE-2026-10822-test.patch | 320 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-10822.patch | 54 +++++ bind.spec | 3 + 3 files changed, 377 insertions(+) create mode 100644 bind-9.18-CVE-2026-10822-test.patch create mode 100644 bind-9.18-CVE-2026-10822.patch diff --git a/bind-9.18-CVE-2026-10822-test.patch b/bind-9.18-CVE-2026-10822-test.patch new file mode 100644 index 0000000..f95514f --- /dev/null +++ b/bind-9.18-CVE-2026-10822-test.patch @@ -0,0 +1,320 @@ +From a4ce4c0ce5b8d7630417730dc1b98bf554e0801f Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 19 May 2026 10:44:04 +1000 +Subject: [PATCH] Check that dns_name_fromwire honours the active region + +When reading DNS records from the wire the active region of the +source buffer is set to the end of the current record. dns_name_fromwire +should fail if it attempts to read past this setting. + +(cherry picked from commit 3ed821d68b15fe4e6288e3054397d6bce7e65968) +(cherry picked from commit d413c9ac2e29a728531354a69c8c8234c01b7d1e) + +Check that a short PRIVATEDNS record is rejected + +A bug in dns_name_fromwire meant that short PRIVATEDNS key +records where being accepted. Test that this is no longer +the case. + +(cherry picked from commit f48d48027384d8c2210b5ce9e3eac7af101ead3d) +(cherry picked from commit 19ac8b8e46aeb0a15e217bc7bdf485b31b87d9b4) + +POC for PRIVATEDNS DNSKEY overrun not being detected + +Construct a DNS message where a PRIVATEDNS DNSKEY identifier +overruns the record boundary by 3 byte so that the label ends +at the end of the compression pointer for the next record. The +next type is less than 256 so the next octet is 00 terminating +the identifier name. The transfered zone is then written to +disk using master-format text triggering the assertion when the +truncated identier is discovered. + +Note this test will produce a false result in versions of +BIND that do not check the PRIVATEDNS identifier as it looks +for the error message when the transfer is aborted. + +(cherry picked from commit 9ce3bce8bc8b4e9c6a9b1e84b5849c33eb27830e) +(cherry picked from commit 8e066d3fc369e3346f22bb5cfb67a7ab08a74034) +--- + bin/tests/system/xfer/ans9/ans.py | 142 ++++++++++++++++++++++++ + bin/tests/system/xfer/ns6/named.conf.in | 9 ++ + bin/tests/system/xfer/tests.sh | 16 +++ + tests/dns/name_test.c | 30 +++++ + tests/dns/rdata_test.c | 21 ++++ + 5 files changed, 218 insertions(+) + create mode 100644 bin/tests/system/xfer/ans9/ans.py + +diff --git a/bin/tests/system/xfer/ans9/ans.py b/bin/tests/system/xfer/ans9/ans.py +new file mode 100644 +index 0000000000..a9e73953ee +--- /dev/null ++++ b/bin/tests/system/xfer/ans9/ans.py +@@ -0,0 +1,142 @@ ++""" ++Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ ++SPDX-License-Identifier: MPL-2.0 ++ ++This Source Code Form is subject to the terms of the Mozilla Public ++License, v. 2.0. If a copy of the MPL was not distributed with this ++file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ ++See the COPYRIGHT file distributed with this work for additional ++information regarding copyright ownership. ++""" ++ ++from collections.abc import AsyncGenerator ++ ++import dns.name ++import dns.rcode ++import dns.rdatatype ++import dns.rrset ++ ++from isctest.asyncserver import ( ++ ControllableAsyncDnsServer, ++ DnsResponseSend, ++ DomainHandler, ++ QueryContext, ++ ResponseAction, ++ ToggleResponsesCommand, ++) ++ ++ ++class AXFRServer(DomainHandler): ++ """ ++ Yield SOA and AXFR responses. Every new AXFR response increments the SOA ++ version. ++ """ ++ ++ domains = ["xfr-and-reconfig", "private-dns-overrun"] ++ ++ def __init__(self) -> None: ++ super().__init__() ++ self.soa_version = 0 ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[ResponseAction, None]: ++ # This is oversimplified because I am lazy - we are appending the SOA ++ # RRset to the ANSWER section for _every_ QTYPE. named is only ++ # expected to send a SOA query over UDP and then an AXFR query over ++ # TCP. Responses to both of those start with a SOA RRset in the ANSWER ++ # section :-) ++ soa_message = qctx.response ++ soa_rrset = dns.rrset.from_text( ++ qctx.qname, ++ 300, ++ qctx.qclass, ++ dns.rdatatype.SOA, ++ f". . {self.soa_version} 0 0 0 0", ++ ) ++ soa_message.answer.append(soa_rrset) ++ ++ yield DnsResponseSend(soa_message) ++ ++ if qctx.qtype == dns.rdatatype.SOA: ++ # If QTYPE=SOA, the SOA record is the complete response. ++ return ++ ++ if qctx.qtype != dns.rdatatype.AXFR: ++ # If QTYPE=AXFR, we will continue cramming RRsets into the ANSWER ++ # section of a subsequent DNS message below. ++ # ++ # If QTYPE was not SOA or AXFR, abort. Yeah, we just sent a broken ++ # response by yielding DnsResponseSend() with a SOA RRset in the ++ # ANSWER section above. We will have to carry that burden for the ++ # rest of our lives. ++ return ++ ++ # Send just the obligatory NS RRset at zone apex in the next message. ++ # This is stupidly inefficient, but makes looping below simpler as we ++ # will already have been done with the mandatory stuff by then. ++ ns_message = qctx.prepare_new_response() ++ ns_rrset = dns.rrset.from_text( ++ qctx.qname, 300, qctx.qclass, dns.rdatatype.NS, "." ++ ) ++ ns_message.answer.append(ns_rrset) ++ ++ yield DnsResponseSend(ns_message) ++ ++ # Generate the AXFR with a txt rrset. ++ txt_message = qctx.prepare_new_response() ++ txt_rrset = dns.rrset.from_text( ++ qctx.qname, ++ 300, ++ qctx.qclass, ++ dns.rdatatype.TXT, ++ "foo bar", ++ ) ++ txt_message.answer.append(txt_rrset) ++ ++ yield DnsResponseSend(txt_message) ++ ++ if qctx.qname == dns.name.from_text("private-dns-overrun"): ++ # A message where the malformed DNSKEY algorithm identifier ++ # finishes on a 00 byte in the next record. Assumes the ++ # next record starts with a compression pointer which is ++ # followed by the type which starts with 00. ++ ++ # Generate malformed PRIVATE DNS DNSKEY ++ dnskey_message = qctx.prepare_new_response() ++ dnskey_rrset = dns.rrset.from_text( ++ qctx.qname, ++ 300, ++ qctx.qclass, ++ dns.rdatatype.DNSKEY, ++ "\\# 12 00 00 00 fd 09 00 00 00 00 00 00 00", ++ ) ++ dnskey_message.answer.append(dnskey_rrset) ++ # Generate well formed PRIVATE DNS DNSKEY ++ dnskey_rrset = dns.rrset.from_text( ++ qctx.qname, ++ 300, ++ qctx.qclass, ++ dns.rdatatype.DNSKEY, ++ "\\# 12 00 00 00 fd 06 00 00 00 00 00 00 00", ++ ) ++ dnskey_message.answer.append(dnskey_rrset) ++ ++ yield DnsResponseSend(dnskey_message) ++ ++ # Finish the AXFR transaction by sending the second SOA RRset. ++ yield DnsResponseSend(soa_message) ++ ++ # This makes sure that the next SOA request causes a new zone transfer ++ self.soa_version += 1 ++ ++ ++if __name__ == "__main__": ++ server = ControllableAsyncDnsServer( ++ default_aa=True, default_rcode=dns.rcode.NOERROR ++ ) ++ server.install_control_command(ToggleResponsesCommand()) ++ server.install_response_handler(AXFRServer()) ++ server.run() +diff --git a/bin/tests/system/xfer/ns6/named.conf.in b/bin/tests/system/xfer/ns6/named.conf.in +index 142383c89a..63809448f0 100644 +--- a/bin/tests/system/xfer/ns6/named.conf.in ++++ b/bin/tests/system/xfer/ns6/named.conf.in +@@ -83,3 +83,12 @@ zone "ixfr-too-big" { + primaries { 10.53.0.1; }; + file "ixfr-too-big.bk"; + }; ++ ++# GL#6004 ++zone "private-dns-overrun" { ++ type secondary; ++ primaries { 10.53.0.9; }; ++ file "private-dns-overrun.bk"; ++ masterfile-format text; # force bug to be exercised ++ request-ixfr no; # ans9 supports only axfr ++}; +diff --git a/bin/tests/system/xfer/tests.sh b/bin/tests/system/xfer/tests.sh +index a2c0adbc28..e08be175b7 100755 +--- a/bin/tests/system/xfer/tests.sh ++++ b/bin/tests/system/xfer/tests.sh +@@ -622,5 +622,21 @@ if [ $tmp -eq 0 ]; then + fi + status=$((status + tmp)) + ++# def test_malformed_private_dns_identifier_overrun(ns6): ++# isctest.log.info( ++# "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected" ++# ) ++# with ns6.watch_log_from_start(timeout=60) as watcher_transfer_completed: ++# watcher_transfer_completed.wait_for_line( ++# "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input" ++# ) ++n=$((n + 1)) ++echo_i "Check that a malformed PRIVATEDNS DNSKEY which overruns the record is rejected ($n)" ++tmp=0 ++nextpartreset ns6/named.run ++retry 60 wait_for_message "zone private-dns-overrun/IN: zone transfer finished: unexpected end of input" || tmp=1 ++if test $tmp != 0; then echo_i "failed"; fi ++status=$((status + tmp)) ++ + echo_i "exit status: $status" + [ $status -eq 0 ] || exit 1 +diff --git a/tests/dns/name_test.c b/tests/dns/name_test.c +index fb34dcace1..95f6598eb8 100644 +--- a/tests/dns/name_test.c ++++ b/tests/dns/name_test.c +@@ -335,6 +335,35 @@ ISC_RUN_TEST_IMPL(fromregion) { + assert_false(dns_name_isabsolute(&name)); + } + ++ISC_RUN_TEST_IMPL(fromwire) { ++ dns_decompress_t dctx; ++ dns_fixedname_t fixed; ++ dns_name_t *name = dns_fixedname_initname(&fixed); ++ isc_buffer_t b; ++ unsigned char source[] = { 0x03, 'o', 'n', 'e', 0x00, 0x03, ++ 't', 'w', 'o', 0x00, 0x05, 't', ++ 'h', 'r', 'e', 'e', 0x00 }; ++ isc_result_t result; ++ ++ isc_buffer_init(&b, source, sizeof(source)); ++ isc_buffer_add(&b, sizeof(source)); ++ isc_buffer_setactive(&b, 10); /* names 'one.' and 'two.' */ ++ ++ /* ++ * We should only be able to read two names from the buffer ++ * as the active region has been set to cover only the first ++ * two. ++ */ ++ dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_STRICT); ++ dns_decompress_setmethods(&dctx, DNS_COMPRESS_NONE); ++ result = dns_name_fromwire(name, &b, &dctx, 0, NULL); ++ assert_int_equal(result, ISC_R_SUCCESS); ++ result = dns_name_fromwire(name, &b, &dctx, 0, NULL); ++ assert_int_equal(result, ISC_R_SUCCESS); ++ result = dns_name_fromwire(name, &b, &dctx, 0, NULL); ++ assert_int_not_equal(result, ISC_R_SUCCESS); ++} ++ + /* is trust-anchor-telemetry test */ + ISC_RUN_TEST_IMPL(istat) { + dns_fixedname_t fixed; +@@ -778,6 +807,7 @@ ISC_TEST_LIST_START + ISC_TEST_ENTRY(fullcompare) + ISC_TEST_ENTRY(compression) + ISC_TEST_ENTRY(fromregion) ++ISC_TEST_ENTRY(fromwire) + ISC_TEST_ENTRY(istat) + ISC_TEST_ENTRY(init) + ISC_TEST_ENTRY(invalidate) +diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c +index 6354819d10..7f0df6e046 100644 +--- a/tests/dns/rdata_test.c ++++ b/tests/dns/rdata_test.c +@@ -2199,6 +2199,27 @@ ISC_RUN_TEST_IMPL(key) { + + check_rdata(NULL, wire_ok, NULL, false, dns_rdataclass_in, + dns_rdatatype_key, sizeof(dns_rdata_key_t)); ++ ++ /* ++ * A valid PRIVATEDNS record with an active region shorter than the ++ * actual record length. A bug in dns_name_fromwire meant that this ++ * was previously accepted. ++ */ ++ dns_decompress_t dctx; ++ unsigned char key[] = { 0x00, 0x00, 0x00, 253, 0x07, 'e', 'x', ++ 'a', 'm', 'p', 'l', 'e', 0x00 }; ++ unsigned char buf[sizeof(key)]; ++ isc_buffer_t source, target; ++ isc_result_t result; ++ ++ isc_buffer_init(&source, key, sizeof(key)); ++ isc_buffer_add(&source, sizeof(key)); ++ isc_buffer_setactive(&source, sizeof(key) - 1); ++ isc_buffer_init(&target, buf, sizeof(buf)); ++ dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_ANY); ++ result = dns_rdata_fromwire(NULL, dns_rdataclass_in, dns_rdatatype_key, ++ &source, &dctx, 0, &target); ++ assert_int_not_equal(result, ISC_R_SUCCESS); + } + + /* +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-10822.patch b/bind-9.18-CVE-2026-10822.patch new file mode 100644 index 0000000..22cdbdd --- /dev/null +++ b/bind-9.18-CVE-2026-10822.patch @@ -0,0 +1,54 @@ +From 7596cbc240b0492461943f7c34d040fb66a7554c Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 19 May 2026 15:00:17 +1000 +Subject: [PATCH] Fix the yaml query zone name code in dnstap-read + +When the buffer to read the query zone name was constructed +isc_buffer_setactive was not called. This is now needed as +dns_name_fromwire is being corrected to check the active region. + +(cherry picked from commit a25522c28c46655a81d2bf1d96374c81d834b157) +(cherry picked from commit a5f1a9d0d2ec021618924b14202ac96ead8299c1) + +Fix dns_name_fromwire to honour the active region + +dns_name_fromwire was not honouring the source buffer's active +region when reading names from the wire. This allowed malformed +records to be accepted when they shouldn't have been. This has +been corrected. + +(cherry picked from commit 7c4f07a7ef6b571073327b02209df7f75b9363ff) +(cherry picked from commit e73b70a64453e7d97a11cb5f0afe8bb02d34aaf8) +--- + bin/tools/dnstap-read.c | 1 + + lib/dns/name.c | 2 +- + 2 files changed, 2 insertions(+), 1 deletion(-) + +diff --git a/bin/tools/dnstap-read.c b/bin/tools/dnstap-read.c +index a1d0243a1a..bb78ae12b1 100644 +--- a/bin/tools/dnstap-read.c ++++ b/bin/tools/dnstap-read.c +@@ -298,6 +298,7 @@ print_yaml(dns_dtdata_t *dt) { + + isc_buffer_init(&b, m->query_zone.data, m->query_zone.len); + isc_buffer_add(&b, m->query_zone.len); ++ isc_buffer_setactive(&b, m->query_zone.len); + + dns_decompress_init(&dctx, -1, DNS_DECOMPRESS_NONE); + result = dns_name_fromwire(name, &b, &dctx, 0, NULL); +diff --git a/lib/dns/name.c b/lib/dns/name.c +index cc0e30e5b5..2ce868a2ba 100644 +--- a/lib/dns/name.c ++++ b/lib/dns/name.c +@@ -1833,7 +1833,7 @@ dns_name_fromwire(dns_name_t *const name, isc_buffer_t *const source, + * The amount of the source we consumed is set once. + */ + const uint8_t *const source_buf = isc_buffer_base(source); +- const uint8_t *const source_max = isc_buffer_used(source); ++ const uint8_t *const source_max = isc_buffer_active(source); + const uint8_t *const start = isc_buffer_current(source); + const uint8_t *marker = start; + const uint8_t *cursor = start; +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index bbe677d..c8f2ddf 100644 --- a/bind.spec +++ b/bind.spec @@ -164,6 +164,9 @@ Patch35: 0001-Use-variable-PROGRAM_SUFFIX-in-install-target.patch # https://gitlab.isc.org/isc-projects/bind9/-/work_items/5856 Patch36: bind-9.18-CVE-2026-11331.patch Patch37: bind-9.18-CVE-2026-11331-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/c5d2fc706ca3635d9928c1cc68db73bffb35d772 +Patch38: bind-9.18-CVE-2026-10822.patch +Patch40: bind-9.18-CVE-2026-10822-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From f792799c7db49e99b04b2bd9a8400ee8ec54a1a1 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 12:28:58 +0200 Subject: [PATCH 135/144] Record ordering based unexpected exit with CNAME or DNAME (CVE-2026-12617) [9.18] [CVE-2026-12617] sec: usr: Do no assert for some specifics CNAME and DNAME queries A bug in the resolver's handling of certain cached DNAME and CNAME responses could cause named to trigger an assertion failure and exit. An attacker controlling a domain name and the authoritative DNS server it is hosted on could exploit this behavior to cause a denial-of-service. This vulnerability has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention. Closes: isc-projects/bind9#5946 [9.18] fix: test: Stabilize the cname_dname_negcache test The test proved unstable due to timing-related race condition, which could produce both false positive and false negative results. Use a more reliable mechanism to reproduce the issue. Human-effort-level: low --- bind-9.18-CVE-2026-12617-test.patch | 435 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-12617.patch | 280 ++++++++++++++++++ bind.spec | 4 + 3 files changed, 719 insertions(+) create mode 100644 bind-9.18-CVE-2026-12617-test.patch create mode 100644 bind-9.18-CVE-2026-12617.patch diff --git a/bind-9.18-CVE-2026-12617-test.patch b/bind-9.18-CVE-2026-12617-test.patch new file mode 100644 index 0000000..b2add78 --- /dev/null +++ b/bind-9.18-CVE-2026-12617-test.patch @@ -0,0 +1,435 @@ +From a31296b120efc985fb1fc3c932882e965156473b Mon Sep 17 00:00:00 2001 +From: Colin Vidal +Date: Mon, 15 Jun 2026 11:34:08 +0200 +Subject: [PATCH] Reproducer for #5946 (assertion in some CNAME/DNAME queries) + +Add a system test reproducing the issue reported by #5946, which +is also CVE-2026-12617. There are two scenarios: + +- A client send queries for a DNAME and A record to the resolver (ns3), + and the authoritative server (ans2) responds positively to the A query + but delay the DNAME response and respond later negatively; + +- A client send queries for a CNAME and A record to the resolver (ns3), + and the authoritative server (ans2) responds positively to the A query + but delay the CNAME response and respond later with a self-referential + CNAME. + +The test does not check the results of the queries, however, it expects +the resolver to correctly handle those and do not assert. + +(cherry picked from commit e88271f2e584010157b068cc998dd76451273562) +(cherry picked from commit bb92832fb6ae899bee7206c2d8966258461c2f71) + +Stabilize timing in the cname_dname_negcache test + +The #5946 reproducer relied on ans2 answering the negative DNAME/CNAME +query a fixed second after receiving it, racing that delay against the +resolver's per-query timeout. When the timeout fired first -- which +happens under load, most notably under ThreadSanitizer, where named is +slowed but ans2 (wall-clock) is not -- the resolver dropped the late +answer, never processed the negative response, and the watched SOA never +appeared, so the test timed out. This made it flaky on the +security-bind-9.20 CI. Merely shortening the fixed delay would trade +that for the opposite, worse failure: the negative answer arriving +before the positive one is cached, silently not exercising the bug. + +Release the negative answer based on the resolver's progress instead of +a wall-clock deadline: hold it until ans2 has sent the positive answer +(a shared event), then wait a short settle for the resolver to cache it. +Both queries traverse the same delegation, so any latency reaching ans2 +shifts the positive send and the negative fetch's deadline together and +cancels out; only the settle, kept well under MINIMUM_QUERY_TIMEOUT +(301 ms), has to fit inside the per-query timeout. + +Verified that the stabilized test still triggers the +INSIST(namereln == dns_namereln_subdomain) assertion when the resolver +fix is reverted. + +Assisted-by: Claude:claude-opus-4-8 +(cherry picked from commit 738456d91564526e6f15c3858b4c809cd6749e1e) +(cherry picked from commit 0c20ee4e8e68999ca617434cde65dd3808f57d8c) + +Split cname_dname_negcache into per-scenario modules + +The DNAME and CNAME scenarios shared a single module, hence a single +module-scoped ns3 (the framework sets servers up per module, not per +test function). test_dname_negcache cached foo.test. DNAME bar.test.; +when test_cname_negcache ran next against the same resolver, +cname.foo.test. was DNAME-mapped to cname.bar.test., so the resolver +never queried ans2 for the self-referential CNAME and that half of the +bug was never exercised. The hardcoded, unanchored "foo.test." watcher +still matched test_dname's leftover SOA, so test_cname passed without +testing anything -- the CNAME assertion had no coverage. + +Give each scenario its own module so each gets a fresh server set, and +anchor the watcher to the queried name so a test cannot pass on an +unrelated record. + +With the resolver fix reverted, each module now independently triggers +its own assertion: + + DNAME query.c INSIST(namereln == dns_namereln_subdomain) + CNAME query.c INSIST(qctx->rdataset == NULL || qctx->qtype == dname) + +Assisted-by: Claude:claude-opus-4-8 +(cherry picked from commit 3ef0b8d04a1653407cfb9ee88772ae18689b1318) +(cherry picked from commit 887124315f03a006c4dc76e48ae3d0d8aac3c407) +--- + .../system/cname_dname_negcache/ans2/ans.py | 148 ++++++++++++++++++ + .../system/cname_dname_negcache/common.py | 46 ++++++ + .../cname_dname_negcache/ns1/bar.test.db | 5 + + .../cname_dname_negcache/ns1/named.conf.j2 | 24 +++ + .../system/cname_dname_negcache/ns1/root.db | 6 + + .../system/cname_dname_negcache/ns1/test.db | 8 + + .../cname_dname_negcache/ns3/named.conf.j2 | 11 ++ + .../tests_cname_negcache.py | 16 ++ + .../tests_dname_negcache.py | 16 ++ + 9 files changed, 280 insertions(+) + create mode 100644 bin/tests/system/cname_dname_negcache/ans2/ans.py + create mode 100644 bin/tests/system/cname_dname_negcache/common.py + create mode 100644 bin/tests/system/cname_dname_negcache/ns1/bar.test.db + create mode 100644 bin/tests/system/cname_dname_negcache/ns1/named.conf.j2 + create mode 100644 bin/tests/system/cname_dname_negcache/ns1/root.db + create mode 100644 bin/tests/system/cname_dname_negcache/ns1/test.db + create mode 100644 bin/tests/system/cname_dname_negcache/ns3/named.conf.j2 + create mode 100644 bin/tests/system/cname_dname_negcache/tests_cname_negcache.py + create mode 100644 bin/tests/system/cname_dname_negcache/tests_dname_negcache.py + +diff --git a/bin/tests/system/cname_dname_negcache/ans2/ans.py b/bin/tests/system/cname_dname_negcache/ans2/ans.py +new file mode 100644 +index 0000000000..392fe1e088 +--- /dev/null ++++ b/bin/tests/system/cname_dname_negcache/ans2/ans.py +@@ -0,0 +1,148 @@ ++""" ++Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ ++SPDX-License-Identifier: MPL-2.0 ++ ++This Source Code Form is subject to the terms of the Mozilla Public ++License, v. 2.0. If a copy of the MPL was not distributed with this ++file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ ++See the COPYRIGHT file distributed with this work for additional ++information regarding copyright ownership. ++""" ++ ++from collections.abc import AsyncGenerator ++ ++import asyncio ++ ++from dns import name, rcode, rdataclass, rdatatype, rrset ++ ++from isctest.asyncserver import ( ++ AsyncDnsServer, ++ DnsResponseSend, ++ QnameQtypeHandler, ++ QueryContext, ++ StaticResponseHandler, ++) ++ ++# The attack relies on the resolver caching the positive CNAME/DNAME answer ++# *before* it processes the negative answer for the same name. The negative ++# answer must therefore be held back until the positive one has been sent, but ++# released again while the negative fetch is still waiting for it. ++# ++# Releasing it at a fixed wall-clock delay (the original approach) is racy: the ++# delay must be larger than the time it takes the resolver to cache the ++# positive answer, yet smaller than the resolver's per-query timeout. Under ++# load -- most notably ThreadSanitizer, which slows down `named` but not this ++# (wall-clock) server -- those bounds can be violated in either direction, ++# making the test either time out (#5946 CI failures) or, worse, silently stop ++# exercising the bug. ++# ++# Instead, gate the negative answer on an event set right after the positive ++# answer is sent. Both queries traverse the same delegation, so any latency in ++# reaching this server shifts the positive send and the negative fetch's ++# deadline together and cancels out; only the small settle below has to fit ++# inside the per-query timeout. ++# ++# _SETTLE must be longer than the few milliseconds the resolver needs to cache ++# the positive answer, and shorter than MINIMUM_QUERY_TIMEOUT (301 ms in ++# lib/dns/resolver.c) so the in-flight negative fetch has not given up yet. ++_SETTLE = 0.1 ++ ++_dname_positive_sent = asyncio.Event() ++_cname_positive_sent = asyncio.Event() ++ ++ ++async def _hold_until_positive_cached(positive_sent: asyncio.Event) -> None: ++ await positive_sent.wait() ++ await asyncio.sleep(_SETTLE) ++ ++ ++def build_rrset( ++ qname: name.Name | str, ++ rtype: rdatatype.RdataType, ++ rdata: str, ++ ttl: int = 300, ++) -> rrset.RRset: ++ return rrset.from_text(qname, ttl, rdataclass.IN, rtype, rdata) ++ ++ ++class FooTestNsHandler(QnameQtypeHandler, StaticResponseHandler): ++ qnames = ["foo.test."] ++ qtypes = [rdatatype.NS] ++ answer = [build_rrset("foo.test.", rdatatype.NS, "ns.foo.test.")] ++ additional = [build_rrset("ns.foo.test.", rdatatype.A, "10.53.0.2")] ++ ++ ++class DelayedDnameNegHandler(QnameQtypeHandler, StaticResponseHandler): ++ qnames = ["foo.test."] ++ qtypes = [rdatatype.DNAME] ++ authority = [ ++ build_rrset( ++ "foo.test.", ++ rdatatype.SOA, ++ "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300", ++ ) ++ ] ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[DnsResponseSend, None]: ++ await _hold_until_positive_cached(_dname_positive_sent) ++ async for response in super().get_responses(qctx): ++ yield response ++ ++ ++class DnamePosHandler(QnameQtypeHandler, StaticResponseHandler): ++ qnames = ["a.foo.test."] ++ qtypes = [rdatatype.A] ++ answer = [ ++ build_rrset("foo.test.", rdatatype.DNAME, "bar.test."), ++ build_rrset("a.foo.test.", rdatatype.CNAME, "a.bar.test."), ++ ] ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[DnsResponseSend, None]: ++ async for response in super().get_responses(qctx): ++ yield response ++ _dname_positive_sent.set() ++ ++ ++class CnameHandler(QnameQtypeHandler): ++ qnames = ["cname.foo.test."] ++ qtypes = [rdatatype.CNAME, rdatatype.A] ++ answer = [build_rrset("cname.foo.test.", rdatatype.CNAME, "cname.foo.test.")] ++ authority = [ ++ build_rrset( ++ "cname.foo.test.", ++ rdatatype.SOA, ++ "ns.test. op.ns.test. 2081509183 86400 3600 3600000 300", ++ ) ++ ] ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[DnsResponseSend, None]: ++ if qctx.qtype == rdatatype.CNAME: ++ await _hold_until_positive_cached(_cname_positive_sent) ++ qctx.prepare_new_response(with_zone_data=False) ++ qctx.response.authority.extend(self.authority) ++ yield DnsResponseSend(qctx.response, authoritative=True) ++ else: ++ qctx.prepare_new_response(with_zone_data=False) ++ qctx.response.answer.extend(self.answer) ++ yield DnsResponseSend(qctx.response, authoritative=True) ++ _cname_positive_sent.set() ++ ++ ++def main() -> None: ++ server = AsyncDnsServer(default_aa=True, default_rcode=rcode.NOERROR) ++ server.install_response_handlers( ++ FooTestNsHandler(), DelayedDnameNegHandler(), DnamePosHandler(), CnameHandler() ++ ) ++ server.run() ++ ++ ++if __name__ == "__main__": ++ main() +diff --git a/bin/tests/system/cname_dname_negcache/common.py b/bin/tests/system/cname_dname_negcache/common.py +new file mode 100644 +index 0000000000..397cfdfa3d +--- /dev/null ++++ b/bin/tests/system/cname_dname_negcache/common.py +@@ -0,0 +1,46 @@ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++# ++# This Source Code Form is subject to the terms of the Mozilla Public ++# License, v. 2.0. If a copy of the MPL was not distributed with this ++# file, you can obtain one at https://mozilla.org/MPL/2.0/. ++# ++# See the COPYRIGHT file distributed with this work for additional ++# information regarding copyright ownership. ++ ++from os import environ ++from re import compile as Re ++from re import escape ++from socket import AF_INET, SOCK_DGRAM, socket ++ ++import isctest ++ ++ ++def run_attack(ns, name1, type1, name2, type2): ++ msg1 = isctest.query.create(name1, type1, cd=True) ++ msg2 = isctest.query.create(name2, type2, cd=True) ++ port = int(environ["PORT"]) ++ ++ with socket(AF_INET, SOCK_DGRAM) as sock: ++ # The order the requests go out doesn't matter. What is important is ++ # that the first query starts recursion before the second query returns ++ # the answer, and the second query returns the answer before the first ++ # query returns the answer. (So, when the NOERROR/NODATA comes back from ++ # the first query, the cache is queried and we get the positive response ++ # cached from the second query attached to the fresp rdataset of the ++ # response of the first query.) ++ # That ordering is enforced by ans2, which holds back the negative ++ # answer to the first query until it has answered the second one (see ++ # ans2/ans.py); the resolver must not crash while reconciling them. ++ sock.sendto(msg1.to_wire(), (ns.ip, port)) ++ sock.sendto(msg2.to_wire(), (ns.ip, port)) ++ ++ # The second query comes back immediately, the resolver caches the DNAME. ++ # The first query comes back shortly after, once ans2 has released the ++ # negative answer, and should not crash the server. Wait for the negative ++ # SOA for this specific name (not just any foo.test. one) so the test cannot ++ # pass on an unrelated record. ++ soa = Re(rf"(? +Date: Thu, 18 Jun 2026 18:17:05 +0200 +Subject: [PATCH] Do not assert in some CNAME/DNAME queries + +Fix a `named` crash because of a fail assertion for certains types of +CNAME and DNAME queries: + +- If a client queries for a DNAME and A record to the resolver, and the + authoritative server responds positively to the A query but delay the + DNAME response and respond later negatively; + +- If a client queries for a CNAME and A record to the resolver, and the + authoritative server responds positively to the A query but delay the + CNAME response and respond later with a self-referential CNAME. + +The first scenario consists of sending two queries: `foo.test./DNAME` +and `a.foo.test./A`. The authoritative server delays the answer for +`foo.test./DNAME` but immediately answers the DNAME record for the +second query: `foo.test. DNAME bar.test.`. The resolver caches it, +follows the DNAME, and resolves `a.bar.test./A`. The authoritative +server eventually answers negatively for `foo.test./DNAME` +(NOERROR/NODATA, with only an SOA in the authority section). The +resolver pulls out the previously cached rdataset (because it has a +higher trust level than the received negative answer), and wrongly (this +is the first bug) sets the result to `DNS_R_DNAME` instead of +`ISC_R_SUCCESS`. The code in `ns/query.c` that handles the resolver +result interprets this as "this is a non-DNAME query and we got a DNAME +rdataset, so follow the chain". It goes into the `query_dname()` +function, which asserts that the qname is a subdomain of the owner name +in the rdataset. That assertion fails because the qname (`foo.test.`) is +exactly equal to the owner name of the DNAME (`foo.test.`), rather than +being a subdomain of it. `DNS_R_DNAME` must only be set when the qtype +is something other than DNAME and the resolver has obtained a DNAME that +needs to be followed. + +The second scenario consists of sending two queries: +`cname.foo.test./CNAME` and `cname.foo.test./A`. The authoritative +server delays the answer for `cname.foo.test./CNAME` but immediately +answers the CNAME record for the second query: `cname.foo.test. CNAME +cname.foo.test.`. Note that the CNAME is self-referential. The resolver +caches it and sets the result code to `DNS_R_CNAME`. Then `ns/query.c` +interprets this as "this is a non-CNAME query and we got a CNAME +rdataset, so follow the chain" (which is correct in this case; however, +because the CNAME rdataset is self-referential, the resolver responds +with SERVFAIL, which is expected). The authoritative server eventually +answers negatively for `cname.foo.test./CNAME`. The resolver then pulls +out the previously cached CNAME rdataset (obtained from the A answer, +even though it was self-referential, the resolver cached it) and wrongly +sets the result to `DNS_R_CNAME` (this is the second bug). As noted +above, `ns/query.c` interprets this as "this is a non-CNAME query and we +got a CNAME rdataset, so follow the chain". The internals here are +slightly more subtle: it first goes into `query_cname()` and sets the +CNAME rdataset in the message answer section, then restarts the query to +follow the CNAME. The restart retrieves the CNAME rdataset from the +cache directly (without going to the resolver), and this time the query +context result is `ISC_R_SUCCESS` (since it was found) and +`qctx->rdataset` points to the same CNAME again (as it is +self-referential), so it goes directly into the +`query_prepresponse()/query_respond()` flow, which attempts to add the +rdataset to the message answer again. However, this fails because the +rdataset is already in the message, and the assertion which expects that +operation to succeed fails (due to `qctx->rdataset` being set to `NULL` +when ownership of the rdataset was transferred). `DNS_R_CNAME` must only +be set when the qtype is something other than CNAME and the resolver has +obtained a CNAME that needs to be followed. + +In both cases, the correct answer from the resolver should have been +`ISC_R_SUCCESS` (instead of respectively `DNS_R_DNAME` and +`DNS_R_CNAME`) becuase the rdataset that has been looked up was found. + +(cherry picked from commit 773d46d58c693047a5945c8fe40512edd0ac214e) +(cherry picked from commit c740c37689f234e21a9b0ef760471ef2cf1133f5) +--- + lib/dns/resolver.c | 137 ++++++++++++++++++++------------------------- + 1 file changed, 60 insertions(+), 77 deletions(-) + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index edc9c207e1..1f8b5058d1 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -692,10 +692,10 @@ fctx_destroy(fetchctx_t *fctx, bool exiting); + static void + send_shutdown_events(dns_resolver_t *res); + static isc_result_t +-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, +- dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, +- dns_ttl_t maxttl, bool optout, bool secure, +- dns_rdataset_t *ardataset, isc_result_t *eresultp); ++ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node, ++ dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl, ++ bool optout, bool secure, dns_rdataset_t *ardataset, ++ isc_result_t *eresultp); + static void + validated(isc_task_t *task, isc_event_t *event); + static void +@@ -5563,6 +5563,46 @@ has_000_label(dns_rdataset_t *nsecset) { + return false; + } + ++/* ++ * After a (non-error) negative-cache add, 'rdataset' is bound to whatever ++ * rdataset the cache authoritatively holds for the queried name and type. ++ * Map that to the result code the fetch should report: ++ * ++ * - A negative cache entry (the one we just added, or a pre-existing one): ++ * DNS_R_NCACHENXDOMAIN or DNS_R_NCACHENXRRSET, depending on NXDOMAIN vs ++ * NODATA. ++ * ++ * - A positive rdataset that was already cached at higher trust, which ++ * caused our negative entry to be discarded (e.g. a CNAME or DNAME cached ++ * by a concurrent query): ISC_R_SUCCESS, because that cached positive ++ * answer is what gets returned. Note the specific case for CNAME and ++ * DNAME *if* the query type is not the same as the rdataset type. There ++ * is a chain to follow *only* if the query type doesn't ask for the CNAME ++ * or the DNAME. ++ */ ++static isc_result_t ++fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) { ++ isc_result_t result = ISC_R_SUCCESS; ++ ++ if (NEGATIVE(rdataset)) { ++ result = NXDOMAIN(rdataset) ? DNS_R_NCACHENXDOMAIN ++ : DNS_R_NCACHENXRRSET; ++ } else if (result == ISC_R_SUCCESS && rdataset->type != fctx->type) { ++ switch (rdataset->type) { ++ case dns_rdatatype_cname: ++ result = DNS_R_CNAME; ++ break; ++ case dns_rdatatype_dname: ++ result = DNS_R_DNAME; ++ break; ++ default: ++ break; ++ } ++ } ++ ++ return result; ++} ++ + /* + * The validator has finished. + */ +@@ -5836,8 +5876,7 @@ validated(isc_task_t *task, isc_event_t *event) { + ttl = 0; + } + +- result = ncache_adderesult(message, fctx->cache, node, covers, +- now, fctx->res->view->minncachettl, ++ result = ncache_adderesult(fctx, message, node, covers, now, + ttl, vevent->optout, vevent->secure, + ardataset, &eresult); + if (result != ISC_R_SUCCESS) { +@@ -6081,23 +6120,7 @@ answer_response: + */ + INSIST(hevent->rdataset != NULL); + if (dns_rdataset_isassociated(hevent->rdataset)) { +- if (NEGATIVE(hevent->rdataset)) { +- INSIST(eresult == DNS_R_NCACHENXDOMAIN || +- eresult == DNS_R_NCACHENXRRSET); +- } else if (eresult == ISC_R_SUCCESS && +- hevent->rdataset->type != fctx->type) +- { +- switch (hevent->rdataset->type) { +- case dns_rdatatype_cname: +- eresult = DNS_R_CNAME; +- break; +- case dns_rdatatype_dname: +- eresult = DNS_R_DNAME; +- break; +- default: +- break; +- } +- } ++ eresult = fctx_setresult(fctx, hevent->rdataset); + } + + hevent->result = eresult; +@@ -6747,24 +6770,7 @@ cache_name(fetchctx_t *fctx, dns_name_t *name, dns_message_t *message, + * event->result. + */ + if (dns_rdataset_isassociated(event->rdataset)) { +- if (NEGATIVE(event->rdataset)) { +- INSIST(eresult == +- DNS_R_NCACHENXDOMAIN || +- eresult == DNS_R_NCACHENXRRSET); +- } else if (eresult == ISC_R_SUCCESS && +- event->rdataset->type != fctx->type) +- { +- switch (event->rdataset->type) { +- case dns_rdatatype_cname: +- eresult = DNS_R_CNAME; +- break; +- case dns_rdatatype_dname: +- eresult = DNS_R_DNAME; +- break; +- default: +- break; +- } +- } ++ eresult = fctx_setresult(fctx, event->rdataset); + } + event->result = eresult; + if (adbp != NULL && *adbp != NULL) { +@@ -6833,12 +6839,14 @@ cache_message(fetchctx_t *fctx, dns_message_t *message, + * eresult. + */ + static isc_result_t +-ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, +- dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t minttl, +- dns_ttl_t maxttl, bool optout, bool secure, +- dns_rdataset_t *ardataset, isc_result_t *eresultp) { ++ncache_adderesult(fetchctx_t *fctx, dns_message_t *message, dns_dbnode_t *node, ++ dns_rdatatype_t covers, isc_stdtime_t now, dns_ttl_t maxttl, ++ bool optout, bool secure, dns_rdataset_t *ardataset, ++ isc_result_t *eresultp) { + isc_result_t result; + dns_rdataset_t rdataset; ++ dns_db_t *cache = fctx->cache; ++ dns_ttl_t minttl = fctx->res->view->minncachettl; + + if (ardataset == NULL) { + dns_rdataset_init(&rdataset); +@@ -6854,37 +6862,13 @@ ncache_adderesult(dns_message_t *message, dns_db_t *cache, dns_dbnode_t *node, + } + if (result == DNS_R_UNCHANGED || result == ISC_R_SUCCESS) { + /* +- * If the cache now contains a negative entry and we +- * care about whether it is DNS_R_NCACHENXDOMAIN or +- * DNS_R_NCACHENXRRSET then extract it. ++ * The cache settled successfully (DNS_R_UNCHANGED means our ++ * negative entry was discarded in favour of existing ++ * higher-trust data). Either way 'ardataset' is now bound to ++ * the rdataset the cache holds for this name and type; derive ++ * the result code from it. + */ +- if (NEGATIVE(ardataset)) { +- /* +- * The cache data is a negative cache entry. +- */ +- if (NXDOMAIN(ardataset)) { +- *eresultp = DNS_R_NCACHENXDOMAIN; +- } else { +- *eresultp = DNS_R_NCACHENXRRSET; +- } +- } else { +- /* +- * The attempt to add a negative cache entry +- * was rejected. Set *eresultp to reflect +- * the type of the dataset being returned. +- */ +- switch (ardataset->type) { +- case dns_rdatatype_cname: +- *eresultp = DNS_R_CNAME; +- break; +- case dns_rdatatype_dname: +- *eresultp = DNS_R_DNAME; +- break; +- default: +- *eresultp = ISC_R_SUCCESS; +- break; +- } +- } ++ *eresultp = fctx_setresult(fctx, ardataset); + result = ISC_R_SUCCESS; + } + if (ardataset == &rdataset && dns_rdataset_isassociated(ardataset)) { +@@ -7029,8 +7013,7 @@ ncache_message(fetchctx_t *fctx, dns_message_t *message, + ttl = 0; + } + +- result = ncache_adderesult(message, fctx->cache, node, covers, now, +- fctx->res->view->minncachettl, ttl, false, ++ result = ncache_adderesult(fctx, message, node, covers, now, ttl, false, + false, ardataset, &eresult); + if (result != ISC_R_SUCCESS) { + goto unlock; +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index c8f2ddf..eaf5eb9 100644 --- a/bind.spec +++ b/bind.spec @@ -167,6 +167,10 @@ Patch37: bind-9.18-CVE-2026-11331-test.patch # https://gitlab.isc.org/isc-projects/bind9/commit/c5d2fc706ca3635d9928c1cc68db73bffb35d772 Patch38: bind-9.18-CVE-2026-10822.patch Patch40: bind-9.18-CVE-2026-10822-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/5a0cef5bdb077df73fa59504efb8ca4c8b0a84c5 +Patch41: bind-9.18-CVE-2026-12617.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/26437be900c68bbe0974ec9ab804c2894c19c419 +Patch42: bind-9.18-CVE-2026-12617-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From a0805bd05d20a1739e273febe90e6f17c7c79e65 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 12:38:04 +0200 Subject: [PATCH 136/144] Potential memory usage beyond configured limits (CVE-2026-11622) [9.18] [CVE-2026-11622] sec: usr: Prevent cache exhaustion under sustained attack The cache memory can become exhausted with expired entries whose memory is not released due to a sustained attack on the same DNS name that prevents the cleanup. This has been fixed. Closes: https://gitlab.isc.org/isc-projects/bind9/-/work_items/4760 --- bind-9.18-CVE-2026-11622.patch | 280 +++++++++++++++++++++++++++++++++ bind.spec | 2 + 2 files changed, 282 insertions(+) create mode 100644 bind-9.18-CVE-2026-11622.patch diff --git a/bind-9.18-CVE-2026-11622.patch b/bind-9.18-CVE-2026-11622.patch new file mode 100644 index 0000000..8600070 --- /dev/null +++ b/bind-9.18-CVE-2026-11622.patch @@ -0,0 +1,280 @@ +From d7e1f4495d6bac8c29b332e04e9b27140339375b Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ond=C5=99ej=20Sur=C3=BD?= +Date: Tue, 23 Jun 2026 10:59:38 +0200 +Subject: [PATCH] Make the dns_slabheaders in the cache reference counted + +Instead of only reference counting the enclosing qpcnode, add the +reference counting directly to the slabheaders. The reference is +incremented when an rdataset is bound to the header and decremented when +the rdataset is disassociated, so a stale slabheader can be removed from +the node's down chain as soon as its own reference count reaches zero, +instead of waiting for the whole qpcnode to become unreferenced. + +Building on that, clean up the ancient headers eagerly: mark_ancient() +is made idempotent, releases the header's own (container) reference and +reaps the stale headers from the node's down chain as soon as their +references reach zero. A header evicted over the per-name type limit is +expired only after the new rdataset has been bound, so the bind's +increment always precedes mark_ancient()'s decrement. + +Because a header can now be reclaimed independently of its node, the +rdataset iterators must keep the header they are positioned on alive: +each iterator takes a reference on its current header and releases it +when it advances or is destroyed. Iteration otherwise stays lazy and +re-reads the node on every step, so it still observes records added to +the node while the iterator is live, as zone signing requires. + +The slab headers are shared with the zone databases, so the matching +increment is added to every bind path. The noqname/closest proofs hand +out rdatasets backed by bare slabs that have no header, so they are +given a separate dns_rdataproof_rdatasetmethods that leaves the +reference count untouched. + +(cherry picked from commit 2dabf117e1264fd13fb33096f87e78a039fd1c6c) +(cherry picked from commit 231b1ca3edfb26389e1af39181aa6b4413e87ec4) +--- + bin/tests/system/reclimit/tests.sh | 4 +- + lib/dns/include/dns/rdataslab.h | 1 + + lib/dns/rbtdb.c | 77 +++++++++++++++++++++++++----- + 3 files changed, 69 insertions(+), 13 deletions(-) + +diff --git a/bin/tests/system/reclimit/tests.sh b/bin/tests/system/reclimit/tests.sh +index c15225488f..55ccac7759 100644 +--- a/bin/tests/system/reclimit/tests.sh ++++ b/bin/tests/system/reclimit/tests.sh +@@ -338,13 +338,13 @@ echo_i "checking that NXDOMAIN names over the max-types-per-name limit don't get + + # Query for 10 NXDOMAIN types + for ntype in $(seq 65270 65279); do +- check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1 ++ check_manytypes 1 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1 + done + # Wait at least 1 second + sleep 1 + # Query for 10 NXDOMAIN types again - these should not be cached + for ntype in $(seq 65270 65279); do +- check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 0 || ret=1 ++ check_manytypes 2 manytypes.big "TYPE${ntype}" NOERROR big SOA 120 || ret=1 + done + + if [ $ret -ne 0 ]; then echo_i "failed"; fi +diff --git a/lib/dns/include/dns/rdataslab.h b/lib/dns/include/dns/rdataslab.h +index 5729c004ca..6bd3b5997d 100644 +--- a/lib/dns/include/dns/rdataslab.h ++++ b/lib/dns/include/dns/rdataslab.h +@@ -44,6 +44,7 @@ + #include + + #include ++#include + + #include + +diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c +index 62bc97d783..0b8547950f 100644 +--- a/lib/dns/rbtdb.c ++++ b/lib/dns/rbtdb.c +@@ -158,6 +158,7 @@ struct noqname { + }; + + typedef struct rdatasetheader { ++ isc_refcount_t references; + /*% + * Locked by the owning node's lock. + */ +@@ -1447,6 +1448,7 @@ init_rdataset(dns_rbtdb_t *rbtdb, rdatasetheader_t *h) { + h->heap_index = 0; + atomic_init(&h->attributes, 0); + atomic_init(&h->last_refresh_fail_ts, 0); ++ isc_refcount_init(&h->references, 1); + + STATIC_ASSERT(sizeof(h->attributes) == 2, + "The .attributes field of rdatasetheader_t needs to be " +@@ -1559,6 +1561,9 @@ rollback_node(dns_rbtnode_t *node, rbtdb_serial_t serial) { + } + } + ++static void ++clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, rdatasetheader_t *top); ++ + static void + mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) { + uint_least16_t attributes = atomic_load_acquire(&header->attributes); +@@ -1584,8 +1589,12 @@ mark_header_ancient(dns_rbtdb_t *rbtdb, rdatasetheader_t *header) { + update_rrsetstats(rbtdb, header->type, attributes, false); + header->node->dirty = 1; + ++ isc_refcount_decrement(&header->references); ++ + /* Increment the stats counter for the ancient RRtype. */ + update_rrsetstats(rbtdb, header->type, newattributes, true); ++ ++ clean_stale_headers(rbtdb, rbtdb->common.mctx, header); + } + + static void +@@ -1621,12 +1630,19 @@ static void + clean_stale_headers(dns_rbtdb_t *rbtdb, isc_mem_t *mctx, + rdatasetheader_t *top) { + rdatasetheader_t *d, *down_next; ++ rdatasetheader_t *down_parent = top; + + for (d = top->down; d != NULL; d = down_next) { + down_next = d->down; +- free_rdataset(rbtdb, mctx, d); ++ d->next = down_parent; ++ ++ if (isc_refcount_current(&d->references) == 0) { ++ free_rdataset(rbtdb, mctx, d); ++ down_parent->down = down_next; ++ } else { ++ down_parent = d; ++ } + } +- top->down = NULL; + } + + static void +@@ -1642,6 +1658,7 @@ clean_cache_node(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node) { + for (current = node->data; current != NULL; current = top_next) { + top_next = current->next; + clean_stale_headers(rbtdb, mctx, current); ++ INSIST(current->down == NULL); + /* + * If current is nonexistent, ancient, or stale and + * we are not keeping stale, we can clean it up. +@@ -3114,6 +3131,8 @@ bind_rdataset(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, rdatasetheader_t *header, + return; + } + ++ isc_refcount_increment(&header->references); ++ + dns__rbtnode_acquire(rbtdb, node, locktype); + + INSIST(rdataset->methods == NULL); /* We must be disassociated. */ +@@ -6307,6 +6326,7 @@ add32(dns_rbtdb_t *rbtdb, dns_rbtnode_t *rbtnode, const dns_name_t *nodename, + bool header_nx; + bool newheader_nx; + bool merge; ++ bool do_expireheader = false; + dns_rdatatype_t rdtype, covers; + rbtdb_rdatatype_t negtype, sigtype; + dns_trust_t trust; +@@ -6856,6 +6876,7 @@ find_header: + } + + if (IS_CACHE(rbtdb) && overmaxtype(rbtdb, ntypes)) { ++ do_expireheader = true; + if (expireheader == NULL) { + expireheader = newheader; + } +@@ -6869,15 +6890,6 @@ find_header: + */ + expireheader = newheader; + } +- +- set_ttl(rbtdb, expireheader, 0); +- mark_header_ancient(rbtdb, expireheader); +- /* +- * FIXME: In theory, we should mark the RRSIG +- * and the header at the same time, but there is +- * no direct link between those two header, so +- * we would have to check the whole list again. +- */ + } + } + } +@@ -6901,6 +6913,15 @@ find_header: + isc_rwlocktype_write, addedrdataset); + } + ++ /* ++ * We need to delay the expiration of the header until we are bound to ++ * it to prevent decrement-then-increment on the header references. ++ */ ++ if (do_expireheader) { ++ set_ttl(rbtdb, expireheader, 0); ++ mark_header_ancient(rbtdb, expireheader); ++ } ++ + return ISC_R_SUCCESS; + } + +@@ -8692,6 +8713,12 @@ rdataset_disassociate(dns_rdataset_t *rdataset) { + dns_db_t *db = rdataset->private1; + dns_dbnode_t *node = rdataset->private2; + ++ if (rdataset->methods == &rdataset_methods) { ++ rdatasetheader_t *header = rdataset->private3; ++ header--; ++ isc_refcount_decrement(&header->references); ++ } ++ + detachnode(db, &node); + } + +@@ -8806,6 +8833,11 @@ rdataset_clone(dns_rdataset_t *source, dns_rdataset_t *target) { + dns_dbnode_t *cloned_node = NULL; + + attachnode(db, node, &cloned_node); ++ if (source->methods == &rdataset_methods) { ++ rdatasetheader_t *header = source->private3; ++ header--; ++ isc_refcount_increment(&header->references); ++ } + INSIST(!ISC_LINK_LINKED(target, link)); + *target = *source; + ISC_LINK_INIT(target, link); +@@ -8969,6 +9001,11 @@ rdatasetiter_destroy(dns_rdatasetiter_t **iteratorp) { + + rbtiterator = (rbtdb_rdatasetiter_t *)(*iteratorp); + ++ if (rbtiterator->current != NULL) { ++ isc_refcount_decrement(&rbtiterator->current->references); ++ rbtiterator->current = NULL; ++ } ++ + if (rbtiterator->common.version != NULL) { + closeversion(rbtiterator->common.db, + &rbtiterator->common.version, false); +@@ -9046,9 +9083,18 @@ rdatasetiter_first(dns_rdatasetiter_t *iterator) { + } + } + ++ if (header != NULL) { ++ isc_refcount_increment0(&header->references); ++ } ++ + NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, + isc_rwlocktype_read); + ++ if (rbtiterator->current != NULL) { ++ isc_refcount_decrement(&rbtiterator->current->references); ++ rbtiterator->current = NULL; ++ } ++ + rbtiterator->current = header; + + if (header == NULL) { +@@ -9140,9 +9186,18 @@ rdatasetiter_next(dns_rdatasetiter_t *iterator) { + } + } + ++ if (header != NULL) { ++ isc_refcount_increment0(&header->references); ++ } ++ + NODE_UNLOCK(&rbtdb->node_locks[rbtnode->locknum].lock, + isc_rwlocktype_read); + ++ if (rbtiterator->current != NULL) { ++ isc_refcount_decrement(&rbtiterator->current->references); ++ rbtiterator->current = NULL; ++ } ++ + rbtiterator->current = header; + + if (header == NULL) { +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index eaf5eb9..dce493d 100644 --- a/bind.spec +++ b/bind.spec @@ -171,6 +171,8 @@ Patch40: bind-9.18-CVE-2026-10822-test.patch Patch41: bind-9.18-CVE-2026-12617.patch # https://gitlab.isc.org/isc-projects/bind9/commit/26437be900c68bbe0974ec9ab804c2894c19c419 Patch42: bind-9.18-CVE-2026-12617-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/14d23a4955c62efe974266a8e96a8c5d7caad040 +Patch43: bind-9.18-CVE-2026-11622.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 238ad5761b1f91463a9845296d13483cd08d7593 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 12:46:33 +0200 Subject: [PATCH 137/144] Cache poisoning via label count discrepancy, RRSIG, wildcards (CVE-2026-11721) [9.18] [CVE-2026-11721] sec: usr: Invalid signed wildcard records were being accepted Signed wildcard responses in which the Labels field in the `RRSIG` record was less than the number of labels in the Signer Name field were being incorrectly accepted. This in turn broke `synth-from-dnssec`, which depends on such records being correctly validated. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for bringing this issue to our attention. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5871 --- bind-9.18-CVE-2026-11721-test.patch | 144 +++++++++++++++ bind-9.18-CVE-2026-11721.patch | 267 ++++++++++++++++++++++++++++ bind.spec | 3 + 3 files changed, 414 insertions(+) create mode 100644 bind-9.18-CVE-2026-11721-test.patch create mode 100644 bind-9.18-CVE-2026-11721.patch diff --git a/bind-9.18-CVE-2026-11721-test.patch b/bind-9.18-CVE-2026-11721-test.patch new file mode 100644 index 0000000..7c54994 --- /dev/null +++ b/bind-9.18-CVE-2026-11721-test.patch @@ -0,0 +1,144 @@ +From b08e0876639ab9f3dae3813202861fd1098f2611 Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 14 Apr 2026 13:46:22 +1000 +Subject: [PATCH] Test RRSIG record parsing + +In particular test that labels and signer fields are consistent. + +(cherry picked from commit 5a95e64731afe63d348d272cc4d3b2f9847150c2) +(cherry picked from commit 19e496ca260b6a756ae1378e8ebcbdb666b7d9ed) +--- + tests/dns/rdata_test.c | 110 +++++++++++++++++++++++++++++++++++++++++ + 1 file changed, 110 insertions(+) + +diff --git a/tests/dns/rdata_test.c b/tests/dns/rdata_test.c +index 7f0df6e046..c704d98ed1 100644 +--- a/tests/dns/rdata_test.c ++++ b/tests/dns/rdata_test.c +@@ -2504,6 +2504,115 @@ ISC_RUN_TEST_IMPL(rkey) { + dns_rdatatype_rkey, sizeof(dns_rdata_rkey_t)); + } + ++ISC_RUN_TEST_IMPL(rrsig) { ++ text_ok_t text_ok[] = { ++ TEXT_VALID("SOA 8 0 86400 20260426170000 20260413160000 54393 " ++ ". " ++ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/" ++ "TEkOZApVG0F6E " ++ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/" ++ "dIdheiig1VvU+9HXLi " ++ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+" ++ "KJXOaxyHbqchYkDFy4PL6qftE " ++ "VaLkueRgjXgOsq/" ++ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw " ++ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+" ++ "IyVrLjZJdLqGkiLBGd1w4X3U12 " ++ "fFxoY3eqzNgBEtduoGKPZ/" ++ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="), ++ /* labels too short for signer */ ++ TEXT_INVALID("SOA 8 0 86400 20260426170000 20260413160000 " ++ "54393 example. " ++ "tFbcoVP8MnpecUquJ/aj+XeNgV7ts9GSHVkXaXRJrJ/" ++ "TEkOZApVG0F6E " ++ "9sYpxGk2ItweLL43ujioGj0HWwZDRR+vbur+O/" ++ "dIdheiig1VvU+9HXLi " ++ "QOViY9Kc64ixdyJhYCC5K+bO1qsHxd+" ++ "KJXOaxyHbqchYkDFy4PL6qftE " ++ "VaLkueRgjXgOsq/" ++ "NxvCXDgAa5xy0+3Sl0myxIs8rJ5KeXfJQFe7qxgaw " ++ "VjJsJTKw8neOTw2rQfLaigWu2LIWw+" ++ "IyVrLjZJdLqGkiLBGd1w4X3U12 " ++ "fFxoY3eqzNgBEtduoGKPZ/" ++ "NpP9cuKJORJ18283aV8hR4WO91VR0q1zcM jLwqUg=="), ++ /* ++ * Sentinel. ++ */ ++ TEXT_SENTINEL() ++ }; ++ wire_ok_t wire_ok[] = { ++ WIRE_VALID(0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69, ++ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79, ++ 0x00, 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, ++ 0x5e, 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, ++ 0x8d, 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, ++ 0x17, 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, ++ 0x99, 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, ++ 0x29, 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, ++ 0x37, 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, ++ 0x43, 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, ++ 0x48, 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, ++ 0xbd, 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, ++ 0x9c, 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, ++ 0xb9, 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, ++ 0x8a, 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, ++ 0x58, 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, ++ 0x44, 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, ++ 0x0e, 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, ++ 0x1a, 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, ++ 0xb1, 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, ++ 0x50, 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, ++ 0x6c, 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, ++ 0xab, 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, ++ 0x16, 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, ++ 0x4b, 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, ++ 0x17, 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, ++ 0xaa, 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, ++ 0x8f, 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, ++ 0x91, 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, ++ 0x78, 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, ++ 0x0c, 0x8c, 0xbc, 0x2a, 0x52), ++ /* labels too short for signer */ ++ WIRE_INVALID( ++ 0x00, 0x06, 0x08, 0x00, 0x00, 0x01, 0x51, 0x80, 0x69, ++ 0xee, 0x44, 0x90, 0x69, 0xdd, 0x13, 0x00, 0xd4, 0x79, ++ 0x07, 0x65, 0x78, 0x61, 0x6d, 0x70, 0x6c, 0x65, 0x00, ++ 0xb4, 0x56, 0xdc, 0xa1, 0x53, 0xfc, 0x32, 0x7a, 0x5e, ++ 0x71, 0x4a, 0xae, 0x27, 0xf6, 0xa3, 0xf9, 0x77, 0x8d, ++ 0x81, 0x5e, 0xed, 0xb3, 0xd1, 0x92, 0x1d, 0x59, 0x17, ++ 0x69, 0x74, 0x49, 0xac, 0x9f, 0xd3, 0x12, 0x43, 0x99, ++ 0x02, 0x95, 0x46, 0xd0, 0x5e, 0x84, 0xf6, 0xc6, 0x29, ++ 0xc4, 0x69, 0x36, 0x22, 0xdc, 0x1e, 0x2c, 0xbe, 0x37, ++ 0xba, 0x38, 0xa8, 0x1a, 0x3d, 0x07, 0x5b, 0x06, 0x43, ++ 0x45, 0x1f, 0xaf, 0x6e, 0xea, 0xfe, 0x3b, 0xf7, 0x48, ++ 0x76, 0x17, 0xa2, 0x8a, 0x0d, 0x55, 0xbd, 0x4f, 0xbd, ++ 0x1d, 0x72, 0xe2, 0x40, 0xe5, 0x62, 0x63, 0xd2, 0x9c, ++ 0xeb, 0x88, 0xb1, 0x77, 0x22, 0x61, 0x60, 0x20, 0xb9, ++ 0x2b, 0xe6, 0xce, 0xd6, 0xab, 0x07, 0xc5, 0xdf, 0x8a, ++ 0x25, 0x73, 0x9a, 0xc7, 0x21, 0xdb, 0xa9, 0xc8, 0x58, ++ 0x90, 0x31, 0x72, 0xe0, 0xf2, 0xfa, 0xa9, 0xfb, 0x44, ++ 0x55, 0xa2, 0xe4, 0xb9, 0xe4, 0x60, 0x8d, 0x78, 0x0e, ++ 0xb2, 0xaf, 0xcd, 0xc6, 0xf0, 0x97, 0x0e, 0x00, 0x1a, ++ 0xe7, 0x1c, 0xb4, 0xfb, 0x74, 0xa5, 0xd2, 0x6c, 0xb1, ++ 0x22, 0xcf, 0x2b, 0x27, 0x92, 0x9e, 0x5d, 0xf2, 0x50, ++ 0x15, 0xee, 0xea, 0xc6, 0x06, 0xb0, 0x56, 0x32, 0x6c, ++ 0x25, 0x32, 0xb0, 0xf2, 0x77, 0x8e, 0x4f, 0x0d, 0xab, ++ 0x41, 0xf2, 0xda, 0x8a, 0x05, 0xae, 0xd8, 0xb2, 0x16, ++ 0xc3, 0xe2, 0x32, 0x56, 0xb2, 0xe3, 0x64, 0x97, 0x4b, ++ 0xa8, 0x69, 0x22, 0x2c, 0x11, 0x9d, 0xd7, 0x0e, 0x17, ++ 0xdd, 0x4d, 0x76, 0x7c, 0x5c, 0x68, 0x63, 0x77, 0xaa, ++ 0xcc, 0xd8, 0x01, 0x12, 0xd7, 0x6e, 0xa0, 0x62, 0x8f, ++ 0x67, 0xf3, 0x69, 0x3f, 0xd7, 0x2e, 0x28, 0x93, 0x91, ++ 0x27, 0x5f, 0x36, 0xf3, 0x76, 0x95, 0xf2, 0x14, 0x78, ++ 0x58, 0xef, 0x75, 0x55, 0x1d, 0x2a, 0xd7, 0x37, 0x0c, ++ 0x8c, 0xbc, 0x2a, 0x52), ++ ++ WIRE_SENTINEL() ++ }; ++ check_rdata(text_ok, wire_ok, NULL, false, dns_rdataclass_in, ++ dns_rdatatype_rrsig, sizeof(dns_rdata_rrsig_t)); ++} ++ + ISC_RUN_TEST_IMPL(resinfo) { + text_ok_t text_ok[] = { + TEXT_VALID_CHANGED("qnamemin exterr=15,16,17 " +@@ -3357,6 +3466,7 @@ ISC_TEST_ENTRY(nsec3) + ISC_TEST_ENTRY(nxt) + ISC_TEST_ENTRY(resinfo) + ISC_TEST_ENTRY(rkey) ++ISC_TEST_ENTRY(rrsig) + ISC_TEST_ENTRY(sshfp) + ISC_TEST_ENTRY(wallet) + ISC_TEST_ENTRY(wks) +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-11721.patch b/bind-9.18-CVE-2026-11721.patch new file mode 100644 index 0000000..d59130b --- /dev/null +++ b/bind-9.18-CVE-2026-11721.patch @@ -0,0 +1,267 @@ +From 7a8a1f74c742e98fb5e105b013e7c2bd7af4a76c Mon Sep 17 00:00:00 2001 +From: Mark Andrews +Date: Tue, 14 Apr 2026 15:14:06 +1000 +Subject: [PATCH] Don't sign out of zone records in dnssec-signzone + +dnssec-signzone was signing extraneous records that were not within +the namespace of the zone. This no longer occurs. + +(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd) + +Don't sign out of zone records in dnssec-signzone + +dnssec-signzone was signing extraneous records that were not within +the namespace of the zone. This no longer occurs. + +(cherry picked from commit e45c9af7051421fd370f20ba8325199c606223fd) +(cherry picked from commit 1a4986e2533f87e80eb21da3f06708d335aff1e2) + +Invalid signed wildcard records were being accepted + +An RRSIG whose Labels field indicates fewer labels than its signer +name requires was being accepted. When such a record covers a +wildcard, the validator reconstructs a wildcard owner name above the +signer's zone and caches it as secure. RFC 8198 cache synthesis +(synth-from-dnssec) then serves that forged wildcard for unrelated +names, poisoning the cache. + +These records are now rejected, both when an RRSIG is parsed and when +its signature is verified. + +(cherry picked from commit 084ca5ee10515e461d46b63df9660b8394bc7de9) +(cherry picked from commit 15089066b15f826d7487c3d160b5872820f84b83) +--- + bin/dnssec/dnssec-signzone.c | 5 ++++ + lib/dns/dnssec.c | 43 +++++++++++++++++++++++--------- + lib/dns/rdata/generic/rrsig_46.c | 37 ++++++++++++++++++++------- + 3 files changed, 64 insertions(+), 21 deletions(-) + +diff --git a/bin/dnssec/dnssec-signzone.c b/bin/dnssec/dnssec-signzone.c +index 73855e6284..9e3a48a592 100644 +--- a/bin/dnssec/dnssec-signzone.c ++++ b/bin/dnssec/dnssec-signzone.c +@@ -1643,6 +1643,11 @@ assignwork(isc_task_t *task, isc_task_t *worker) { + dns_db_detachnode(gdb, &node); + goto next; + } ++ if (!dns_name_issubdomain(name, gorigin)) { ++ dumpnode(name, node); ++ dns_db_detachnode(gdb, &node); ++ goto next; ++ } + /* + * Sort the zone data from the glue and out-of-zone data. + * For NSEC zones nodes with zone data have NSEC records. +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index c7e922437c..b12529b5d5 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -130,11 +130,11 @@ dns_dnssec_keyfromrdata(const dns_name_t *name, const dns_rdata_t *rdata, + isc_buffer_t b; + isc_region_t r; + +- INSIST(name != NULL); +- INSIST(rdata != NULL); +- INSIST(mctx != NULL); +- INSIST(key != NULL); +- INSIST(*key == NULL); ++ REQUIRE(name != NULL); ++ REQUIRE(rdata != NULL); ++ REQUIRE(mctx != NULL); ++ REQUIRE(key != NULL); ++ REQUIRE(*key == NULL); + REQUIRE(rdata->type == dns_rdatatype_key || + rdata->type == dns_rdatatype_dnskey); + +@@ -187,12 +187,14 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + isc_result_t ret; + isc_buffer_t *databuf = NULL; + char data[256 + 8]; ++ unsigned int labels; + unsigned int sigsize; + dns_fixedname_t fnewname; + dns_fixedname_t fsigner; + + REQUIRE(name != NULL); +- REQUIRE(dns_name_countlabels(name) <= 255); ++ labels = dns_name_countlabels(name); ++ REQUIRE(labels <= 255 && labels > 0); + REQUIRE(set != NULL); + REQUIRE(key != NULL); + REQUIRE(inception != NULL); +@@ -221,7 +223,7 @@ dns_dnssec_sign(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + + sig.covered = set->type; + sig.algorithm = dst_key_alg(key); +- sig.labels = dns_name_countlabels(name) - 1; ++ sig.labels = labels - 1; + if (dns_name_iswildcard(name)) { + sig.labels--; + } +@@ -365,10 +367,13 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + isc_result_t ret; + unsigned char data[300]; + dst_context_t *ctx = NULL; +- int labels = 0; ++ unsigned int labels; ++ unsigned int siglabels; + bool downcase = false; + + REQUIRE(name != NULL); ++ labels = dns_name_countlabels(name); ++ REQUIRE(labels > 0); + REQUIRE(set != NULL); + REQUIRE(key != NULL); + REQUIRE(mctx != NULL); +@@ -383,6 +388,21 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + return DNS_R_SIGINVALID; + } + ++ /* ++ * The RRSIG labels field can't indicate fewer labels than the ++ * signer. Also the labels shouldn't be greater than that of ++ * the owner name. ++ * ++ * sig.labels doesn't include the root label, so add 1 to account ++ * for it. ++ */ ++ siglabels = sig.labels + 1; ++ if (siglabels < dns_name_countlabels(&sig.signer) || siglabels > labels) ++ { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_SIGINVALID; ++ } ++ + if (isc_serial_lt(sig.timeexpire, sig.timesigned)) { + inc_stat(dns_dnssecstats_fail); + return DNS_R_SIGINVALID; +@@ -449,10 +469,9 @@ again: + * If the name is an expanded wildcard, use the wildcard name. + */ + dns_fixedname_init(&fnewname); +- labels = dns_name_countlabels(name) - 1; + RUNTIME_CHECK(dns_name_downcase(name, dns_fixedname_name(&fnewname), + NULL) == ISC_R_SUCCESS); +- if (labels - sig.labels > 0) { ++ if (labels > siglabels) { + dns_name_split(dns_fixedname_name(&fnewname), sig.labels + 1, + NULL, dns_fixedname_name(&fnewname)); + } +@@ -463,7 +482,7 @@ again: + * Create an envelope for each rdata: . + */ + isc_buffer_init(&envbuf, data, sizeof(data)); +- if (labels - sig.labels > 0) { ++ if (labels > siglabels) { + isc_buffer_putuint8(&envbuf, 1); + isc_buffer_putuint8(&envbuf, '*'); + memmove(data + 2, r.base, r.length); +@@ -559,7 +578,7 @@ cleanup_struct: + inc_stat(dns_dnssecstats_fail); + } + +- if (ret == ISC_R_SUCCESS && labels - sig.labels > 0) { ++ if (ret == ISC_R_SUCCESS && labels > siglabels) { + if (wild != NULL) { + RUNTIME_CHECK(dns_name_concatenate( + dns_wildcardname, +diff --git a/lib/dns/rdata/generic/rrsig_46.c b/lib/dns/rdata/generic/rrsig_46.c +index 10bc039e93..4cf4259c2b 100644 +--- a/lib/dns/rdata/generic/rrsig_46.c ++++ b/lib/dns/rdata/generic/rrsig_46.c +@@ -23,12 +23,12 @@ + static isc_result_t + fromtext_rrsig(ARGS_FROMTEXT) { + isc_token_t token; +- unsigned char c; ++ unsigned char alg, labels; + long i; + dns_rdatatype_t covered; +- char *e; ++ char *e = NULL; + isc_result_t result; +- dns_name_t name; ++ dns_name_t signer; + isc_buffer_t buffer; + uint32_t time_signed, time_expire; + +@@ -61,8 +61,8 @@ fromtext_rrsig(ARGS_FROMTEXT) { + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + false)); +- RETTOK(dns_secalg_fromtext(&c, &token.value.as_textregion)); +- RETERR(mem_tobuffer(target, &c, 1)); ++ RETTOK(dns_secalg_fromtext(&alg, &token.value.as_textregion)); ++ RETERR(mem_tobuffer(target, &alg, 1)); + + /* + * Labels. +@@ -72,8 +72,8 @@ fromtext_rrsig(ARGS_FROMTEXT) { + if (token.value.as_ulong > 0xffU) { + RETTOK(ISC_R_RANGE); + } +- c = (unsigned char)token.value.as_ulong; +- RETERR(mem_tobuffer(target, &c, 1)); ++ labels = (unsigned char)token.value.as_ulong; ++ RETERR(mem_tobuffer(target, &labels, 1)); + + /* + * Original ttl. +@@ -144,12 +144,20 @@ fromtext_rrsig(ARGS_FROMTEXT) { + */ + RETERR(isc_lex_getmastertoken(lexer, &token, isc_tokentype_string, + false)); +- dns_name_init(&name, NULL); ++ dns_name_init(&signer, NULL); + buffer_fromregion(&buffer, &token.value.as_region); + if (origin == NULL) { + origin = dns_rootname; + } +- RETTOK(dns_name_fromtext(&name, &buffer, origin, options, target)); ++ RETTOK(dns_name_fromtext(&signer, &buffer, origin, options, target)); ++ ++ /* ++ * (RRSIG labels doesn't include the root label, so add one ++ * to normalize it before checking against the signer.) ++ */ ++ if ((unsigned int)(labels + 1) < dns_name_countlabels(&signer)) { ++ RETTOK(ISC_R_RANGE); ++ } + + /* + * Sig. +@@ -278,6 +286,7 @@ static isc_result_t + fromwire_rrsig(ARGS_FROMWIRE) { + isc_region_t sr; + dns_name_t name; ++ unsigned char labels; + + REQUIRE(type == dns_rdatatype_rrsig); + +@@ -300,6 +309,8 @@ fromwire_rrsig(ARGS_FROMWIRE) { + return ISC_R_UNEXPECTEDEND; + } + ++ labels = sr.base[3]; ++ + isc_buffer_forward(source, 18); + RETERR(mem_tobuffer(target, sr.base, 18)); + +@@ -309,6 +320,14 @@ fromwire_rrsig(ARGS_FROMWIRE) { + dns_name_init(&name, NULL); + RETERR(dns_name_fromwire(&name, source, dctx, options, target)); + ++ /* ++ * (RRSIG labels doesn't include the root label, so add one ++ * to normalize it before checking against the signer.) ++ */ ++ if ((unsigned int)(labels + 1) < dns_name_countlabels(&name)) { ++ RETERR(DNS_R_FORMERR); ++ } ++ + /* + * Sig. + */ +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index dce493d..97c1f00 100644 --- a/bind.spec +++ b/bind.spec @@ -173,6 +173,9 @@ Patch41: bind-9.18-CVE-2026-12617.patch Patch42: bind-9.18-CVE-2026-12617-test.patch # https://gitlab.isc.org/isc-projects/bind9/commit/14d23a4955c62efe974266a8e96a8c5d7caad040 Patch43: bind-9.18-CVE-2026-11622.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/58812f64bf14b3930f5bb90a2d0e1f59bc8260b4 +Patch44: bind-9.18-CVE-2026-11721.patch +Patch45: bind-9.18-CVE-2026-11721-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 7e9f5e27cccd5bc7d917505c4ab025e6c36aa11e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 13:22:35 +0200 Subject: [PATCH 138/144] Incorrect acceptance of NSEC3 records (CVE-2026-10723) [9.18] [CVE-2026-10723] sec: usr: Correct verification of NSEC3 signer name BIND 9 accepted child-zone NSEC3 records where the first label equals the hash of the parent zone as valid parent-zone closest encloser proofs. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. Closes isc-projects/bind9#5874 --- bind-9.18-CVE-2026-10723-test.patch | 854 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-10723.patch | 67 +++ bind.spec | 3 + 3 files changed, 924 insertions(+) create mode 100644 bind-9.18-CVE-2026-10723-test.patch create mode 100644 bind-9.18-CVE-2026-10723.patch diff --git a/bind-9.18-CVE-2026-10723-test.patch b/bind-9.18-CVE-2026-10723-test.patch new file mode 100644 index 0000000..04bff8a --- /dev/null +++ b/bind-9.18-CVE-2026-10723-test.patch @@ -0,0 +1,854 @@ +From 2a4786b0edde59274f682c9bd4ae4026c2d08218 Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Wed, 1 Jul 2026 22:56:02 -0700 +Subject: [PATCH] add isctest.mark method for ecdsa_deterinistic + +This checks support for ECDSA deterministic mode in the cryptography +library. + +(cherry picked from commit 6e44151466864d3dd783a20da83d01028781d3e2) +(cherry picked from commit dc3f52388427f4f94087d984d5a2088b925810e2) + +Reproducer for #5874 NSEC3 impersonation + +LLM generated. + +(cherry picked from commit f3e2eb333be3ac636f745aa13cfb8d9ee8af87d8) +(cherry picked from commit 35e3d49d2222c13786a06021c7ed583d2a656e51) + +Update reproducer #5874 + +Update the llm generated reproducer: +- Move server.py into ans1/ans.py +- Remove unnecessary named.conf configuration options +- Add comments describing the steps (copied from GL issue) +- Rename system test + +(cherry picked from commit c1321fef165a2ef8c2bff971901c58941e8e694c) +(cherry picked from commit 833dd3b230b92596074e8da15b12298f46c939f2) +--- + bin/tests/system/chain/ans3/ans.py | 10 +- + bin/tests/system/chain/ans4/ans.py | 8 +- + bin/tests/system/cookie/ans9/ans.py | 7 +- + bin/tests/system/digdelv/ans8/ans.py | 7 +- + bin/tests/system/dnssec/ans10/ans.py | 11 +- + bin/tests/system/forward/ans11/ans.py | 12 +- + bin/tests/system/isctest/mark.py | 12 + + .../system/nsec3_impersonation/ans1/ans.py | 280 ++++++++++++++++++ + .../nsec3_impersonation/ns2/named.conf.j2 | 33 +++ + .../tests_nsec3_impersonation.py | 152 ++++++++++ + bin/tests/system/qmin/ans2/ans.py | 11 +- + bin/tests/system/qmin/ans3/ans.py | 11 +- + bin/tests/system/qmin/ans4/ans.py | 11 +- + bin/tests/system/resolver/ans10/ans.py | 12 +- + 14 files changed, 529 insertions(+), 48 deletions(-) + create mode 100644 bin/tests/system/nsec3_impersonation/ans1/ans.py + create mode 100644 bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 + create mode 100644 bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py + +diff --git a/bin/tests/system/chain/ans3/ans.py b/bin/tests/system/chain/ans3/ans.py +index 0a031c1145..7c54c3c51a 100644 +--- a/bin/tests/system/chain/ans3/ans.py ++++ b/bin/tests/system/chain/ans3/ans.py +@@ -19,10 +19,10 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta +-import functools + +-import dns, dns.message, dns.query ++import dns ++import dns.message ++import dns.query + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -173,9 +173,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/chain/ans4/ans.py b/bin/tests/system/chain/ans4/ans.py +index c969117368..de536b25bd 100755 +--- a/bin/tests/system/chain/ans4/ans.py ++++ b/bin/tests/system/chain/ans4/ans.py +@@ -22,7 +22,9 @@ import select + from datetime import datetime, timedelta + import functools + +-import dns, dns.message, dns.query ++import dns ++import dns.message ++import dns.query + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -371,9 +373,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/cookie/ans9/ans.py b/bin/tests/system/cookie/ans9/ans.py +index 3b0f82cc1d..2710386d74 100644 +--- a/bin/tests/system/cookie/ans9/ans.py ++++ b/bin/tests/system/cookie/ans9/ans.py +@@ -15,9 +15,6 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta +-import time +-import functools + + import dns + import dns.edns +@@ -257,9 +254,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/digdelv/ans8/ans.py b/bin/tests/system/digdelv/ans8/ans.py +index 3e18edc1cc..1896a2bafc 100644 +--- a/bin/tests/system/digdelv/ans8/ans.py ++++ b/bin/tests/system/digdelv/ans8/ans.py +@@ -17,7 +17,8 @@ import socket + import select + import struct + +-import dns, dns.message ++import dns ++import dns.message + from dns.rcode import * + + modes = [ +@@ -109,9 +110,9 @@ hung_conns = [] + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/dnssec/ans10/ans.py b/bin/tests/system/dnssec/ans10/ans.py +index 84bf0a2642..46af72a147 100644 +--- a/bin/tests/system/dnssec/ans10/ans.py ++++ b/bin/tests/system/dnssec/ans10/ans.py +@@ -16,10 +16,11 @@ import signal + import socket + import select + from datetime import datetime, timedelta +-import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -140,9 +141,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/forward/ans11/ans.py b/bin/tests/system/forward/ans11/ans.py +index 00b5895f76..d5b8a5b037 100644 +--- a/bin/tests/system/forward/ans11/ans.py ++++ b/bin/tests/system/forward/ans11/ans.py +@@ -16,11 +16,11 @@ import signal + import socket + import select + import struct +-from datetime import datetime, timedelta +-import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -192,9 +192,9 @@ hung_conns = [] + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/isctest/mark.py b/bin/tests/system/isctest/mark.py +index 53860a806c..098af5acfc 100644 +--- a/bin/tests/system/isctest/mark.py ++++ b/bin/tests/system/isctest/mark.py +@@ -88,3 +88,15 @@ softhsm2_environment = pytest.mark.skipif( + ), + reason="SOFTHSM2_CONF and SOFTHSM2_MODULE environmental variables must be set and pkcs11-tool and softhsm2-util tools present", + ) ++ ++ecdsa_deterministic = False ++try: ++ from cryptography.hazmat.backends import default_backend ++ ++ ecdsa_deterministic = default_backend().ecdsa_deterministic_supported() ++except Exception: # pylint: disable=broad-except ++ pass ++ ++with_ecdsa_deterministic = pytest.mark.skipif( ++ not ecdsa_deterministic, reason="ECDSA deterministic signing is not supported" ++) +diff --git a/bin/tests/system/nsec3_impersonation/ans1/ans.py b/bin/tests/system/nsec3_impersonation/ans1/ans.py +new file mode 100644 +index 0000000000..177e79c195 +--- /dev/null ++++ b/bin/tests/system/nsec3_impersonation/ans1/ans.py +@@ -0,0 +1,280 @@ ++#!/usr/bin/python3 ++ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++# ++# This Source Code Form is subject to the terms of the Mozilla Public ++# License, v. 2.0. If a copy of the MPL was not distributed with this ++# file, you can obtain one at https://mozilla.org/MPL/2.0/. ++# ++# See the COPYRIGHT file distributed with this work for additional ++# information regarding copyright ownership. ++ ++from collections.abc import AsyncGenerator ++from dataclasses import dataclass ++from pathlib import Path ++ ++import json ++ ++from cryptography.hazmat.primitives import serialization ++ ++import dns.dnssec ++import dns.flags ++import dns.message ++import dns.name ++import dns.rcode ++import dns.rdata ++import dns.rdataclass ++import dns.rdatatype ++import dns.rrset ++ ++from isctest.asyncserver import ( ++ AsyncDnsServer, ++ DnsResponseSend, ++ QueryContext, ++ ResponseHandler, ++) ++ ++TTL = 300 ++TLD = "tld.test." ++APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ" ++ATTACKER = f"{APEX_HASH.lower()}.{TLD}" ++VICTIM = f"victim.{TLD}" ++AUTH_IP = "10.53.0.1" ++ ++ ++@dataclass(frozen=True) ++class Key: ++ zone: dns.name.Name ++ private_key: object ++ dnskey: dns.rdata.Rdata ++ ds: dns.rdata.Rdata ++ ++ ++def name(text: str) -> dns.name.Name: ++ return dns.name.from_text(text) ++ ++ ++def load_keys() -> dict[str, Key]: ++ path = Path(__file__).resolve().parent / "keys.json" ++ with path.open(encoding="utf-8") as keys_file: ++ raw_keys = json.load(keys_file) ++ ++ keys = {} ++ for zone, raw_key in raw_keys.items(): ++ private_key = serialization.load_pem_private_key( ++ raw_key["private_pem"].encode("ascii"), ++ password=None, ++ ) ++ dnskey = dns.rdata.from_text( ++ dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"] ++ ) ++ ds = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.DS, raw_key["ds"]) ++ keys[zone] = Key(name(zone), private_key, dnskey, ds) ++ ++ return keys ++ ++ ++def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset: ++ return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas) ++ ++ ++def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset: ++ return dns.rrset.from_rdata(name(owner), TTL, rdata) ++ ++ ++def rrsig_rrset(covered: dns.rrset.RRset, signer: Key) -> dns.rrset.RRset: ++ rrsig = dns.dnssec.sign( ++ covered, ++ signer.private_key, ++ signer.zone, ++ signer.dnskey, ++ lifetime=86400, ++ verify=True, ++ ) ++ return dns.rrset.from_rdata(covered.name, covered.ttl, rrsig) ++ ++ ++def add_signed( ++ section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key ++) -> None: ++ section.append(covered) ++ section.append(rrsig_rrset(covered, signer)) ++ ++ ++def dnskey_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset: ++ return rrset_from_rdata(zone, zone_key.dnskey) ++ ++ ++def ds_rrset(zone: str, zone_key: Key) -> dns.rrset.RRset: ++ return rrset_from_rdata(zone, zone_key.ds) ++ ++ ++def soa_rrset(zone: str) -> dns.rrset.RRset: ++ return rrset( ++ zone, ++ dns.rdatatype.SOA, ++ f"ns.{zone} hostmaster.{zone} 1 3600 600 86400 300", ++ ) ++ ++ ++def ns_rrset(zone: str, ns_target: str) -> dns.rrset.RRset: ++ return rrset(zone, dns.rdatatype.NS, ns_target) ++ ++ ++def glue_rrset(ns_target: str, address: str) -> dns.rrset.RRset: ++ return rrset(ns_target, dns.rdatatype.A, address) ++ ++ ++def answer_dnskey(response: dns.message.Message, zone: str, zone_key: Key) -> None: ++ add_signed(response.answer, dnskey_rrset(zone, zone_key), zone_key) ++ ++ ++def answer_soa(response: dns.message.Message, zone: str, zone_key: Key) -> None: ++ add_signed(response.answer, soa_rrset(zone), zone_key) ++ ++ ++def answer_ns( ++ response: dns.message.Message, zone: str, ns_target: str, zone_key: Key ++) -> None: ++ add_signed(response.answer, ns_rrset(zone, ns_target), zone_key) ++ ++ ++class SignedResponseHandler(ResponseHandler): ++ def __init__(self, keys: dict[str, Key]) -> None: ++ self.keys = keys ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[DnsResponseSend, None]: ++ qctx.prepare_new_response(with_zone_data=False) ++ qctx.response.flags |= dns.flags.AA ++ qctx.response.set_rcode(dns.rcode.NOERROR) ++ self.respond(qctx) ++ yield DnsResponseSend(qctx.response, authoritative=True) ++ ++ def respond(self, qctx: QueryContext) -> None: ++ raise NotImplementedError ++ ++ ++def child_nsec3_rrset() -> dns.rrset.RRset: ++ rdata = dns.rdata.from_text( ++ dns.rdataclass.IN, ++ dns.rdatatype.NSEC3, ++ f"1 0 0 - {APEX_HASH} NS SOA RRSIG DNSKEY NSEC3PARAM", ++ ) ++ return dns.rrset.from_rdata(name(f"{APEX_HASH}.{TLD}"), TTL, rdata) ++ ++ ++def forged_nxdomain(response: dns.message.Message, keys: dict[str, Key]) -> None: ++ response.set_rcode(dns.rcode.NXDOMAIN) ++ ++ add_signed(response.authority, soa_rrset(TLD), keys[TLD]) ++ ++ # The owner name derives zone "tld.test.", but the RRSIG signer is the ++ # malicious child zone "1b40241kforiog780n4ikscrlvetpctq.tld.test.". ++ add_signed(response.authority, child_nsec3_rrset(), keys[ATTACKER]) ++ ++ ++class VictimForgedNxdomainHandler(SignedResponseHandler): ++ """ ++ This serves the forged response for the victim's domain. ++ """ ++ ++ def match(self, qctx: QueryContext) -> bool: ++ return qctx.qname == name(VICTIM) and qctx.qtype == dns.rdatatype.A ++ ++ def respond(self, qctx: QueryContext) -> None: ++ forged_nxdomain(qctx.response, self.keys) ++ ++ ++class ChildDsHandler(SignedResponseHandler): ++ """ ++ This will spoof the response for the malicious zone when qtype is DS. ++ It is actually a validly signed DS response. ++ """ ++ ++ def match(self, qctx: QueryContext) -> bool: ++ return qctx.qname == name(ATTACKER) and qctx.qtype == dns.rdatatype.DS ++ ++ def respond(self, qctx: QueryContext) -> None: ++ response = qctx.response ++ zone = ATTACKER ++ child_key = self.keys[ATTACKER] ++ parent_key = self.keys[TLD] ++ ++ add_signed(response.answer, ds_rrset(zone, child_key), parent_key) ++ ++ ++class AttackerZoneHandler(SignedResponseHandler): ++ """ ++ Acts as the malicious authoritative name server. The zone being served ++ is the hashed label of the parent zone (tld.test). This will respond ++ for all queries qtype SOA, DNSKEY, NS at the apex. Any names below ++ the apex are answered with an NXDOMAIN with no NSEC or NSEC3 present. ++ """ ++ ++ def match(self, qctx: QueryContext) -> bool: ++ return qctx.qname.is_subdomain(name(ATTACKER)) ++ ++ def respond(self, qctx: QueryContext) -> None: ++ if qctx.qname == name(ATTACKER): ++ if qctx.qtype == dns.rdatatype.DNSKEY: ++ answer_dnskey(qctx.response, ATTACKER, self.keys[ATTACKER]) ++ elif qctx.qtype == dns.rdatatype.SOA: ++ answer_soa(qctx.response, ATTACKER, self.keys[ATTACKER]) ++ else: ++ answer_ns( ++ qctx.response, ATTACKER, f"ns.{ATTACKER}", self.keys[ATTACKER] ++ ) ++ qctx.response.additional.append(glue_rrset(f"ns.{ATTACKER}", AUTH_IP)) ++ return ++ ++ qctx.response.set_rcode(dns.rcode.NXDOMAIN) ++ add_signed(qctx.response.authority, soa_rrset(ATTACKER), self.keys[ATTACKER]) ++ ++ ++class TldZoneHandler(SignedResponseHandler): ++ """ ++ Acts as the TLD who is being used in the attack, but is not a standard ++ name server. It only responds with validly signed records for DNSKEY, SOA ++ and NS on the apex. Any names below the apex are answered with an NXDOMAIN ++ with no NSEC or NSEC3 present. ++ ++ If we turn this into a regular name server than the attack won't work. ++ The attack assumes that the adversary can inject these responses on-path. ++ """ ++ ++ def match(self, qctx: QueryContext) -> bool: ++ return qctx.qname.is_subdomain(name(TLD)) ++ ++ def respond(self, qctx: QueryContext) -> None: ++ if qctx.qname == name(TLD): ++ if qctx.qtype == dns.rdatatype.DNSKEY: ++ answer_dnskey(qctx.response, TLD, self.keys[TLD]) ++ elif qctx.qtype == dns.rdatatype.SOA: ++ answer_soa(qctx.response, TLD, self.keys[TLD]) ++ else: ++ answer_ns(qctx.response, TLD, "ns.tld.test.", self.keys[TLD]) ++ qctx.response.additional.append(glue_rrset("ns.tld.test.", AUTH_IP)) ++ return ++ ++ qctx.response.set_rcode(dns.rcode.NXDOMAIN) ++ add_signed(qctx.response.authority, soa_rrset(TLD), self.keys[TLD]) ++ ++ ++def main() -> None: ++ keys = load_keys() ++ server = AsyncDnsServer(default_aa=True) ++ server.install_response_handlers( ++ VictimForgedNxdomainHandler(keys), ++ ChildDsHandler(keys), ++ AttackerZoneHandler(keys), ++ TldZoneHandler(keys), ++ ) ++ server.run() ++ ++ ++if __name__ == "__main__": ++ main() +diff --git a/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 +new file mode 100644 +index 0000000000..2c9b0bba9e +--- /dev/null ++++ b/bin/tests/system/nsec3_impersonation/ns2/named.conf.j2 +@@ -0,0 +1,33 @@ ++// validating resolver ++ ++options { ++ query-source address 10.53.0.2; ++ notify-source 10.53.0.2; ++ transfer-source 10.53.0.2; ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.2; }; ++ listen-on-v6 { none; }; ++ recursion yes; ++ dnssec-validation yes; ++}; ++ ++controls { ++ inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; ++}; ++ ++include "../../_common/rndc.key"; ++ ++zone "." { ++ type hint; ++ file "../../_common/root.hint"; ++}; ++ ++zone "tld.test" { ++ type static-stub; ++ server-addresses { 10.53.0.1; }; ++}; ++ ++trust-anchors { ++ tld.test. static-key 257 3 13 "@TLD_DNSKEY@"; ++}; +diff --git a/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py +new file mode 100644 +index 0000000000..bd9bd275b6 +--- /dev/null ++++ b/bin/tests/system/nsec3_impersonation/tests_nsec3_impersonation.py +@@ -0,0 +1,152 @@ ++#!/usr/bin/python3 ++ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++# ++# This Source Code Form is subject to the terms of the Mozilla Public ++# License, v. 2.0. If a copy of the MPL was not distributed with this ++# file, you can obtain one at https://mozilla.org/MPL/2.0/. ++# ++# See the COPYRIGHT file distributed with this work for additional ++# information regarding copyright ownership. ++ ++from pathlib import Path ++ ++import json ++ ++from cryptography.hazmat.primitives import serialization ++from cryptography.hazmat.primitives.asymmetric import ec ++ ++import dns.dnssec ++import dns.flags ++import dns.name ++import dns.rdataclass ++import dns.rdatatype ++import pytest ++ ++import isctest ++import isctest.mark ++ ++APEX_HASH = "1B40241KFORIOG780N4IKSCRLVETPCTQ" ++ATTACKER = f"{APEX_HASH.lower()}.tld.test." ++VICTIM = "victim.tld.test." ++AUTH = "10.53.0.1" ++RESOLVER = "10.53.0.2" ++ ++pytestmark = [ ++ isctest.mark.with_ecdsa_deterministic, ++ pytest.mark.extra_artifacts( ++ [ ++ "ans*/ans.run", ++ "ans*/keys.json", ++ ] ++ ), ++] ++ ++ ++def _make_key(zone): ++ private_key = ec.generate_private_key(ec.SECP256R1()) ++ dnskey = dns.dnssec.make_dnskey( ++ private_key.public_key(), ++ algorithm="ECDSAP256SHA256", ++ flags=257, ++ ) ++ ds = dns.dnssec.make_ds(dns.name.from_text(zone), dnskey, "SHA256") ++ private_pem = private_key.private_bytes( ++ encoding=serialization.Encoding.PEM, ++ format=serialization.PrivateFormat.PKCS8, ++ encryption_algorithm=serialization.NoEncryption(), ++ ).decode("ascii") ++ return { ++ "private_pem": private_pem, ++ "dnskey": dnskey.to_text(), ++ "ds": ds.to_text(), ++ } ++ ++ ++def bootstrap(): ++ zones = ["tld.test.", ATTACKER] ++ keys = {zone: _make_key(zone) for zone in zones} ++ ++ Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii") ++ ++ tld_dnskey = "".join(keys["tld.test."]["dnskey"].split()[3:]) ++ return {"TLD_DNSKEY": tld_dnskey} ++ ++ ++def check_dnskey_response(zone): ++ query = isctest.query.create(zone, "DNSKEY") ++ response = isctest.query.tcp(query, AUTH) ++ ++ isctest.check.noerror(response) ++ assert response.flags & dns.flags.AA ++ assert ( ++ response.get_rrset( ++ response.answer, ++ dns.name.from_text(zone), ++ dns.rdataclass.IN, ++ dns.rdatatype.DNSKEY, ++ ) ++ is not None ++ ), response ++ ++ ++def check_ds_response(zone): ++ query = isctest.query.create(zone, "DS") ++ response = isctest.query.tcp(query, AUTH) ++ ++ isctest.check.noerror(response) ++ assert response.flags & dns.flags.AA ++ assert ( ++ response.get_rrset( ++ response.answer, ++ dns.name.from_text(zone), ++ dns.rdataclass.IN, ++ dns.rdatatype.DS, ++ ) ++ is not None ++ ), response ++ ++ ++def test_attack_responses(): ++ check_dnskey_response("tld.test.") ++ check_dnskey_response(ATTACKER) ++ check_ds_response(ATTACKER) ++ ++ query = isctest.query.create(VICTIM, "A") ++ response = isctest.query.tcp(query, AUTH) ++ ++ isctest.check.nxdomain(response) ++ assert response.flags & dns.flags.AA ++ ++ nsec3_owner = dns.name.from_text(f"{APEX_HASH}.tld.test.") ++ nsec3 = response.get_rrset( ++ response.authority, ++ nsec3_owner, ++ dns.rdataclass.IN, ++ dns.rdatatype.NSEC3, ++ ) ++ rrsig = response.get_rrset( ++ response.authority, ++ nsec3_owner, ++ dns.rdataclass.IN, ++ dns.rdatatype.RRSIG, ++ covers=dns.rdatatype.NSEC3, ++ ) ++ ++ assert nsec3 is not None, response ++ assert rrsig is not None, response ++ assert rrsig[0].signer == dns.name.from_text(ATTACKER) ++ ++ ++def test_nsec3_impersonation(): ++ """ ++ Reproducer for #5874: ++ F-006 DNSSEC Validation Bypass NSEC3 Apex Hash Label Parent Impersonation ++ """ ++ query = isctest.query.create(VICTIM, "A") ++ response = isctest.query.tcp(query, RESOLVER) ++ ++ isctest.check.noadflag(response) ++ isctest.check.servfail(response) +diff --git a/bin/tests/system/qmin/ans2/ans.py b/bin/tests/system/qmin/ans2/ans.py +index d372c2003b..9343fbc8ef 100755 +--- a/bin/tests/system/qmin/ans2/ans.py ++++ b/bin/tests/system/qmin/ans2/ans.py +@@ -15,11 +15,12 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta + import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -432,9 +433,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/qmin/ans3/ans.py b/bin/tests/system/qmin/ans3/ans.py +index b5ae73c3fa..4e7250790f 100755 +--- a/bin/tests/system/qmin/ans3/ans.py ++++ b/bin/tests/system/qmin/ans3/ans.py +@@ -15,11 +15,12 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta + import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -261,9 +262,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/qmin/ans4/ans.py b/bin/tests/system/qmin/ans4/ans.py +index 517217aec1..2d5556daff 100755 +--- a/bin/tests/system/qmin/ans4/ans.py ++++ b/bin/tests/system/qmin/ans4/ans.py +@@ -15,11 +15,12 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta + import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -320,9 +321,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +diff --git a/bin/tests/system/resolver/ans10/ans.py b/bin/tests/system/resolver/ans10/ans.py +index 6e95dbbfc6..d637c63e5a 100644 +--- a/bin/tests/system/resolver/ans10/ans.py ++++ b/bin/tests/system/resolver/ans10/ans.py +@@ -15,11 +15,11 @@ import sys + import signal + import socket + import select +-from datetime import datetime, timedelta +-import time +-import functools + +-import dns, dns.message, dns.query, dns.flags ++import dns ++import dns.message ++import dns.query ++import dns.flags + from dns.rdatatype import * + from dns.rdataclass import * + from dns.rcode import * +@@ -128,9 +128,9 @@ else: + while running: + try: + inputready, outputready, exceptready = select.select(input, [], []) +- except select.error as e: ++ except select.error: + break +- except socket.error as e: ++ except socket.error: + break + except KeyboardInterrupt: + break +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-10723.patch b/bind-9.18-CVE-2026-10723.patch new file mode 100644 index 0000000..a519b38 --- /dev/null +++ b/bind-9.18-CVE-2026-10723.patch @@ -0,0 +1,67 @@ +From 608026780a43abe5b23a9af3af21808369032158 Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Thu, 21 May 2026 14:41:55 -0700 +Subject: [PATCH] Check NSEC3 signer matches the owning zone + +When validating NSEC3 records, reject any signature whose signer field +does not match the zone owning the NSEC3. + +This ensures that a child zone cannot impersonate its parent and forge +NXDOMAIN responses for sibling domains. + +Fixes: isc-projects/bind9#5874 +(cherry picked from commit 6e5066bb1f0f12d090e8707adb7d6ccf74f8012b) +(cherry picked from commit c9cb6a5e24e43489cf3fd4d4cc2193b6a74499cb) +--- + lib/dns/dnssec.c | 19 +++++++++++++++++-- + lib/isc/result.c | 2 +- + 2 files changed, 18 insertions(+), 3 deletions(-) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index b12529b5d5..9b9b1f2bb2 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -424,10 +424,25 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + + /* +- * NS, SOA and DNSKEY records are signed by their owner. +- * DS records are signed by the parent. ++ * NS, SOA and DNSKEY records are signed by their owners. ++ * NSEC3 records are signed by the apex, exactly one level up ++ * from their owner names. ++ * DS records are signed by the parent zone. + */ + switch (set->type) { ++ case dns_rdatatype_nsec3: { ++ dns_name_t apex = DNS_NAME_INITEMPTY; ++ labels = dns_name_countlabels(name); ++ if (labels <= 1) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_INVALIDNSEC3; ++ } ++ dns_name_split(name, labels - 1, NULL, &apex); ++ if (!dns_name_equal(&apex, &sig.signer)) { ++ inc_stat(dns_dnssecstats_fail); ++ return DNS_R_SIGINVALID; ++ } ++ } break; + case dns_rdatatype_ns: + case dns_rdatatype_soa: + case dns_rdatatype_dnskey: +diff --git a/lib/isc/result.c b/lib/isc/result.c +index 83e8cfeed7..b76c3d1f7b 100644 +--- a/lib/isc/result.c ++++ b/lib/isc/result.c +@@ -198,7 +198,7 @@ static const char *description[ISC_R_NRESULTS] = { + [DNS_R_COVERINGNSEC] = "covering NSEC record returned", + [DNS_R_MXISADDRESS] = "MX is an address", + [DNS_R_DUPLICATE] = "duplicate query", +- [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name (wildcard)", ++ [DNS_R_INVALIDNSEC3] = "invalid NSEC3 owner name", + [DNS_R_NOTPRIMARY] = "not primary", + [DNS_R_BROKENCHAIN] = "broken trust chain", + [DNS_R_EXPIRED] = "expired", +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index 97c1f00..08b85ad 100644 --- a/bind.spec +++ b/bind.spec @@ -176,6 +176,9 @@ Patch43: bind-9.18-CVE-2026-11622.patch # https://gitlab.isc.org/isc-projects/bind9/commit/58812f64bf14b3930f5bb90a2d0e1f59bc8260b4 Patch44: bind-9.18-CVE-2026-11721.patch Patch45: bind-9.18-CVE-2026-11721-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/348fd47f7636f610a39ba98427fcacab8e62389b +Patch46: bind-9.18-CVE-2026-10723.patch +Patch47: bind-9.18-CVE-2026-10723-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 711c5c46ba5a4ac6163a69bda924cbf4410bf01c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 13:28:00 +0200 Subject: [PATCH 139/144] Unexpected exit with NSEC and NSEC3 both present (CVE-2026-13204) [9.18] [CVE-2026-13204] fix: usr: Prevent crash from malformed NSEC/NSEC3 response An assertion could be triggered by an improperly signed NOQNAME proof. This has been fixed. ISC thanks Qifan Zhang of Palo Alto Networks for reporting the issue. Closes https://gitlab.isc.org/isc-projects/bind9/-/issues/5985 --- bind-9.18-CVE-2026-13204-test.patch | 416 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-13204.patch | 158 +++++++++++ bind.spec | 3 + 3 files changed, 577 insertions(+) create mode 100644 bind-9.18-CVE-2026-13204-test.patch create mode 100644 bind-9.18-CVE-2026-13204.patch diff --git a/bind-9.18-CVE-2026-13204-test.patch b/bind-9.18-CVE-2026-13204-test.patch new file mode 100644 index 0000000..fc86b42 --- /dev/null +++ b/bind-9.18-CVE-2026-13204-test.patch @@ -0,0 +1,416 @@ +From 89e950d215e9922e5af6e3c69b9d6a8750346bb6 Mon Sep 17 00:00:00 2001 +From: Alessio Podda +Date: Fri, 12 Jun 2026 11:16:01 +0200 +Subject: [PATCH] Reproducer for #5985 addnoqname mismatch + +LLM generated. + +(cherry picked from commit 5f4de929b3e4749b6e32c51660be11c47c2514e6) +(cherry picked from commit 0cf010c153518f1f9831e201891ecba8d8ba65e1) + +Update reproducer #5985 + +Update the llm generated reproducer: +- Move server.py into ans/ans1.py +- Remove unncessary named.conf configuration options +- Add comments describing the steps +- Rename system test + +(cherry picked from commit fd539807829dd7d2eb76c8b503083f5d84fec6f0) +(cherry picked from commit 6c0e599ea85c0c53a4af09742e64e193da089bb4) +--- + .../dnssec_findnoqname_mismatch/ans1/ans.py | 207 ++++++++++++++++++ + .../ns2/named.conf.j2 | 33 +++ + .../tests_findnoqname_mismatch.py | 126 +++++++++++ + 3 files changed, 366 insertions(+) + create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py + create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 + create mode 100644 bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py + +diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py +new file mode 100644 +index 0000000000..b36fc831c8 +--- /dev/null ++++ b/bin/tests/system/dnssec_findnoqname_mismatch/ans1/ans.py +@@ -0,0 +1,207 @@ ++#!/usr/bin/python3 ++ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++ ++from collections.abc import AsyncGenerator ++from dataclasses import dataclass ++from datetime import datetime, timedelta, timezone ++from pathlib import Path ++ ++import base64 ++import json ++ ++from cryptography.hazmat.primitives import serialization ++ ++import dns.dnssec ++import dns.flags ++import dns.message ++import dns.name ++import dns.rdata ++import dns.rdataclass ++import dns.rcode ++import dns.rdatatype ++import dns.rrset ++ ++from isctest.asyncserver import ( ++ AsyncDnsServer, ++ DnsResponseSend, ++ QueryContext, ++ ResponseHandler, ++) ++ ++TTL = 300 ++ZONE = "f217.test." ++CHILD = f"evil.{ZONE}" ++ATTACK = f"www.{CHILD}" ++NSEC_OWNER = f"00000000.{CHILD}" ++NSEC_NEXT = f"zzz.{CHILD}" ++FORGED_A = "192.0.2.217" ++ ++ ++@dataclass(frozen=True) ++class Key: ++ zone: dns.name.Name ++ private_key: object ++ dnskey: dns.rdata.Rdata ++ ++ ++def name(text: str) -> dns.name.Name: ++ return dns.name.from_text(text) ++ ++ ++def load_key() -> Key: ++ path = Path(__file__).resolve().parent / "keys.json" ++ with path.open(encoding="utf-8") as keys_file: ++ raw_key = json.load(keys_file)[ZONE] ++ ++ private_key = serialization.load_pem_private_key( ++ raw_key["private_pem"].encode("ascii"), ++ password=None, ++ ) ++ dnskey = dns.rdata.from_text( ++ dns.rdataclass.IN, dns.rdatatype.DNSKEY, raw_key["dnskey"] ++ ) ++ return Key(name(ZONE), private_key, dnskey) ++ ++ ++def rrset(owner: str, rdtype: dns.rdatatype.RdataType, *rdatas: str) -> dns.rrset.RRset: ++ return dns.rrset.from_text(owner, TTL, dns.rdataclass.IN, rdtype, *rdatas) ++ ++ ++def rrset_from_rdata(owner: str, rdata: dns.rdata.Rdata) -> dns.rrset.RRset: ++ return dns.rrset.from_rdata(name(owner), TTL, rdata) ++ ++ ++def add_signed( ++ section: list[dns.rrset.RRset], covered: dns.rrset.RRset, signer: Key ++) -> None: ++ rrsig = dns.dnssec.sign( ++ covered, ++ signer.private_key, ++ signer.zone, ++ signer.dnskey, ++ lifetime=86400, ++ verify=True, ++ ) ++ section.append(covered) ++ section.append(dns.rrset.from_rdata(covered.name, covered.ttl, rrsig)) ++ ++ ++def soa_rrset(zone: str) -> dns.rrset.RRset: ++ return rrset( ++ zone, ++ dns.rdatatype.SOA, ++ f"ns.{ZONE} hostmaster.{ZONE} 1 7200 3600 1209600 300", ++ ) ++ ++ ++def garbage_rrsig( ++ owner: str, covered: dns.rdatatype.RdataType, labels: int, signer: str ++) -> dns.rrset.RRset: ++ now = datetime.now(timezone.utc) ++ inception = (now - timedelta(hours=1)).strftime("%Y%m%d%H%M%S") ++ expiration = (now + timedelta(days=1)).strftime("%Y%m%d%H%M%S") ++ signature = base64.b64encode(bytes(64)).decode("ascii") ++ text = ( ++ f"{dns.rdatatype.to_text(covered)} 13 {labels} {TTL} " ++ f"{expiration} {inception} 12345 {signer} {signature}" ++ ) ++ rdata = dns.rdata.from_text(dns.rdataclass.IN, dns.rdatatype.RRSIG, text) ++ return dns.rrset.from_rdata(name(owner), TTL, rdata) ++ ++ ++def add_ds_denial(response: dns.message.Message, key: Key) -> None: ++ add_signed(response.authority, soa_rrset(ZONE), key) ++ nsec = rrset(CHILD, dns.rdatatype.NSEC, f"ns.{ZONE} NS RRSIG NSEC") ++ add_signed(response.authority, nsec, key) ++ ++ ++def add_attack_answer(response: dns.message.Message) -> None: ++ """ ++ Crafted authoritative response to .evil.f217.hack./A ++ ++ ;; ANSWER ++ .evil.f217.hack. 300 IN A 192.0.2.217 ++ .evil.f217.hack. 300 IN RRSIG A 13 1 300 12345 evil.f217.hack. ++ ^^^ Labels = 1, qname has 4 labels, wildcard heuristic fires ++ ++ ;; AUTHORITY (single owner, three rdatasets in this wire order) ++ 00000000.evil.f217.hack. 300 IN NSEC zzz.evil.f217.hack. A RRSIG NSEC ++ 00000000.evil.f217.hack. 300 IN RRSIG NSEC 13 4 300 12345 evil.f217.hack. ++ 00000000.evil.f217.hack. 300 IN NSEC3 1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG ++ """ ++ # A + RRSIG ++ response.answer.append(rrset(ATTACK, dns.rdatatype.A, FORGED_A)) ++ response.answer.append(garbage_rrsig(ATTACK, dns.rdatatype.A, 1, CHILD)) ++ # NSEC ++ nsec = rrset( ++ NSEC_OWNER, ++ dns.rdatatype.NSEC, ++ f"{NSEC_NEXT} A RRSIG NSEC", ++ ) ++ response.authority.append(nsec) ++ # RRSIG(NSEC) ++ response.authority.append( ++ garbage_rrsig( ++ NSEC_OWNER, ++ dns.rdatatype.NSEC, ++ len(name(NSEC_OWNER).labels) - 1, ++ CHILD, ++ ) ++ ) ++ # NSEC3 ++ nsec3 = rrset( ++ NSEC_OWNER, ++ dns.rdatatype.NSEC3, ++ "1 0 0 - VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV A RRSIG", ++ ) ++ response.authority.append(nsec3) ++ ++ ++class RuntimeCheckHandler(ResponseHandler): ++ def __init__(self, key: Key) -> None: ++ self.key = key ++ self.zone = name(ZONE) ++ self.child = name(CHILD) ++ self.attack = name(ATTACK) ++ ++ def match(self, qctx: QueryContext) -> bool: ++ return qctx.qname.is_subdomain(self.zone) ++ ++ async def get_responses( ++ self, qctx: QueryContext ++ ) -> AsyncGenerator[DnsResponseSend, None]: ++ qctx.prepare_new_response(with_zone_data=False) ++ qctx.response.flags |= dns.flags.AA ++ qctx.response.set_rcode(dns.rcode.NOERROR) ++ ++ if qctx.qname == self.zone and qctx.qtype == dns.rdatatype.DNSKEY: ++ add_signed( ++ qctx.response.answer, ++ rrset_from_rdata(ZONE, self.key.dnskey), ++ self.key, ++ ) ++ elif qctx.qname == self.zone and qctx.qtype == dns.rdatatype.SOA: ++ add_signed(qctx.response.answer, soa_rrset(ZONE), self.key) ++ elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DS: ++ add_ds_denial(qctx.response, self.key) ++ elif qctx.qname == self.child and qctx.qtype == dns.rdatatype.DNSKEY: ++ qctx.response.authority.append(soa_rrset(CHILD)) ++ elif qctx.qname == self.attack and qctx.qtype == dns.rdatatype.A: ++ add_attack_answer(qctx.response) ++ else: ++ add_signed(qctx.response.authority, soa_rrset(ZONE), self.key) ++ ++ yield DnsResponseSend(qctx.response, authoritative=True) ++ ++ ++def main() -> None: ++ server = AsyncDnsServer(default_aa=True) ++ server.install_response_handlers(RuntimeCheckHandler(load_key())) ++ server.run() ++ ++ ++if __name__ == "__main__": ++ main() +diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 +new file mode 100644 +index 0000000000..f4fbd8a617 +--- /dev/null ++++ b/bin/tests/system/dnssec_findnoqname_mismatch/ns2/named.conf.j2 +@@ -0,0 +1,33 @@ ++// validating resolver ++ ++options { ++ query-source address 10.53.0.2; ++ notify-source 10.53.0.2; ++ transfer-source 10.53.0.2; ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.2; }; ++ listen-on-v6 { none; }; ++ recursion yes; ++ dnssec-validation yes; ++}; ++ ++controls { ++ inet 10.53.0.2 port @CONTROLPORT@ allow { any; } keys { rndc_key; }; ++}; ++ ++include "../../_common/rndc.key"; ++ ++zone "." { ++ type hint; ++ file "../../_common/root.hint"; ++}; ++ ++zone "f217.test" { ++ type static-stub; ++ server-addresses { 10.53.0.1; }; ++}; ++ ++trust-anchors { ++ f217.test. static-key 257 3 13 "@ZONE_DNSKEY@"; ++}; +diff --git a/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py +new file mode 100644 +index 0000000000..f3e332a360 +--- /dev/null ++++ b/bin/tests/system/dnssec_findnoqname_mismatch/tests_findnoqname_mismatch.py +@@ -0,0 +1,126 @@ ++#!/usr/bin/python3 ++ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++ ++from pathlib import Path ++ ++import json ++ ++from cryptography.hazmat.primitives import serialization ++from cryptography.hazmat.primitives.asymmetric import ec ++ ++import dns.dnssec ++import dns.name ++import dns.rdataclass ++import dns.rdatatype ++import pytest ++ ++import isctest ++import isctest.mark ++ ++ZONE = "f217.test." ++CHILD = f"evil.{ZONE}" ++ATTACK = f"www.{CHILD}" ++NSEC_OWNER = f"00000000.{CHILD}" ++FORGED_A = "192.0.2.217" ++AUTH = "10.53.0.1" ++RESOLVER = "10.53.0.2" ++ ++pytestmark = [ ++ isctest.mark.with_ecdsa_deterministic, ++ pytest.mark.extra_artifacts( ++ [ ++ "ans1/ans.run", ++ "ans1/keys.json", ++ ] ++ ), ++] ++ ++ ++def _make_key(): ++ private_key = ec.generate_private_key(ec.SECP256R1()) ++ dnskey = dns.dnssec.make_dnskey( ++ private_key.public_key(), ++ algorithm="ECDSAP256SHA256", ++ flags=257, ++ ) ++ private_pem = private_key.private_bytes( ++ encoding=serialization.Encoding.PEM, ++ format=serialization.PrivateFormat.PKCS8, ++ encryption_algorithm=serialization.NoEncryption(), ++ ).decode("ascii") ++ return { ++ "private_pem": private_pem, ++ "dnskey": dnskey.to_text(), ++ } ++ ++ ++def bootstrap(): ++ keys = {ZONE: _make_key()} ++ Path("ans1/keys.json").write_text(json.dumps(keys, indent=2), encoding="ascii") ++ zone_dnskey = "".join(keys[ZONE]["dnskey"].split()[3:]) ++ return {"ZONE_DNSKEY": zone_dnskey} ++ ++ ++def _query(server, qname, qtype): ++ query = isctest.query.create(qname, qtype) ++ return isctest.query.tcp(query, server, attempts=1, timeout=5) ++ ++ ++def _rrset(response, section, owner, rdtype, covers=None): ++ if covers is None: ++ return response.get_rrset( ++ section, dns.name.from_text(owner), dns.rdataclass.IN, rdtype ++ ) ++ return response.get_rrset( ++ section, ++ dns.name.from_text(owner), ++ dns.rdataclass.IN, ++ rdtype, ++ covers=covers, ++ ) ++ ++ ++def _has_a(response, section, owner, address): ++ rrset = _rrset(response, section, owner, dns.rdatatype.A) ++ return rrset is not None and any(rdata.address == address for rdata in rrset) ++ ++ ++def _check_rrsig(response, section, owner, rdtype, signer, labels=None): ++ rrsig = _rrset(response, section, owner, dns.rdatatype.RRSIG, covers=rdtype) ++ assert rrsig is not None, response.to_text() ++ assert rrsig[0].signer == dns.name.from_text(signer), response.to_text() ++ if labels is not None: ++ assert rrsig[0].labels == labels, response.to_text() ++ ++ ++def test_malicious_findnoqname_addnoqname_mismatch(): ++ response = _query(AUTH, ATTACK, "A") ++ isctest.check.noerror(response) ++ assert _has_a(response, response.answer, ATTACK, FORGED_A), response.to_text() ++ _check_rrsig(response, response.answer, ATTACK, dns.rdatatype.A, CHILD, labels=1) ++ ++ # Has NSEC ++ assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC) ++ _check_rrsig(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC, CHILD) ++ # Has NSEC3 ++ assert _rrset(response, response.authority, NSEC_OWNER, dns.rdatatype.NSEC3) ++ assert ( ++ _rrset( ++ response, ++ response.authority, ++ NSEC_OWNER, ++ dns.rdatatype.RRSIG, ++ covers=dns.rdatatype.NSEC3, ++ ) ++ is None ++ ) ++ ++ ++def test_resolver_findnoqname_addnoqname_mismatch(): ++ # Send one trigger query ++ _query(RESOLVER, ATTACK, "A") ++ response = _query(RESOLVER, ZONE, "SOA") ++ isctest.check.noerror(response) +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-13204.patch b/bind-9.18-CVE-2026-13204.patch new file mode 100644 index 0000000..d8ff262 --- /dev/null +++ b/bind-9.18-CVE-2026-13204.patch @@ -0,0 +1,158 @@ +From 895cac04332d85489ddf881b28e18e9956f6e348 Mon Sep 17 00:00:00 2001 +From: Evan Hunt +Date: Wed, 13 May 2026 20:45:57 -0700 +Subject: [PATCH] dns_rdataset_addnoqname() could find unsigned NSEC/NSEC3 + +The dns_rdatalist addnoqname() implementation searches for the first +NSEC or NSEC3 record in a message, then for the first RRSIG covering +that type in the same message. Previously, if no RRSIG for the type was +found, the function accepted the unsigned record. Now, it will instead +continue searching until an NSEC or NSEC3 that does have a matching +signature is found. + +When this function is called from validated() in resolver.c, a +non-success return code is now treated as an error instead of triggering +an assertion failure. + +Fixes: isc-projects/bind9#5985 +(cherry picked from commit 57cba571ee31311e54d8a11cb38094d439f04e09) +(cherry picked from commit 48f5aa5fb3746d6194edcc57e8792a8b3cc3b454) +--- + lib/dns/rbtdb.c | 10 +++++++--- + lib/dns/rdatalist.c | 33 ++++++++++++++++----------------- + lib/dns/resolver.c | 4 +++- + lib/ns/query.c | 3 +-- + 4 files changed, 27 insertions(+), 23 deletions(-) + +diff --git a/lib/dns/rbtdb.c b/lib/dns/rbtdb.c +index 0b8547950f..c922df557b 100644 +--- a/lib/dns/rbtdb.c ++++ b/lib/dns/rbtdb.c +@@ -6946,7 +6946,7 @@ delegating_type(dns_rbtdb_t *rbtdb, dns_rbtnode_t *node, + static isc_result_t + addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader, + uint32_t maxrrperset, dns_rdataset_t *rdataset) { +- struct noqname *noqname; ++ struct noqname *noqname = NULL; + isc_mem_t *mctx = rbtdb->common.mctx; + dns_name_t name; + dns_rdataset_t neg, negsig; +@@ -6958,7 +6958,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader, + dns_rdataset_init(&negsig); + + result = dns_rdataset_getnoqname(rdataset, &name, &neg, &negsig); +- RUNTIME_CHECK(result == ISC_R_SUCCESS); ++ if (result != ISC_R_SUCCESS) { ++ goto cleanup; ++ } + + noqname = isc_mem_get(mctx, sizeof(*noqname)); + dns_name_init(&noqname->name, NULL); +@@ -6984,7 +6986,9 @@ addnoqname(dns_rbtdb_t *rbtdb, rdatasetheader_t *newheader, + cleanup: + dns_rdataset_disassociate(&neg); + dns_rdataset_disassociate(&negsig); +- free_noqname(mctx, &noqname); ++ if (noqname != NULL) { ++ free_noqname(mctx, &noqname); ++ } + return result; + } + +diff --git a/lib/dns/rdatalist.c b/lib/dns/rdatalist.c +index 98036f9cb3..2cca8d64be 100644 +--- a/lib/dns/rdatalist.c ++++ b/lib/dns/rdatalist.c +@@ -192,6 +192,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) { + dns_rdataset_t *neg = NULL; + dns_rdataset_t *negsig = NULL; + dns_rdataset_t *rdset; ++ dns_rdataset_t *sigset; + dns_ttl_t ttl; + + REQUIRE(rdataset != NULL); +@@ -199,30 +200,27 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) { + for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL; + rdset = ISC_LIST_NEXT(rdset, link)) + { +- if (rdset->rdclass != rdataset->rdclass) { +- continue; +- } +- if (rdset->type == dns_rdatatype_nsec || +- rdset->type == dns_rdatatype_nsec3) ++ if (rdset->rdclass != rdataset->rdclass || ++ (rdset->type != dns_rdatatype_nsec && ++ rdset->type != dns_rdatatype_nsec3)) + { +- neg = rdset; ++ continue; + } +- } +- if (neg == NULL) { +- return ISC_R_NOTFOUND; +- } + +- for (rdset = ISC_LIST_HEAD(name->list); rdset != NULL; +- rdset = ISC_LIST_NEXT(rdset, link)) +- { +- if (rdset->type == dns_rdatatype_rrsig && +- rdset->covers == neg->type) ++ for (sigset = ISC_LIST_HEAD(name->list); sigset != NULL; ++ sigset = ISC_LIST_NEXT(sigset, link)) + { +- negsig = rdset; ++ if (sigset->type == dns_rdatatype_rrsig && ++ sigset->covers == rdset->type) ++ { ++ neg = rdset; ++ negsig = sigset; ++ break; ++ } + } + } + +- if (negsig == NULL) { ++ if (neg == NULL || negsig == NULL) { + return ISC_R_NOTFOUND; + } + /* +@@ -238,6 +236,7 @@ isc__rdatalist_addnoqname(dns_rdataset_t *rdataset, const dns_name_t *name) { + rdataset->ttl = neg->ttl = negsig->ttl = ttl; + rdataset->attributes |= DNS_RDATASETATTR_NOQNAME; + rdataset->private6 = name; ++ + return ISC_R_SUCCESS; + } + +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index 1f8b5058d1..059ce53a9e 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -5893,7 +5893,9 @@ validated(isc_task_t *task, isc_event_t *event) { + result = dns_rdataset_addnoqname( + vevent->rdataset, + vevent->proofs[DNS_VALIDATOR_NOQNAMEPROOF]); +- RUNTIME_CHECK(result == ISC_R_SUCCESS); ++ if (result != ISC_R_SUCCESS) { ++ goto noanswer_response; ++ } + INSIST(vevent->sigrdataset != NULL); + vevent->sigrdataset->ttl = vevent->rdataset->ttl; + if (vevent->proofs[DNS_VALIDATOR_CLOSESTENCLOSER] != NULL) { +diff --git a/lib/ns/query.c b/lib/ns/query.c +index 3bd7daf79c..2a2ba1daba 100644 +--- a/lib/ns/query.c ++++ b/lib/ns/query.c +@@ -7953,8 +7953,7 @@ query_addnoqnameproof(query_ctx_t *qctx) { + goto cleanup; + } + +- result = dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig); +- RUNTIME_CHECK(result == ISC_R_SUCCESS); ++ CHECK(dns_rdataset_getnoqname(qctx->noqname, fname, neg, negsig)); + + query_addrrset(qctx, &fname, &neg, &negsig, dbuf, + DNS_SECTION_AUTHORITY); +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index 08b85ad..80cdb0a 100644 --- a/bind.spec +++ b/bind.spec @@ -179,6 +179,9 @@ Patch45: bind-9.18-CVE-2026-11721-test.patch # https://gitlab.isc.org/isc-projects/bind9/commit/348fd47f7636f610a39ba98427fcacab8e62389b Patch46: bind-9.18-CVE-2026-10723.patch Patch47: bind-9.18-CVE-2026-10723-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/b9ff2c9a36bb678fd1393d4f932b35a6882cd2a8 +Patch48: bind-9.18-CVE-2026-13204.patch +Patch49: bind-9.18-CVE-2026-13204-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From a859b5175e62cc137d3e021d0b3342498db9faee Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 13:33:29 +0200 Subject: [PATCH 140/144] DNSSEC Validation Bypass via Out-of-Zone NSEC Next Field (CVE-2026-13321) [9.18] [CVE-2026-13321] sec: usr: Fix DNSSEC validation bypass via out-of-zone NSEC Next Field A malicious zone with out-of-zone NSEC next owner names can cause a DNSSEC validating resolver to cache such record and, if `synth-from-dnssec` is enabled, to generate negative answers for any zone that is covered by the range. ISC would like to thank Qifan Zhang of Palo Alto Networks for reporting the issue. Closes isc-projects/bind9#5873 --- bind-9.18-CVE-2026-13321-test.patch | 445 ++++++++++++++++++++++++++++ bind-9.18-CVE-2026-13321.patch | 277 +++++++++++++++++ bind.spec | 3 + 3 files changed, 725 insertions(+) create mode 100644 bind-9.18-CVE-2026-13321-test.patch create mode 100644 bind-9.18-CVE-2026-13321.patch diff --git a/bind-9.18-CVE-2026-13321-test.patch b/bind-9.18-CVE-2026-13321-test.patch new file mode 100644 index 0000000..df6ba04 --- /dev/null +++ b/bind-9.18-CVE-2026-13321-test.patch @@ -0,0 +1,445 @@ +From eaa35628f4a201049295a8944f4d28e8a1013199 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= +Date: Wed, 6 May 2026 16:54:57 +0300 +Subject: [PATCH] Add system test for out-of-zone nsec dnssec bypass + +A malicious zone with out-of-zone NSEC entries can get a DNSSEC +validating resolver's cache to cover the victim zone for non-existence +and prevent nameserver queries without DNSSEC failure. + +Test for this case with an `evil.test` zone that tries to cover the +`victim.test` zone. + +(cherry picked from commit 654f9773c0af59965c343bdfeb096b3dffe9dd53) +(cherry picked from commit c969ad2c17b43dd999e358bfeb280d3df6fab822) +--- + .../system/dnssec_bypass/ns1/named.conf.j2 | 31 ++++ + bin/tests/system/dnssec_bypass/ns1/root.db | 19 +++ + bin/tests/system/dnssec_bypass/ns1/test.db | 23 +++ + .../system/dnssec_bypass/ns2/named.conf.j2 | 26 +++ + bin/tests/system/dnssec_bypass/ns2/victim.db | 18 +++ + bin/tests/system/dnssec_bypass/ns3/evil.db | 23 +++ + .../system/dnssec_bypass/ns3/named.conf.j2 | 26 +++ + .../system/dnssec_bypass/ns4/named.conf.j2 | 35 ++++ + .../system/dnssec_bypass/tests_bypass.py | 152 ++++++++++++++++++ + 9 files changed, 353 insertions(+) + create mode 100644 bin/tests/system/dnssec_bypass/ns1/named.conf.j2 + create mode 100644 bin/tests/system/dnssec_bypass/ns1/root.db + create mode 100644 bin/tests/system/dnssec_bypass/ns1/test.db + create mode 100644 bin/tests/system/dnssec_bypass/ns2/named.conf.j2 + create mode 100644 bin/tests/system/dnssec_bypass/ns2/victim.db + create mode 100644 bin/tests/system/dnssec_bypass/ns3/evil.db + create mode 100644 bin/tests/system/dnssec_bypass/ns3/named.conf.j2 + create mode 100644 bin/tests/system/dnssec_bypass/ns4/named.conf.j2 + create mode 100644 bin/tests/system/dnssec_bypass/tests_bypass.py + +diff --git a/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 +new file mode 100644 +index 0000000000..59ced1831a +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns1/named.conf.j2 +@@ -0,0 +1,31 @@ ++/* ++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ * ++ * SPDX-License-Identifier: MPL-2.0 ++ * ++ * This Source Code Form is subject to the terms of the Mozilla Public ++ * License, v. 2.0. If a copy of the MPL was not distributed with this ++ * file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ * ++ * See the COPYRIGHT file distributed with this work for additional ++ * information regarding copyright ownership. ++ */ ++ ++options { ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.1; }; ++ listen-on-v6 { none; }; ++ recursion no; ++ dnssec-validation no; ++}; ++ ++zone "test." { ++ type primary; ++ file "test.db.signed"; ++}; ++ ++zone "." { ++ type primary; ++ file "root.db.signed"; ++}; +diff --git a/bin/tests/system/dnssec_bypass/ns1/root.db b/bin/tests/system/dnssec_bypass/ns1/root.db +new file mode 100644 +index 0000000000..8d98a0456c +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns1/root.db +@@ -0,0 +1,19 @@ ++; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++; ++; SPDX-License-Identifier: MPL-2.0 ++; ++; This Source Code Form is subject to the terms of the Mozilla Public ++; License, v. 2.0. If a copy of the MPL was not distributed with this ++; file, you can obtain one at https://mozilla.org/MPL/2.0/. ++; ++; See the COPYRIGHT file distributed with this work for additional ++; information regarding copyright ownership. ++ ++$TTL 3600 ++. IN SOA a.nil. a.nil. 1 3600 600 86400 300 ++. IN NS a.root-servers.nil. ++ ++a.root-servers.nil. IN A 10.53.0.1 ++ ++test. IN NS ns1.test. ++ns1.test. IN A 10.53.0.1 +diff --git a/bin/tests/system/dnssec_bypass/ns1/test.db b/bin/tests/system/dnssec_bypass/ns1/test.db +new file mode 100644 +index 0000000000..6efcd95e42 +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns1/test.db +@@ -0,0 +1,23 @@ ++; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++; ++; SPDX-License-Identifier: MPL-2.0 ++; ++; This Source Code Form is subject to the terms of the Mozilla Public ++; License, v. 2.0. If a copy of the MPL was not distributed with this ++; file, you can obtain one at https://mozilla.org/MPL/2.0/. ++; ++; See the COPYRIGHT file distributed with this work for additional ++; information regarding copyright ownership. ++ ++$ORIGIN test. ++$TTL 3600 ++ ++@ IN SOA a a 1 3600 600 86400 300 ++ IN NS ns1.test. ++ns1 IN A 10.53.0.1 ++ ++evil IN NS ns1.evil ++ns1.evil IN A 10.53.0.3 ++ ++victim IN NS ns1.victim ++ns1.victim IN A 10.53.0.2 +diff --git a/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 +new file mode 100644 +index 0000000000..e81cee7cac +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns2/named.conf.j2 +@@ -0,0 +1,26 @@ ++/* ++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ * ++ * SPDX-License-Identifier: MPL-2.0 ++ * ++ * This Source Code Form is subject to the terms of the Mozilla Public ++ * License, v. 2.0. If a copy of the MPL was not distributed with this ++ * file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ * ++ * See the COPYRIGHT file distributed with this work for additional ++ * information regarding copyright ownership. ++ */ ++ ++options { ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.2; }; ++ listen-on-v6 { none; }; ++ recursion no; ++ dnssec-validation no; ++}; ++ ++zone "victim.test." { ++ type primary; ++ file "victim.db.signed"; ++}; +diff --git a/bin/tests/system/dnssec_bypass/ns2/victim.db b/bin/tests/system/dnssec_bypass/ns2/victim.db +new file mode 100644 +index 0000000000..edcc234322 +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns2/victim.db +@@ -0,0 +1,18 @@ ++; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++; ++; SPDX-License-Identifier: MPL-2.0 ++; ++; This Source Code Form is subject to the terms of the Mozilla Public ++; License, v. 2.0. If a copy of the MPL was not distributed with this ++; file, you can obtain one at https://mozilla.org/MPL/2.0/. ++; ++; See the COPYRIGHT file distributed with this work for additional ++; information regarding copyright ownership. ++ ++$ORIGIN victim.test. ++$TTL 3600 ++ ++@ IN SOA ns1 hostmaster 1 3600 600 86400 2147483647 ++ IN NS ns1 ++ ++ns1 IN A 10.53.0.2 +diff --git a/bin/tests/system/dnssec_bypass/ns3/evil.db b/bin/tests/system/dnssec_bypass/ns3/evil.db +new file mode 100644 +index 0000000000..618f9d3e85 +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns3/evil.db +@@ -0,0 +1,23 @@ ++; Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++; ++; SPDX-License-Identifier: MPL-2.0 ++; ++; This Source Code Form is subject to the terms of the Mozilla Public ++; License, v. 2.0. If a copy of the MPL was not distributed with this ++; file, you can obtain one at https://mozilla.org/MPL/2.0/. ++; ++; See the COPYRIGHT file distributed with this work for additional ++; information regarding copyright ownership. ++ ++$ORIGIN evil.test. ++$TTL 300 ++ ++@ IN SOA ns1 hostmaster 1 3600 600 86400 300 ++ IN NS ns1 ++; Try to poison the victim zone in a resolver cache. ++; If admitted, the aggressive NSEC cache will accept a range such as ++; [evil.test, b.victim.test) and will cause the victim nameserver to ++; be never queried. ++ IN NSEC b.victim.test. NS SOA RRSIG NSEC DNSKEY ++ ++ns1 IN A 10.53.0.3 +diff --git a/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 +new file mode 100644 +index 0000000000..17d3e18e4e +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns3/named.conf.j2 +@@ -0,0 +1,26 @@ ++/* ++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ * ++ * SPDX-License-Identifier: MPL-2.0 ++ * ++ * This Source Code Form is subject to the terms of the Mozilla Public ++ * License, v. 2.0. If a copy of the MPL was not distributed with this ++ * file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ * ++ * See the COPYRIGHT file distributed with this work for additional ++ * information regarding copyright ownership. ++ */ ++ ++options { ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.3; }; ++ listen-on-v6 { none; }; ++ recursion no; ++ dnssec-validation no; ++}; ++ ++zone "evil.test." { ++ type primary; ++ file "evil.db.signed"; ++}; +diff --git a/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 +new file mode 100644 +index 0000000000..039695d9b7 +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/ns4/named.conf.j2 +@@ -0,0 +1,35 @@ ++/* ++ * Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++ * ++ * SPDX-License-Identifier: MPL-2.0 ++ * ++ * This Source Code Form is subject to the terms of the Mozilla Public ++ * License, v. 2.0. If a copy of the MPL was not distributed with this ++ * file, you can obtain one at https://mozilla.org/MPL/2.0/. ++ * ++ * See the COPYRIGHT file distributed with this work for additional ++ * information regarding copyright ownership. ++ */ ++ ++options { ++ query-source address 10.53.0.4; ++ notify-source 10.53.0.4; ++ transfer-source 10.53.0.4; ++ port @PORT@; ++ pid-file "named.pid"; ++ listen-on { 10.53.0.4; }; ++ listen-on-v6 { none; }; ++ allow-transfer { any; }; ++ recursion yes; ++ dnssec-validation yes; ++ synth-from-dnssec yes; ++}; ++ ++trust-anchors { ++ @root.domain@ @root.type@ @root.contents@; ++}; ++ ++zone "." { ++ type hint; ++ file "../../_common/root.hint"; ++}; +diff --git a/bin/tests/system/dnssec_bypass/tests_bypass.py b/bin/tests/system/dnssec_bypass/tests_bypass.py +new file mode 100644 +index 0000000000..c41bb7e016 +--- /dev/null ++++ b/bin/tests/system/dnssec_bypass/tests_bypass.py +@@ -0,0 +1,152 @@ ++# Copyright (C) Internet Systems Consortium, Inc. ("ISC") ++# ++# SPDX-License-Identifier: MPL-2.0 ++# ++# This Source Code Form is subject to the terms of the Mozilla Public ++# License, v. 2.0. If a copy of the MPL was not distributed with this ++# file, you can obtain one at https://mozilla.org/MPL/2.0/. ++# ++# See the COPYRIGHT file distributed with this work for additional ++# information regarding copyright ownership. ++ ++from datetime import datetime, timedelta, timezone ++ ++import shutil ++ ++from cryptography.hazmat.primitives.asymmetric import ec ++ ++import dns.dnssec ++import dns.name ++import dns.rdataclass ++import dns.rdataset ++import dns.rdatatype ++import dns.rrset ++import dns.zone ++ ++from isctest.run import EnvCmd ++ ++import isctest ++ ++TTL = 3600 ++ ++ ++def bootstrap(): ++ keygen = EnvCmd("KEYGEN", "-q -a ECDSA256") ++ signer = EnvCmd("SIGNER", "-S -g -O full") ++ ++ def sign_regular_zone(ns: str, zone: str, database: str) -> isctest.kasp.Key: ++ isctest.log.info(f"{zone}: generate keys") ++ keygen(zone, cwd=ns).out.strip() ++ ksk = keygen(f"-f KSK {zone}", cwd=ns).out.strip() ++ ++ isctest.log.info(f"{zone}: sign zone") ++ signer(f"-o {zone} {database}", cwd=ns) ++ ++ if ns != "ns1": ++ shutil.copy(f"{ns}/dsset-{zone}", f"ns1/dsset-{zone}") ++ shutil.copy(f"{ns}/{ksk}.key", f"ns1/{ksk}.key") ++ ++ return isctest.kasp.Key(ksk, keydir=ns) ++ ++ # dnssec-signzone and `dns.dnssec.sign_zone` correctly disregard the invalid ++ # NSEC entries when signing the zone. However, for this test we actualy *want* ++ # to serve invalid yet signed zones. To accomplish this we sign the zone and then ++ # replace the correct entries with the faulty ones accompanied by its RRSIG. ++ # ++ # TODO(aydin): move this to `isctest` to sign broken zones ++ def sign_rogue_zone(ns: str, zone: str, database: str) -> None: ++ # Read zone. ++ origin = dns.name.from_text(zone) ++ data = dns.zone.from_file(f"{ns}/{database}", origin=origin, relativize=False) ++ ++ # Get key for signing. ++ isctest.log.info(f"{zone}: generate keys") ++ private_key = ec.generate_private_key(ec.SECP256R1()) ++ dnskey = dns.dnssec.make_dnskey( ++ public_key=private_key.public_key(), ++ algorithm=dns.dnssec.Algorithm.ECDSAP256SHA256, ++ flags=257, ++ ) ++ ++ # Sign zone. ++ isctest.log.info(f"{zone}: sign zone") ++ now = datetime.now(timezone.utc) ++ inception = now - timedelta(hours=1) ++ expiration = now + timedelta(days=30) ++ ++ for name, node in data.nodes.items(): ++ owner = name.derelativize(origin) ++ rdatasets = list(node.rdatasets) ++ ++ for rdataset in rdatasets: ++ rrset = dns.rrset.RRset(owner, rdataset.rdclass, rdataset.rdtype) ++ rrset.update(rdataset) ++ ++ rrsig = dns.dnssec.sign( ++ rrset=rrset, ++ private_key=private_key, ++ signer=origin, ++ dnskey=dnskey, ++ inception=inception, ++ expiration=expiration, ++ deterministic=False, ++ ) ++ ++ rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG) ++ rdataset.add(rrsig, rrset.ttl) ++ node.replace_rdataset(rdataset) ++ ++ # Sign DNSKEY RRset. ++ dnskey_rrset = dns.rrset.RRset(origin, dns.rdataclass.IN, dns.rdatatype.DNSKEY) ++ dnskey_rrset.add(dnskey, ttl=TTL) ++ ++ apex_node = data.nodes[origin] ++ apex_node.replace_rdataset(dnskey_rrset) ++ ++ rrsig = dns.dnssec.sign( ++ rrset=dnskey_rrset, ++ private_key=private_key, ++ signer=origin, ++ dnskey=dnskey, ++ inception=inception, ++ expiration=expiration, ++ deterministic=False, ++ ) ++ rdataset = dns.rdataset.Rdataset(rrset.rdclass, dns.rdatatype.RRSIG) ++ rdataset.add(rrsig, dnskey_rrset.ttl) ++ apex_node.replace_rdataset(rdataset) ++ ++ # Output zone. ++ data.to_file(f"{ns}/{database}.signed", relativize=False) ++ ++ # Output DS. ++ ds = dns.dnssec.make_ds(name=origin, key=dnskey, algorithm="SHA256") ++ with open(f"ns1/dsset-{zone}", "w", encoding="utf-8") as f: ++ f.write(f"{zone} {TTL} IN DS {ds.to_text()}\n") ++ ++ sign_rogue_zone("ns3", "evil.test.", "evil.db") ++ sign_regular_zone("ns2", "victim.test.", "victim.db") ++ sign_regular_zone("ns1", "test.", "test.db") ++ root_ksk = sign_regular_zone("ns1", ".", "root.db") ++ ++ return { ++ "root": root_ksk.into_ta("static-key"), ++ } ++ ++ ++def test_out_of_zone_nsec(ns4): ++ isctest.log.info("trying to poison aggressive nsec cache") ++ msg = isctest.query.create("nx.evil.test", "A") ++ res = isctest.query.tcp(msg, ns4.ip) ++ isctest.check.noadflag(res) ++ ++ isctest.log.info("query victim from recursive") ++ msg = isctest.query.create("victim.test", "SOA") ++ res = isctest.query.tcp(msg, ns4.ip, attempts=1) ++ isctest.check.noerror(res) ++ isctest.check.adflag(res) ++ isctest.check.rr_count_eq(res.answer, 2) ++ ++ isctest.log.info("checking for query history on victim nameserver") ++ with open("ns2/named.run", "r", encoding="utf-8") as f: ++ assert "(victim.test): query 'victim.test/SOA/IN' approved" in f.read() +-- +2.55.0 + diff --git a/bind-9.18-CVE-2026-13321.patch b/bind-9.18-CVE-2026-13321.patch new file mode 100644 index 0000000..8a09ff1 --- /dev/null +++ b/bind-9.18-CVE-2026-13321.patch @@ -0,0 +1,277 @@ +From 72967445f37a01d28b4ecb0e8f907e22fddd5087 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Ayd=C4=B1n=20Mercan?= +Date: Thu, 7 May 2026 18:59:20 +0300 +Subject: [PATCH] Reject out-of-zone NSEC next owner names + +When verifying DNSSEC records, make sure that a next owner name of +an NSEC record is a subdomain of the signer field. + +This follows the specification RFC 4034, section 4.1.1: + + Owner names of RRsets for which the given zone is not authoritative + (such as glue records) MUST NOT be listed in the Next Domain Name + unless at least one authoritative RRset exists at the same owner + name. + +While the above paragraph is intended for glue records, it also +applies to out-of-zone data. + +(cherry picked from commit 4065512d25b71605b9502bb69dfb903776d35aa9) +(cherry picked from commit 058023c66f11d78590d4aa8c4f98946c4c965e21) + +change dns_nsec_requiredtypespresent to dns_nsec_is_legal + +Change `dns_nsec_requiredtypespresent` to `dns_nsec_is_legal` as a +function for checking multiple NSEC validity rules. + +Currently we now additionally check for out-of-zone NSEC entries. + +(cherry picked from commit be2a6a497312469890b552907d039d2de0b44ccc) +(cherry picked from commit f751e19a30d107f04c2f644aff9f8dab8fed03ab) +--- + lib/dns/dnssec.c | 13 ++++++++++ + lib/dns/include/dns/dnssec.h | 6 +++++ + lib/dns/include/dns/nsec.h | 18 ++++++++++---- + lib/dns/nsec.c | 17 ++++++++++--- + lib/dns/resolver.c | 48 ++++++++++++++++++++++++++++++++++-- + lib/ns/query.c | 6 ++--- + 6 files changed, 94 insertions(+), 14 deletions(-) + +diff --git a/lib/dns/dnssec.c b/lib/dns/dnssec.c +index 9b9b1f2bb2..5acaea9ecb 100644 +--- a/lib/dns/dnssec.c ++++ b/lib/dns/dnssec.c +@@ -357,8 +357,10 @@ isc_result_t + dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + bool ignoretime, unsigned int maxbits, isc_mem_t *mctx, + dns_rdata_t *sigrdata, dns_name_t *wild) { ++ dns_rdata_nsec_t nsec; + dns_rdata_rrsig_t sig; + dns_fixedname_t fnewname; ++ dns_rdata_t rdata = DNS_RDATA_INIT; + isc_region_t r; + isc_buffer_t envbuf; + dns_rdata_t *rdatas; +@@ -464,6 +466,17 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + } + break; + } ++ /* ++ * Check for out of zone NSEC entries. ++ */ ++ if (set->type == dns_rdatatype_nsec) { ++ RETERR(dns_rdataset_first(set)); ++ dns_rdataset_current(set, &rdata); ++ RETERR(dns_rdata_tostruct(&rdata, &nsec, NULL)); ++ if (!dns_name_issubdomain(&nsec.next, &sig.signer)) { ++ return DNS_R_NOVALIDNSEC; ++ } ++ } + + again: + ret = dst_context_create(key, mctx, DNS_LOGCATEGORY_DNSSEC, false, +diff --git a/lib/dns/include/dns/dnssec.h b/lib/dns/include/dns/dnssec.h +index cb8fd9dc20..2be11b9144 100644 +--- a/lib/dns/include/dns/dnssec.h ++++ b/lib/dns/include/dns/dnssec.h +@@ -151,6 +151,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + * this record, as this requires a resolver or database. + * If 'ignoretime' is true, temporal validity will not be checked. + * ++ * If 'set' is of type NSEC, this function also verifies that the ++ * Next Name is a subdomain of the Signer's Name from 'sigrdata'. ++ * + * 'maxbits' specifies the maximum number of rsa exponent bits accepted. + * + * Requires: +@@ -173,6 +176,9 @@ dns_dnssec_verify(const dns_name_t *name, dns_rdataset_t *set, dst_key_t *key, + *\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data (either + * it is not a zone key or its flags prevent + * authentication) ++ * ++ *\li #DNS_R_NOVALIDNSEC - the NSEC rdata is not valid ++ *\li #DNS_R_KEYUNAUTHORIZED - the key cannot sign this data + *\li DST_R_* + */ + +diff --git a/lib/dns/include/dns/nsec.h b/lib/dns/include/dns/nsec.h +index 50df8e45f1..1e71bf14e8 100644 +--- a/lib/dns/include/dns/nsec.h ++++ b/lib/dns/include/dns/nsec.h +@@ -119,13 +119,21 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name, + */ + + bool +-dns_nsec_requiredtypespresent(dns_rdataset_t *rdataset); +-/* +- * Return true if all the NSEC records in rdataset have both +- * NSEC and RRSIG present. ++dns_nsec_is_legal(dns_rdataset_t *rdataset, const dns_name_t *name); ++/**< ++ * \brief ++ * Validates a rdataset of type NSEC. + * +- * Requires: ++ * This functions checks for the following in the given rdataset: ++ * \li All NSEC records have both NSEC and RRSIG present ++ * \li All NSEC entries are under the `name` ++ * ++ * \par Requires: + * \li rdataset to be a NSEC rdataset. ++ * \li `name` is a valid dns_name_t ++ * ++ * \retval true if all the checks pass ++ * \retval false otherwise + */ + + ISC_LANG_ENDDECLS +diff --git a/lib/dns/nsec.c b/lib/dns/nsec.c +index 80ee8d7d58..5abcce5f7f 100644 +--- a/lib/dns/nsec.c ++++ b/lib/dns/nsec.c +@@ -21,6 +21,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -497,8 +498,9 @@ dns_nsec_noexistnodata(dns_rdatatype_t type, const dns_name_t *name, + } + + bool +-dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) { +- dns_rdataset_t rdataset; ++dns_nsec_is_legal(dns_rdataset_t *nsecset, const dns_name_t *name) { ++ dns_rdataset_t rdataset = DNS_RDATASET_INIT; ++ dns_rdata_nsec_t nsec; + isc_result_t result; + bool found = false; + +@@ -513,12 +515,19 @@ dns_nsec_requiredtypespresent(dns_rdataset_t *nsecset) { + { + dns_rdata_t rdata = DNS_RDATA_INIT; + dns_rdataset_current(&rdataset, &rdata); +- if (!dns_nsec_typepresent(&rdata, dns_rdatatype_nsec) || +- !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig)) ++ ++ /* must never fail */ ++ result = dns_rdata_tostruct(&rdata, &nsec, NULL); ++ INSIST(result == ISC_R_SUCCESS); ++ ++ if (!dns_name_issubdomain(&nsec.next, name) || ++ !dns_nsec_typepresent(&rdata, dns_rdatatype_rrsig) || ++ !dns_nsec_typepresent(&rdata, dns_rdatatype_nsec)) + { + dns_rdataset_disassociate(&rdataset); + return false; + } ++ + found = true; + } + dns_rdataset_disassociate(&rdataset); +diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c +index 059ce53a9e..eac67f7a19 100644 +--- a/lib/dns/resolver.c ++++ b/lib/dns/resolver.c +@@ -65,7 +65,9 @@ + #include + #include + #include ++#include + #include ++#include + #include + + /* Detailed logging of fctx attach/detach */ +@@ -5603,6 +5605,36 @@ fctx_setresult(fetchctx_t *fctx, dns_rdataset_t *rdataset) { + return result; + } + ++static bool ++get_and_check_signer_name(dns_name_t *signer, dns_rdataset_t *sigrdataset) { ++ dns_rdata_rrsig_t rrsig; ++ isc_result_t result; ++ dns_rdata_t rdata; ++ ++ if (dns_rdataset_first(sigrdataset) != ISC_R_SUCCESS) { ++ return false; ++ } ++ ++ rdata = (dns_rdata_t)DNS_RDATA_INIT; ++ dns_rdataset_current(sigrdataset, &rdata); ++ result = dns_rdata_tostruct(&rdata, &rrsig, NULL); ++ INSIST(result == ISC_R_SUCCESS); ++ dns_name_copy(&rrsig.signer, signer); ++ ++ while (dns_rdataset_next(sigrdataset) == ISC_R_SUCCESS) { ++ rdata = (dns_rdata_t)DNS_RDATA_INIT; ++ dns_rdataset_current(sigrdataset, &rdata); ++ result = dns_rdata_tostruct(&rdata, &rrsig, NULL); ++ INSIST(result == ISC_R_SUCCESS); ++ ++ if (!dns_name_equal(signer, &rrsig.signer)) { ++ return false; ++ } ++ } ++ ++ return true; ++} ++ + /* + * The validator has finished. + */ +@@ -5633,6 +5665,8 @@ validated(isc_task_t *task, isc_event_t *event) { + dns_fixedname_t fwild; + dns_name_t *wild = NULL; + dns_message_t *message = NULL; ++ dns_fixedname_t fsigner; ++ dns_name_t *signer = NULL; + + UNUSED(task); /* for now */ + +@@ -6021,10 +6055,20 @@ answer_response: + } + + /* +- * Don't cache NSEC if missing NSEC or RRSIG types. ++ * Don't cache if all the RRSIGs don't have the same ++ * signer. ++ */ ++ signer = dns_fixedname_initname(&fsigner); ++ if (!get_and_check_signer_name(signer, sigrdataset)) { ++ continue; ++ } ++ ++ /* ++ * Don't cache NSEC if missing NSEC or RRSIG ++ * types. + */ + if (rdataset->type == dns_rdatatype_nsec && +- !dns_nsec_requiredtypespresent(rdataset)) ++ !dns_nsec_is_legal(rdataset, signer)) + { + continue; + } +diff --git a/lib/ns/query.c b/lib/ns/query.c +index 2a2ba1daba..8bbcd7ff30 100644 +--- a/lib/ns/query.c ++++ b/lib/ns/query.c +@@ -10370,10 +10370,10 @@ query_coveringnsec(query_ctx_t *qctx) { + } + + /* +- * If NSEC or RRSIG are missing from the type map +- * reject the NSEC RRset. ++ * Check that the NSEC entry is legal. ++ * (NSEC + RRSIG present and the entry isn't out-of-zone) + */ +- if (!dns_nsec_requiredtypespresent(qctx->rdataset)) { ++ if (!dns_nsec_is_legal(qctx->rdataset, signer)) { + goto cleanup; + } + +-- +2.55.0 + diff --git a/bind.spec b/bind.spec index 80cdb0a..4bac975 100644 --- a/bind.spec +++ b/bind.spec @@ -182,6 +182,9 @@ Patch47: bind-9.18-CVE-2026-10723-test.patch # https://gitlab.isc.org/isc-projects/bind9/commit/b9ff2c9a36bb678fd1393d4f932b35a6882cd2a8 Patch48: bind-9.18-CVE-2026-13204.patch Patch49: bind-9.18-CVE-2026-13204-test.patch +# https://gitlab.isc.org/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f +Patch50: bind-9.18-CVE-2026-13321.patch +Patch51: bind-9.18-CVE-2026-13321-test.patch %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 8c2399e1628abe39f5c801b72a61af6af04dba63 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Fri, 17 Jul 2026 20:09:43 +0200 Subject: [PATCH 141/144] Fix tsig-keygen and named-checkzone Found out that multiple programs require fixed name and cannot contain suffixes. This will fix those programs to run as designed and switch versions. It affects: - tsig-keygen - ddns-confgen - named-checkzone - named-compilezone This should make those tools to decide only based or starting part of the program. Upstream supported suffix .exe, but we need support of different suffixes. This change should work for both. --- bind-9.20-tsig-keygen-suffix.patch | 45 ++++++++++++++++++++++++++++++ bind.spec | 3 ++ 2 files changed, 48 insertions(+) create mode 100644 bind-9.20-tsig-keygen-suffix.patch diff --git a/bind-9.20-tsig-keygen-suffix.patch b/bind-9.20-tsig-keygen-suffix.patch new file mode 100644 index 0000000..6c1c465 --- /dev/null +++ b/bind-9.20-tsig-keygen-suffix.patch @@ -0,0 +1,45 @@ +From 32f203d4e3c711cde5b1546a054be42b16436822 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= +Date: Fri, 17 Jul 2026 19:42:39 +0200 +Subject: [PATCH] Support program suffixes of tsig-confgen and ddns-confgen + +Suffixes different than .exe are used on Fedora. But those commands +require exact names only. Allow switching between two variants only from +prefix. That should work on all platforms. It should support also names +like tsig-confgen-9.18 or tsig-confgen-9.20. + +The same case applies to named-checkzone and named-compilezone. +--- + bin/check/named-checkzone.c | 2 +- + bin/confgen/tsig-keygen.c | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/bin/check/named-checkzone.c b/bin/check/named-checkzone.c +index ae8feafc8c..5a1f712463 100644 +--- a/bin/check/named-checkzone.c ++++ b/bin/check/named-checkzone.c +@@ -137,7 +137,7 @@ main(int argc, char **argv) { + } + + #define PROGCMP(X) \ +- (strcasecmp(prog_name, X) == 0 || strcasecmp(prog_name, X ".exe") == 0) ++ (strncasecmp(prog_name, X, strlen(X)) == 0) + + if (PROGCMP("named-checkzone")) { + progmode = progmode_check; +diff --git a/bin/confgen/tsig-keygen.c b/bin/confgen/tsig-keygen.c +index f0d2f9a245..9b13312b5b 100644 +--- a/bin/confgen/tsig-keygen.c ++++ b/bin/confgen/tsig-keygen.c +@@ -113,7 +113,7 @@ main(int argc, char **argv) { + } + + #define PROGCMP(X) \ +- (strcasecmp(progname, X) == 0 || strcasecmp(progname, X ".exe") == 0) ++ (strncasecmp(progname, X, strlen(X)) == 0) + + if (PROGCMP("tsig-keygen")) { + progmode = progmode_keygen; +-- +2.54.0 + diff --git a/bind.spec b/bind.spec index 4bac975..08979b6 100644 --- a/bind.spec +++ b/bind.spec @@ -185,6 +185,9 @@ Patch49: bind-9.18-CVE-2026-13204-test.patch # https://gitlab.isc.org/isc-projects/bind9/commit/36f3d50f9c8ebc8d25ee033e707ca502e20b083f Patch50: bind-9.18-CVE-2026-13321.patch Patch51: bind-9.18-CVE-2026-13321-test.patch +# https://gitlab.isc.org/isc-projects/bind9/-/merge_requests/12420 +Patch52: bind-9.20-tsig-keygen-suffix.patch + %{?systemd_ordering} # https://fedoraproject.org/wiki/Changes/RPMSuportForSystemdSysusers From 2e2533ed0cc1f74d40d315d439bcc5e003f12fa6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 28 Jul 2026 16:59:39 +0200 Subject: [PATCH 142/144] Fix plugin path, add alternatives to devel libs Devel libs detection from bind-dyndb-ldap needs working _libdir/libdns.so. Provide extra symlink to that. But requires additional change on bind-dyndb-ldap change to follow those links. --- bind.spec | 40 ++++++++++++++++++++++++++++------------ 1 file changed, 28 insertions(+), 12 deletions(-) diff --git a/bind.spec b/bind.spec index 08979b6..37d3425 100644 --- a/bind.spec +++ b/bind.spec @@ -757,6 +757,7 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9 %global main_bin8 named rndc{,-confgen} %global main_bin1 named{-journalprint,-checkconf,-rrchecker} mdig %global dnssec_utils_bin1 dnssec-{cds,dsfromkey,importkey,keyfromlabel,keygen,revoke,settime,signzone,verify} +%global devel_lib lib{bind9,dns,irs,isc,isccc,isccfg,ns} %global main_man5 named.conf rndc.conf %global main_unit named.service named-setup-rndc.service %global main_lib filter-{a,aaaa} @@ -787,8 +788,13 @@ mkdir -p ${RPM_BUILD_ROOT}%{_includedir}/bind9 %define altflibexec() \\\ --follower %{_libexecdir}/%{1} %{upname}-%{1} %{_libexecdir}/%{name}/%{1} +# This is for devel subpackage only, not plugins {1} (_libdir/)libname.so +%define altflib() \\\ + --follower %{_libdir}/%{1}.so %{upname}-%{1}.so %{_libdir}/%{1}%{program_suffix}.so + +# This is only for bind plugins, which have also man page %define altflibman() \\\ - --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}.so%{program_suffix} \\\ + --follower %{_libdir}/bind/%{1}.so %{upname}-%{1}.so %{_libdir}/bind/%{1}%{program_suffix}.so \\\ --follower %{_mandir}/man%{2}/%{1}.%{2}%{manext} %{upname}-%{1}.%{2} %{_mandir}/man%{2}/%{1}%{program_suffix}.%{2}%{manext} %define altrmbinman() \ @@ -992,13 +998,22 @@ fi %post devel %if "%{program_suffix}" != "" - alternatives --install %{_includedir}/bind9 %{upname}-includedir %{bind_include} %{alternatives_prio} + ALTS="" + for BIN in %{devel_lib}; do + BINX="%{_libdir}/${BIN}.so" + if ! [ -L "$BINX" ] && [ -f "$BINX" ] && [ -x "$BINX" ]; then + rm -f -- "$BINX" + fi + ALTS+="%{altflib $BIN}" + done + alternatives --install %{_includedir}/bind9 %{upname}-devel %{bind_include} %{alternatives_prio} \ + ${ALTS} %endif %postun devel %if "%{program_suffix}" != "" if [ $1 -eq 0 ] ; then - alternatives --remove %{upname}-includedir %{bind_include} + alternatives --remove %{upname}-devel %{bind_include} fi %endif %end @@ -1198,23 +1213,24 @@ fi; %ghost %attr(0644,-,-) %{_mandir}/man1/%{dnssec_utils_bin1}.1%{manext} %files devel -%{_libdir}/libbind9-%{mver}.so -%{_libdir}/libisccc-%{mver}.so -%{_libdir}/libns-%{mver}.so -%{_libdir}/libdns-%{mver}.so -%{_libdir}/libisc-%{mver}.so -%{_libdir}/libisccfg-%{mver}.so -%{_libdir}/libirs-%{mver}.so +%{_libdir}/%{devel_lib}%{program_suffix}.so %ghost %attr(0755,-,-) %{_includedir}/bind9 +%ghost %attr(0755,-,-) %{_libdir}/libbind9.so +%ghost %attr(0755,-,-) %{_libdir}/libdns.so +%ghost %attr(0755,-,-) %{_libdir}/libirs.so +%ghost %attr(0755,-,-) %{_libdir}/libisc.so +%ghost %attr(0755,-,-) %{_libdir}/libisccc.so +%ghost %attr(0755,-,-) %{_libdir}/libisccfg.so +%ghost %attr(0755,-,-) %{_libdir}/libns.so %dir %{bind_include} -%{bind_include}/isccc -%{bind_include}/ns %{bind_include}/bind9 %{bind_include}/dns %{bind_include}/dst %{bind_include}/irs %{bind_include}/isc +%{bind_include}/isccc %{bind_include}/isccfg +%{bind_include}/ns %files chroot %config(noreplace) %{_sysconfdir}/named-chroot.files From 65771b447c5187f22c6845030151ad59a8534784 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 28 Jul 2026 21:10:58 +0200 Subject: [PATCH 143/144] Provide include file bind9/config.h again It got removed somewhere in repeated rebasing process. Get it packaged again, bind-dyndb-ldap cannot compile without it. --- bind.spec | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/bind.spec b/bind.spec index 37d3425..659d5c9 100644 --- a/bind.spec +++ b/bind.spec @@ -624,6 +624,10 @@ touch ${RPM_BUILD_ROOT}/%{chroot_prefix}%{_sysconfdir}/named.conf %make_install PROGRAM_SUFFIX="%{program_suffix}" +# Provide again bind's config.h +mkdir -p ${RPM_BUILD_ROOT}%{bind_include}/bind9 +sed -e 's/PACKAGE_/BIND9_/' config.h > ${RPM_BUILD_ROOT}%{bind_include}/bind9/config.h + # Remove unwanted files rm -f ${RPM_BUILD_ROOT}/etc/bind.keys From 1faffc32a8bde4db4ae9446586dcab77727ffd67 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Petr=20Men=C5=A1=C3=ADk?= Date: Tue, 25 Aug 2026 15:06:59 +0200 Subject: [PATCH 144/144] Remove non-matching version from conflict --- bind.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/bind.spec b/bind.spec index 659d5c9..e0523a9 100644 --- a/bind.spec +++ b/bind.spec @@ -371,7 +371,7 @@ Requires: grep Requires: %{name}%{?_isa} = %{epoch}:%{version}-%{release} %upname_compat %{upname}-chroot %if "%{name}" != "%{upname}" -Conflicts: %{upname}-chroot != %{epoch}:%{version}-%{release} +Conflicts: %{upname}-chroot Conflicts: %{upname}-sdb-chroot %endif